6 ms·

dev-python/cryptography to use rust, killing alpha, hppa, ia64, m68k, s390

20 points by nickysielicki 6y ago

jjgreen 6y ago
Michał Górny's later post in the thread is worth a read: https://archives.gentoo.org/gentoo-dev/message/167c5156a80d6860e935a2ea92c6b6b5 https://archives.gentoo.org/gentoo-dev/message/167c5156a80d6...
- lumpa 6y ago
  It seems at least portage will be able to remove the dependency on dev-python/cryptography: https://archives.gentoo.org/gentoo-dev/message/73e4a44a8d04709ff33d59eda96030cd https://archives.gentoo.org/gentoo-dev/message/73e4a44a8d047...
- theamk 6y ago
  The kinda-response from cryptography thread: https://github.com/pyca/cryptography/issues/5771#issuecomment-775119338 https://github.com/pyca/cryptography/issues/5771#issuecommen... >> You can't really expect volunteers to port the whole Rust to other architectures just to get cryptography back. > It sounds like you're saying that your time as a Gentoo and NetBSD maintainer is worth more than the time of cryptography maintainers. They are volunteers as well, y' know. You expect those volunteers to keep their security-focused project dependent on inherently insecure technology because it would make your own job easier. Your goals and requirements might not be matching the goals and plans of the maintainers of cryptography. It might be unfortunate for you but it really is as simple as that.
  - hedora 6y ago
    That’s pretty definitive: the cryptography module is developed by volunteers that have neither the time nor inclination to support existing users. The only reasonable options are porting to something else or forking the module. That’s been my experience with everything I’ve written or maintained in python, which is why I no longer consider using it for new projects. It’s too bad. I dusted off some old python 2 scripts today, and (thanks to the frozen in time interpreter/modules) they worked fine.
    - xxpor 6y ago
      Python itself doesn't actually support these architectures! It just happens to work, and well they broke it. IDK what else you'd expect.
riskable 6y ago
The post says that risc-v isn't supported by Rust but this is incorrect: https://doc.rust-lang.org/nightly/rustc/platform-support.html https://doc.rust-lang.org/nightly/rustc/platform-support.htm... It's not tier 1 but it is supported. In fact, embedded Rust on risc-v is super hot right now.
- hedora 6y ago
  It says the riscv rust gentoo packages are missing. That seems plausible.
- deleted 6y ago
  [deleted]
theamk 6y ago
Once again, there is a choice -- support old hardware or have secure software. This happened before with the web browsers, and the solution was to either stop using using old computers for web, or run ancient versions, only go to "known good" websites, and hope really hard that you don't end up on a page with exploit by accident. And now this trickles down to the non-web world as well, and this is potentially much worse -- after all, most of the modern languages require network connectivity of some sort.
duskwuff 6y ago
For context... I don't think Gentoo has statistics for the relative number of users on each architecture, but Debian does (at https://popcon.debian.org/ https://popcon.debian.org/, scroll down to "Statistics per Debian architectures"). Relative to 185,729 samples from users on amd64, there are: 5 users on alpha 8 users on hppa 5 users on ia64 5 users on m68k 7 users on s390x This is a vanishingly small number of users we are talking about here. Most of these architectures have been out of production for the last 10-15 years; they're largely only used by retrocomputing enthusiasts, not as production systems.
- xxpor 6y ago
  s390x (linux on Z) != s390 (31 bit arch from the early 90s for IBM mainframes)
  - duskwuff 6y ago
    Oh, huh, you're right. That one's so rare that it looks like Debian stopped getting any popcon reports from it several years ago: https://popcon.debian.org/stat/sub-s390.png https://popcon.debian.org/stat/sub-s390.png
    - viraptor 6y ago
      Worth keeping the reporting bias in mind in this case. It's extremely more likely that a home user will send data to popcon than a mainframe which may not even have a full internet connection. I wouldn't be surprised if many are run in isolated networks and with local repos. (I don't expect it to be more than 10 either way of course)
      - skissane 6y ago
        I doubt many mainframes are running Debian. IBM recommends Red Hat, SUSE or Ubuntu. All three come with commercial support contracts. If you are already paying big bucks for a mainframe, it seems far more likely you'd go with one of the IBM-recommended distributions than go with Debian. (Ubuntu may have an interest in keeping Debian on mainframe alive because doing so helps them in offering Ubuntu on mainframe.)
theamk 6y ago
Related discussion: lwn.net article about this situation https://news.ycombinator.com/item?id=26097153 https://news.ycombinator.com/item?id=26097153

20 points by nickysielicki 6y ago

Michał Górny's later post in the thread is worth a read: https://archives.gentoo.org/gentoo-dev/message/167c5156a80d6860e935a2ea92c6b6b5 https://archives.gentoo.org/gentoo-dev/message/167c5156a80d6...

lumpa 6y ago
It seems at least portage will be able to remove the dependency on dev-python/cryptography: https://archives.gentoo.org/gentoo-dev/message/73e4a44a8d04709ff33d59eda96030cd https://archives.gentoo.org/gentoo-dev/message/73e4a44a8d047...
theamk 6y ago
The kinda-response from cryptography thread: https://github.com/pyca/cryptography/issues/5771#issuecomment-775119338 https://github.com/pyca/cryptography/issues/5771#issuecommen... >> You can't really expect volunteers to port the whole Rust to other architectures just to get cryptography back. > It sounds like you're saying that your time as a Gentoo and NetBSD maintainer is worth more than the time of cryptography maintainers. They are volunteers as well, y' know. You expect those volunteers to keep their security-focused project dependent on inherently insecure technology because it would make your own job easier. Your goals and requirements might not be matching the goals and plans of the maintainers of cryptography. It might be unfortunate for you but it really is as simple as that.
- hedora 6y ago
  That’s pretty definitive: the cryptography module is developed by volunteers that have neither the time nor inclination to support existing users. The only reasonable options are porting to something else or forking the module. That’s been my experience with everything I’ve written or maintained in python, which is why I no longer consider using it for new projects. It’s too bad. I dusted off some old python 2 scripts today, and (thanks to the frozen in time interpreter/modules) they worked fine.
  - xxpor 6y ago
    Python itself doesn't actually support these architectures! It just happens to work, and well they broke it. IDK what else you'd expect.

riskable 6y ago

The post says that risc-v isn't supported by Rust but this is incorrect: https://doc.rust-lang.org/nightly/rustc/platform-support.html https://doc.rust-lang.org/nightly/rustc/platform-support.htm... It's not tier 1 but it is supported. In fact, embedded Rust on risc-v is super hot right now.

hedora 6y ago
It says the riscv rust gentoo packages are missing. That seems plausible.
deleted 6y ago
[deleted]

theamk 6y ago

Once again, there is a choice -- support old hardware or have secure software. This happened before with the web browsers, and the solution was to either stop using using old computers for web, or run ancient versions, only go to "known good" websites, and hope really hard that you don't end up on a page with exploit by accident. And now this trickles down to the non-web world as well, and this is potentially much worse -- after all, most of the modern languages require network connectivity of some sort.

duskwuff 6y ago

For context... I don't think Gentoo has statistics for the relative number of users on each architecture, but Debian does (at https://popcon.debian.org/ https://popcon.debian.org/, scroll down to "Statistics per Debian architectures"). Relative to 185,729 samples from users on amd64, there are: 5 users on alpha 8 users on hppa 5 users on ia64 5 users on m68k 7 users on s390x This is a vanishingly small number of users we are talking about here. Most of these architectures have been out of production for the last 10-15 years; they're largely only used by retrocomputing enthusiasts, not as production systems.

xxpor 6y ago
s390x (linux on Z) != s390 (31 bit arch from the early 90s for IBM mainframes)
- duskwuff 6y ago
  Oh, huh, you're right. That one's so rare that it looks like Debian stopped getting any popcon reports from it several years ago: https://popcon.debian.org/stat/sub-s390.png https://popcon.debian.org/stat/sub-s390.png
  - viraptor 6y ago
    Worth keeping the reporting bias in mind in this case. It's extremely more likely that a home user will send data to popcon than a mainframe which may not even have a full internet connection. I wouldn't be surprised if many are run in isolated networks and with local repos. (I don't expect it to be more than 10 either way of course)
    - skissane 6y ago
      I doubt many mainframes are running Debian. IBM recommends Red Hat, SUSE or Ubuntu. All three come with commercial support contracts. If you are already paying big bucks for a mainframe, it seems far more likely you'd go with one of the IBM-recommended distributions than go with Debian. (Ubuntu may have an interest in keeping Debian on mainframe alive because doing so helps them in offering Ubuntu on mainframe.)

theamk 6y ago

Related discussion: lwn.net article about this situation https://news.ycombinator.com/item?id=26097153 https://news.ycombinator.com/item?id=26097153