https://github.com/python/cpython/commit/41c224c45c32190a1675d2f9d3b733862e502ff4
commit: 41c224c45c32190a1675d2f9d3b733862e502ff4
branch: main
author: Seth Larson <[email protected]>
committer: sethmlarson <[email protected]>
date: 2026-11-04T19:24:39Z
summary:
gh-161263: Skip MD5 algorithm challenge tests on FIPS
files:
A Lib/lib2to3/Grammar3.11.18.final.0.pickle
A Lib/lib2to3/PatternGrammar3.11.18.final.0.pickle
A Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst
M Lib/test/test_urllib2.py
diff --git a/Lib/lib2to3/Grammar3.11.18.final.0.pickle
b/Lib/lib2to3/Grammar3.11.18.final.0.pickle
new file mode 100644
index 000000000000000..c3acebc758875b5
Binary files /dev/null and b/Lib/lib2to3/Grammar3.11.18.final.0.pickle differ
diff --git a/Lib/lib2to3/PatternGrammar3.11.18.final.0.pickle
b/Lib/lib2to3/PatternGrammar3.11.18.final.0.pickle
new file mode 100644
index 000000000000000..67e7d83e9194d5e
Binary files /dev/null and b/Lib/lib2to3/PatternGrammar3.11.18.final.0.pickle
differ
diff --git a/Lib/test/test_urllib2.py b/Lib/test/test_urllib2.py
index 52f77eaf85e589b..a5b5a3d706dd409 100644
--- a/Lib/test/test_urllib2.py
+++ b/Lib/test/test_urllib2.py
@@ -30,6 +30,11 @@
support.requires_working_socket(module=True)
+skip_libssl_fips_mode = unittest.skipIf(
+ support.is_libssl_fips_mode(),
+ "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing",
+)
+
# XXX
# Request
# CacheFTPHandler (hard to write)
@@ -1782,6 +1787,7 @@ def test_proxy_basic_auth(self):
"proxy.example.com:3128",
)
+ @skip_libssl_fips_mode # Uses MD5 algorithm in challenge
def test_proxy_digest_auth(self):
# gh-60299: ProxyDigestAuthHandler must look up credentials using
# the proxy's authority
@@ -1845,6 +1851,7 @@ def test_proxy_digest_auth_uri(self):
auth = http_handler.requests[1].get_header("Proxy-authorization")
self.assertIn('uri="%s"' % request_url, auth)
+ @skip_libssl_fips_mode # Uses MD5 algorithm in challenge
def test_digest_auth_uses_full_url(self):
# The non-proxy case must keep using the full request URL (not
# just the host) for the password lookup, so that sub-URI realm
@@ -1967,6 +1974,7 @@ def check_digest_auth(self, headers, realm):
self.assertIn('nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093"', auth)
self.assertIn('opaque="5ccc069c403ebaf9f0171e9517f40e41"', auth)
+ @skip_libssl_fips_mode
def test_digest_auth_multiple_challenges(self):
realm = "[email protected]"
digest = (f'Digest realm="{realm}", '
@@ -2032,6 +2040,7 @@ def test_digest_auth_parse_challenges(self):
[('Negotiate', 'Negotiate'), ('Bearer', 'Bearer abc=='),
('Digest', 'Digest realm="a"')])
+ @skip_libssl_fips_mode
def test_proxy_digest_auth_multiple_challenges(self):
realm = "[email protected]"
digest = (f'Digest realm="{realm}", '
@@ -2355,12 +2364,6 @@ def test_parse_proxy(self):
self.assertRaises(ValueError, _parse_proxy, 'file:/ftp.example.com'),
-skip_libssl_fips_mode = unittest.skipIf(
- support.is_libssl_fips_mode(),
- "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing",
-)
-
-
class TestDigestAuthAlgorithms(unittest.TestCase):
def setUp(self):
self.handler = AbstractDigestAuthHandler()
diff --git
a/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst
b/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst
new file mode 100644
index 000000000000000..98c631cc2f663a3
--- /dev/null
+++ b/Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst
@@ -0,0 +1,2 @@
+Skip tests which use MD5 algorithm for WWW-Authenticate challenges when
+libssl is in FIPS mode.
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
