Make use of hashlib.md5() FIPS compliant

[nielspardon]

resolves #6900

Description

• replaces all direct usages of hashlib.md5() with calls to dbt.utils.md5()
• sets usedforsecurity=False when calling hashlib.md5()

Previously when running make test on a FIPS enabled system there were many test failures. With the changes of this PR both make test and make integration run through without errors on a FIPS enabled system.

Checklist

• I have read the contributing guide and understand what's expected of me
• I have signed the CLA
• I have run this code in development and it appears to resolve the stated issue
• This PR includes tests, or tests are not required/relevant for this PR
• I have opened an issue to add/update docs, or docs changes are not required/relevant for this PR
• I have run changie new to create a changelog entry

[gshank]

We're getting a bunch of:

    def md5(string, charset="utf-8"):
>       return hashlib.md5(string.encode(charset), usedforsecurity=False).hexdigest()
E       TypeError: openssl_md5() takes no keyword arguments

[gshank]

It looks like that keyword parameter is only supported for Python 3.9 and later, so we'll have to check the python version when making those md5 calls.

[nielspardon]

It looks like that keyword parameter is only supported for Python 3.9 and later, so we'll have to check the python version when making those md5 calls.

Since I'm not a big Python expert. Do you have a suggestion / pattern for such cases already that I can use? Like checking the Python version and then only supplying the parameter if we run on >3.9?

[nielspardon]

I'm guessing something like this should do the trick?

def md5(string, charset="utf-8"):
    if sys.version_info >= (3, 9):
        return hashlib.md5(string.encode(charset), usedforsecurity=False).hexdigest()
    else:
        return hashlib.md5(string.encode(charset)).hexdigest()

[gshank]

Yes, that's the right way to check python versions.

[nielspardon]

I updated the PR. Since the usedforsecurity parameter was only added in Python 3.9 one can not run dbt on Python <3.9 with FIPS mode enabled.

I verified on a test system that tests are running fine with Python 3.8 when FIPS is deactivated with the if statement.

[jtcohen6]

Backporting for inclusion in next v1.4 patch (probably v1.4.3), per reasonable request: #6900 (comment)

We shouldn't actually merge the backport PR until final release of v1.4.2 next week.