Python 3.13 dropped crypt from the stdlib, and openSUSE Leap 16 packages
neither legacycrypt nor crypt_r, so the server did not start there
without a pip install. Both of those only call crypt(3) from libcrypt,
which every distribution ships, so do that through ctypes as the last
resort, serialized because crypt(3) returns a static buffer. Its hashes
match the stdlib module byte for byte.
Move the import chain both callers carried into confluent.pwcrypt. The
legacycrypt Recommends is no longer needed.
Neither is packaged by EPEL or Ubuntu, so the hard dependency made the
server uninstallable there without --nodeps or a stub package. Both are
already optional in the code: httpapi drops passkey support when
webauthn does not import, and the Lenovo IMM2 BIOS settings path reports
the missing module as unsupported functionality. Recommend them instead,
as the SUSE branch already does for webauthn.
See xcat2/confluent#192.
Linux-PAM reads vendor defaults from /usr/lib/pam.d and distributions are
migrating there package by package: systemd and polkit already ship into
it on both EL and Debian, and on SUSE 16 openssh has followed. There the
old code left a dangling /etc/pam.d/confluent and every pam authentication
against it failed.
The deb postinst carries the same logic, so fix it in step. ln -sf rather
than ln -s because -e is false for a dangling link, so the old code retried
the symlink and failed with 'File exists' instead of repairing it.
crypt left the standard library in 3.13 and both imports of it here are
unconditional, so the server does not start on a 3.13 distro that ships no
crypt shim of its own.
legacycrypt and crypt_r both reach the same libcrypt call, tried in that
order because legacycrypt is pure ctypes while crypt_r wants a compiler.
Both were checked byte for byte against the stdlib for the $6$ salts used
here, and a hash written under the stdlib verifies under either, so stored
crypted.* attributes keep working.
Recommends rather than Requires, and only above 3.12: el9 and el10 still
ship the stdlib module, and some 3.13 distros package no candidate at all,
where a hard dependency would make the rpm uninstallable.
EL7's python3 support is barren and would require a lot of dependency
work.
Move EL7 back to python2 and will deprecate EL7 support when we ditch
python2
Markus Hilger
Jarrod Johnson
Jarrod Johnson
Tinashe
Tinashe Kucherera
Christian Goll