Bug 966954

Summary:

python-sphinx fails to build html docs in fips mode

Product:

Red Hat Enterprise Linux 7

Reporter:

Bohuslav "Slavek" Kabrda <bkabrda>

Component:

python-sphinx

Assignee:

Tomas Orsava <torsava>

Status:

CLOSED ERRATA

QA Contact:

David Kutálek <dkutalek>

Severity:

unspecified

Docs Contact:

Marie Hornickova <mdolezel>

Priority:

unspecified

Version:

7.3

CC:

bkabrda, bnater, dkutalek, isenfeld, jberan, mcepl, omoris, ovasik, riehecky, torsava

Target Milestone:

Keywords:

Patch

Target Release:

---

Hardware:

Unspecified

OS:

Unspecified

Whiteboard:

Fixed In Version:

python-sphinx-1.1.3-10.el7

Doc Type:

Bug Fix

Doc Text:

Sphinx builds HTML documentation in FIPS mode properly Previously, the Python Sphinx generator failed to build documentation in the HTML format on systems with FIPS mode activated. With this update,the use of the md5() function has been fixed by setting the "used_for_security" parameter to `false`. As a result, Sphinx now builds HTML documentation as expected.

Story Points:

---

Clone Of:

Environment:

Last Closed:

2016-11-04 01:02:35 UTC

Type:

Bug

Regression:

---

Mount Type:

---

Documentation:

---

CRM:

Verified Versions:

Category:

---

oVirt Team:

---

RHEL 7.3 requirements from Atomic Host:

Cloudforms Team:

---

Target Upstream Version:

Embargoed:

Bug Depends On:

Bug Blocks:

839624, 1289025, 1295829, 1313485

Attachments:

Description	Flags
Allow rebuilding docs in fips mode	none

Description Bohuslav "Slavek" Kabrda 2013-05-24 11:30:03 UTC

Sphinx html builder uses md5 function for determining whether the docs have been already built [1] and thus fails with ValueError in any html docs build. This would IMHO be safe to alter using usedforsecurity=False in md5 function call (because this is really not used for security).

[1] https://bitbucket.org/birkenfeld/sphinx/src/c2fbf3a2f56f/sphinx/builders/html.py#cl-155

Comment 2 Miloslav Trmač 2013-05-24 15:50:15 UTC

(In reply to Bohuslav "Slavek" Kabrda from comment #0)
> Sphinx html builder uses md5 function for determining whether the docs have
> been already built [1] and thus fails with ValueError in any html docs
> build. This would IMHO be safe to alter using usedforsecurity=False in md5
> function call (because this is really not used for security).

Yes, I think that's a completely valid option (or at least I can't see an attack scenario that would apply to building/not building documentation).

Another option is to migrate to a stronger hash anyway (which would imply a rebuild when upgrading from an older version of sphinx to a newer version of sphinx, but the caching would work fine on the next call of get_outdated_docs() again).

Or just let get_outdated_docs() return everything if md5 computation fails.

Comment 8 Robert Kuska 2016-03-10 08:18:36 UTC

Created attachment 1134757 [details]
Allow rebuilding docs in fips mode

Attaching patch which should fix the issue

Comment 13 errata-xmlrpc 2016-11-04 01:02:35 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2222.html