fix: handle missing hashlib.md5 on FIPS-enforced Python

[mwatkins-ld]

Summary

MD5 is not a FIPS-approved algorithm, and some FIPS-enforced Python images remove hashlib.md5 entirely. Because DigestAuth references hashlib.md5 in a class-level dictionary, this causes an AttributeError at import time, making the entire httpx2 library unusable on these environments, even if MD5 digest auth is never used.

This change conditionally registers the MD5 algorithm entries only when hashlib.md5 is present, so httpx2 can be imported on FIPS-enforced environments while preserving full MD5 digest auth support elsewhere. When a server requests an unavailable algorithm, a clear ProtocolError is raised instead of an opaque KeyError.

Discussion: #1094

Checklist

• I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• (No documentation to update?)

[codspeed-hq]

Merging this PR will not alter performance

✅ 17 untouched benchmarks
⏩ 7 skipped benchmarks¹

---

_{Comparing mwatkins-ld:fix/digest-auth-fips-compat (948d0ce) with main (a966320)}

Footnotes

1. 7 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/httpx2/httpx2/_auth.py">

<violation number="1" location="src/httpx2/httpx2/_auth.py:178">
P3: The FIPS test never exercises this import-time guard; add a test that imports/reloads the auth module with `hashlib.md5` absent so the original library-import failure remains covered.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The FIPS test never exercises this import-time guard; add a test that imports/reloads the auth module with hashlib.md5 absent so the original library-import failure remains covered.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/httpx2/httpx2/_auth.py, line 178:

<comment>The FIPS test never exercises this import-time guard; add a test that imports/reloads the auth module with `hashlib.md5` absent so the original library-import failure remains covered.</comment>

<file context>
@@ -168,15 +168,16 @@ def _build_auth_header(self, username: str | bytes, password: str | bytes) -> st
         "SHA-512": hashlib.sha512,
         "SHA-512-SESS": hashlib.sha512,
     }
+    if hasattr(hashlib, "md5"):
+        _ALGORITHM_TO_HASH_FUNCTION["MD5"] = hashlib.md5
+        _ALGORITHM_TO_HASH_FUNCTION["MD5-SESS"] = hashlib.md5
</file context>

[mwatkins-ld]

Should be fixed in: 48b001b and 948d0ce

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[mbeijen]

Thanks, looks good! @Kludex I think this is a nice fix