Rewrite password hashing to utilize passlib + bcrypt

* Upon logging in the existing unsalted sha1 passwords will be
  upgraded to bcrypt
* PyPI will prefer using cookie auth to prevent needing to do
  bcrypt on every request
* Load passlib configuration from the existing config.ini file

1 files changed, 12 insertions, 0 deletions

diff --git a/config.py b/config.py
index b8922bc..d8489f1 100644
--- a/config.py
+++ b/config.py
@@ -1,6 +1,9 @@
 import ConfigParser
 from urlparse import urlsplit, urlunsplit
 
+from passlib.context import CryptContext
+
+
 class Config:
     ''' Read in the config and set up the vars with the correct type.
     '''
@@ -61,6 +64,15 @@ class Config:
 
         self.sentry_dsn = c.get('sentry', 'dsn')
 
+        self.passlib = CryptContext(
+                # Unless we've manually specific a list of deprecated
+                #   algorithms assume we will deprecate all but the default.
+                deprecated=["auto"],
+            )
+
+        # Configure a passlib context from the config file
+        self.passlib.load_path(configfile, update=True)
+
     def make_https(self):
         if self.url.startswith("http:"):
             self.url = "https"+self.url[4:]