Add "redwood" Sequoia Rust/Python bridge #6828
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
legoktm
force-pushed
the
rust-redwood
branch
2 times, most recently
from
42f4fe8 to
5d5708c
Compare
cfm
requested changes
Jun 6, 2023
There was a problem hiding this comment.
Test plan checks out! Please take (or leave :-) the inline comments in the spirit of an initial read-through.
I'll review #6832 tomorrow, which will let you rebase this from develop along with any changes you make in response to the review.
legoktm
force-pushed
the
rust-redwood
branch
3 times, most recently
from
ba97ac1 to
de44480
Compare
Sequoia is a modern PGP library written in Rust that we're going to switch SecureDrop over to using instead of gpg/pretty_bad_protocol for our encryption/decryption needs. The overall transition has been explored and discussed in #6399 and <https://github.com/freedomofpress/securedrop-engineering/blob/main/proposals/approved/sequoia-server.md>. This adds the Rust code we will compile into a Python wheel, named "redwood", to call into the Sequoia library. Four functions are exposed: * generate_source_key_pair * encrypt_message * encrypt_file * decrypt The functions are rather self-explanatory and Python type stubs are provided as well. The `rust-toolchain.toml` file instructs rustup to use Rust 1.69.0 (current latest version), we'll figure out a toolchain upgrade cadence later on. It should now be possible to build a redwood wheel: $ maturin build -m redwood/Cargo.toml
These lint and test solely the Rust code (no Python). The following tools are enabled: * rustfmt: code formatting (like black) * clippy: linting (like flake8+pylint+mypy) * cargo test: Rust test suite Running maturin to verify the Python integration will happen in the next commit, when it's hooked into the development environment. Refs #6814.
We need to compile Rust code before we can launch the development environment and run tests. Add a build_redwood step to `securedrop/bin/dev-deps` that uses maturin to build a wheel and install it into the securedrop-app-code virtualenv. maturin is only needed at build time, so it is pinned in a new `build-requirements.txt` Fixes #6814. Fixes #6816.
|
Rebased! |
|
Oh actually, I'm wondering if we need to do a diff review for maturin now? Like, it's mostly Rust but there is a bit of Python in it that I assume we should peek at? |
|
But also it's kind of useless to review the Python parts without the Rust parts, so I'm also ok with deferring it to #6500, with that being a blocker for actual usage of the code. |
13 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Status
Ready for review, but depends on #6832
Description of Changes
See individual commit messages.
Refs #6814.
Fixes #6814.
Fixes #6816.
Testing
How should the reviewer test this PR?
make dev) worksDeployment
Any special considerations for deployment? This PR merely introduces Rust code and builds it for the development environment, it should have no impact on staging/prod installs yet.
Checklist
make lint) and tests (make test) pass in the development containerIf you added or updated a production code dependency:
Since this includes Rust code, we're going to defer the review to #6500.