canonical/dex-auth-operator

Remove installation of bcrypt in Charm code

Closed this issue · 2 comments

BCrypt is installed during the run of the charm, which is a bad practice.

subprocess.check_call(["apt", "install", "-y", "python3-bcrypt"])

It is used to hash the password only. We can use other libraries to perform string hashing which does not require the installation of the additional package.

Additionally, packages installed this way are not scanned during the CVE scanning.

Added to be fixed.

Low priority.