unresolved import `argon2::password_hash::rand_core::OsRng`

[GamerBene19]

The example from the docs contains the following:

use argon2::{
    password_hash::{
        rand_core::OsRng,
        ....
    },
    ...
};

...
let salt = SaltString::generate(&mut OsRng);
...

If I create a new Cargo project with cargo init and add argon2 crate via cargo add argon2 I get these errors:

[~/Development/argon2-mre] <> * cargo run
   Compiling argon2-mre v0.1.0 (/home/benedikt/Development/argon2-mre)
error[E0432]: unresolved import `argon2::password_hash::rand_core::OsRng`
  --> src/main.rs:3:81
   |
 3 |     password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString, rand_core::OsRng},
   |                                                                                 ^^^^^^^^^^^^^^^^ no `OsRng` in the root
   |
note: found an item that was configured out
  --> /home/benedikt/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_core-0.6.4/src/lib.rs:49:43
   |
49 | #[cfg(feature = "getrandom")] pub use os::OsRng;
   |       ---------------------               ^^^^^
   |       |
   |       the item is gated behind the `getrandom` feature

For more information about this error, try `rustc --explain E0432`.
error: could not compile `argon2-mre` (bin "argon2-mre") due to 1 previous error
[~/Development/argon2-mre] <> *

The issue seems to be that rand_core only provides OsRng with the getrandom feature which argon2 does not enable/pass on.

I can resolve the issue if I manually add the dependency to rand_core's getrandom feature with

rand_core = { version = "0.6", features = ["getrandom"] }

I have created a repo with a MRE of the bug and fix (second commit): https://github.com/GamerBene19/argon2-mre to debug.

However I am unsure if this is the intended approach to fix this issue. Perhaps using OsRng from somewhere else would be preferred? Advice would be greatly appreciated!

[tarcieri]

We're about to put out another breaking set of crate releases which will upgrade rand_core (to, in fact, a version that hasn't been released yet) and the state of OsRng is in flux. Exactly how that plays out will impact what we do in argon2, but we'll find a solution for it.

[IgnisDa]

Hi @tarcieri, any updates on this?

[tarcieri]

We've delayed the releases so we can ship with rand_core v0.10. You can follow along with upstream progress here:

https://github.com/RustCrypto/traits/issues/1571

Note that there will be no OsRng in the next set of releases.