General request to loosen dependency versions wherever possible about anoncreds-rs HOT 5 OPEN

I think ed/curve/x25519-dalek had to be locked due to an incompatibility with the RustCrypto crates, but they have recently gotten some new maintainers and releases and we should be able to update now, hopefully. In general I agree with making the dependencies compatible but it can be tricky sometimes.

from anoncreds-rs.

I am not opposed to fixing this, preferably by updating deps like x25519-dalek instead of lowering zeroize in anoncreds-rs. Is this something the vcx team can pick up as it would be a lot easier for you to discover the issues and create pull requests for them. I'd be happy to accept them.

from anoncreds-rs.

Thanks for the reply. Yea agreed that x25519-dalek updating (i.e. to "2") would be the ideal solution.

I've started a thread/PR in indy-utils (which is where i think the root of the immediate issue is), seeking that they loosen their x25519-dalek dependency. As this seems to immediately allow anoncreds, askar and indy-vdr to play nicely together.

However long-term would be for everyone to coordinate a [email protected] upgrade

hyperledger/indy-shared-rs#38

from anoncreds-rs.

@andrewwhitehead — what do you think of this synchronization across the shared components?

from anoncreds-rs.

I have a local branch updating the indy-utils ed25519 support for the 2.0 versions, it's not a huge change. It looks like this would also address a new CVE against the older versions.

I plan to release a new indy-credx patch version with the latest updates (staying on 1.1) before updating to 2.0 in a new minor release. aries-askar is also due for a new release, but I'm not certain if it's desirable to update to the 2.0 versions before that, or wait for the next one.

Given that indy-utils and indy-data-types are both used in indy-credx and indy-vdr currently (and nowhere else), I think it makes sense to merge indy-utils into indy-data-types for the next breaking release. Instead of re-implementing the ed25519 support it would be possible to depend on askar-crypto for this, but that might further complicate the dependency picture (unless it helps to guarantee compatibility?).

from anoncreds-rs.