Python cryptography, Rust, and Gentoo [LWN.net]

Python cryptography, Rust, and Gentoo

Posted Feb 11, 2021 18:13 UTC (Thu) by flussence (guest, #85566)
Parent article: Python cryptography, Rust, and Gentoo

I have to wonder why Portage doesn't just use pycurl in that case; it already needs a command-line program for downloading tarballs anyway, might as well be consistent about it.

(Ironically the default download program—wget—isn't supported by Gentoo on m68k, while curl is.)

to post comments

Python cryptography, Rust, and Gentoo

Posted Feb 12, 2021 8:15 UTC (Fri) by jak90 (subscriber, #123821) [Link] (3 responses)

That too will only get you as far as alternatives to the Rust backends for libcurl currently in development (Hyper, Rustls) will enjoy productive support.
In that case, upstream is probably more upfront about breaking yesterdays compatibility at least.

Python cryptography, Rust, and Gentoo

Posted Feb 13, 2021 2:01 UTC (Sat) by flussence (guest, #85566) [Link] (2 responses)

You seem to be confused. The dependency chain of pycurl is python, curl, openssl. Rust has no say in this, and it won't for as long as curl touts support for 80+ platforms as a feature.

Python cryptography, Rust, and Gentoo

Posted Feb 13, 2021 13:43 UTC (Sat) by mathstuf (subscriber, #69389) [Link] (1 responses)

libcurl is looking to add backends which are implemented in Rust. Now, I'm sure these will remain optional, but what is a distro to do: not ship the backends in the libcurl package or have a libcurl-with-rust replacement package. (Of course, this is moot if the backends are loaded dynamically and the Rust bits can just go into a new package; I just don't know.)

Python cryptography, Rust, and Gentoo

Posted Feb 14, 2021 16:37 UTC (Sun) by nix (subscriber, #2304) [Link]

curl backends are largely not pluggable; a given build uses one backend of any given type, and that's it. (Hence a lot of distros ship several curl packages using different crypto backends.)

So it's easy to avoid rust usage in curl on platforms that don't support it: build in some other choice of backends that aren't implemented in Rust. Working on embedded systems with harsher constraints is why a lot of these backends exist in the first place (e.g. the mbedtls backend), so this is nothing new for curl.