Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use zeroize 1 or newer #89

Closed
wants to merge 1 commit into from
Closed

Conversation

A6GibKm
Copy link

@A6GibKm A6GibKm commented May 30, 2022

Version =1.3 was set so the library builds on older rust versions. But
this won't allow to build the library if some other dependency
requires a newer version.

See https://gitlab.gnome.org/GNOME/fractal/-/issues/1016#note_1442659

Version =1.3 was set so the library builds on older rust versions. But
this won't allow to build the library if some other dependency
requires a newer version.

See https://gitlab.gnome.org/GNOME/fractal/-/issues/1016#note_1442659
@honzasp
Copy link

honzasp commented Jun 18, 2022

For other people who hit the same issue, a workaround is to use version 1.1 of this crate.

@jplatte
Copy link

jplatte commented Jun 24, 2022

This has already been done on the release/2.0 branch, I don't think it makes sense to have another PR for the same thing on main, it seems very unlikely to be merged.

@gferon
Copy link

gferon commented Sep 29, 2022

Is there a way we could get this merged in the 1.2.x branch with a new release on crates.io? As pointed out previously, this prevents building x25519-dalek with other crates that require a more recent version of zeroize and I guess the problem is only going to get worse over time.

@jakehemmerle
Copy link

Using the release/2.0 branch as a dep worked for me, but this still needs an update otherwise other crates can't depend on this.

@tarcieri
Copy link
Contributor

tarcieri commented Nov 5, 2022

Another breaking release of x25519-dalek relies on a forthcoming v4.0 release of curve25519-dalek: dalek-cryptography/curve25519-dalek#405

That said the fix is already on the release branch, so as @jplatte noted earlier this PR is superfluous.

@tarcieri tarcieri closed this Nov 5, 2022
@piegamesde
Copy link

Can this please be backported to 1.2 nevertheless? The restriction is blocking me from updating security related dependencies. It's not only about having to wait for v2.0 being released, since that's semver-breaking I'll also have to wait until all intermediary dependencies using it have updated.

This is a pretty bad situation given that the only downside of the fix I can see is "bumps the MSRV" (correct me if I'm wrong).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants