Python37 lock fix

[dannon]

Fixes #9641

One concern is that pbkdf2_hmac was added in python 2.7.8. I'm not that worried about it because that was available July 2, 2014, and we're not supporting 2.7 anymore anyway, but... It's worth thinking about.

[mvdbeek]

That seems to fix the login issue for me. There's still:

Exception ignored in: <function _after_at_fork_child_reinit_locks at 0x103ea09d0>
Traceback (most recent call last):
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 260, in _after_at_fork_child_reinit_locks
spawned uWSGI worker 3 (pid: 25930, cores: 2)
    _releaseLock()  # Acquired by os.register_at_fork(before=.
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 228, in _releaseLock
spawned 2 offload threads for uWSGI worker 3
    _lock.release()
RuntimeError: cannot release un-acquired lock
Exception ignored in: <function _after_at_fork_child_reinit_locks at 0x103ea09d0>
Traceback (most recent call last):
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 260, in _after_at_fork_child_reinit_locks
spawned uWSGI worker 4 (pid: 25931, cores: 2)
    _releaseLock()  # Acquired by os.register_at_fork(before=.
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 228, in _releaseLock
    _lock.release()
RuntimeError: cannot release un-acquired lock
spawned 2 offload threads for uWSGI worker 4
Exception ignored in: <function _after_at_fork_child_reinit_locks at 0x103ea09d0>
Traceback (most recent call last):
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 260, in _after_at_fork_child_reinit_locks
spawned uWSGI http 1 (pid: 25932)
running "unix_signal:2 gracefully_kill_them_all" (master-start)...
    _releaseLock()  # Acquired by os.register_at_fork(before=.
  File "/Users/mvandenb/.pyenv/versions/3.8.2/lib/python3.8/logging/__init__.py", line 228, in _releaseLock
running "unix_signal:15 gracefully_kill_them_all" (master-start)...
galaxy.web_stack DEBUG 2020-04-22 13:51:12,655 [p:25928,w:1,m:0] [MainThread] Calling postfork function: <bound method ApplicationStack.set_postfork_server_name of <galaxy.web_stack.UWSGIApplicationStack object at 0x10391fc40>>
    _lock.release()
RuntimeError: cannot release un-acquired lock
Exception ignored in: <function _after_at_fork_child_reinit_locks at 0x103ea09d0>

on 3.7.6 and 3.8.2, but I think that's uwsgi's fault.

[dannon]

@mvdbeek Nice, glad this fixes it. That other one is indeed a separate issue.

[nsoranzo]

While we are updating this, I see on https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf2_hmac that: "The number of iterations should be chosen based on the hash algorithm and computing power. As of 2013, at least 100,000 iterations of SHA-256 are suggested."

Should we increase COST_FACTOR = 10000 ?

[dannon]

@nsoranzo I noticed that, too. We can certainly bump the default for new hashes.