salt pip package is using wrong and super outdated crypto library

[cr1st1p]

Description of Issue

I am working on Manjaro - Arch based Linux distribution.

I wanted to use salt-lint, which unfortunately, asks for salt being installed through python packaging (pip3)

The problem is that the salt package depends on pycrypto, which is at version 2.6.1, which is said, on its home page to have been tested up to python 3.3, and on github, there is no commit since 2014 (!!)

And of course, Arch is using now python 3.8, so I get, from Crypto code:

AttributeError: module 'time' has no attribute 'clock'

Checking what the distro is using instead of pycrypto - it seems to be pycryptodome, which is a fork/replacement of pycrypto.

You should update the dependency on the python pip package.

Setup

none

Steps to Reproduce Issue

have salt-minion try to connect to a master, on a python 3.8 setup, and installed from the python pip package.

Versions Report

(Provided by running salt --versions-report. Please also mention any differences in master/minion versions.)

Salt Version:
           Salt: 3000

Dependency Versions:
           cffi: 1.13.2
       cherrypy: Not Installed
       dateutil: 2.8.1
      docker-py: 4.2.0
          gitdb: 2.0.6
      gitpython: 2.1.1
         Jinja2: 2.11.1
        libgit2: 0.28.4
       M2Crypto: Not Installed
           Mako: 1.1.1
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: 2.19
       pycrypto: 3.9.7
   pycryptodome: Not Installed
         pygit2: 1.0.3
         Python: 3.8.1 (default, Jan 22 2020, 06:38:00)
   python-gnupg: Not Installed
         PyYAML: 5.3
          PyZMQ: 18.1.1
          smmap: 2.0.5
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2

System Versions:
           dist: manjaro 19.0.0 Kyria
         locale: utf-8
        machine: x86_64
        release: 5.4.18-1-MANJARO
         system: Linux
        version: Manjaro Linux 19.0.0 Kyria

By the way, it looks to wrongly detect pycrypto as being installed and NOT pycryptodome! (look also at the versions)

[garethgreenaway]

@cr1st1p Thanks for the report. Currently we do not support the 3.8 version of Python, we're hoping to add support for that in the Sodium release.

[cr1st1p]

Don't be fooled - python 3.8 is just a side note :-)
time.clock, from pycrypto, is deprecated, I think, since python 3.3

The problem, in my opinion, is with the wrong dependency on pycrypto instead of pycryptodome
Look again at how old and unmaintained pycrypto is.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[s0undt3ch]

Thank you for the report.
We had replaced pycrypto already, but when we were packaging Salt 3000 we hit an issue with regards to packaging for some distributions.
In order not to delay the release we reverted back to pycrypto.
This is just to give you some background and to anyone reading this issue.

The plan for Sodium(salt 3001) is to have this dependency issue resolved.