Merge pull request #503 from NASA-PDS/fix/upgrade-fabric-python313-502

Upgrade fabric to v3.0 for Python 3.13 compatibility

Author: jordanpadams

setup.cfg

@@ -32,7 +32,7 @@ install_requires =
     connexion[swagger-ui]~=2.7.0
     dataclasses==0.7; python_version <= '3.6'
     distlib~=0.3.7
-    fabric~=2.7.1
+    fabric~=3.0
     filelock~=3.12.3
     Flask~=2.2.2
     flask-cors==3.0.9

src/pds_doi_service/core/actions/roundup/sftp.py

@@ -4,6 +4,7 @@
 import tempfile
 
 import fabric.transfer  # type: ignore
+import paramiko  # type: ignore
 from fabric import Connection  # type: ignore
 from paramiko.sftp import SFTPError  # type: ignore
 from pds_doi_service.core.actions.roundup.enumerate import get_previous_week_metadata
@@ -12,6 +13,28 @@
 from pds_doi_service.core.util.config_parser import DOIConfigUtil
 
 
+class FIPSCompliantAutoAddPolicy(paramiko.MissingHostKeyPolicy):
+    """
+    FIPS-compliant host key policy that accepts unknown hosts without computing MD5 fingerprints.
+
+    This policy is similar to AutoAddPolicy but avoids calling get_fingerprint() which uses MD5
+    and fails in FIPS mode. It's appropriate for internal SFTP servers where host key verification
+    is not critical.
+    """
+
+    def missing_host_key(self, client, hostname, key):
+        """
+        Accept the host key without computing fingerprints.
+
+        Args:
+            client: SSHClient instance
+            hostname: The hostname of the server
+            key: The server's host key
+        """
+        # Add the key without logging the fingerprint (which would use MD5)
+        client._host_keys.add(hostname, key.get_name(), key)
+
+
 def ensure_target_dir(dir_path: str, conn: Connection):
     transfer = fabric.transfer.Transfer(connection=conn)
     sftp = transfer.sftp
@@ -53,7 +76,20 @@ def run(
     dest_filename = f'roundup-week-ending-{metadata.last_date.strftime("%Y%m%d")}.json'
     dest_path = os.path.join(dest_dir_path, dest_filename)
 
-    conn = Connection(host=sftp_host, port=sftp_port, user=sftp_user, connect_kwargs={"password": sftp_password})
+    # Configure connection with FIPS-compliant host key policy
+    # This automatically accepts unknown host keys without computing MD5 fingerprints
+    conn = Connection(
+        host=sftp_host,
+        port=sftp_port,
+        user=sftp_user,
+        connect_kwargs={
+            "password": sftp_password,
+            "look_for_keys": False,  # Disable SSH key auth to avoid MD5 fingerprint in FIPS mode
+            "allow_agent": False,  # Disable SSH agent to avoid MD5 fingerprint in FIPS mode
+        },
+    )
+    # Set FIPS-compliant host key policy that doesn't use MD5
+    conn.client.set_missing_host_key_policy(FIPSCompliantAutoAddPolicy())
     transfer = fabric.transfer.Transfer(connection=conn)
 
     ensure_target_dir(dest_dir_path, conn)

src/pds_doi_service/core/actions/roundup/test/sftp_test.py

@@ -8,6 +8,37 @@
 from pds_doi_service.core.actions.roundup.test.base import WeeklyRoundupNotificationBaseTestCase
 
 
+class SftpImportTestCase(unittest.TestCase):
+    """Test that SFTP dependencies (fabric, invoke) can be imported successfully.
+
+    This test ensures that all required dependencies for SFTP functionality are
+    properly installed and available, catching issues like missing transitive
+    dependencies (e.g., decorator, lexicon) that may occur with certain Python versions.
+    """
+
+    def test_fabric_imports(self):
+        """Test that fabric and its dependencies can be imported."""
+        try:
+            import fabric.transfer  # noqa: F401
+            from fabric import Connection  # noqa: F401
+        except ImportError as e:
+            self.fail(f"Failed to import fabric dependencies: {e}")
+
+    def test_paramiko_imports(self):
+        """Test that paramiko SFTP components can be imported."""
+        try:
+            from paramiko.sftp import SFTPError  # noqa: F401
+        except ImportError as e:
+            self.fail(f"Failed to import paramiko SFTP components: {e}")
+
+    def test_sftp_module_imports(self):
+        """Test that the SFTP module itself can be imported without errors."""
+        try:
+            from pds_doi_service.core.actions.roundup import sftp  # noqa: F401
+        except ImportError as e:
+            self.fail(f"Failed to import SFTP module: {e}")
+
+
 class WeeklyRoundupAdsSftpNotificationTestCase(WeeklyRoundupNotificationBaseTestCase):
     _temp_file_path: str