Set usedforsecurity=False in hashlib methods (FIPS compliance)
#5790
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The documentation is not available anymore as the PR was closed or merged. |
|
Thanks for the review! I'll merge now that the dependency version thingy is fixed (was mostly a problem for |
yoonseokjin
pushed a commit
to yoonseokjin/diffusers
that referenced
this pull request
Dec 25, 2023
…gingface#5790) * Set usedforsecurity=False in hashlib methods (FIPS compliance) * update version dependency * bump hfh version * bump hfh version
AmericanPresidentJimmyCarter
pushed a commit
to AmericanPresidentJimmyCarter/diffusers
that referenced
this pull request
Apr 26, 2024
…gingface#5790) * Set usedforsecurity=False in hashlib methods (FIPS compliance) * update version dependency * bump hfh version * bump hfh version
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related to huggingface/transformers#27034 and huggingface/huggingface_hub#1782.
TL;DR:
hashlibis not a secure library for cryptography-related stuff. We are only usinghashlibfor non-security-related purposes indiffusersso it's fine. From Python 3.9 we can setusedforsecurity=Falsein anyhashlibmethod which is mandatory for companies that forbid the use ofhashlibfor security purposes. This PR fixes that.Note: before merging this we need to release a new tokenizers version that would allow the newest
huggingface_hubversion (see huggingface/tokenizers#1385). Otherwise it might create friction to users that want to installdiffusers+tokenizersat the same time.