Hashlib specification

[DueViktor]

What does this PR do?

The following PR address the issue raised in #27034.

Fixes # (issue)
Close #27034

Before submitting

• This PR fixes a typo or improves the docs (you can dismiss the other checks if that's the case).
• Did you read the contributor guideline,
  Pull Request section?
• Was this discussed/approved via a Github issue or the forum? Please add a link
  to it if that's the case.
• Did you make sure to update the documentation with your changes? Here are the
  documentation guidelines, and
  here are tips on formatting docstrings.
• Did you write any new necessary tests?

Who can review?

Anyone in the community is free to review the PR once the tests have passed. Feel free to tag
members/contributors who may be interested in your PR.

[DueViktor]

@ArthurZucker, perhaps you can review this?

[ArthurZucker]

Hey! As this might affect other HF repos we want to take our time and find a solution for all of them 🤗 gotta be aligned with other library maintainers! FYI @Wauplin

[DueViktor]

Hey! As this might affect other HF repos we want to take our time and find a solution for all of them 🤗 gotta be aligned with other library maintainers! FYI @Wauplin

That's fair. In case you need some references, similar changes have been included in other repos:

• [FR] Extend previous work on FIPS compliance mlflow/mlflow#10106 (comment)
• Call hashlib.md5 with usedforsecurity=False for FIPS mlflow/mlflow#9961
• Update Streamlit hashlib usage for FIPS-Compliant Systems and Security Best Practices streamlit/streamlit#7120
• Making streamlit FIPS compliant streamlit/streamlit#7526

[Wauplin]

Thanks a lot @DueViktor for raising the question 🙏 I opened a PR in huggingface_hub which is the underlying library common to the other HF-libraries (transformers, diffusers, datasets,.): huggingface/huggingface_hub#1782. My plan is to release that and then integrate with dependent libraries once adopted.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. If you think this still needs to be addressed please comment on this thread.

Please note that issues that do not follow the contributing guidelines are likely to be ignored.

[Wauplin]

Closing this PR without merging. This has been handled in a separate PR (see #27034 for full context).