Fix: Replace blake2b with FIPS-compatible hash fallback to support secure environments

soda/core/soda/common/hash_utils.py

@@ -0,0 +1,27 @@
+import hashlib
+
+
+def fips_safe_hasher(digest_size: int):
+    """
+    Returns a hash object that mimics hashlib.blake2b.
+    Falls back to hashlib.sha256 with truncation if blake2b is unavailable (e.g., in FIPS mode).
+    """
+    try:
+        return hashlib.blake2b(digest_size=digest_size)
+    except (TypeError, ValueError, AttributeError):
+
+        class TruncatedSHA256:
+            def __init__(self):
+                self._hasher = hashlib.sha256()
+                self.digest_size = digest_size
+
+            def update(self, data):
+                self._hasher.update(data)
+
+            def digest(self):
+                return self._hasher.digest()[: self.digest_size]
+
+            def hexdigest(self):
+                return self._hasher.hexdigest()[: self.digest_size * 2]
+
+        return TruncatedSHA256()

soda/core/soda/execution/identity.py

@@ -4,6 +4,8 @@
 from numbers import Number
 from typing import Optional
 
+from soda.common.hash_utils import fips_safe_hasher
+
 
 class Identity:
     @staticmethod
@@ -63,7 +65,8 @@ def __init__(self, hash_string_length: int = 8):
     def get_blake2b(self) -> blake2b:
         # Lazy initialization of blake2b in order to return None in the self.get_hash(self) in case nothing was added
         if self.blake2b is None:
-            self.blake2b = blake2b(digest_size=int(self.hash_string_length / 2))
+            # self.blake2b = blake2b(digest_size=int(self.hash_string_length / 2))
+            self.blake2b = fips_safe_hasher(digest_size=int(self.hash_string_length / 2))
         return self.blake2b
 
     def add(self, value: Optional[str]):

soda/trino/soda/data_sources/trino_data_source.py

@@ -71,6 +71,7 @@ def __init__(self, logs: Logs, data_source_name: str, data_source_properties: di
         self.source = data_source_properties.get("source", trino.constants.DEFAULT_SOURCE)
         self.http_headers = data_source_properties.get("http_headers", None)
         self.client_tags = data_source_properties.get("client_tags", None)
+        self.verify_ssl = data_source_properties.get("verify_ssl", None)
 
     def connect(self):
         # Default to BasicAuthentication so we don't break current users.
@@ -96,6 +97,7 @@ def connect(self):
             http_headers=self.http_headers,
             source=self.source,
             client_tags=self.client_tags,
+            verify=self.verify_ssl,
         )
 
     def regex_replace_flags(self) -> str: