remove LegacyPasswd code and dependency on crypt

[peterbecich]

hackage-server has a dependency on the extra-library crypt:

hackage-server/hackage-server.cabal

Lines 443 to 444 in 5f5b814

	if !os(darwin)
	extra-libraries: crypt

I believe that refers to this function: https://en.wikipedia.org/wiki/Crypt_(C)

It appears that crypt is deprecated:
https://www.gentoo.org/support/news-items/2021-10-18-libxcrypt-migration-stable.html

The implementation of libcrypt.so within glibc has been deprecated
for a long time and will be removed in the near future.

For this reason, we are following other distributions (where
this has been tested for years already) and switching to the
external libxcrypt implementation, now also in stable installations.

It also looks like Nix is moving away from libcrypt to a different library libxcrypt: NixOS/nixpkgs#181764

---

The usage of the library in hackage-server is here:

hackage-server/src/Distribution/Server/Features/LegacyPasswds/Auth.hs

Line 49 in c3312b0

foreign import ccall unsafe "crypt" cCrypt :: CString-> CString -> CString

Can we replace libcrypt with libxcrypt , or replace this foreign import ccall with some other library like

• https://hackage.haskell.org/package/cryptonite
• https://hackage.haskell.org/package/crypt-sha512
• https://hackage.haskell.org/package/bcrypt-0.0.11/docs/Crypto-BCrypt.html#v:hashPassword

[peterbecich]

The easiest way to solve this is by deleting the "old-style crypt() auth", if possible:

hackage-server/src/Distribution/Server/Features/LegacyPasswds/Auth.hs

Lines 29 to 43 in 5f5b814

	-- Old-style crypt() auth
	--
	-- compatible with apache htpasswd files using CRYPT format:
	--
	-- http://httpd.apache.org/docs/2.2/misc/password_encryptions.html
	--
	-- | These are the *old* crypt format password hashes (salted DES: perl crypt).
	-- Not the same as the new hashes we store in 'PasswdHash'.
	--
	newtype HtPasswdHash = HtPasswdHash String
	deriving (Eq, Show, Typeable, MemSize)
	$(deriveSafeCopy 0 'base ''HtPasswdHash)

[gbaz]

At this point I think just ripping out the legacypasswd stuff is acceptable -- the migration has been over for a long time now. PR welcome.