Consider releasing an update to fix chrono issue

[nbigaouette-eai]

rust-tuf version 0.1.6 depends on chrono 0.3.1, which has been yanked due to wrong symver versioning.

This makes rust-tuf version 0.1.6 impossible to use:

$ cargo new --bin --vcs none tufexample
$ cd tufexample
$ echo 'tuf = "0.1.6"' >> Cargo.toml
$ cargo build
    Updating registry `https://github.com/rust-lang/crates.io-index`
error: no matching version `^0.3.1` found for package `chrono` (required by `tuf`)
location searched: registry https://github.com/rust-lang/crates.io-index
versions found: 0.4.0, 0.3.0, 0.2.25, ...

The only way for now is to use rust-tuf from git's branch develop.

$ sed -ibk "s|tuf = .*||g" Cargo.toml
$ echo 'tuf = {git = "https://github.com/heartsucker/rust-tuf.git", branch = "develop" }'
$ cargo build
    Updating git repository `https://github.com/heartsucker/rust-tuf.git`
    Updating registry `https://github.com/rust-lang/crates.io-index`
[...]
    Finished dev [unoptimized + debuginfo] target(s) in 36.1 secs

Could a new version of rust-tuf be released to crates.io?

Thanks!

[heartsucker]

Hey @nbigaouette-eai. Since the API has dramatically changed from 0.1.x to 0.2.0, and the 0.1.x series is unsupported, what you should do is switch to pointing to a pinned commit on the develop branch of this repo. I'm coming close to an alpha release of 0.2.0 which should have a relatively stable API, and you could easily change back over to using crates.io after that.

[nbigaouette-eai]

Yes, I'm already pointing to the develop branch.

The issue is that the version on crates.io is useless. This was an unfortunate screwup from the chrono crate where a version was released that did not respect symver; the increment was on the patch version (0.3.0 -> 0.3.1) but the API broke so it should have been released as a 0.4.0. Their 0.4.0 should have been a 0.5.0 instead... As such, the authors decided to yank 0.3.1 from crates.io.

And since chrono 0.3.1 is yanked from crates.io, rust-tuf 0.1.6 cannot be used anymore! I hoped a new version of rust-tuf could have been released, just to fix this issue.

So if chrono 0.3.1 and 0.4.0 have the same API, a hypothetical version bump from 0.1.6 to 0.1.7 (or 0.2?) could be made which includes just this fix and released to crates.io to solve this problem.

I understand rust-tuf is unsupported, but without a version bump on crates.io the package is useless... :(

[nbigaouette-eai]

Bumping rust-tuf's dependency to chrono 0.4.0 fails:

error[E0432]: unresolved import `chrono::UTC`
 --> src/metadata.rs:1:24
  |
1 | use chrono::{DateTime, UTC};
  |                        ^^^ no `UTC` in the root

error[E0432]: unresolved import `chrono::UTC`
 --> src/tuf.rs:1:5
  |
1 | use chrono::UTC;
  |     ^^^^^^^^^^^ no `UTC` in the root

error[E0432]: unresolved import `chrono::UTC`
 --> src/metadata.rs:1:24
  |
1 | use chrono::{DateTime, UTC};
  |                        ^^^ no `UTC` in the root

error[E0432]: unresolved import `chrono::UTC`
 --> src/tuf.rs:1:5
  |
1 | use chrono::UTC;
  |     ^^^^^^^^^^^ no `UTC` in the root

error: aborting due to 2 previous errors

error: Could not compile `tuf`.
Build failed, waiting for other jobs to finish...
error: aborting due to 2 previous errors

error: build failed

So their API changed... I'll see what I can do.

[heartsucker]

UTC --> offests::Utc

[heartsucker]

I pushed a new version to crates.io.