Repository navigation
Clarification on backport of pyelliptic requested + external dependency unbundling #886
Description
As I work for a GNU system which unbundles where possible, I'd like to get some more
clarification on the backporting of pyelliptic you do. Can you explain your changes or point
out in the code which changes are made?
At your choice, could you even move the external dependencies
into git-submodules (other repositories) so it can be up to package
maintainers to pull them in?
This would improve the work of us package maintainers in cutting down the lines of code, especially for package systems like GNU Guix or systems like Gentoo.
https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies
http://dustycloud.org/misc/talks/guix/chicagolug_2015/guix_talk.html (could include reasons and understanding, there are very likely more insights in https://www.gnu.org/software/guix/help/#papers and https://www.gnu.org/software/guix/help/#talks (same page))
Activity
PeterSurda commentedon Jul 16, 2016
I don't know what the difference is, you'd have to diff it yourself. You could contact Atheros and ask him.
bmng-dev commentedon Jul 17, 2016
Newer versions of PyElliptic break the Bitmessage protocol. Bitmessage still uses ECDSA-with-SHA1 signatures and length prefixed coordinate representation for ephemeral public keys while recent versions of PyElliptic only use ECDSA-with-SHA2 signatures and uncompressed point compression form representation for ephemeral public keys. The bundled PyElliptic has an improved OpenSSL library locator.
The bundled Socksipy has been modified to support Tor's SOCKS Extensions.
rekado commentedon Jul 17, 2016
Do you plan to send your improvements to the respective upstream projects?
bmng-dev commentedon Jul 19, 2016
Me personally? No, I didn't make the modifications.
PeterSurda commentedon Jul 19, 2016
I modified the socksipy, I added support for the RESOLVE extension used by Tor. This is used for improving bootstrapping. I can try to push it upstream.
PyElliptic was probably modified by Atheros (I wasn't involved in the development at that time so I don't know).
PeterSurda commentedon Feb 26, 2017
Also recently me and one other developer modified the bundled pyelliptic to support OpenSSL 1.1.x and LibreSSL (the old code does support LibreSSL, but if you want to add OpenSSL 1.1.x support you also have to distinguish between OpenSSL and LibreSSL). I'll see if it can be pushed upstream, but it's not a high priority and the upstream seems abandoned.
I'll refactor socksify into an asyncore class in the future, so the socksipy dependecy can be removed altogether.
g1itch commentedon Mar 2, 2017
Concerning
socksocket.resolve()there is an issue in the upstream PySocks project. I think you can cooperate.Downgrade OpenSSL version