[3.15] gh-161263: Skip MD5 algorithm challenge tests on FIPS

(cherry picked from commit 41c224c)

Co-authored-by: Seth Larson <seth@python.org>

Author: sethmlarson

Lib/test/test_urllib2.py

@@ -30,6 +30,11 @@
 
 support.requires_working_socket(module=True)
 
+skip_libssl_fips_mode = unittest.skipIf(
+    support.is_libssl_fips_mode(),
+    "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing",
+)
+
 # XXX
 # Request
 # CacheFTPHandler (hard to write)
@@ -1751,6 +1756,7 @@ def test_proxy_basic_auth(self):
                               "proxy.example.com:3128",
                               )
 
+    @skip_libssl_fips_mode  # Uses MD5 algorithm in challenge
     def test_proxy_digest_auth(self):
         # gh-60299: ProxyDigestAuthHandler must look up credentials using
         # the proxy's authority
@@ -1814,6 +1820,7 @@ def test_proxy_digest_auth_uri(self):
         auth = http_handler.requests[1].get_header("Proxy-authorization")
         self.assertIn('uri="%s"' % request_url, auth)
 
+    @skip_libssl_fips_mode  # Uses MD5 algorithm in challenge
     def test_digest_auth_uses_full_url(self):
         # The non-proxy case must keep using the full request URL (not
         # just the host) for the password lookup, so that sub-URI realm
@@ -1936,6 +1943,7 @@ def check_digest_auth(self, headers, realm):
             self.assertIn('nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093"', auth)
             self.assertIn('opaque="5ccc069c403ebaf9f0171e9517f40e41"', auth)
 
+    @skip_libssl_fips_mode
     def test_digest_auth_multiple_challenges(self):
         realm = "digest@example.com"
         digest = (f'Digest realm="{realm}", '
@@ -2001,6 +2009,7 @@ def test_digest_auth_parse_challenges(self):
             [('Negotiate', 'Negotiate'), ('Bearer', 'Bearer abc=='),
              ('Digest', 'Digest realm="a"')])
 
+    @skip_libssl_fips_mode
     def test_proxy_digest_auth_multiple_challenges(self):
         realm = "digest@example.com"
         digest = (f'Digest realm="{realm}", '
@@ -2324,12 +2333,6 @@ def test_parse_proxy(self):
         self.assertRaises(ValueError, _parse_proxy, 'file:/ftp.example.com'),
 
 
-skip_libssl_fips_mode = unittest.skipIf(
-    support.is_libssl_fips_mode(),
-    "conservative skip due to OpenSSL FIPS mode possible algorithm nerfing",
-)
-
-
 class TestDigestAuthAlgorithms(unittest.TestCase):
     def setUp(self):
         self.handler = AbstractDigestAuthHandler()

Misc/NEWS.d/next/Tests/2026-11-03-13-12-50.gh-issue-161263.Voe8VM.rst

@@ -0,0 +1,2 @@
+Skip tests which use MD5 algorithm for WWW-Authenticate challenges when
+libssl is in FIPS mode.