Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bumps shadow-rs to 1.0.1 and adjust build.rs #731

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ssolit
Copy link

@ssolit ssolit commented Mar 3, 2025

Hello, this bumps the version of the shadow-rs dependency, as the old one triggers security warnings from dependabot.

@ssolit ssolit requested a review from a team as a code owner March 3, 2025 04:24
@fitzthum
Copy link
Member

fitzthum commented Mar 3, 2025

Looks like you're using a newer version of Rust locally, which causes some problems with the Cargo.lock.

Can you try rustup override set 1.80.0 (assuming you use rustup) and build again.

You may need to set a few dependencies with cargo update foo@bar --precise baz

Sorry for the inconvenience but we are trying to avoid constantly bumping the MSRV.

@ssolit
Copy link
Author

ssolit commented Mar 3, 2025

It looks like the version of shadow-rs being introduced has a chain of dependencies (tz-rs @ 0.7+, tzdb @ 0.7+, and tzdb_data @ 0.2.1) that require at least Rust 1.81.0.

I tried to update them with

cargo update -p [email protected] --precise 0.6.14
cargo update -p [email protected] --precise 0.5.10
cargo update -p [email protected] --precise 0.6.1
cargo update -p [email protected] --precise 0.1.4

and get errors like

failed to select a version for the requirement `tz-rs = "^0.7.0"`
candidate versions found which didn't match: 0.6.14
location searched: crates.io index
required by package `tzdb v0.7.2`
    ... which satisfies dependency `tzdb = "^0.7.2"` (locked to 0.7.2) of package `shadow-rs v1.0.1`
    ... which satisfies dependency `shadow-rs = "^1.0.1"` (locked to 1.0.1) of package `attestation-service v0.1.0 (/home/azureuser/coco/ssolit_trustee/attestation-service)`
    ... which satisfies path dependency `attestation-service` (locked to 0.1.0) of package `integration-tests v0.1.0 (/home/azureuser/coco/ssolit_trustee/integration-tests)`

This might be blocked until the MSRV is bumped from 1.80 to 1.81

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants