- Package:
- python3-pbkdf2
- Source:
- python-pbkdf2
- Submitter:
- Sebastian Noack
- Date:
- 2024-11-29 07:57:02 UTC
- Severity:
- normal
pbkdf2_bin() doesn't have arguments to configure the number of iterations and the key length, which renders it completely useless. pbkdf2_hex() has these arguments, but always fails with a TypeError (even if iterations and keylen are not given) since it tries to pass them to pbkdf2_bin() which does not support them. I did not check whether this is an upstream bug, or Debian specific. But either way I suggest to implement the "iterations" and "keylen" arguments for pbkdf2_bin(). Alternatively, you might want to consider just removing this package from Debian. In its current state, it just causes any package that might depend on it, being broken as well. And a PBKDF2 implementation in plain Python isn't very useful in the first place, as with any reasonable amount of iterations, it will run unreasonably long.
Hi, the package python3-pbkdf2 used to be on collab-maint on Alioth but was not uploaded by the maintainer since the migration to Salsa. Thus I took the liberty to not migrate to the debian/ team but rather to Debian Python team where the package sensibly belongs to.[1] It seems upstream is inactive since there was no response on sensible PRs (I applied one as a quilt patch). I addressed this bug report in README.Debian[2] mentioning the option for a removal of the package. You might like to bump the severity of this bug if you think this should happen even before Trixie release. Kind regards Andreas. [1] https://salsa.debian.org/python-team/packages/python-pbkdf2 [2] https://salsa.debian.org/python-team/packages/python-pbkdf2/-/blob/master/debian/README.Debian?ref_type=heads