Package: radicale
Version: 2.1.11-8
Severity: important

Dear Maintainer,

radicale requires the python3-passlib module to use bcrypt encryption (htpasswd 
-B),
which is the standard secure way of hashing passwords. Otherwise, the service 
fails
with:

ERROR: An exception occurred during server startup: The htpasswd encryption 
method 'bcrypt' requires the passlib module with bcrypt support.

Currently upstream documents this as an "optional" dependency, but since 
passlib is
so small (Installed-Size: 1984) I would suggest you hard-depend on it in the 
Debian
package.

X

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable-debug'), (500, 
'testing-debug'), (500, 'stable'), (300, 'unstable'), (100, 'experimental'), 
(1, 'experimental-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.7.0-1-amd64 (SMP w/4 CPU threads)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages radicale depends on:
ii  adduser              3.118
ii  init-system-helpers  1.58
ii  lsb-base             11.1.0
ii  python3-radicale     2.1.11-8

Versions of packages radicale recommends:
ii  ssl-cert  1.0.39

Versions of packages radicale suggests:
pn  apache2                     <none>
ii  apache2-utils               2.4.46-1
pn  libapache2-mod-proxy-uwsgi  <none>
ii  python3-bcrypt              3.1.7-3
ii  python3-passlib             1.7.2-2
pn  uwsgi                       <none>
pn  uwsgi-plugin-python3        <none>

-- Configuration Files:
/etc/radicale/config changed:
[server]
certificate = /etc/ssl/certs/ssl-cert-snakeoil.pem
key = /etc/ssl/private/ssl-cert-snakeoil.key
[encoding]
[auth]
type = htpasswd
htpasswd_filename = /etc/radicale/users
htpasswd_encryption = bcrypt
[rights]
type = from_file
file = /etc/radicale/rights
[storage]
[web]
[logging]
config = /etc/radicale/logging
[headers]


-- no debconf information

Reply via email to