why not remove this instead?

i thought: what if someone doesn't want local auth but wants to use pagure CI ? then he will either comment/remove those lines particular to local auth.

Lets see what @pingou has to say :smile:

Yes, I have found this issue a few days ago:

https://pagure.io/fork/williamjmorenor/pagure/c/a3caaa2a56573e1f539f5d5785e863e54a3605b3

I changed my decision after: https://pagure.io/pagure/pull-request/1214#comment-9025

Oups, looks like I replied to the wrong issue there.

Thanks for catching it @vivekanand1101

Maybe just add a comment above it to say that it's needed only for local auth or with pagure-ci?

We can then drop the comment when cryptography actually becomes a dep of the core.

Thanks ! :)