usage in rocket / actix-web is "hard" about a2 HOT 6 CLOSED

Welcome to the cowboy country! Rust async story is moving fast now and expect some changes before Rust2018 this Autumn, at least pinning and async/await.

For the crypto story, ring is quite ergonomic and absolutely the fastest crypto library available. It still uses C and assembly libraries for some of its algorithms, but one by one they're rewriting them to Rust. At some point there might be no ring-sys anymore, but that time is not yet. The best thing now is to keep track of ring versions and follow the upgrade path. At least it's much easier to upgrade to new major versions that it ever was with OpenSSL. A big thanks for @briansmith and everybody doing this work.

Also what we have here... The a2 is using libraries just released to crates.io. We have very stellar performance and reliability with this lib, but I expect even more of these hiccups as you witnessed before the situation settles. At least with Rust you can quite safely just upgrade and let the compiler find the problems for you. Never had any trouble after compilation was successful.

from a2.

YMMD .. i can very much agree on the OpenSSL part. It is just a terrible experience every time something is not quite right (either system installed dependencies [on older systems] or library issues etc.)

after all, what i have here currently is insanely fast [after a few tests against the python approach] and i think i am just heading this way further and find out how this is going. I think i can close this for now because there is really not much to do here i think.

Have a nice day and thank you very much for your help, this really helped!

from a2.

I've had this same issue with Ring and some libraries. It contains some C-code in the ring-asm library that forces the whole project to use the same version.

What you could try is to update cookie, actix-web and heroid to use ring v0.13.0-alpha5, it should be possible with little or no changes. a2 uses rustls for alpn negotiation, so it's a quite hard dependency for this project right now.

Ring is also quite notorious forcing you to update, but they have a reason to keep people with the newest and most secure version.

Please tell me if you face trouble.

from a2.

Cookie did it already in master: rwf2/cookie-rs@8579b4b

Actix is depending on cookie with their sessions feature, so you can either disable it if you don't need it or if you do, upgrade to the master branch of cookie: https://github.com/actix/actix-web/blob/master/Cargo.toml#L37

What I suggest is that you go with the Github versions and try to get updates to cookie-rs and actix-web through so the official versions would use the new ring. Please tell me if you have any trouble!

from a2.

thanks for the fast reply. What i currently did was forking actix-web and changed the dependency of cookie manually this way but i don't really know if that is a good way or not.

what do you think is a good way from now on? Is it reasonable to open a ticket on the actix-web side as well? The problem is, i don't see anyone at fault here but it sure is a problem to a certain degree. Do you think that things like this just "settle" because its hard to justify such a situation for a production environment to be honest – i really like your crate and it feels mature but these dependency quirks let me think ...

EDIT: to be fair in that regard my current approach in python has some weird dependency difficulties with openssl, too – i don't see anyone at fault here, its just unpleasant.

from a2.

briansmith/ring#535

from a2.