:thumbsup:

For the first commit: sha1 is dangerously close to being broken. Can we use sha256 here instead?

For the second commit: I understand that this gets Koji working with FIPS enabled, but setting kwargs['usedforsecurity'] = False is misleading IMHO. I would argue that we are using md5 for security when we "authenticate" archive uploads/storage/downloads. We would never use those in a modern system, and I think we need to completely remove all uses of md5 and sha1 from Koji.

@ktdreyer I've added a commit which replaces usage of md5 in upload functions. @julian8628 can you look if it looks sane? https://pagure.io/fork/tkopecek/koji/commits/issue2291

@tkopecek it looks good, thanks!
I've rebased it, and added an arg name change from hash to checksum.

Commit 2778b7ac fixes this pull-request

Please note that the checksums in the upload code path are for sanity, not security. This is why adler32 was the default. Clearly adler32 was not intended to provide strong cryptographic protection. In the upload case. Security in the upload call should come from the call connection itself (https and authentication).

The sums in the upload code are not stored. They are simply used as a sanity check on the upload. I'm not sure FIPS applies to this part.

That makes sense Mike. Thanks for explaining.

I think it will make Koji easier to audit for security problems and easier for new developers to understand the code if we can remove the use of md5 and weak sha methods entirely. Also, historically we've not emphasized HTTPS everywhere, eg #2163