Computation of the secret when it is not supplied on the command line
involves passing a string constructed with str to the sha1 function.
However that function expects binary data which is a different type in
Python3. This commit uses the bytes constructor as an additional step to
convert from text to binary data.
Details
Details
Diff Detail
Diff Detail
- Build Status
Buildable 39309 Build 39325: arc lint + arc unit
Event Timeline
lnt/lnttool/create.py | ||
---|---|---|
141–146 | Being no security expert, I am not sure about the patch. I do see that getrandbits is documented as not being for security purposes, but I think we can do the Python 3 support without changing the status quo of the "security". With the future package: from builtins import bytes hashlib.sha1(bytes(str(random.getrandbits(256)), encoding='ascii')).hexdigest() |
Comment Actions
Use approach suggested by Hubert to adapt the existing code rather than use a new way of generating random bits to not change the security strength of the code.
Being no security expert, I am not sure about the patch. I do see that getrandbits is documented as not being for security purposes, but I think we can do the Python 3 support without changing the status quo of the "security".
With the future package: