Hacker News Reader

Comment by thesuperbigfrog | Hacker News Reader

It seems like the easiest answer is to fork the cryptography library:

- current maintainers and those who are on supported architectures can use the Rust implementation. The current maintainers no longer want to maintain the C implementation and that is their prerogative as this article describes.

- new maintainers and those on unsupported architectures can continue to use the C implementation. Not everyone in the current user base (to include some distribution maintainers) is able to use the new Rust implementation at this time, but they still need the library.

It's not ideal, but it seems like the only practical way ahead that meets everyone's needs.

View on HN

> It seems like the easiest answer is to fork the cryptography library

I would suggest that not only isn't the easiest answer, it's not an answer at all. Because...

> new maintainers and those on unsupported architectures can continue to use the C implementation

...there will be no new maintainers. This came up a few times three weeks ago, and so far, a (small!) number of people have hopefully suggested that it would be nice if "someone" volunteered, none of them have actually followed through, and as far as I can tell, interest as only waned since.

There is a high chance that there is no pyca/cryptography users on these niche platforms that Gentoo is trying to support. If there are any, they should pay for support not expect maintainers to support theirs fridge platform.

> support theirs fridge platform.

I love this typo in context of s390!

pyca/cryptography was an indirect dependency of Gentoo's package manager, Portage. Portage is written in Python. So by definition, there were users.

"was", because after this incident, careful review revealed that it isn't necessary, and dependency got removed. So yes, probably no users now.

Speaking of fridge platforms, does LLVM target any PIC ISAs?

If Gentoo doesn't work on fridges, what's up with this:

> The Gentoo/s390 Project works to keep Gentoo the most up to date and fastest s390 distribution available.

That's a declaration of support, and if that's not what they mean, they could list some limitations on their wiki. [1]

A lot of system distributions declare some platforms as supported and others as best effort and still others as probably not working, but you're welcome to try. That's reasonable, of course, but it's nice if you're upfront about it.

[1] https://wiki.gentoo.org/wiki/Project:S390

Then this is up to Gentoo and IBM to support the latest versions on the platform discontinued in 1998!. It is unreasonable to expect pyca/cryptography maintainers to support these platforms that are not even supported by python itself.

sounds great! I look forward to gentoo and IBM stepping up to the plate to maintain support

Reply on news.ycombinator.com