# Running test\_hashlib, test\_hmac, test\_ssl with OPENSSL\_FORCE\_FIPS\_MODE=1 on CI? **URL:** \ **Category:** Core Development\ **Tags:** ci\ **Created:** [November 9, 2026, 10:55am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971 "2026-11-09T10:55:06Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![hroncok](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/hroncok/32/18696_2.png) [@hroncok](https://discuss.python.org/u/hroncok)\ **Post date:** [November 9, 2026, 10:55am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/1 "2026-11-09T10:55:06Z")
In response to [https://www.cve.org/CVERecord?id=CVE-2026-119170](https://www.cve.org/CVERecord?id=CVE-2026-119170) and how the regression was introduced in [[3.14] gh-149816: fix a race when fetching OpenSSL digests (GH-153019) by picnixz · Pull Request #160006 · python/cpython · GitHub](https://github.com/python/cpython/pull/160006) and only discovered post merge, I wonder if we could add this to a CI job that already uses OpenSSL: ```python OPENSSL_FORCE_FIPS_MODE=1 python -m test ... test_hashlib test_hmac test_ssl ``` The tests take ~15 seconds on my machine when run without parallelization (`-jN`). ---
**Author:** ![picnixz](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/picnixz/32/12660_2.png) [@picnixz](https://discuss.python.org/u/picnixz)\ **Post date:** [November 9, 2026, 10:58am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/2 "2026-11-09T10:58:49Z")
TIL about this flag. Until today I always had two OpenSSL builds, one with a special FIPS configuration and one without, mainly to exercise the fallbacks and so on, in addition to build bots. Usually I check the buildbots outputs but since it was during the sprint, I was likely too tired and hence introduced that regression. That being said, I think we can add a single job that just runs some SSL-related tests with that environment. ---
**Author:** ![picnixz](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/picnixz/32/12660_2.png) [@picnixz](https://discuss.python.org/u/picnixz)\ **Post date:** [November 9, 2026, 11:33am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/3 "2026-11-09T11:33:55Z")
@hroncok Do you want to send an issue/PR for that one? or should I do it myself? ---
**Author:** ![hroncok](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/hroncok/32/18696_2.png) [@hroncok](https://discuss.python.org/u/hroncok)\ **Post date:** [November 9, 2026, 11:54am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/4 "2026-11-09T11:54:10Z")
I was waiting for more feedback, but happy to do it. Do you have some tip on which would be the best file to add it to? [cpython/.github/workflows at main · python/cpython · GitHub](https://github.com/python/cpython/tree/main/.github/workflows) is a lot to digest. ---
**Author:** ![picnixz](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/picnixz/32/12660_2.png) [@picnixz](https://discuss.python.org/u/picnixz)\ **Post date:** [November 9, 2026, 1:08pm UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/5 "2026-11-09T13:08:54Z")
Likely around [cpython/.github/workflows/build.yml at main · python/cpython · GitHub](https://github.com/python/cpython/blob/main/.github/workflows/build.yml#L254). Those tests are for the SSL-only tests. ---
**Author:** ![zware](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/zware/32/58_2.png) [@zware](https://discuss.python.org/u/zware)\ **Post date:** [November 9, 2026, 2:20pm UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/6 "2026-11-09T14:20:11Z")
Perhaps it could be wired into Tools/ssl/multissltests.py and added to the matrix in the workflow that runs it? ---
**Author:** ![vstinner](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/vstinner/32/15130_2.png) [@vstinner](https://discuss.python.org/u/vstinner)\ **Post date:** [November 9, 2026, 9:44pm UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/7 "2026-11-09T21:44:40Z")
> [@hroncok](#): > > only discovered post merge, I wonder if we could add this to a CI job that already uses OpenSSL: We do have some CentOS FIPS buildbots: - AMD64 CentOS10 FIPS No Builtin Hashes 3.x: [Buildbot](https://buildbot.python.org/?#/builders/2340) - AMD64 CentOS10 FIPS Only Blake2 Builtin Hash 3.x: [Buildbot](https://buildbot.python.org/?#/builders/2350/builds/355) - AMD64 CentOS9 FIPS No Builtin Hashes 3.x: [Buildbot](https://buildbot.python.org/?#/builders/879/builds/13586) - AMD64 CentOS9 FIPS Only Blake2 Builtin Hash 3.x: [Buildbot](https://buildbot.python.org/?#/builders/828/builds/13353) And similar buildbot for stable versions. The problem is that the 3.14 and 3.15 jobs are red (fail) for a long time and so don’t report new regressions since tests were already failing ☹ Adding new jobs on GitHub sounds like a good idea! Especially if we can only run them when “ssl code” is modified (GitHub Action already implements this logic for “SSL” jobs", we can reuse it). ---
**Author:** ![hroncok](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/hroncok/32/18696_2.png) [@hroncok](https://discuss.python.org/u/hroncok)\ **Post date:** [November 10, 2026, 11:27am UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/8 "2026-11-10T11:27:05Z")
Some collateral issues first, starting with [ValueError: [Provider routines] invalid salt length in test\_hashlibtest\_pbkdf2\_hmac\_c on FIPS w/ OpenSSL 4.0.3 · Issue #161739 · python/cpython · GitHub](https://github.com/python/cpython/issues/161739) ---
**Author:** ![hroncok](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/hroncok/32/18696_2.png) [@hroncok](https://discuss.python.org/u/hroncok)\ **Post date:** [November 10, 2026, 2:40pm UTC](https://discuss.python.org/t/running-test-hashlib-test-hmac-test-ssl-with-openssl-force-fips-mode-1-on-ci/109971/9 "2026-11-10T14:40:34Z")
> [@picnixz](#): > > TIL about this flag. Fun fact, it’s Fedora/RHEL only 🤦 > **[Tree - rpms/openssl - src.fedoraproject.org](https://src.fedoraproject.org/rpms/openssl/blob/rawhide/f/0007-RH-Add-Kernel-FIPS-mode-flag-support-FIXSTYLE.patch)**