Changed the fall-forward to an explicit version check instead.

The original check was causing issues where 3.8 in Windows was throwing an unexpected error.

This should hopefully fix 3.8 in Windows while maintaining the same support in Linux.

1 files changed, 10 insertions, 15 deletions

diff --git a/SCons/Util.py b/SCons/Util.py
index 1f19fba..8b79a3e 100644
--- a/SCons/Util.py
+++ b/SCons/Util.py
@@ -1692,22 +1692,17 @@ def _attempt_init_of_python_3_9_hash_object(hash_function_object):
     if hash_function_object is None:
         return None
     
-    # it's surprisingly difficult to get the version of python used without an external library:
     # https://stackoverflow.com/a/11887885 details how to check versions with the "packaging" library.
-    # instead of an explicit version check this does a check for the supported feature directly.
-    try:
-        _valid_arguments=inspect.getfullargspec(hash_function_object).kwonlyargs
-        # if this keyword exists, the hashlib is from python >= 3.9, and the hash is always supported.
-        if "usedforsecurity" in _valid_arguments:
-            return hash_function_object(usedforsecurity=False)
-    except TypeError:
-        # unfortunately inspec.getfullargspec throws a TypeError in previous versions of python
-        # as the algorithms were native functions rather than python functions. As such we swallow
-        # the original error here to distinguish from lack of initialization support of the algorithm,
-        # which is a ValueError.
-        # The following line may throw the ValueError if FIPS support is turned on, so this function
-        # should be wrapped inside a try-catch to properly deal with the error thrown.
-        return hash_function_object()
+    # however, for our purposes checking the version is greater than or equal to 3.9 is good enough, as
+    # the API is guaranteed to have support for the 'usedforsecurity' flag in 3.9. See 
+    # https://docs.python.org/3/library/hashlib.html#:~:text=usedforsecurity for the version support notes.
+    if (sys.version_info.major > 3) or (sys.version_info.major == 3 and sys.version_info.minor >= 9):
+        return hash_function_object(usedforsecurity=False)
+
+    # note that this can throw a ValueError in FIPS-enabled versions of Linux prior to 3.9
+    # the OpenSSL hashlib will throw on first init here, but that is assumed to be responsibility of
+    # the caller to diagnose the ValueError & potentially display the error to screen.
+    return hash_function_object()
 
 def _set_allowed_viable_default_hashes(hashlib_used):
     """Checks if SCons has ability to call the default algorithms normally supported.