Please eliminate the crypto-aes dependency (probably by moving to cryptonite)

[jmazon]

For whatever reason (GHC upgrade?), crypto-aes has become incompatible with my CPU. As the package has been self-advertising as deprecated for years, it's probably not reasonable to patch it.

There are at least two PRs (#32, #36) to address this. Could we please get back to the conversation and move forward?

(Disclaimer: I'm the author of #36. I hadn't noticed the other one. Which, FWIW, now has conflicts. I don't care which one is chosen, or if we have to write yet another one with SystemDRG instead. Let's please just get this fixed.)

FWIW I've come to patch this because it breaks hledger-web. Other yesod apps probably impacted as well.

[simonmichael]

I just found this while working on hledger-web GHC 9.6 compatibility. FWIW it looks as if clientsession's dependencies cprng-aes and crypto-random both fail to build with GHC 9.6, and both were last updated 8/9 years ago. So, +1 for moving off these.

[simonmichael]

Ping

[andreasabel]

Ping @snoyberg @meteficha : Looks like there is action required now to keep this package alive. What are your maintainer intentions with this package?

[snoyberg]

I'm sorry I missed #36, but that PR is no longer a good option. cryptonite is no longer maintained either. Moving to crypton would in theory be acceptable. Keeping compat with existing encryption formats would be nice, but not strictly necessary.

[avanov]

@snoyberg to reliably move to crypton the entire infrastructure of cryptonite's dependent packages has to move too, namely cryptonite-conduit, which is a tall order, whilst just merging #36 provides the immediate incremental improvement over the current package version with crypto-aes. The fix for cryptonite that required the crypton fork doesn't affect the functionality of this package and just using the currentcryptonite for a time being is a viable option for production code that shares the same package across many other libraries.

[snoyberg]

Fair point. OK, let's move ahead with this. I'll look it over now.

[snoyberg]

I've merged the PR. I'm out of the house right now, I'll release once I'm back home.

[avanov]

Thank you!

[snoyberg]

clientsession-0.9.2.0 is now on Hackage.

[ysangkok]

@avanov crypton-conduit now exists, so I think it would make sense to do the move now, given

• deprecating cryptonite commercialhaskell/stackage#7474

What do you think?

[avanov]

@ysangkok I support the move as long as the respective encoders and decoders are b/w compatible with the previous implementation at the level of serialized values.