CBOR library choice

[btoews]

Thanks for working on a Ruby WebAuthn implementation. A well supported library will hopefully spur adoption for the many Ruby apps out there today.

I'm curious why you've chosen to use the msgpack based CBOR implementation instead of the libcbor implementation. Knowing very little about either, it seems like libcbor would be preferable. It seems like the msgpack implementation will be difficult to maintain as updates and security fixes are made to the upstream msgpack code. The cbor-ruby Gem has seen virtually no changes since 2016 while the msgpack-ruby Gem is under active development. This seems concerning. In comparison, the libcbor codebase seems more active and easier to maintain.

As I said, I know very little about either project, so the msgpack one might be way better. I'm mostly curious about the thinking behind your choice.

[grzuy]

I'm curious why you've chosen to use the msgpack based CBOR implementation instead of the libcbor implementation.

"Pure ruby" cbor-ruby means we don't require any system library as a pre-requisite, meaning faster setup/ramp-up, which we value especially at this very early development phase.

Knowing very little about either, it seems like libcbor would be preferable. It seems like the msgpack implementation will be difficult to maintain as updates and security fixes are made to the upstream msgpack code.

I agree. Good point.
In the long run we should use libcbor.

I'm mostly curious about the thinking behind your choice.

Sure.
Thank you very much @mastahyeti for opening the issue and raising your concern!

[grzuy]

After making repeated efforts to move to libcbor gem in the last year and having faced several bugs and issues blocking us from migrating, I am considering cbor good enough for now for our purpose. It kind of just worked and we had no big problems with it so far.

See comment in cedarcode/cose-ruby#43 (comment).

If someone disagrees please let me know :-)

Thanks again @mastahyeti for raising the concern in the first place.