[tor-bugs] #27130 [Core Tor/Tor]: rust dependency updating instructions don't work

[Tor Bug Tracker & Wiki]

#27130: rust dependency updating instructions don't work
-------------------------------------------------+-------------------------
 Reporter:  cyberpunks                           |          Owner:  nickm
     Type:  defect                               |         Status:
                                                 |  accepted
 Priority:  Medium                               |      Milestone:  Tor:
                                                 |  unspecified
Component:  Core Tor/Tor                         |        Version:  Tor:
                                                 |  0.3.3.9
 Severity:  Normal                               |     Resolution:
 Keywords:  rust, doc, 033-unreached-backport,   |  Actual Points:
  042-deferred-20190918                          |
Parent ID:                                       |         Points:
 Reviewer:  nickm                                |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by cypherpunks):

 Replying to [comment:24 nickm]:
 > I agree with 1 and 3; we should discuss 2 as a team.

 So has there been any team discussion of 2 yet?

 > First, cargo now includes "cargo vendor", but it has been updated to no
 longer support the `--explicit-version` flag.  We should investigate why,
 and what to do about it.

 > My next step here is to read up on why --explicit-version is no longer
 supported here, and to start a discussion on what we actually want to do
 about versions.

 What has reading up on this turned up?

 `cargo vendor` was [https://github.com/rust-lang/cargo/pull/6869 merged]
 in [https://blog.rust-lang.org/2019/08/15/Rust-1.37.0.html#built-in-cargo-
 support-for-vendored-dependencies cargo 0.38] which came out August 15,
 2019. (So if you tested this script in the 10 months between when the
 branch was last reviewed in September 2018 and July 2019, you wouldn't
 have had any issues.)

 > All tests were imported as part of this commit, but not all features
 > were imported. Some flags have been left out that were added later in
 > the lifetime of `cargo vendor` which seem like they're more questionable
 > to stabilize. I'm hoping that they can have separate PRs adding their
 > implementation here, and we can make a decision of their stabilization
 > at a later date.

 The [https://github.com/alexcrichton/cargo-vendor/pull/15 original flag]
 simply wasn't reimplemented. [https://github.com/rust-
 lang/cargo/pull/7631#issuecomment-561890784 Until it was,] several months
 later, with a new name: `--versioned-dirs`. That was released in cargo
 0.43, which came out in March 2020.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27130#comment:26>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online