On Thu, 5 Mar 2026, Adam Gundry wrote:
On 05/03/2026 05:54, Viktor Dukhovni wrote:
Now it turns out that for maximum portability, `mlkem` in turn has a build flag `use_crypton` that selects either `crypton`, or (current default) the older `cryptonite` library as its dependency. So the dependen graph is:
tls <- mlkem <- if (use_crypton): crypton else: cryptonite
The general principle (albeit one that is not necessarily widely understood or well advertised) is that package APIs should not depend on flag assignments, for precisely the reason you outline:
I think that condition is satisfied here: The API of tls is independent from whether mlkem calls crypton or cryponite. So in principle things should work if `tls` uses `crypton`, and `mlkem` uses `cryptonite`, as Cabal might choose as default.