Red Hat Bugzilla – Bug 966954
python-sphinx fails to build html docs in fips mode
Last modified: 2016-11-22 04:07:43 EST
Sphinx html builder uses md5 function for determining whether the docs have been already built [1] and thus fails with ValueError in any html docs build. This would IMHO be safe to alter using usedforsecurity=False in md5 function call (because this is really not used for security). [1] https://bitbucket.org/birkenfeld/sphinx/src/c2fbf3a2f56f/sphinx/builders/html.py#cl-155
(In reply to Bohuslav "Slavek" Kabrda from comment #0) > Sphinx html builder uses md5 function for determining whether the docs have > been already built [1] and thus fails with ValueError in any html docs > build. This would IMHO be safe to alter using usedforsecurity=False in md5 > function call (because this is really not used for security). Yes, I think that's a completely valid option (or at least I can't see an attack scenario that would apply to building/not building documentation). Another option is to migrate to a stronger hash anyway (which would imply a rebuild when upgrading from an older version of sphinx to a newer version of sphinx, but the caching would work fine on the next call of get_outdated_docs() again). Or just let get_outdated_docs() return everything if md5 computation fails.
Created attachment 1134757 [details] Allow rebuilding docs in fips mode Attaching patch which should fix the issue
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2016-2222.html