zksync-era
zksync-era copied to clipboard
matter-labs
Unable to vendor crates
Using current commit 6d540100aeb3fa237cb23b2f1168d82f9d8e1930:
❯ cargo vendor
error: failed to sync
Caused by:
found duplicate version of package `bellman_ce v0.3.2` vendored from two sources:
source 1: https://github.com/matter-labs/bellman?branch=dev#5520aa22
source 2: https://github.com/matter-labs/bellman?branch=snark-wrapper#e01e5fa0
Also cargo tree -d finds a lot of duplicate dependencies.
The whole dependency chain is a mess... packages are referred to with the same version and name but with a different git branch.
Ideally you could cargo vendor the repo to get a reproducible set of dependencies for a reproducible build.
Recommendation: change the package name to ${orig}-${branchname} in the repos in question, or change the version.
source = "git+https://github.com/matter-labs/franklin-crypto?branch=dev#5695d07c7bc604c2c39a27712ffac171d39ee1ed"
source = "git+https://github.com/matter-labs/franklin-crypto?branch=snark_wrapper#2546c63b91b59bdb0ad342d26f03fb57477550b2"
source = "git+https://github.com/matter-labs/bellman?branch=dev#5520aa2274afe73d281373c92b007a2ecdebfbea"
source = "git+https://github.com/matter-labs/bellman?branch=snark-wrapper#e01e5fa08a97a113e76ec8a69d06fe6cc2c82d17"
I'll file a bug against these repos.
Found a PR, which enables cargo vendor --no-merge-sources , which solves the problem... https://github.com/rust-lang/cargo/pull/13271
Hello! We are planning to get rid of git dependencies and publish everything on crates.io.
With that, the problem should be resolved.
Hello! We are planning to get rid of
gitdependencies and publish everything oncrates.io. With that, the problem should be resolved.
That would be the best solution ever :partying_face:
The background here is that when the crypto team uses 1.4.1, that means protocol version 1.4.1. So pretty much as far from semver as you can be. The crates.io will at least force publishing different versions but we might consider enforcing semver.
We will use a separate, semver-compliant versioning scheme for crates (e.g. let's say that 1.4.1 represents a "protocol" version, but all the crates will live in 0.x.y domain).
Folks, should we close this issue, given there's a plan or we find value keeping it around?
