scidsg / hushline

Hush Line connects whistleblowers with organizations and people who can help.
https://hushline.app
GNU Affero General Public License v3.0
74 stars 21 forks source link

`passlib` is unmaintained #553

Open brassy-endomorph opened 2 months ago

brassy-endomorph commented 2 months ago

Is your feature request related to a problem? Please describe.

Passlib has not been updated in 4 years. We get this deprecation warning.

passlib/utils/__init__.py:854: DeprecationWarning: 'crypt' is deprecated and slated for removal in Python 3.13
    from crypt import crypt as _crypt

Describe the solution you'd like

  1. Remove passlib and do our own thing
  2. Vendor passlib and update it as needed
  3. See if someone trustworthy else has make a passlib2 or similar and use that
  4. Fork passlib, republish for the good of the community, and maintain that

All of these have drawbacks, and I'm not at this time proposing we take any particular path. This issue is just to draw attention and document it.

Describe alternatives you've considered

return to monk and burn the puters

Additional context

This is my fault as I opened https://github.com/scidsg/hushline/issues/275 and recommended passlib without realizing how unmaintained it was

rmlibre commented 1 month ago

The argon2_cffi package should be used for argon2 use cases.

Meanwhile, both the cryptography package and the stdlib's hashlib contain scrypt references.

These seem to be the only use cases for passlib, making replacement straightforward.