Remove byteorder dependency

[psychon]

Hi,

I was asked to rebase zip-rs/zip-old#390 against this repository. Here is the result.

What follows is the description of my original PR to what is now called zip-old (well, I removed some outdated parts).

Note that CI will still fail, because:

error[E0433]: failed to resolve: use of undeclared crate or module `bzip2`
Error:   --> src/read.rs:31:5
   |
31 | use bzip2::read::BzDecoder;
   |     ^^^^^ use of undeclared crate or module `bzip2`

I'll leave that one to you. I think I did not cause this.

---

Hi,

I came across the use of "byteorder" in this crate and thought "one does not really need byteorder for this". Feel free to disagree and to just close this PR.

Since there are many uses of "byteorder", I tried to do this in small parts and do a commit for each one. Hopefully this makes it easier to understand what is going on. Dunno.

[Pr0methean]

Please sign your commit.

[psychon]

What do you mean? As far as I can tell, all of them have a Signed-off-by line.

[Pr0methean]

They don't have a "Verified" badge. See these guides:

1. https://docs.github.com/en/authentication/managing-commit-signature-verification/generating-a-new-gpg-key
2. https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-gpg-key-to-your-github-account
3. https://docs.github.com/en/authentication/managing-commit-signature-verification/associating-an-email-with-your-gpg-key
4. https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits

[psychon]

Uhm... why? What's the point?

I don't think I want to jump through your hoops. And so far I fail to see the point.

[Pr0methean]

The point is so that GitHub can assure users that commits were actually written by the person they say they were written by. Git lets you put anyone's name and email on a commit. Following the xz backdoor, I expect infosec managers to demand it on all libraries as widely used as this one.

[psychon]

So how exactly does signed commits prevent Jia Tan to create a github account and a GPG key in their name?

The point is so that GitHub can assure users that commits were actually written by the person they say they were written by.

What exactly does "person" here refer to? To you, I am just a random person on the internet with a github account. If I now create a GPG key for "Socket puppet" and add it to my GitHub account, then I am still a random person on the internet. Just with a github account and a GPG key instead of just a github account.

I expect infosec managers to demand it on all libraries as widely used as this one.

No idea what an infosec manager is. And Google doesn't know either.

When I meet an infosec manager, I'll ask them what the point to this security theatre is.

[Pr0methean]

So how exactly does signed commits prevent Jia Tan to create a github account and a GPG key in their name?

You have to open a confirmation email to show that you control the address on the GPG key, if you haven't done so already to use other account features. It also makes you refresh your 2FA, so that compromising the GitHub account wouldn't be a trivial workaround.

[psychon]

So... at that point, GitHub knows that I have a mail address. GitHub already knew that before, because I managed to register. Sure, that mail address is not public and now it would be public knowledge that GitHub verified my mail address.

Since you brought up XZ: Jia Tan got maintainer access by helping via mail off-list. So... somehow they managed to overcome an even bigger hurdle than "receive a mail once". And still that didn't stop them.

It also makes you refresh your 2FA,

Okay, I clicked your links. None of them mention anything about 2FA. So I guess nothing in there actually forces me to setup 2FA.

Edit: One more data point: When I open the GitHub web interface and press "edit" to create a change via the web interface, the resulting commit is signed and shows up as verified. And that without any 2FA. This is just security theatre.

Sadly, I cannot use that hack to open a PR since GitHub always uses zip-old as the base commit.