This is more "intent to implement" rather than a bug report.

Describe the bug

glibc's libcrypt implementation supports a narrow range of hashes, and none of modern RAM-heavy ones.

glibc maintaines would like to spin this library off into a separate project and drop libcrypt from the glibc altogether.

Some distributions have already switched to API- and ABI-compatible libxcrypt:

• Fedora
• Arch

Expected behaviour

All packages that use libcrypt.so.1 can use strong hash types.

Action plan

• Package libxcrypt.
• Add a flag withLibcrypt (defaults to true) to glibc package that disables building and installing libcrypt.so.1 and crypt.h if set to false.
• One-by-one update packages that expect libcrypt.so.1 in glibc by giving them a flag useGlibcLibcrypt (defaults to true).
• Add a global setting useGlibcLibcrypt (defaults to true), and disable withLibgcrypt in glibc and useGlibcLibgcrypt in other packages it is set to false.
• Wait until the dust settles.
• Switch useGibcLibcrypt to default to false.
• Wait until the dust settles.
• Remove withLibcrypt, useGlibcLibcrypt from packages, make useGlibcLibcrypt no-op.

Known issues

I have stumbled upon the following problems while doing a PoC on the packages I regularly use (not the whole archive):

• I have no idea how to make the global flag be respected
• ppp expects and checks libcrypt in glibc

Affected packages

Normally it would be easy to do a reverse-dependency search to see what relies on a particular library. However with a library bundled in glibc the tree of reverse dependencies is not particularly useful.

I have greped the whole nixos-unstable and manually processed the results. Attached is the list of

• Packages with files that link to libcrypt.so.1 and actually use symbols from them (+++)
• Packages with files that link to libcrypt.so.1, but don't actually use any symbols (???)
• Packages with files that mention libcrypt.so.1, but don't link to it (mostly text) (XXX).

This is a very rough list, the only way to get a definite list is by rebuilding the archive, however it should suffice as a starting point.

libcrypt-users.txt

Notify maintainers
@edolstra