Fix Content-MD5 in FIPS environments

[JensWehner]

Content-MD5 uses hashlib.md5() and fails under FIPS policy. Mark the protocol checksum as non-security use and add a regression test.

[github-actions]

Thank you for your contribution @JensWehner! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
8 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Updates Blob Content-MD5 calculation for FIPS environments and adds regression coverage.

Changes:

• Marks MD5 as non-security usage.
• Adds a FIPS-policy regression test.
• Sibling Storage packages remain unaddressed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
tests/test_content_validation.py	Tests non-security MD5 usage.
_shared/validation.py	Passes usedforsecurity=False to MD5.

[jalauzon-msft]

@JensWehner, thanks for the contribution! We are good to take this change but please address the comment from Copilot and bring this change to all four of our base packages. While it may not be used in all packages, we like to keep the _shared folder in sync across all packages. You do not need to port the test to other packages if you do not want though.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.

[github-actions]

[Pilot] PR Pipeline Failure Analysis

A CI pipeline failed on this pull request. Here is an automated analysis of what went wrong and how to get the build green.

What failed

The mypy validation stage failed for 2 packages in the sdk/eventhub area. Both failures share the same root cause — a type error in vendored storage blob code:

• azure-eventhub-checkpointstoreblob — mypy FAIL(1)
• azure-eventhub-checkpointstoreblob-aio — mypy FAIL(1)

The storage packages (azure-storage-blob, azure-storage-file-datalake, azure-storage-file-share, azure-storage-queue) all passed mypy.

Error (identical in both packages):

azure/eventhub/extensions/checkpointstoreblob[aio]/_vendor/storage/blob/_models.py:603:
  error: Incompatible types in assignment
    (expression has type "Any | None", variable has type "str")  [assignment]

Build: https://dev.azure.com/azure-sdk/public/_build/results?buildId=6618602

Recommended next steps

• Fix the type error at line 603 of _vendor/storage/blob/_models.py in both packages:
  • sdk/eventhub/azure-eventhub-checkpointstoreblob/azure/eventhub/extensions/checkpointstoreblob/_vendor/storage/blob/_models.py
  • sdk/eventhub/azure-eventhub-checkpointstoreblob-aio/azure/eventhub/extensions/checkpointstoreblobaio/_vendor/storage/blob/_models.py
• The variable is typed as str but the expression can be Any | None. Add a type guard/cast (e.g. cast(str, ...)) or update the vendored code to allow Optional[str].
• Since this is vendored code, the fix may also need to be applied upstream in azure-storage-blob and then re-vendored — or suppressed with a # type: ignore[assignment] comment if the vendored copy is intentionally frozen.
• See the CI troubleshooting guide: https://aka.ms/ci-fix
• Push new commits to address the failures; this comment updates automatically on the next failing run.

Raw pipeline analysis (azsdk ci analyze)

Failed Tasks
### Errors:
azure/eventhub/extensions/checkpointstoreblob/_vendor/storage/blob/_models.py:603:
  error: Incompatible types in assignment (expression has type "Any | None", variable has type "str")  [assignment]
Found 1 error in 1 file (checked 75 source files)
mypy check completed with exit code 1

azure/eventhub/extensions/checkpointstoreblobaio/_vendor/storage/blob/_models.py:603:
  error: Incompatible types in assignment (expression has type "Any | None", variable has type "str")  [assignment]
Found 1 error in 1 file (checked 85 source files)
mypy check completed with exit code 1

=== SUMMARY ===
PACKAGE                                                                 CHECK  STATUS  DURATION(s)
/mnt/vss/_work/1/s/sdk/storage/azure-storage-blob                       mypy  OK             26.73
/mnt/vss/_work/1/s/sdk/storage/azure-storage-file-datalake              mypy  OK             28.32
/mnt/vss/_work/1/s/sdk/storage/azure-storage-file-share                 mypy  OK             16.42
/mnt/vss/_work/1/s/sdk/storage/azure-storage-queue                      mypy  OK             15.06
/mnt/vss/_work/1/s/sdk/eventhub/azure-eventhub-checkpointstoreblob      mypy  FAIL(1)        23.34
/mnt/vss/_work/1/s/sdk/eventhub/azure-eventhub-checkpointstoreblob-aio  mypy  FAIL(1)        26.17

Total checks: 6 | Failed: 2 | Worst exit code: 1

Pipeline: https://dev.azure.com/azure-sdk/public/_build/results?buildId=6618602

Copilot detected the failing pipeline and generated the analysis above. To have it attempt a fix automatically, reply with @copilot please fix the failing pipeline on this PR.

Generated by Pipeline Analysis - Next Steps · 47.7 AIC · ⌖ 6.37 AIC · ⊞ 6.6K · ◷

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

sdk/storage/azure-storage-queue/azure/storage/queue/_shared/validation.py:80

• The regression test added in this PR imports only Blob's validation module, so it does not exercise this separate Queue implementation. A future omission or regression here would still pass that test; add the same FIPS simulation against azure.storage.queue._shared.validation.calculate_content_md5.

    md5 = hashlib.md5(usedforsecurity=False)  # nosec

sdk/storage/azure-storage-file-share/azure/storage/fileshare/_shared/validation.py:80

• The new regression test executes only Blob's copy of this helper, not the File Share module changed here. Please add equivalent coverage in File Share's existing tests/test_content_validation.py so its independently shipped implementation is verified under the simulated FIPS policy.

    md5 = hashlib.md5(usedforsecurity=False)  # nosec

sdk/storage/azure-storage-file-datalake/azure/storage/filedatalake/_shared/validation.py:80

• The Blob-only regression test does not execute this independently shipped Data Lake helper. Add the equivalent FIPS simulation to Data Lake's existing tests/test_content_validation.py; otherwise this package can regress to plain hashlib.md5() without any package test failing.

    md5 = hashlib.md5(usedforsecurity=False)  # nosec