https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Bug ID: 2005536 Summary: Review Request: rust-fiat-crypto - Fiat-crypto generated RustFiat-crypto generated Rust Product: Fedora Version: rawhide Status: NEW Component: Package Review Assignee: nobody@fedoraproject.org Reporter: zebob.m@gmail.com QA Contact: extras-qa@fedoraproject.org CC: package-review@lists.fedoraproject.org Target Milestone: --- Classification: Fedora
Spec URL: https://eclipseo.fedorapeople.org/for-review/rust-fiat-crypto.spec SRPM URL: https://eclipseo.fedorapeople.org/for-review/rust-fiat-crypto-0.1.8-1.fc36.s...
Description: Fiat-crypto generated Rust.Fiat-crypto generated Rust.
Fedora Account System Username: eclipseo
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
--- Comment #1 from Robert-André Mauchin 🐧 zebob.m@gmail.com --- Koji scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=75870166
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Robert-André Mauchin 🐧 zebob.m@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |2002464
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2002464 [Bug 2002464] F36FailsToInstall: rust-curve25519-dalek+fiat-crypto-devel, rust-curve25519-dalek+fiat_u32_backend-devel, rust-curve25519-dalek+fiat_u64_backend-devel, rust-curve25519-dalek+packed_simd-devel
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Fabio Valentini decathorpe@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Doc Type|--- |If docs needed, set a value Status|NEW |ASSIGNED CC| |decathorpe@gmail.com Flags| |fedora-review? Assignee|nobody@fedoraproject.org |decathorpe@gmail.com
--- Comment #2 from Fabio Valentini decathorpe@gmail.com --- Three comments before a final review:
- The crate has been updated to version 0.1.11, please update to that version, if possible. - Re-generate the .spec file with rust2rpm 20. - The Summary and description are nonsense, please improve them (preferably submit those improvements upstream, too).
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Fabio Valentini decathorpe@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(zebob.m@gmail.com | |)
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
--- Comment #3 from Robert-André Mauchin 🐧 zebob.m@gmail.com --- New Spec URL: https://eclipseo.fedorapeople.org/for-review/rust-fiat-crypto.spec New SRPM URL: https://eclipseo.fedorapeople.org/for-review/rust-fiat-crypto-0.1.17-1.fc37....
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Robert-André Mauchin 🐧 zebob.m@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(zebob.m@gmail.com |needinfo?(decathorpe@gmail. |) |com)
--- Comment #4 from Robert-André Mauchin 🐧 zebob.m@gmail.com --- (In reply to Fabio Valentini from comment #2)
Three comments before a final review:
- The crate has been updated to version 0.1.11, please update to that
version, if possible.
- Re-generate the .spec file with rust2rpm 20.
- The Summary and description are nonsense, please improve them (preferably
submit those improvements upstream, too).
I've updated the SPEC if you want to have a look.
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
--- Comment #5 from Robert-André Mauchin 🐧 zebob.m@gmail.com --- Koji scratch build: https://koji.fedoraproject.org/koji/taskinfo?taskID=93757768
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Fabio Valentini decathorpe@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |182235 (FE-Legal) Flags|needinfo?(decathorpe@gmail. | |com) |
--- Comment #6 from Fabio Valentini decathorpe@gmail.com --- Package looks good to me, with one exception.
The fiat-crypto crate ships implementations of many elliptic curves, some of which aren't explicitly listed as "permitted in Fedora" here: https://fedoraproject.org/wiki/Legal:ECC
There has been some discussion about whether any elliptic curves are actually still not "good", but we haven't received any definitive resonses from Red Hat legal: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/...
Looks like the curves implemented in fiat-crypto are:
- Curve 25519: listed as OK - p224 / secp224r1: listed as OK - p256 / secp256r1: listed as OK - p384 / secp384r1: listed as OK - p434: not listed as OK; cannot find any documentation or source for this curve - p448 / Curve 448: listed as OK - p521 / secp521r1: listed as OK - secp256k1: listed as OK
Blocking FE-Legal. We need to know whether the p434 curve is OK ...
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=182235 [Bug 182235] Fedora Legal Tracker
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
--- Comment #7 from Fabio Valentini decathorpe@gmail.com --- Also sent to the "legal" mailing list, since in my experience the FE-Legal tracker bug is ignored: https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/...
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
--- Comment #8 from Fabio Valentini decathorpe@gmail.com --- Finally got an actionable response from Red Hat Legal after asking ** a third time **:
https://lists.fedoraproject.org/archives/list/legal@lists.fedoraproject.org/...
The relevant part:
Ok, so ... I'm pretty sure we actually don't *need* the affected code. Would removing all p434 related code from the sources entirely (to be on the safe side), and building the package without support for this curve, be an acceptable solution until the legal status is cleared up?
Yes, that's an acceptable solution in the meantime.
All code related to p434 curve will need to removed from the upstream tarball and the Fedora package can only use a "cleaned" tarball.
https://bugzilla.redhat.com/show_bug.cgi?id=2005536
Fabio Valentini decathorpe@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution|--- |DUPLICATE Last Closed| |2023-06-07 17:12:03
--- Comment #9 from Fabio Valentini decathorpe@gmail.com --- I've submitted a new package for the latest version of the fiat-crypto crate where I've tried to implement this approach. Closing this bug as a duplicate since it has not been updated in the last 6 months.
*** This bug has been marked as a duplicate of bug 2213270 ***
package-review@lists.fedoraproject.org