Should support unbundling liboqs and others about rosenpass HOT 5 CLOSED

libsodium is linked using pkg-config, so there it should be easy to replace it as wished when packaging for a distro. With liboqs, no chance. The liboqs-sys crate does ship its own vendored version of oqs and AFAICT doesn't offer to override the version used. So as I see it, there is nothing we can do from the rosenpass side. Feel free to re-open the issue if you disagree!

from rosenpass.

I do disagree! Maybe this issue should be raised with the liboqs crate instead.

from rosenpass.

Please go for it :) I'm eager to see what they think. I'm with you that it makes sense to allow the packagers to choose how deps are satisfied, however for a young project (with potential API & ABI breakage) it might make sense that the bindings they ship come with exactly one specific version of the respective C code. That surely avoids all different weird kind of bugs.

from rosenpass.

I'm more interested in avoiding the bug where there's a CVE we patched in the liboqs port but not in your project because you bundle your own static copy.

from rosenpass.

See this bug report: open-quantum-safe/liboqs-rust#190

from rosenpass.