sqlalchemy: Errors from use of hashlib.md5 for truncated names on FIPS-enabled systems

Describe the bug

On systems (RHEL) where FIPS is enabled, the md5 is disabled in openssl and calls to hashlib.md5() in python will fail with an error like:

# SNIP
|   File "/opt/app-root/lib64/python3.11/site-packages/sqlalchemy/sql/compiler.py", line 7507, in _truncate_and_render_maxlen_name
|     name = name[0 : max_ - 8] + "_" + util.md5_hex(name)[-4:]
|                                       ^^^^^^^^^^^^^^^^^^
|   File "/opt/app-root/lib64/python3.11/site-packages/sqlalchemy/util/langhelpers.py", line 90, in md5_hex
|     m = hashlib.md5()
|         ^^^^^^^^^^^^^
| ValueError: [digital envelope routines] unsupported
|
| Application startup failed. Exiting.
| Server stopped!

As mentioned in the docs, for newer versions of python (3.9+) there is a usedforsecurity flag that can be set to False to avoid this error.

Optional link from https://docs.sqlalchemy.org which documents the behavior that is expected

No response

SQLAlchemy Version in Use

2.0.15

DBAPI (i.e. the database driver)

psycopg2

Database Vendor and Major Version

Postgresql 15

Python Version

3.11

Operating system

Linux, OSX

To Reproduce

# Create table with a constraint name or column name that exceeds a maximum length.

class MyModel(DeclarativeBase):
    __tablename__ = "mytable"

    id: Mapped[int] = mapped_column(primary_key=True)
    very_very_very_very_very_very_very_very_very_very_long_name: Mapped[str]
#   0123456789012345678901234567890123456789012345678901234567890123456789
#   1         2         3         4         5         6         7

Error

# SNIP
|   File "/opt/app-root/lib64/python3.11/site-packages/sqlalchemy/sql/compiler.py", line 7507, in _truncate_and_render_maxlen_name
|     name = name[0 : max_ - 8] + "_" + util.md5_hex(name)[-4:]
|                                       ^^^^^^^^^^^^^^^^^^
|   File "/opt/app-root/lib64/python3.11/site-packages/sqlalchemy/util/langhelpers.py", line 90, in md5_hex
|     m = hashlib.md5()
|         ^^^^^^^^^^^^^
| ValueError: [digital envelope routines] unsupported
|
| Application startup failed. Exiting.
| Server stopped!

Additional context

No response

About this issue

  • Original URL
  • State: closed
  • Created 10 months ago
  • Comments: 16 (12 by maintainers)

Commits related to this issue

Most upvoted comments

it’s checked into main now so if you want to install from github you can try that. otherwise it will go out in 2.0.21

OK, will add a compat function, thanks