Migrate backend to rust

[alex]

• Convert ed25519 to Rust #8697
• Convert ed448 to Rust #8705
• Simplify X25519 key loading #8263
• Migrate x448 to Rust #8691
• Migrate DH to Rust #8768
• aead
  • Convert AESGCM AEAD to Rust #9181
  • Migrate ChaCha20Poly1305 AEAD to Rust #9399
  • Migrate AES-CCM to Rust #10279
  • Migrate OCB3 to Rust #9569
  • Convert AESSIV AEAD to Rust #9359
• Convert symmetric ciphers to Rust #9859
• Convert CMAC to Rust #9639
• Port DSA to Rust #8978
• Migrate EC support to Rust #9024
• Convert hashes to Rust #8775
• Convert HMAC to Rust #8781
• Convert Poly1305 to Rust #8788
• Port RSA to rust #9152
• Convert KDFs to Rust #8787
• Convert the remainder of PKCS#12 encryption to Rust #11200
• Migrate PKCS7 backend to Rust #10228

[rozhuk-im]

How to use python staff on platforms without rust support?

[alex]

Cryptography has required rust for more than 2 years. This issue does not change that, it merely uses rust for an additional area of functionality.

To use cryptography on a platform without rust support, you'll need to add rust support for that platform.

[rozhuk-im]

Who will pay for adding rust to new platforms?

[alex]

All the developers of PyCA/cryptography are volunteers, we're not being paid for our work here. Perhaps you'd like to ask the commercial vendors for these platforms to sponsor Rust/LLVM platform support.

…

On Wed, Nov 15, 2023, 11:17 AM rim ***@***.***> wrote: Who will pay for adding rust to new platforms? — Reply to this email directly, view it on GitHub <#8770 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBFATJZBOADL4K75EV3YETTIHAVCNFSM6AAAAAAXGKPNP2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJSHA2DCNRZGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[rozhuk-im]

Ok, I see.
Project without moderation, responsibility and plans.
Since this is one of base python packet that widely used, all python products may be broken in any time on any platform.
This is bad for business and for users.

I will avoid python based projects and will recommend to avoid for other peoples.

[alex]

I'm not going to engage further, except to note that our adoption of rust was extensively documented and communicated more than 2 years ago. It was also widely debated. You've now dropped into what amounts to a random issue and complain to us, presumably because your commercial vendor has not invested in platform support.

…

On Wed, Nov 15, 2023, 12:10 PM rim ***@***.***> wrote: Ok, I see. Project without moderation, responsibility and plans. Since this is one of base python packet that widely used, all python products may be broken in any time on any platform. This is bad for business and for users. I will avoid python based projects and will recommend to avoid for other peoples. — Reply to this email directly, view it on GitHub <#8770 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBD4WVVT3AO4ZQZYYP3YETZQ5AVCNFSM6AAAAAAXGKPNP2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJSHEZTIMRUGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[rozhuk-im]

Using rust was wrong way, that reduce supported platforms count and increase support costs for whole industry.

After this project get rusted - I spend to many time with outdated or broken py-cryptography package @ FreeBSD.
I do avoid projects that create problems instead of solve them.
Python ecosystem have a lot show stopper problems and this is +1.

If you want to speak about investing to some platform you should have business plan/commercial offer.

[alex]

freebsd is supported by rust upstream

…

On Wed, Nov 15, 2023, 3:35 PM rim ***@***.***> wrote: Using rust was wrong way, that reduce supported platforms count and increase support costs for whole industry. After this project get rusted - I spend to many time with outdated or broken py-cryptography package @ FreeBSD. I do avoid projects that create problems instead of solve them. Python ecosystem have a lot show stopper problems and this is +1. If you want to speak about investing to some platform you should have business plan/commercial offer. — Reply to this email directly, view it on GitHub <#8770 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBGQLFYWTLV4EOQHYX3YEURSHAVCNFSM6AAAAAAXGKPNP2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMJTGIZDEOJUGM> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[rozhuk-im]

Good luck with rust on non amd64 h/w.

[alex]

We actively ship this package for arm64 (for Linux and macOS). Rust declares support (at various tiers) for FreeBSD with x86-64, x86, arm64, arm32, ppc64, powerpc, and riscv. What platform are you concerned for?

[rozhuk-im]

Using wget | sh to install rust looks like ugly joke.
Build rust outside amd64 takes a lot of time, require some skills and h/w with enough resources.

Python packages - another one strange idea, since it depend on OpenSSL specific version, that may be differ or LibreSSL may be as default xSSL lib.

If you want more details, feel free to read: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=254853

[alex]

I've read the issue. It was not as illuminating as I'd hoped.

As best I can tell, the current state is that FreeBSD has successfully upgraded their version of pyca/cryptography, and have it working on multiple architectures (I see x86-64, arm64, and armv7 mentioned at a minimum).

There appears to be an issue with building rust under qemu, though I'm unclear of what the cause is, and it appears that building under qemu is no longer the officially supported way to build ports.

Many of the recent comments appear to be dealing with the pain of the OpenSSL 3 migration, which is entirely orthogonal to rust. We also heartily agree that the OpenSSL 3 migration has been very painful. I do not understand your comment about LibreSSL, we support it, numerous versions of OpenSSL, and BoringSSL out out the box: https://cryptography.io/en/latest/installation/#supported-platforms

If you have a specific issue, we're happy to hear it. But at this point your comments have been extremely unproductive, to say nothing of rude.

[mzary]

Rust while attracting, is troublesome, at least for some platforms. Moreover, triggering the Rust build to update only one Python module is overkill and contributes to global warming. Could you let me know if you're aware of that? Green computing is as important as security nowadays. I have submitted a PR on FreeBSD Bugzilla to raise attention to this problem. https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=276105