The crate 'ring': "We don't recommend that third parties depend upon it.": 1023 reverse dependencies of ring
I don't really know what to make of this. I'm new to rust and this leaves me somewhat confused.
Today I was looking for how to handle column based data structures and looked into some crate (elusion).
As always I check how well it's integrated into the ecosystem and how potentially problematic its supply chain may be.
So when looking at its dependencies I see: "ring, experimental".
This worries me.
I then check out ring, and look at its reverse dependencies, i.e. how big is the incentive to keep the crate alive.
1023 reverse dependencies of ring!
This is what the readme of ring has to say:
Most of the C and assembly language code in ring comes from BoringSSL. BoringSSL is a fork of OpenSSL. This quote from the BoringSSL README.md discouraging you from using it applies to this project:
BoringSSL is a fork of OpenSSL that is designed to meet Google's needs.
Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it.
This project was originally shared on GitHub in 2015 as an experiment. It was put on crates.io shortly to help other people with their experiments. It is an experiment.