search

dalek-cryptography / curve25519-dalek

A pure-Rust implementation of group operations on Ristretto and Curve25519
Other
853 stars 422 forks source link

ed25519: loosen `signature` crate dependency #582

Closed tarcieri closed 9 months ago

tarcieri commented 10 months ago

The signature crate contains unstable, minor version-gated functionality.

The v2.1 release did not change any of that, and only added new functionality. So it's safe to relax the requirement for signature to >=2.0, <2.2.

tarcieri commented 9 months ago

@rozbb this seems simple enough?

StyMaar commented 9 months ago

Just curious, what's the purpose of the upper version bound at all? Is it because some hypothetical later version of the signature crate could potentially break semver on the unstable features?

tarcieri commented 9 months ago

The digest feature of ed25519-dalek activates signature/digest, which is a pre-1.0 dependency.

Per the versioning policies of both ed25519-dalek and signature, upgrading digest is an exception to SemVer:

https://github.com/dalek-cryptography/curve25519-dalek/tree/main/ed25519-dalek#public-api-semver-exemptions

Note that this doesn't impact most users who don't activate the digest feature, which is off-by-default.

rozbb commented 9 months ago

Sorry this got lost. Will read tn

tarcieri commented 9 months ago

@rozbb world's smallest PR 😅

rozbb commented 9 months ago

Allow me to reply with the world's smallest: ˡᵍᵗᵐ

rozbb commented 9 months ago

(I'm sorry for this taking so long; I've been working pretty hard lately, trying to make sure this is my last year of grad school; I hopefully graduate in May)