deprecated-crypt-alternative fails with undecipherable errors if libxcrypt doesn't have the right hash algorithms enabled

[quantenzitrone]

$ python3 --version
Python 3.13.8
$ pwd
/path/to/python-deadlib/crypt
$ python3 -m unittest
.E.F..Es
======================================================================
ERROR: test_crypt (tests.test_crypt.CryptTestCase.test_crypt)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/path/to/python-deadlib/crypt/tests/test_crypt.py", line 33, in test_crypt
    cr = crypt.crypt('mypassword', 'ab')
  File "/path/to/python-deadlib/crypt/crypt/__init__.py", line 96, in crypt
    return _crypt.crypt(word, salt)
           ~~~~~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 22] Invalid argument

======================================================================
ERROR: test_sha2_rounds (tests.test_crypt.CryptTestCase.test_sha2_rounds)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/path/to/python-deadlib/crypt/tests/test_crypt.py", line 76, in test_sha2_rounds
    cr = crypt.crypt('mypassword', salt)
  File "/path/to/python-deadlib/crypt/crypt/__init__.py", line 96, in crypt
    return _crypt.crypt(word, salt)
           ~~~~~~~~~~~~^^^^^^^^^^^^
OSError: [Errno 22] Invalid argument

======================================================================
FAIL: test_methods (tests.test_crypt.CryptTestCase.test_methods)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/path/to/python-deadlib/crypt/tests/test_crypt.py", line 60, in test_methods
    self.assertEqual(crypt.methods[-1], crypt.METHOD_CRYPT)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: <crypt.METHOD_BLOWFISH> != <crypt.METHOD_CRYPT>

----------------------------------------------------------------------
Ran 8 tests in 0.910s

FAILED (failures=1, errors=2, skipped=1)

[youknowone]

@quantenzitrone Thank you for the report! I'd like to understand better how to reproduce this problem.
I used 3.13.5 on aarch64-apple-darwin. I used deprecated-crypt-alternative-0.1.2 from PyPI to provide _crypt. Any idea what's different?

[quantenzitrone]

i used a self compiled version from this repo
if i use the pip version, it works indeed, sorry that i didn't think to try that
pip seems to vendor libcrypt-eb21b399.so.2
do you know where that comes from?

[quantenzitrone]

yep, replacing libcrypt-eb21b399.so.2 with libcrypt.so.2 from libxcrypt v4.4.38 recreates the error

[quantenzitrone]

oh it runs fine with libxcrypt 4.4.28

[quantenzitrone]

ok i got the problem
my libxcrypt version only has the "strong" hashes enabled, but crypt expects md5 and sha256

[youknowone]

Thank you!

The build came from github CI. (e.g. https://github.com/youknowone/python-deadlib/actions/runs/12156036264)

What is the expected test result with Python 3.10 + your libxcrypt?

If it is different to deprecated-crypt-alternative's behavior, what will be the best way to replicate the environment to me?

[quantenzitrone]

to produce the original error message, you will have to use the libcrypt.so from nixpkgs, e.g. by replacing the pip provided library:
For nix-build you will need to install the nix package-manager (https://nixos.org/download or https://lix.systems/install/#on-any-other-linuxmacos-system)

python3 -m venv .venv
.venv/bin/pip install deprecated-crypt-alternative
nix-build '<nixpkgs>' -A libxcrypt
cp result/lib/libcrypt.so .venv/lib/python3.13/site-packages/_crypt.libs/libcrypt-eb21b399.so.2

alternatively you could build libxcrypt yourself and use

./configure --enable-hashes=strong

to only build the strong hashes
this will however result in a different weird error:

$ ../.venv/bin/python -m unittest
.F.F..Fs
======================================================================
FAIL: test_crypt (tests.test_crypt.CryptTestCase.test_crypt)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/zitrone/documents/programming/github.com/python-deadlib/crypt/tests/test_crypt.py", line 36, in test_crypt
    self.assertEqual(cr2, cr)
    ~~~~~~~~~~~~~~~~^^^^^^^^^
AssertionError: '*1' != '*0'
- *1
+ *0


======================================================================
FAIL: test_methods (tests.test_crypt.CryptTestCase.test_methods)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/zitrone/documents/programming/github.com/python-deadlib/crypt/tests/test_crypt.py", line 60, in test_methods
    self.assertEqual(crypt.methods[-1], crypt.METHOD_CRYPT)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: <crypt.METHOD_BLOWFISH> != <crypt.METHOD_CRYPT>

======================================================================
FAIL: test_sha2_rounds (tests.test_crypt.CryptTestCase.test_sha2_rounds)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/home/zitrone/documents/programming/github.com/python-deadlib/crypt/tests/test_crypt.py", line 79, in test_sha2_rounds
    self.assertEqual(cr2, cr)
    ~~~~~~~~~~~~~~~~^^^^^^^^^
AssertionError: '*1' != '*0'
- *1
+ *0


----------------------------------------------------------------------
Ran 8 tests in 0.928s

FAILED (failures=3, skipped=1)

[youknowone]

"only build the strong hashes" sounds like your crypt build doesn't include MD5 and CRYPT, right?
I am not sure about test_crypt and test_sha2_rounds yet, but failing test_methods is expected result because it can't add METHOD_CRYPT in that case.

[quantenzitrone]

md5 and sha256 are missing, crypt, as yescrypt is there
the original problem is resolved, if you want to close this
however deprecated-crypt-module could use some tests that catches this

[youknowone]

This project doesn't intend either to add any feature or to fix any bug.
If CPython 3.10 behave differently, it will be fixed to behave the same. Otherwise the broken state is the correct state if it is broken as how CPython does.

To close or proceed this issue: Check the test result of old CPython with _crypt module