python312Packages.hkdf: drop

[pyrox0]

Description of changes

Part of #326513

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[emilazy]

An HKDF implementation is probably one of the less concerning cryptography libraries to not be updated for a decade, but I still don’t feel great about this.

autobahn only requires it (and spake2) optionally for some dead cryptocurrency thing that we should probably drop, but magic-wormhole depends on this through spake2. It looks like magic-wormhole was removed by Fedora along with hkdf and spake2 in favour of the Rust version from the same upstream.

I’m going to ask around about this, but it might be better just to drop this if we find the Rust version of Magic Wormhole to be an acceptable replacement.

[pyrox0]

I’m going to ask around about this, but it might be better just to drop this if we find the Rust version of Magic Wormhole to be an acceptable replacement.

Sounds like a plan, I'll make this into a draft till there's a conclusion on that front.

[emilazy]

After engaging with upstream, it looks like they’re actively maintaining spake2 again; the current unstable version has moved off hkdf to cryptography and also dropped the six dependency. We should probably wait for an official release, but it should be possible to drop hkdf after that.

[emilazy]

The changes to spake2 were merged, but there’s no release yet; I’ve opened warner/python-spake2#20.

[emilazy]

There’s new releases of spake2 and magic-wormhole 🎉

Did you want to handle the bumps and dropping hkdf in this PR, or would you prefer I do it? The xbr optional dependencies of autobahn should definitely be able to go.

[pyrox0]

Working on doing those bumps and dropping the package now.

Edit: seems like the bumps have already been done, just dropped the xbr deps of autobahn and ensuring nothing else breaks when dropping hkdf.

[emilazy]

Any progress on this? I’m holding out hope that we can rush the last few packages in the few days before the 24.11 freeze 😅

[emilazy]

Actually I misread the release schedule and we have until the 25th to finish the job, so don’t feel unduly rushed!

[pyrox0]

Pushed an update, this doesn't evaluate nicely because there's tahoe-lafs build failures, but the exact same check error counts ((skips=14, expectedFailures=1, failures=41, errors=4342, successes=724)) appear by building from the master branch, so I know that this PR does not change that. Should probably investigate fixing or marking that package as broken.

[emilazy]

Thanks for updating this :) An existing build failure is fine and normal; it’ll be dealt with in Zero Hydra Failures before the 24.11 release soon. Is there anything else blocking this or did you want to undraft?

[pyrox0]

Nope, I'll undraft now, I don't see anything else that would be blocking.

[emilazy]

Result of nixpkgs-review pr 330769 run on aarch64-linux 1

4 packages marked as broken and skipped:

• python312Packages.magic-wormhole-mailbox-server
• python312Packages.magic-wormhole-mailbox-server.dist
• python312Packages.magic-wormhole-transit-relay
• python312Packages.magic-wormhole-transit-relay.dist

4 packages failed to build:

• tahoe-lafs
• tahoe-lafs.dist
• tahoe-lafs.doc
• tahoe-lafs.info

42 packages built:

• authentik
• buildbot
• buildbot-full
• buildbot-ui
• buildbot-worker
• buildbot-worker.dist
• buildbot.dist
• gnome-keysign
• gnome-keysign.dist
• magic-wormhole (python312Packages.magic-wormhole)
• magic-wormhole.dist (python312Packages.magic-wormhole.dist)
• paperless-ngx
• python311Packages.autobahn
• python311Packages.autobahn.dist
• python311Packages.channels
• python311Packages.channels-redis
• python311Packages.channels-redis.dist
• python311Packages.channels.dist
• python311Packages.daphne
• python311Packages.daphne.dist
• python311Packages.labgrid
• python311Packages.labgrid.dist
• python311Packages.magic-wormhole
• python311Packages.magic-wormhole-mailbox-server
• python311Packages.magic-wormhole-mailbox-server.dist
• python311Packages.magic-wormhole-transit-relay
• python311Packages.magic-wormhole-transit-relay.dist
• python311Packages.magic-wormhole.dist
• python311Packages.strawberry-graphql
• python311Packages.strawberry-graphql.dist
• python312Packages.autobahn
• python312Packages.autobahn.dist
• python312Packages.channels
• python312Packages.channels-redis
• python312Packages.channels-redis.dist
• python312Packages.channels.dist
• python312Packages.daphne
• python312Packages.daphne.dist
• python312Packages.labgrid
• python312Packages.labgrid.dist
• python312Packages.strawberry-graphql
• python312Packages.strawberry-graphql.dist