MD5 not supported without usedforsecurity=False in FIPS 140-2 environment

[szelenka]

First check

• I added a descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the Prefect documentation for this issue.
• I checked that this issue is related to Prefect and not one of its dependencies.

Bug summary

The md5 algorithm is compromised and forbidden in FIPS environments.

The Prefect library explicitly uses hashlib.md5 in multiple locations, which makes it impossible to run Prefect 2.x with strict FIPS enforcement. However, Prefect version 1.x can function in strict FIPS environments.

Dask was using md5 for simple hashing (not security) which is permitted in FIPS environments, but it requires an extra parameter introduced in Python 3.9+; see:

• #8608
• #8762
• #48024

The hash_algo is an input parameter to many of the methods in utilities/hashing.py, but it doesn't seem like there's any method to allow the user to override this with a different hashing algorithm.

Reproduction

1. Install Prefect 2.x on a system with strict FIPS 140-2 enforcement
2. Attempt to run a simple Prefect Flow locally

Error

/opt/python/lib/python3.10/site-packages/prefect/flows.py:619: in flow
    Flow(
/opt/python/lib/python3.10/site-packages/prefect/context.py:176: in __register_init__
    __init__(__self__, *args, **kwargs)
/opt/python/lib/python3.10/site-packages/prefect/flows.py:158: in __init__
    version = file_hash(flow_file)
/opt/python/lib/python3.10/site-packages/prefect/utilities/hashing.py:41: in file_hash
    return stable_hash(contents, hash_algo=hash_algo)
/opt/python/lib/python3.10/site-packages/prefect/utilities/hashing.py:22: in stable_hash
    h = hash_algo()
E   ValueError: [digital envelope routines] disabled for fips

Versions

Version:             2.6.8
API version:         0.8.3
Python version:      3.10.8
Git commit:          68044e28
Built:               Thu, Nov 17, 2022 3:19 PM
OS/Arch:             darwin/arm64
Profile:             default
Server type:         ephemeral
Server:
  Database:          sqlite
  SQLite version:    3.39.4

Additional context

Ideally, stop using md5 for hashing; but if required follow the example from Dask. Perhaps a sha512 hash would be a better default?

Pandas opted to use UUID instead for their hashing to get around a similar problem, but I don't think that will work with the object hashing Prefect is doing.

Or make it possible for the end-user to easily configure which default hashing algorithm is used across the utilities/hashing.py methods.