Python 3.13: Concerns about passlib maintenance

[Brett Holman]

Python 3.13 will release in September 2024. We added a passlib dependency to Python 3.13 recently in preparation for this release, per the upstream Python recommendation:

Deprecated since version 3.11, will be removed in version 3.13: The crypt module is deprecated (see PEP 594 for details and alternatives). The hashlib module is a potential replacement for certain use cases. The passlib package can replace all use cases of this module.

However, there is some concern about the maintenance status of passlib. Given the looming release date later in this year, and the activity in the upstream bug, we will want to keep an eye developments in that bug.

I just left a comment on the upstream passlib bug for this issue expressing cloud-init's interest in the outcomes of the issue.

Reference: passlib commits

• implemented in PR #2139
• made into a >= Python 3.13 requirement in PR #4274
• fixed to actually work in PR #4669 - revealed in GH Actions test failure

[Brett Holman]

Apparently Eli Collins is back and has a plan for supporting passlib - a 1.7.5 release is expected soon.

[James Falcon]

Sweet. Think we still need this bug?

[Brett Holman]

Sweet. Think we still need this bug?

I was thinking we can close it once the next release gets published.