[TECH DEBT] Cryptography APIs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description of the tech debt to be addressed, include links and screenshots
Looking into the cryptographic APIs that are used throughout the code base I noticed pycryptodomex is a hard dependency and M2Crypto is apparently not. The reason to bring this up is that, for example, in salt/crypt.py M2Crytpo is favoured over Cryptodome.
Also in modules like TLS pyOpenSSL is used instead of pyca/cryptography, as recommended by the Python Cryptographic Authority.
Would it make sense to use just one cryptography library to reduce maintenance cost? pyca/cryptography seems to have a more thriving community and more activity than M2Crypto.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing requirements/crypto.txt, salt/crypt.py, and salt/modules/tls.py to inventory the cryptographic libraries currently used and where each is preferred. Trace their callers and dependencies before defining a migration scope. Done would require an agreed single-library direction and a validated plan for updating the affected APIs and requirements.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100