diff --git a/AUTHORS.rst b/AUTHORS.rst index 2923446a..1bd657fb 100644 --- a/AUTHORS.rst +++ b/AUTHORS.rst @@ -11,3 +11,4 @@ Authors * Andreas Rammhold - https://github.com/andir * Nicholas Bunn - https://github.com/NicholasBunn * Nathan McDougall - https://github.com/nathanjmcdougall +* Oleksandr Zaiats - https://github.com/z4y4ts diff --git a/CHANGELOG.rst b/CHANGELOG.rst index 07a38ac9..12dc6070 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -9,6 +9,7 @@ latest * Improve contribution experience for Windows developers using Just. * Tweak Just commands for running version-specific Python tests. * Remove `typing-extensions` as a dependency. +* Make package FIPS compatible by marking blake2 hashing with `usedforsecurity=False`. 3.14 (2025-12-10) ----------------- diff --git a/src/grimp/adaptors/caching.py b/src/grimp/adaptors/caching.py index d717063d..2baa4ac4 100644 --- a/src/grimp/adaptors/caching.py +++ b/src/grimp/adaptors/caching.py @@ -37,7 +37,9 @@ def make_data_file_name( # Use a hash algorithm with a limited size to avoid cache filenames that are too long # the filesystem, which can happen if there are more than a few root packages # being analyzed. - safe_unicode_identifier = hashlib.blake2b(bytes_identifier, digest_size=20).hexdigest() + safe_unicode_identifier = hashlib.blake2b( + bytes_identifier, digest_size=20, usedforsecurity=False + ).hexdigest() return f"{safe_unicode_identifier}.data.json" @classmethod