3 ms·
I'm curious -- what was the inputs to the decision to redo the logic from scratch, rather than wrap something like the `webpki` crate?
by hlieberman 3y ago
I'm curious -- what was the inputs to the decision to redo the logic from scratch, rather than wrap something like the `webpki` crate?
- woodruffw 3y agoThis is a great question! The answer is twofold: 1. Compatibility: PyCA Cryptography has strict compatibility requirements, including being able to build with older versions of Rust that crates like webpki and rustls-webpki may not be interested in supporting. 2. Generality: PyCA Cryptography is a general purpose cryptographic toolbox, and the plan for X.509 validation is not intrinsically linked to just the Web PKI profiles. In the future, they may wish to make their APIs more flexible than a strictly CABF validator would require, meaning that they would either need to carry patches against `webpki` or get such flexibility upstreamed (to the detriment of the crate's single purpose). (I am not a maintainer of Cryptography; this is my understanding of the reasons as one of the implementors of this feature.)
- ivanr 3y agoGenuine question: does the `webpki` crate provide a good path building implementation?