Index: /main/waeup.kofa/trunk/CHANGES.txt
===================================================================
--- /main/waeup.kofa/trunk/CHANGES.txt	(revision 17279)
+++ /main/waeup.kofa/trunk/CHANGES.txt	(revision 17280)
@@ -4,4 +4,8 @@
 1.8.1.dev0 (unreleased)
 =======================
+
+* Upgrade `dolmen.beaker` dependency. Removes other outdated crypto
+  dependencies. Requires new buildout run. Moves cookie configuration from code
+  to site.zcml session config.
 
 * Beautify INSTALL.txt.
Index: /main/waeup.kofa/trunk/etc/site.zcml.in
===================================================================
--- /main/waeup.kofa/trunk/etc/site.zcml.in	(revision 17279)
+++ /main/waeup.kofa/trunk/etc/site.zcml.in	(revision 17280)
@@ -1,3 +1,4 @@
 <configure xmlns="http://namespaces.zope.org/zope"
+           xmlns:browser="http://namespaces.zope.org/browser"
            xmlns:kofa="http://namespaces.waeup.org/kofa"
            i18n_domain="${kofa_params:devel_pkg}">
@@ -80,3 +81,13 @@
              principal="zope.manager" />
    </configure>
+
+   <!-- session -->
+   <browser:beakerSession
+        key="waeup.kofa.session.id"
+        secret="KofaRocks"
+        timeout="3600"
+        type="cookie"
+        validate_key="thisMightBeChanged"
+        />
+
 </configure>
Index: in/waeup.kofa/trunk/src/waeup/kofa/beaker.py
===================================================================
--- /main/waeup.kofa/trunk/src/waeup/kofa/beaker.py	(revision 17279)
+++ 	(revision )
@@ -1,60 +1,0 @@
-"""Configure dolmen.beaker.
-
-One main advantage of using dolmen.beaker is that session data for a
-certain user can be stored almost automatically in a cookie, thus
-reducing the number of needed ZODB operations.
-
-Security Advisory
------------------
-
-To prevent users from playing around with their session data, these
-data is encrypted by some keys stored in a dict registered as a global
-utility.
-
-These keys are set each time the Zope instance starts. If they change,
-all existing cookies will become unreadable and therefore the stored
-sessions will be lost. Already logged-in users will have to login
-again and all other session based operations might have to be
-restarted.
-
-Changing the keys might therefore have sideeffects.
-
-On the other hand static keys stored in SVN might become known to
-users and enable them to manipulate their session data.
-
-For better security the keys (or one of the keys) could therefore be
-gathered from 'outside' (a file in filesystem, some environment var,
-or whatever).
-"""
-import grok
-from zope.app.appsetup.interfaces import IDatabaseOpenedWithRootEvent
-from zope.component import getUtility
-
-#: Our configuration for dolmen.beaker sessions.
-#:
-#: See http://gitweb.dolmen-project.org/dolmen.beaker.git?a=blob;f=src/dolmen/beaker/utilities.py
-#:
-#: for default configuration.
-BEAKER_CONFIG = dict(
-    data_dir=None,
-    invalidate_corrupt=True,
-    key='waeup.kofa.session.id',
-    log_file=None,
-    secret="KofaRocks",
-    timeout=3600,
-    type="cookie",
-    validate_key="thisMightBeChanged",
-    )
-
-@grok.subscribe(IDatabaseOpenedWithRootEvent)
-def set_beaker_conf(event):
-    # Set beaker conf once when ZODB was opened
-    try:
-        from dolmen.beaker.interfaces import ISessionConfig
-    except ImportError:
-        # we seem to work without dolmen.beaker
-        return
-
-    config = getUtility(ISessionConfig)
-    config.update(BEAKER_CONFIG)
-    return
Index: /main/waeup.kofa/trunk/src/waeup/kofa/ftesting.zcml
===================================================================
--- /main/waeup.kofa/trunk/src/waeup/kofa/ftesting.zcml	(revision 17279)
+++ /main/waeup.kofa/trunk/src/waeup/kofa/ftesting.zcml	(revision 17280)
@@ -1,4 +1,5 @@
 <configure
    xmlns="http://namespaces.zope.org/zope"
+   xmlns:browser="http://namespaces.zope.org/browser"
    xmlns:kofa="http://namespaces.waeup.org/kofa"
    i18n_domain="waeup.kofa"
@@ -50,5 +51,5 @@
       principal="zope.Everybody"
       />
-  <grant 
+  <grant
       permission="waeup.Anonymous"
       principal="zope.Anybody"
@@ -70,3 +71,12 @@
   <grant role="zope.Manager" principal="zope.mgr" />
 
+   <!-- session -->
+   <browser:beakerSession
+        key="waeup.kofa.session.id"
+        secret="KofaRocks"
+        timeout="3600"
+        type="cookie"
+        validate_key="thisMightBeChanged"
+        />
+
 </configure>
Index: /main/waeup.kofa/trunk/src/waeup/kofa/tests/test_beaker.py
===================================================================
--- /main/waeup.kofa/trunk/src/waeup/kofa/tests/test_beaker.py	(revision 17279)
+++ /main/waeup.kofa/trunk/src/waeup/kofa/tests/test_beaker.py	(revision 17280)
@@ -1,6 +1,13 @@
+# We test beaker functionality, although we have no beaker-related code
+# anymore. All configuration is done in ZCML snippets in
+# site.zcml/ftesting.zcml now.
+# The dolmen.beaker package is developed on: https://github.com/trollfot/dolmen.beaker
+from dolmen.beaker.interfaces import ISessionConfig
+from zope.component import queryUtility
 from zope.component.hooks import setSite
 from zope.publisher.browser import TestRequest
 from zope.session.interfaces import ISession
 from waeup.kofa.testing import FunctionalLayer, FunctionalTestCase
+
 
 class BeakerTests(FunctionalTestCase):
@@ -18,5 +25,31 @@
         setSite(self.getRootFolder()) # needed to start transaction
         request = TestRequest()
-        session = ISession(request)
+        session = ISession(request)  # this is a Zope session
         self.assertTrue(session.__module__.startswith('dolmen.beaker'))
+        self.assertTrue(session.get("_path", None) is not None)
         return
+
+    def test_beaker_session_values(self):
+        # Ensure we get also a beaker session
+        # (which is part of a Zope session)
+        try:
+            import dolmen.beaker
+        except ImportError:
+            # no beaker installed, no test
+            return
+        setSite(self.getRootFolder()) # needed to start transaction
+        config = ISessionConfig
+        request = TestRequest()
+        session = ISession(request).session
+        self.assertEqual(session.__module__, "beaker.session")
+        self.assertTrue(session.get("_path", None) is not None)
+        return
+
+    def test_beaker_config_accessible(self):
+        # The session config is set in site.zcml / ftesting.zcml
+        # See beakerSession directive
+        # See https://github.com/trollfot/dolmen.beaker/blob/master/src/dolmen/beaker/zcml.py
+        # for options
+        config = queryUtility(ISessionConfig)
+        self.assertEqual(config.get("key"), "waeup.kofa.session.id")
+        self.assertEqual(config.get("timeout"), 3600)
Index: /main/waeup.kofa/trunk/versions.cfg
===================================================================
--- /main/waeup.kofa/trunk/versions.cfg	(revision 17279)
+++ /main/waeup.kofa/trunk/versions.cfg	(revision 17280)
@@ -10,5 +10,5 @@
 alabaster = 0.7.7
 Babel = 1.3
-Beaker = 1.6.4
+Beaker = 1.11.0
 collective.recipe.sphinxbuilder = 0.8.2
 collective.recipe.template = 2.1
@@ -17,6 +17,7 @@
 distribute = 0.6.49
 docutils = 0.11
-dolmen.beaker = 0.1
+dolmen.beaker = 0.4
 experimental.cssselect = 0.3
+funcsigs = 1.0.2
 grok = 1.1.1
 grokcore.view = 1.13.5
@@ -47,5 +48,4 @@
 psutil = 2.1.3
 py = 1.0.2
-pycryptopp = 0.6.0.1206569328141510525648634803928199668821045408958
 Pygments = 2.0.2
 pyprof2calltree = 1.1.1
