Bug 966954 - python-sphinx fails to build html docs in fips mode
Summary: python-sphinx fails to build html docs in fips mode
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: python-sphinx   
(Show other bugs)
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Tomas Orsava
QA Contact: David Kutálek
Marie Dolezelova
URL:
Whiteboard:
Keywords: Patch
Depends On:
Blocks: 1313485 839624 1289025 1295829
TreeView+ depends on / blocked
 
Reported: 2013-05-24 11:30 UTC by Bohuslav "Slavek" Kabrda
Modified: 2016-11-22 09:07 UTC (History)
10 users (show)

Fixed In Version: python-sphinx-1.1.3-10.el7
Doc Type: Bug Fix
Doc Text:
Sphinx builds HTML documentation in FIPS mode properly Previously, the Python Sphinx generator failed to build documentation in the HTML format on systems with FIPS mode activated. With this update,the use of the md5() function has been fixed by setting the "used_for_security" parameter to `false`. As a result, Sphinx now builds HTML documentation as expected.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-04 01:02:35 UTC
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Allow rebuilding docs in fips mode (1.64 KB, patch)
2016-03-10 08:18 UTC, Robert Kuska
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2222 normal SHIPPED_LIVE python-sphinx bug fix and enhancement update 2016-11-03 13:25:51 UTC

Description Bohuslav "Slavek" Kabrda 2013-05-24 11:30:03 UTC
Sphinx html builder uses md5 function for determining whether the docs have been already built [1] and thus fails with ValueError in any html docs build. This would IMHO be safe to alter using usedforsecurity=False in md5 function call (because this is really not used for security).

[1] https://bitbucket.org/birkenfeld/sphinx/src/c2fbf3a2f56f/sphinx/builders/html.py#cl-155

Comment 2 Miloslav Trmač 2013-05-24 15:50:15 UTC
(In reply to Bohuslav "Slavek" Kabrda from comment #0)
> Sphinx html builder uses md5 function for determining whether the docs have
> been already built [1] and thus fails with ValueError in any html docs
> build. This would IMHO be safe to alter using usedforsecurity=False in md5
> function call (because this is really not used for security).

Yes, I think that's a completely valid option (or at least I can't see an attack scenario that would apply to building/not building documentation).

Another option is to migrate to a stronger hash anyway (which would imply a rebuild when upgrading from an older version of sphinx to a newer version of sphinx, but the caching would work fine on the next call of get_outdated_docs() again).

Or just let get_outdated_docs() return everything if md5 computation fails.

Comment 8 Robert Kuska 2016-03-10 08:18 UTC
Created attachment 1134757 [details]
Allow rebuilding docs in fips mode

Attaching patch which should fix the issue

Comment 13 errata-xmlrpc 2016-11-04 01:02:35 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2222.html


Note You need to log in before you can comment on or make changes to this bug.