search

smol-dot / smoldot

Lightweight client for Substrate-based chains, such as Polkadot and Kusama.
GNU General Public License v3.0
168 stars 45 forks source link

blake2-rfc no longer maintained - change to blake2 #1885

Open DragonDev1906 opened 1 week ago

DragonDev1906 commented 1 week ago

The blake2-rfc dependency hasn't been updated in 3 years, has outdated dependencies and open PRs for those. To me this looks like it is no longer maintained. How about switching to https://crates.io/crates/blake2 (RustCrypto)?

EDIT: The same goes for the libsecp256k1 dependency (no updates since 1 year and open dependency update PRs): https://github.com/paritytech/libsecp256k1/pulls → https://github.com/RustCrypto/elliptic-curves/tree/master/k256

tomaka commented 1 week ago

I fundamentally disagree that because a library doesn't get updated means that we should no longer use it. If anything, a library not getting any update can be a sign of stability/maturity.

DragonDev1906 commented 1 week ago

That is true. It also leads to increased compile times due to the use of outdated transitive dependencies (even though there is a PR for it) and does not explain why a simple PR updating the readme is over 5 years old and didn't even get a comment.

Besides that there is also a benefit of using a library that has 5x as many users/downloads, especially for security relevant dependencies and the knowledge that if there is an issue it is more likely to get fixed.

In the end it is up to you, I hope you have considered both and actively decided to stay on blake2-rfc.