search

facebook / opaque-ke

An implementation of the OPAQUE password-authenticated key exchange protocol
Apache License 2.0
300 stars 46 forks source link

Fix zeroize dependency in a more future-proof fashion #321

Closed nitnelave closed 1 year ago

nitnelave commented 1 year ago

Also, bump to 0.6.2 for release.

I'm trying to publish a crate that depends on opaque 0.6 and (indirectly) on zeroize 1.5.7. The 0.6.1 of opaque_ke is still on zeroize ~1.1, so it's not compatible.

For me to release my crate, I'd need a 0.6.2 release.

(note that I know that 0.6 is deprecated, but my crate will depend on both opaque 0.6 and 3.0+ and will allow users to do a smooth transitions without having to reset their passwords)

daxpedda commented 1 year ago

@kevinlewi pointed out here (https://github.com/facebook/opaque-ke/pull/286#issuecomment-1327832553) why a v0.6.2 won't be released with a higher version of zeroize: the MSRV.

Maybe a v0.7 would be more appropriate?

nitnelave commented 1 year ago

Good point. Changed to 0.7

kevinlewi commented 1 year ago

LGTM. I updated the MSRV in the CI to 1.56. I can commit this, but @nitnelave can you test on the updated commit before I make an actual 0.7.0 release?

nitnelave commented 1 year ago

Yep, just built and tested with the new commit, it works for me. Thanks!