Use passlib in place of legacycrypt

legacycrypt requires to install libcrypt.so.1 manually

Keep legacycrypt as a dependency for now, to ease the transition to those
who already have a custom data.py.

Move hash_password() to lib.common, to make easier to change the
implementation in the future.

Signed-off-by: Gaëtan Lehmann <gaetan.lehmann@vates.tech>

Author: glehmann

conftest.py

@@ -13,19 +13,17 @@
 import lib.config as global_config
 from lib import pxe
 from lib.common import (
-    callable_marker,
     DiskDevName,
     HostAddress,
+    callable_marker,
     is_uuid,
     prefix_object_name,
-    setup_formatted_and_mounted_disk,
     shortened_nodeid,
-    teardown_formatted_and_mounted_disk,
     vm_image,
     wait_for,
 )
-from lib.netutil import is_ipv6
 from lib.host import Host
+from lib.netutil import is_ipv6
 from lib.pool import Pool
 from lib.sr import SR
 from lib.vm import VM, vm_cache_key_from_def
@@ -34,8 +32,6 @@
 # Import package-scoped fixtures. Although we need to define them in a separate file so that we can
 # then import them in individual packages to fix the buggy package scope handling by pytest, we also
 # need to import them in the global conftest.py so that they are recognized as fixtures.
-from pkgfixtures import formatted_and_mounted_ext4_disk, sr_disk_wiped
-
 from typing import Dict, Generator, Iterable
 
 # Do we cache VMs?
@@ -321,7 +317,7 @@ def xfail_on_xcpng_8_3(host, request):
 @pytest.fixture(scope='session')
 def host_no_ipv6(host):
     if is_ipv6(host.hostname_or_ip):
-        pytest.skip(f"This test requires an IPv4 XCP-ng")
+        pytest.skip("This test requires an IPv4 XCP-ng")
 
 @pytest.fixture(scope="session")
 def shared_sr(host):
@@ -442,9 +438,7 @@ def vm_ref(request):
             logging.info(">> No VM specified on CLI, and no default found in test definition. Using global default.")
             ref = 'mini-linux-x86_64-bios'
 
-    if is_uuid(ref):
-        return ref
-    elif ref.startswith('http'):
+    if is_uuid(ref) or ref.startswith('http'):
         return ref
     else:
         return vm_image(ref)

data.py-dist

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
-import legacycrypt as crypt     # type: ignore
 import os
-from typing import Any, TYPE_CHECKING
+
+from lib.common import hash_password
+
+from typing import TYPE_CHECKING, Any
 
 if TYPE_CHECKING:
     from lib.typing import IsoImageDef
@@ -15,11 +17,6 @@ if TYPE_CHECKING:
 HOST_DEFAULT_USER = "root"
 HOST_DEFAULT_PASSWORD = ""
 
-def hash_password(password):
-    """Hash password for /etc/password."""
-    salt = crypt.mksalt(crypt.METHOD_SHA512)
-    return crypt.crypt(password, salt)
-
 HOST_DEFAULT_PASSWORD_HASH = hash_password(HOST_DEFAULT_PASSWORD)
 
 # Public keys for a private keys available to the test runner

lib/common.py

@@ -18,6 +18,7 @@
 from uuid import UUID
 
 import requests
+from passlib.hash import sha512_crypt
 from pydantic import TypeAdapter
 
 from typing import (
@@ -367,3 +368,7 @@ def _param_clear(host, xe_prefix, uuid, param_name):
     """ Common implementation for param_clear. """
     args = {'uuid': uuid, 'param-name': param_name}
     host.xe(f'{xe_prefix}-param-clear', args)
+
+def hash_password(password: str) -> str:
+    """Hash password for /etc/password."""
+    return sha512_crypt.using(rounds=5000).hash(password)

pkgfixtures.py

@@ -1,12 +1,13 @@
 from __future__ import annotations
 
 import pytest
-from typing import TYPE_CHECKING, Generator
 
 import logging
 
 from lib.common import setup_formatted_and_mounted_disk, teardown_formatted_and_mounted_disk
 
+from typing import TYPE_CHECKING, Generator
+
 if TYPE_CHECKING:
     from lib.common import DiskDevName
     from lib.host import Host

pyproject.toml

@@ -7,8 +7,10 @@ requires-python = ">=3.11"
 dependencies = [
     "cryptography>=3.3.1",
     "gitpython",
+    # TODO: keep legacycrypt to let the user transition to lib.common.hash_password in their data.py
     "legacycrypt",
     "packaging>=20.7",
+    "passlib",
     "pluggy>=1.1.0",
     "pydantic",
     "pytest>=8.0.0",
@@ -30,6 +32,7 @@ dev = [
     "types-requests",
     "typing-extensions",
     "libarchive-c==5.3",
+    "types-passlib",
 ]
 
 [tool.pyright]

requirements/base.txt

@@ -3,6 +3,7 @@ cryptography>=3.3.1
 gitpython
 legacycrypt
 packaging>=20.7
+passlib
 pluggy>=1.1.0
 pydantic
 pytest>=8.0.0

scripts/install_xcpng.py

@@ -17,7 +17,7 @@
 # flake8: noqa: E402
 sys.path.append(f"{os.path.abspath(os.path.dirname(__file__))}/..")
 from lib import pxe
-from lib.commands import SSHCommandFailed, scp, ssh
+from lib.commands import SSHCommandFailed, ssh
 from lib.common import is_uuid, wait_for
 from lib.host import host_data
 from lib.pool import Pool
@@ -62,7 +62,7 @@ def generate_answerfile(directory, installer, hostname_or_ip, target_hostname, a
 </installation>
         """)
         elif action == 'restore':
-            answerfile.write(f"""<?xml version="1.0"?>
+            answerfile.write("""<?xml version="1.0"?>
 <restore>
 </restore>
         """)
@@ -159,7 +159,7 @@ def main():
 
     try:
         pool = Pool(args.host) # will fail if host is not XCP-ng or XAPI doesn't respond yet
-    except Exception as e:
+    except Exception:
         raise Exception(f"Host `{args.host}` isn't ready or isn't an XCP-ng host")
 
     host = pool.master