Merge pull request #29608 from martinky24/bugfix/29603/md5-fips

tacaswell · web-flow · commit 2d5e503540d5 · 2025-02-12T10:21:11.000-05:00
Remove md5 usage to prevent issues on FIPS enabled systems (closes #29603)
diff --git a/lib/matplotlib/sphinxext/mathmpl.py b/lib/matplotlib/sphinxext/mathmpl.py
@@ -146,7 +146,10 @@ def latex2html(node, source):
     fontset = node['fontset']
     fontsize = node['fontsize']
     name = 'math-{}'.format(
-        hashlib.md5(f'{latex}{fontset}{fontsize}'.encode()).hexdigest()[-10:])
+        hashlib.sha256(
+            f'{latex}{fontset}{fontsize}'.encode(),
+            usedforsecurity=False,
+        ).hexdigest()[-10:])
 
     destdir = Path(setup.app.builder.outdir, '_images', 'mathmpl')
     destdir.mkdir(parents=True, exist_ok=True)
diff --git a/lib/matplotlib/testing/compare.py b/lib/matplotlib/testing/compare.py
@@ -46,22 +46,20 @@ def get_cache_dir():
 
 
 def get_file_hash(path, block_size=2 ** 20):
-    md5 = hashlib.md5()
+    sha256 = hashlib.sha256(usedforsecurity=False)
     with open(path, 'rb') as fd:
         while True:
             data = fd.read(block_size)
             if not data:
                 break
-            md5.update(data)
+            sha256.update(data)
 
     if Path(path).suffix == '.pdf':
-        md5.update(str(mpl._get_executable_info("gs").version)
-                   .encode('utf-8'))
+        sha256.update(str(mpl._get_executable_info("gs").version).encode('utf-8'))
     elif Path(path).suffix == '.svg':
-        md5.update(str(mpl._get_executable_info("inkscape").version)
-                   .encode('utf-8'))
+        sha256.update(str(mpl._get_executable_info("inkscape").version).encode('utf-8'))
 
-    return md5.hexdigest()
+    return sha256.hexdigest()
 
 
 class _ConverterError(Exception):
diff --git a/lib/matplotlib/texmanager.py b/lib/matplotlib/texmanager.py
@@ -168,7 +168,10 @@ def get_basefile(cls, tex, fontsize, dpi=None):
         Return a filename based on a hash of the string, fontsize, and dpi.
         """
         src = cls._get_tex_source(tex, fontsize) + str(dpi)
-        filehash = hashlib.md5(src.encode('utf-8')).hexdigest()
+        filehash = hashlib.sha256(
+            src.encode('utf-8'),
+            usedforsecurity=False
+        ).hexdigest()
         filepath = Path(cls._texcache)
 
         num_letters, num_levels = 2, 2
