Use passlib in place of legacycrypt

[glehmann]

legacycrypt requires to install libcrypt.so.1 manually

Keep legacycrypt as a dependency for now, to ease the transition to those who already have a custom data.py.

Move hash_password() to lib.common, to make easier to change the implementation in the future.

This is in draft while I test if it actually works with an install test.

This PR is part of a tree containing 3 PRs:

1. master
2. "Use passlib in place of legacycrypt" (this PR) → master
3. Add Docker-based compatibility test kit for external validation #431 → Use passlib in place of legacycrypt #396
4. Introduce TOML-based configuration to replace data.py #491 → Use passlib in place of legacycrypt #396

[stormi]

@xcp-ng/os-platform-release another reviewer wanted here.

[vxgmichel]

Since data.py is a configuration file, wouldn't be better to avoid computing redundant information in it?
Maybe the hash logic can go to lib/installer.py instead, with something like this:

diff --git a/lib/installer.py b/lib/installer.py
index 02fb96d..d384cd5 100644
--- a/lib/installer.py
+++ b/lib/installer.py
@@ -5,7 +5,7 @@ import time
 import xml.etree.ElementTree as ET
 
 from lib.commands import SSHCommandFailed, ssh
-from lib.common import wait_for
+from lib.common import hash_password, wait_for
 
 from typing import Any, Self
 
@@ -36,6 +36,8 @@ class AnswerFile:
     # makes a mutable deep copy of all `contents`
     @staticmethod
     def _normalize_structure(defn: dict[str, Any]) -> dict[str, Any]:
+        from data import HOST_DEFAULT_PASSWORD, INSERT_HOST_DEFAULT_PASSWORD_HASH
+
         assert isinstance(defn, dict), f"{defn!r} is not a dict"
         assert 'TAG' in defn, f"{defn} has no TAG"
 
@@ -47,7 +49,10 @@ class AnswerFile:
         for key, value in defn.items():
             if key == 'CONTENTS':
                 if isinstance(value, str):
-                    new_defn['CONTENTS'] = value
+                    if value == INSERT_HOST_DEFAULT_PASSWORD_HASH:
+                        new_defn['CONTENTS'] = hash_password(HOST_DEFAULT_PASSWORD)
+                    else:
+                        new_defn['CONTENTS'] = value
                 else:
                     new_defn['CONTENTS'] = [
                         AnswerFile._normalize_structure(item)

With INSERT_HOST_DEFAULT_PASSWORD_HASH being initialized in data.py with a sentinel value like:

INSERT_HOST_DEFAULT_PASSWORD_HASH = "<INSERT_HOST_DEFAULT_PASSWORD_HASH>"

But maybe that's outside the scope of this PR.

[glehmann]

The scope of this PR was focused on removing an anoying depedency.
I like the idea though. I've done something similar in #491.

[vxgmichel]

Maybe document the rounds=5000 since it's not obvious that it's the default value that the system assumes when it's not explicitly provided in the corresponding /etc/shadow line.

LGTM otherwise 👍

[vxgmichel]

Suggested change

	"""Hash password for /etc/password."""
	"""Hash password for /etc/shadow."""

[ydirson]

other than that remark, lgtm

[ydirson]

this does not seem to belong to this commit

[glehmann]

fixed!

[stormi]

@glehmann are you waiting on something before the merge?

[vxgmichel]

Tested on tests/install as well 👍