dignifiedquire / dignifiedquire/cx448
serdect version skew
- Dominant language
- Rust
- Stars
- 3
- Forks
- 1
- PR merge metrics
- No merged PRs in 30d
Description
`cx448` depends on:
```
crypto-bigint = { version = "0.5.5", features = ["generic-array"], default-features = false }
serdect = { version = "0.3.0", optional = true }
```
but `crypto-bigint` 0.5.5 [depends on an earlier version of `serdect`](https://github.com/RustCrypto/crypto-bigint/blob/395bb171178990a93ef571664271dabc50749043/Cargo.toml#L27):
```
serdect = { version = "0.2", optional = true, default-features = false }
```
This is troubling, because it requires two semver-incompatible versions of `serdect`, in particular across [a major change to the wire format](https://github.com/RustCrypto/formats/blob/master/serdect/CHANGELOG.md#030-2025-01-06):
```
## 0.3.0 (2025-01-06)
NOTE: this release includes major breaking changes to the wire format, namely
all bytestrings now include a length prefix, even when serializing fixed-size
arrays. This is intended to work around deficiencies in the `serde` API
(see serde-rs/serde#2120) as well as serde-based format implementations which
have variable-time behavior when using `serialize_tuple`.
Any binary data serialized with previous versions of `serdect` now needs a
length prefix prepended to the data, which will vary depending on the
particular data format.
### Changed
- Switch to length-prefixed encoding using the `serialize_bytes` method ([#1112], [#1515])
- MSRV 1.70 ([#1244])
[#1112]: https://github.com/RustCrypto/formats/pull/1112
[#1515]: https://github.com/RustCrypto/formats/pull/1515
[#1244]: https://github.com/RustCrypto/formats/pull/1244
```
The implication is that to build `cx448` i need to have two different versions of `serdect` available, each of which produces (and consumes) a different wireformat. Is that deliberate?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by inspecting cx448's dependency declarations and Cargo's resolved dependency graph, then compare the referenced crypto-bigint Cargo.toml entry with serdect 0.3.0 and its changelog. Determine whether the two serdect versions can coexist safely across the affected wire format; done should include a decided dependency strategy and evidence that the resulting build and serialization behavior are correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100