Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Nimbilize #187

Closed
wants to merge 4 commits into from
Closed

Nimbilize #187

wants to merge 4 commits into from

Conversation

lantos1618
Copy link

@lantos1618 lantos1618 commented Mar 12, 2022

Making some of the functions public and starting to make the folder structure confirm with nimble package init structure.
Added jsony, stew and gmp requirements. Note they are not bound to a version atm.

should pkg be removed from all files? example:
-- pkg/jsony
++ jsony

tests seem to pass but there is this warning which is assumed to fail?
[WARNING] Skipping - deserialization_fails_too_many_bytes.json

@lantos1618
Copy link
Author

@mratsim

@mratsim
Copy link
Owner

mratsim commented Mar 14, 2022

Nimble init structure is broken.

Nimble drops src on install which requires all the code to use different resolution paths depending if the package is installed or git cloned. As stated in #111 (comment), I'm not going back to src and using srcDir as long as this is the case. It is especially important for a cryptographic lib, especially with assembly, that test vectors are available upon install to check the installation, as are docs, future examples, benchmarks, ...

Furthermore jsony, stew, gmp are test-only dependencies. It is key that Constantine has no dependencies as the most prolific attack vector right now is supply-chain attacks on Pypi and NPM. Again, this is a nimble limitation that I suggested to solve 4 years ago: nim-lang/nimble#482.

Recent example on supply chain attacks: https://blog.sonarsource.com/securing-developer-tools-package-managers with Pypi refusing to fix the attack vector, leaving Python devs prey to those ...

@mratsim
Copy link
Owner

mratsim commented Sep 18, 2022

This PR is significantly outdated, would probably be easier to restart from scratch so closing.

@mratsim mratsim closed this Sep 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants