cwillisf
commented
3 years ago (moved from #186)
Investigation notes: what if we switch from Perfect to another third-party Websocket server library?
It looks like Vapor is the only reasonable third-party candidate currently available. I experimented with both Vapor 3 and Vapor 4.
Vapor 4 seems to support everything we need, but it only support macOS 10.15 and above. Scratch Link currently supports macOS 10.10 and above, and while we could probably drop a few of the older versions I'm not sure we can go all the way to 10.15 just yet.
Vapor 3 seems to support all versions of macOS that we support, in that it doesn't explicitly specify a minimum version of macOS. Unfortunately, Vapor 3 doesn't support HTTPS / WSS, which is a requirement for the way Scratch Link currently works.
Summary:
- Vapor 3 won't work unless we find a way to eliminate the need for HTTPS / WSS (see #137)
- Vapor 4 would probably work if we're willing to set macOS 10.15 as our minimum requirement
Expected Behavior
In general, the scratch-link codebase should only use up-to-date and actively maintained dependencies. This is even more important for dependencies related to network and security features.
Actual Behavior
The macOS version of Scratch Link uses the PerfectlySoft "Perfect" family of libraries for HTTP, SSL/TLS, and WebSockets. The PerfectlySoft group seems to have been disbanded and these libraries are no longer maintained.
So far the consequences are low: I'm not aware of any serious stability or security problems with these libraries. The only current problem I know about is that the libraries don't build for Apple M1, which is tracked as a separate issue in #186.
Operating System and Browser
Mac