zkcrypto / bulletproofs

A pure-Rust implementation of Bulletproofs using Ristretto.
MIT License
52 stars 29 forks source link

Possibly stale dependency curve25519-dalek-ng, and strangeness with forks #15

Closed Stentonian closed 9 months ago

Stentonian commented 1 year ago

Hi I am trying to understand what is happening around the following 2 repos and their forks:

The repo I am currently building depends on both of the forked repos mentioned above. I have some concerns around curve25519-dalek-ng because there have been no updates since 2021 while the original one receives updates fairly regularly. It seems that the original reason for creating the fork was not actually valid so I tried changing to using curve25519-dalek but since this bulletproos repo depends on curve25519-dalek-ng I can't change to curve25519-dalek unless I change to the original dalek bulletproofs repo. But the problem there is that if I want to use the original repo I must use the rust crate bulletproofs 2.0.0, which does not compile. Also, it's strange that this bulletproofs repo takes the crate identifier bulletproofs 4.0.0 (why are 2 different versions pointing to 2 different repos?).

What is the recommendation here? Could I make a PR to change this repo to use curve25519-dalek? Should I just fork both repos and do my own thing? Are the changes in curve25519-dalek not necessary for curve25519-dalek-ng?

@hdevalence @cathieyun

cathieyun commented 11 months ago

Hi Stenton -

Thanks for reaching out. Your confusion is understandable, there is a messy history with regards to those repos. You are welcome to open a PR to make the changes that you think would be best for the repos. Technically since I'm at Apple now, I can't make any open-source contributions myself, but I am happy to review your changes and approve them if they make sense for the safety and usability of the repos.

Thanks, Cathie Yun

On Fri, Nov 10, 2023 at 5:25 AM Stenton Mayne @.***> wrote:

Hi I am trying to understand what is happening around the following 2 repos and their forks:

The repo I am currently building https://github.com/silversixpence-crypto/dapol/issues/11 depends on both of the forked repos mentioned above. I have some concerns around curve25519-dalek-ng because there have been no updates since 2021 while the original one receives updates fairly regularly. It seems that the original reason for creating the fork was not actually valid https://github.com/dalek-cryptography/curve25519-dalek/issues/345 so I tried changing to using curve25519-dalek but since this bulletproos repo depends on curve25519-dalek-ng I can't change to curve25519-dalek unless I change to the original dalek bulletproofs repo. But the problem there is that if I want to use the original repo I must use the rust crate bulletproofs 2.0.0, which does not compile https://github.com/dalek-cryptography/bulletproofs/issues/359. Also, it's strange that this bulletproofs repo takes the crate identifier bulletproofs 4.0.0 (why are 2 different versions pointing to 2 different repos?).

What is the recommendation here? Could I make a PR to change this repo to use curve25519-dalek? Should I just fork both repos and do my own thing? Are the changes in curve25519-dalek not necessary for curve25519-dalek-ng?

@hdevalence https://github.com/hdevalence @cathieyun https://github.com/cathieyun

— Reply to this email directly, view it on GitHub https://github.com/zkcrypto/bulletproofs/issues/15, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAZJJOT2OEMEIMIXA6E73ZDYDYTLJAVCNFSM6AAAAAA7GFU7ACVHI2DSMVQWIX3LMV43ASLTON2WKOZRHE4DONRSGYYTSNY . You are receiving this because you were mentioned.Message ID: @.***>

Stentonian commented 11 months ago

@cathieyun are you able to review the PR?

Stentonian commented 10 months ago

@hdevalence @cathieyun would you be able to review the PR soon? I'd like to get these dependencies sorted before the MVP of our codebase starts to get used

cathieyun commented 10 months ago

Thanks for putting the PR together, I reviewed it.