Python lacking hashlib.scrypt (breaks -ios9)

[Krontab]

Problem Description

pipx may install with a Python lacking hashlib.scrypt (breaks -ios9).

On some systems, pipx creates the cisco-hashgen venv with an older or differently-built Python that lacks hashlib.scrypt. This causes the -ios9 (scrypt) mode to fail with AttributeError: module 'hashlib' has no attribute 'scrypt'. We should document a prerequisite to ensure the interpreter used by pipx supports hashlib.scrypt and how to direct pipx to the right Python.

Impact

• Affects: pipx-based installs when pipx’s default interpreter lacks hashlib.scrypt.
• Symptom: -ios9 fails at runtime with AttributeError on hashlib.scrypt, while other modes (-asa, -ios5, -ios8) still work.

Example error users may see

AttributeError: module 'hashlib' has no attribute 'scrypt' during -ios9 generation.

How to diagnose the problem

• Check which interpreter pipx is using for the app:
  head -n1 "$(which cisco-hashgen)"

• Test scrypt support in that exact interpreter:
  ~/.local/pipx/venvs/cisco-hashgen/bin/python -c "import hashlib; print('has scrypt:', hasattr(hashlib, 'scrypt'))"

• If has scrypt: False, the interpreter used by pipx doesn’t support scrypt.

Why this happens

• pipx defaults to the Python it was installed/configured with, not necessarily the python3 on your current PATH.
• Some Python builds (e.g., older versions or ones compiled without scrypt/OpenSSL KDF support) don’t expose hashlib.scrypt.

Resolution/Workarounds

Option A: Use a specific interpreter during install or reinstall

Example with Homebrew Python 3.12+/3.13+

pipx install cisco-hashgen --python /opt/homebrew/bin/python3

or, if already installed:

pipx reinstall cisco-hashgen --python /opt/homebrew/bin/python3

Verify:

~/.local/pipx/venvs/cisco-hashgen/bin/python -c "import hashlib; print('has scrypt:', hasattr(hashlib, 'scrypt'))"
/Users/username/.local/pipx/venvs/cisco-hashgen/bin/python
3.9.6 (default, Apr 30 2025, 02:07:17) 
[Clang 17.0.0 (clang-1700.0.13.5)]
has scrypt: False
~ >> 

Option B: Set pipx’s default Python for future installs

export PIPX_DEFAULT_PYTHON=/opt/homebrew/bin/python3
pipx reinstall cisco-hashgen

Option C: Reinstall pipx so it uses a modern Python by default (RECOMMENDED)

• Install pipx via your package manager (e.g., Homebrew), then install cisco-hashgen again.
• Don't forget to restart your terminal session.
• Afterward, verify the venv interpreter provides hashlib.scrypt as shown above.

~ >> brew install pipx        
==> Pouring pipx--1.7.1_1.arm64_sequoia.bottle.tar.gz
🍺  /opt/homebrew/Cellar/pipx/1.7.1_1: 155 files, 1019.3KB
==> Running `brew cleanup pipx`...
zsh completions have been installed to:
  /opt/homebrew/share/zsh/site-functions

~ >> pipx install cisco-hashgen
  installed package cisco-hashgen 2.0.1, installed using Python 3.13.6
  These apps are now globally available
    - cisco-hashgen
done! ✨ 🌟 ✨

~ >> ~/.local/pipx/venvs/cisco-hashgen/bin/python -c "import sys, hashlib; print(sys.executable); print(sys.version); print('has scrypt:', hasattr(hashlib, 'scrypt'))"
/Users/username/.local/pipx/venvs/cisco-hashgen/bin/python
3.13.6 (main, Aug  6 2025, 13:05:20) [Clang 17.0.0 (clang-1700.0.13.3)]
has scrypt: True

Optional cleanup if pipx shows stale state

pipx list
# If the package isn’t listed but binaries exist, remove them:
rm -rf ~/.local/pipx/venvs/cisco-hashgen
rm -f ~/.local/bin/cisco-hashgen

Proposed docs update (Install prerequisites)

• Python compatibility: 3.9–3.13.
• Requirement for -ios9: the interpreter must provide hashlib.scrypt.
• When using pipx, ensure the venv is created with a Python that supports scrypt:

pipx install cisco-hashgen --python /path/to/python3

• You can set PIPX_DEFAULT_PYTHON to make this persistent.
• Verification command:

~/.local/pipx/venvs/cisco-hashgen/bin/python -c "import hashlib; print('has scrypt:', hasattr(hashlib, 'scrypt'))"
/Users/username/.local/pipx/venvs/cisco-hashgen/bin/python
3.9.6 (default, Apr 30 2025, 02:07:17) 
[Clang 17.0.0 (clang-1700.0.13.5)]
has scrypt: False
~ >> 

Notes

• Until the interpreter is switched, -asa, -ios5, and -ios8 continue to work; only -ios9 requires hashlib.scrypt.