[BugFix] [Vul] Add missing usedforsecurity=False in MD5 hashing to enable FIPS

[shaoyuyoung]

A supplement to the previous PR (#17043).
When it comes to MD5 hashing, we might meet the two problems below:

• It is an unsafe hashing algorithm, please refer to CWE-327
• As a result, when using vLLM (consisting of MD5 hashing without usedforsecurity=False) on FIPS, the program throws ValueError.

Solution: add the param usedforsecurity=False for hashlib.md5

BTW, I think we should add this vul pattern into vLLM CI check, avoiding the new unsafe use of md5 hashing to be introduced to the codebase.
FIX #18318

Warning
usedforsecurity=False is a "do not explode in FIPS mode" flag to make software FIPS tolerant, not making the code comply with FIPS.

[github-actions]

👋 Hi! Thank you for contributing to the vLLM project.

💬 Join our developer Slack at https://slack.vllm.ai to discuss your PR in #pr-reviews, coordinate on features in #feat- channels, or join special interest groups in #sig- channels.

Just a reminder: PRs would not trigger full CI run by default. Instead, it would only run fastcheck CI which starts running only a small and essential subset of CI tests to quickly catch errors. You can run other CI tests on top of those by going to your fastcheck build on Buildkite UI (linked in the PR checks section) and unblock them. If you do not have permission to unblock, ping simon-mo or khluu to add you in our Buildkite org.

Once the PR is approved and ready to go, your PR reviewer(s) can run CI to test the changes comprehensively before merging.

To run CI, PR reviewers can either: Add ready label to the PR or enable auto-merge.

🚀

[shaoyuyoung]

I'm very sorry that some checking mechanisms were triggered when I updated the branch

[shaoyuyoung]

v1 label can be removed

[shaoyuyoung]

cc @russellb, mind taking a look at this? thanks! :)

[robertgshaw2-redhat]

Thanks @shaoyuyoung

[robertgshaw2-redhat]

Would you be make the CI check to avoid future actions that break FIPS compliance?

[shaoyuyoung]

Would you be make the CI check to avoid future actions that break FIPS compliance?

Sure thing! :)
But plz give me some time to understand vllm CI. I will send PR once I'm ready :)

[shaoyuyoung]

The previous CI seemed to trigger a Docker error. I'm not sure whether it is my issue. Can we rerun the CI?

[shaoyuyoung]

Warning
As @tiran mentioned, usedforsecurity=False is a "do not explode in FIPS mode" flag to make software FIPS tolerant, not making the code comply with FIPS.