Clarification on backport of pyelliptic requested + external dependency unbundling

As I work for a GNU system which unbundles where possible, I'd like to get some more
clarification on the backporting of pyelliptic you do. Can you explain your changes or point
out in the code which changes are made?

At your choice, could you even move the external dependencies
into git-submodules (other repositories) so it can be up to package
maintainers to pull them in?

This would improve the work of us package maintainers in cutting down the lines of code, especially for package systems like GNU Guix or systems like Gentoo.
https://wiki.gentoo.org/wiki/Why_not_bundle_dependencies
http://dustycloud.org/misc/talks/guix/chicagolug_2015/guix_talk.html (could include reasons and understanding, there are very likely more insights in https://www.gnu.org/software/guix/help/#papers and https://www.gnu.org/software/guix/help/#talks (same page))

[PeterSurda]

I don't know what the difference is, you'd have to diff it yourself. You could contact Atheros and ask him.

Thanks for the reply, Peter. I'll just CC @Atheros1 here as I find the github bugtracker not ideal.

But, this is not the only purpose of this issue, the second being bundled dependencies.

[bmng-dev]

Newer versions of PyElliptic break the Bitmessage protocol. Bitmessage still uses ECDSA-with-SHA1 signatures and length prefixed coordinate representation for ephemeral public keys while recent versions of PyElliptic only use ECDSA-with-SHA2 signatures and uncompressed point compression form representation for ephemeral public keys. The bundled PyElliptic has an improved OpenSSL library locator.

The bundled Socksipy has been modified to support Tor's SOCKS Extensions.

[rekado]

Do you plan to send your improvements to the respective upstream projects?

[bmng-dev]

Me personally? No, I didn't make the modifications.

[PeterSurda]

I modified the socksipy, I added support for the RESOLVE extension used by Tor. This is used for improving bootstrapping. I can try to push it upstream.

PyElliptic was probably modified by Atheros (I wasn't involved in the development at that time so I don't know).

[PeterSurda]

Also recently me and one other developer modified the bundled pyelliptic to support OpenSSL 1.1.x and LibreSSL (the old code does support LibreSSL, but if you want to add OpenSSL 1.1.x support you also have to distinguish between OpenSSL and LibreSSL). I'll see if it can be pushed upstream, but it's not a high priority and the upstream seems abandoned.

I'll refactor socksify into an asyncore class in the future, so the socksipy dependecy can be removed altogether.

[g1itch]

Concerning socksocket.resolve() there is an issue in the upstream PySocks project. I think you can cooperate.