rust-crypto

[drahnr]

rust-crypto is unmaintained for ~2 years now. The dependencies are ageing and are unmaintained too (i.e. gcc crate, which got renamed to cc and which received a ton of fixes for its build.rs) and pulling in libraries with known issues (openssl <= 1.1.0).

Are there any plans to obsolete the usage of rust-crypto?

[luser]

We're really just using it for hmac and hashing. There's #310 which wants to replace both ring and rust-crypto with RustCrypto. I'm going to look more closely at that once I get the last few large PRs merged for the distributed compilation feature that we've been adding.

[drahnr]

I would have preferred to use ring for no specific reason, but the author of #310 is right, it would be overkill and the minimal dependency solution is by far preferable over an unmaintained crate. I had a brief look into sha1 and the implementation is very concise and readable and asm dependencies are feature flagged (asm).

Background: I tried to cross compile this into a static binary for Windows from Linux, and a lot of those unmaintained crates stem from a time where build scripts were not really tested for the cross compile use case - and all of a sudden one is 3 crates deep in patches of those crates - when the immediate goal was to just get it linking statically for windows from my linux dev environment.

[newpavlov]

IIUC sccache no longer depends on rust-crypto, so I think this issue can be closed.

[Xuanwo]

IIUC sccache no longer depends on rust-crypto, so I think this issue can be closed.

cc @sylvestre to close this issue. BTW, I'm willing to help triage and close stale issues~

[sylvestre]

cc @sylvestre to close this issue. BTW, I'm willing to help triage and close stale issues~

This requires some extra perms from the Mozilla org. (Almost) everybody is off. Let's see next year :)