Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Retro compatible for p256 0.10.0 #3598

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

rodoufu
Copy link

@rodoufu rodoufu commented Apr 23, 2024

Motivation and Context

Keeping it retro compatible with solana-sdk 1.16

Description

Updating p256 version from 0.11 to 0.10 will still allow version 0.11 but will include 0.10 which is necessary when building something that includes solana-sdk version 1.16.

p256 0.11 has another version of zeroize which is incompatible

How to reproduce the issue.

Create a project with this Cargo.toml:

[package]
name = "test_aws"
version = "0.1.0"
edition = "2021"

[dependencies]
solana-sdk = "1.16.27"
aws-sigv4 = { version = "1.2.1", features = ["sigv4a"] }

Then run this:

cargo test --all-features
    Updating crates.io index
error: failed to select a version for `zeroize`.
    ... required by package `curve25519-dalek v3.2.1`
    ... which satisfies dependency `curve25519-dalek = "^3.2.1"` of package `solana-program v1.16.27`
    ... which satisfies dependency `solana-program = "=1.16.27"` of package `solana-sdk v1.16.27`
    ... which satisfies dependency `solana-sdk = "^1.16.27"` of package `test_aws v0.1.0 (/Users/rodolfo-araujo/git/test_aws)`
versions that meet the requirements `>=1, <1.4` are: 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.0

all possible versions conflict with previously selected packages.

  previously selected package `zeroize v1.5.3`
    ... which satisfies dependency `zeroize = "^1"` of package `aws-sigv4 v1.2.1`
    ... which satisfies dependency `aws-sigv4 = "^1.2.1"` of package `test_aws v0.1.0 (/Users/rodolfo-araujo/git/test_aws)`

failed to select a version for `zeroize` which could resolve this conflic

@rodoufu rodoufu requested a review from a team as a code owner April 23, 2024 19:40
@jdisanti
Copy link
Collaborator

Hello. Can you explain the problem some more? I don't really understand. If the conflict is between zeroize ^1 and zeroize ^1.5, it should just work. ^1 is compatible with ^1.5, so it would just choose ^1.5.

@rodoufu
Copy link
Author

rodoufu commented Apr 24, 2024

Hello. Can you explain the problem some more? I don't really understand. If the conflict is between zeroize ^1 and zeroize ^1.5, it should just work. ^1 is compatible with ^1.5, so it would just choose ^1.5.

@jdisanti I'm sorry, I had it wrong in the description the first time I sent it.
I have fixed the description.

When I created it initially I got the wrong version of curve25519-dalek, the version that cargo is resolving is actually 3.2.1 which requires zeroize >=1, <1.4 but p256 0.11 requires zeroize ^1.5, that is the conflict.

I've also added a simple example of how to reproduce it with only a simple Cargo.toml file.

@ysaito1001
Copy link
Contributor

Instead of downgrading p256 used by aws-sigv4 to 0.10.0, is it possible to ask the maintainers for solana-sdk to upgrade their dependency on curve25519-dalek (the latest of which, 4.1.2, does not have semver upper bound < 1.4 on zeroize)? You can then use the upgraded solana-sdk.

@rodoufu
Copy link
Author

rodoufu commented Apr 24, 2024

Instead of downgrading p256 used by aws-sigv4 to 0.10.0, is it possible to ask the maintainers for solana-sdk to upgrade their dependency on curve25519-dalek (the latest of which, 4.1.2, does not have semver upper bound < 1.4 on zeroize)? You can then use the upgraded solana-sdk.

@ysaito1001 updating curve25519-dalek to 4.1.2 breaks a lot of stuff in solana-sdk. I'm guessing that is why they are still using 3.2.1 in their latest version https://crates.io/crates/solana-sdk/1.18.11/dependencies
I've been trying to open an MR with them as well, with the smaller impact as I can.

@rodoufu
Copy link
Author

rodoufu commented Apr 26, 2024

@ysaito1001 to update solana one would also need to update its version of rand to 0.8 on jsonrpc from Parity for which I have an open PR as well paritytech/jsonrpc#688

Also, the change I added should not necessarily downgrade p256 0.11 to p256 0.10, but it will accept it when it is possible, it is just less restrictive.

@tarcieri
Copy link

tarcieri commented Aug 7, 2024

Note: there's a PR to fix Solana here: anza-xyz/agave#2252

I'd also note that the latest release of p256 is v0.13, so aws-sigv4 is a little behind, if anything.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants