some weird dependency issues

[rkuhn]

Since the addition of libp2p-webrtc I’ve been seeing cargo complaints that seem weird to me, like this one:

error: failed to select a version for `zeroize`.
    ... required by package `der v0.6.0`
    ... which satisfies dependency `der = "^0.6"` of package `elliptic-curve v0.12.3`
    ... which satisfies dependency `elliptic-curve = "^0.12.1"` of package `p256 v0.11.1`
    ... which satisfies dependency `p256 = "^0.11.1"` of package `webrtc-dtls v0.7.0`
    ... which satisfies dependency `dtls = "^0.7.0"` of package `webrtc v0.6.0`
    ... which satisfies dependency `webrtc = "^0.6.0"` of package `libp2p-webrtc v0.4.0-alpha`
    ... which satisfies dependency `libp2p-webrtc = "^0.4.0-alpha"` of package `libp2p v0.50.0`
    ... which satisfies dependency `libp2p = "^0.50.0"` of package `ax v0.1.0 (/home/rkuhn/comp/Actyx/rust/actyx/ax)`
    ... which satisfies path dependency `ax` (locked to 0.1.0) of package `node-manager-bindings v0.1.0 (/home/rkuhn/comp/Actyx/rust/actyx/node-manager-bindings)`
versions that meet the requirements `^1.5` are: 1.5.7, 1.5.6, 1.5.5, 1.5.4, 1.5.3

all possible versions conflict with previously selected packages.

  previously selected package `zeroize v1.3.0`
    ... which satisfies dependency `zeroize = "=1.3"` of package `x25519-dalek v1.2.0`
    ... which satisfies dependency `x25519-dalek = "^1.2.0"` of package `crypto v0.1.0 (/home/rkuhn/comp/Actyx/rust/actyx/crypto)`
...

The weird part is that I don’t enable webrtc:

libp2p = { version = "0.50.0", default-features = false, features = ["tokio", "tcp", "dns", "noise", "request-response"] }

Perhaps this is just a normal behaviour of cargo, but perhaps someone here also knows better or knows what to do about it.

---

The somewhat unfortunate part related to the above is: elliptic-curve is incompatible with x25519-dalek (which seems unmaintained for now) for the above reason, so bringing it on board should keep this in mind. I was lucky because I could remove my usage without much pain, so I’m not blocked on this.

[thomaseizinger]

1. The "dalek-crypto" org just got a new maintainer: See ed25519-dalek PK Oracle rustsec/advisory-db#1360.

2. Can this problem be fixed with a cargo update?

[rkuhn]

1. yay!
2. no, since there is no version of x25519-dalek that permits zeroize newer than 1.3.x.

The second point makes me wonder why =1.3 dependency syntax even exists, since it clearly breaks the ecosystem.

[thomaseizinger]

I wonder if der actually needs zeroize v1.5 or whether that was just selected as the version that happened to be released at the time but it would actually work with an earlier version too.