Bug 966954 - python-sphinx fails to build html docs in fips mode
python-sphinx fails to build html docs in fips mode
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: python-sphinx (Show other bugs)
7.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Tomas Orsava
David Kutálek
Marie Dolezelova
: Patch
Depends On:
Blocks: 839624 1313485 1289025 1295829
  Show dependency treegraph
 
Reported: 2013-05-24 07:30 EDT by Bohuslav "Slavek" Kabrda
Modified: 2016-11-22 04:07 EST (History)
10 users (show)

See Also:
Fixed In Version: python-sphinx-1.1.3-10.el7
Doc Type: Bug Fix
Doc Text:
Sphinx builds HTML documentation in FIPS mode properly Previously, the Python Sphinx generator failed to build documentation in the HTML format on systems with FIPS mode activated. With this update,the use of the md5() function has been fixed by setting the "used_for_security" parameter to `false`. As a result, Sphinx now builds HTML documentation as expected.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-03 21:02:35 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Allow rebuilding docs in fips mode (1.64 KB, patch)
2016-03-10 03:18 EST, Robert Kuska
no flags Details | Diff

  None (edit)
Description Bohuslav "Slavek" Kabrda 2013-05-24 07:30:03 EDT
Sphinx html builder uses md5 function for determining whether the docs have been already built [1] and thus fails with ValueError in any html docs build. This would IMHO be safe to alter using usedforsecurity=False in md5 function call (because this is really not used for security).

[1] https://bitbucket.org/birkenfeld/sphinx/src/c2fbf3a2f56f/sphinx/builders/html.py#cl-155
Comment 2 Miloslav Trmač 2013-05-24 11:50:15 EDT
(In reply to Bohuslav "Slavek" Kabrda from comment #0)
> Sphinx html builder uses md5 function for determining whether the docs have
> been already built [1] and thus fails with ValueError in any html docs
> build. This would IMHO be safe to alter using usedforsecurity=False in md5
> function call (because this is really not used for security).

Yes, I think that's a completely valid option (or at least I can't see an attack scenario that would apply to building/not building documentation).

Another option is to migrate to a stronger hash anyway (which would imply a rebuild when upgrading from an older version of sphinx to a newer version of sphinx, but the caching would work fine on the next call of get_outdated_docs() again).

Or just let get_outdated_docs() return everything if md5 computation fails.
Comment 8 Robert Kuska 2016-03-10 03:18 EST
Created attachment 1134757 [details]
Allow rebuilding docs in fips mode

Attaching patch which should fix the issue
Comment 13 errata-xmlrpc 2016-11-03 21:02:35 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2222.html

Note You need to log in before you can comment on or make changes to this bug.