search

ecordell / pymacaroons

A Python Macaroon Library
pymacaroons.readthedocs.org
MIT License
79 stars 23 forks source link

avoid C dependencies #43

Open rogpeppe opened 6 years ago

rogpeppe commented 6 years ago

pymacaroons depends on libnacl, but there's an alternative implementation of the NaCL crypto that doesn't require C shared library installation (which can be operationally problematic).

See https://github.com/jfindlay/pure_pynacl.

ecordell commented 6 years ago

I love the idea of this (as it was one of the main motivators behind writing pymacaroons in the first place), but I'm a little concerned with taking a dependency on single-author crypto code that's not actively maintained and afaict hasn't been reviewed by anyone else. libnacl binds to libsodium which is frequently patched and has many eyes and many users.

Another option might be pynacl, which also binds to libsodium but the wheel on pypi includes pre-built libsodium libs. (matrix forked pymacaroons to switch to that).

A third option which would require a little more effort is packaging up pymacaroons with several swappable options for nacl, so you can pip install pymacaroons[pure_pynacl] if you're comfortable with that implementation.

rogpeppe commented 6 years ago

Using pynacl seems like a decent interim solution - that would mean we wouldn't need special apt-get stanzas in various places (particularly as libsodium-dev isn't available directly as under Ubuntu 14.04).

ecordell commented 6 years ago

Pynacl added in #45