When we added Rust to cryptography we originally required a rustc of >=1.45. Through initial feedback we dropped this MSRV to 1.41 to ease the transition. Time, however, marches ever onward. We will need to update it in the future (and in version 38.0 we've announced an increase in MSRV to 1.48). How conservative should we be moving forward?

Some data: Wheels vs sdists

A very large percentage of our users obtain a wheel. Here is the last 30 days of downloads:

Within just the Rust-required versions (35+):

Due to the sheer volume of downloads even a less than 2% sdist rate results in nearly 2 million sdist downloads. It is that <2% (along with distribution packagers) who are potentially affected by choices around our MSRV.

Advantages of conservatism

Users who do not receive a wheel need to install a compatible rustc. With newer version requirements the odds of needing to use rustup rather than the system package manager increase. Ubuntu backports newer rustc, but most other distributions do not. Additionally, users who do compile (and do not use CI systems where newer rust is automatically installed and upgraded over time) will occasionally have their systems break due to an MSRV increase.

Advantages to aggressive upgrades

Some potential features and performance optimizations are gated behind newer rustc versions. For example, support for SSH certificate parsing could be added via ssh-key, except the MSRV is 1.57. Similarly, we've had multiple PRs to our own asn1 crate blocked by MSRV concerns:

• alex/rust-asn1#239 is blocked until 1.51
• alex/rust-asn1#181 merged only after our decision to move to 1.48

I am tentatively in favor of being significantly more aggressive in our MSRV, but Alex and I are both interested in hearing from the community.