Rocket: rocket_contrib conflicts with latest ring (0.14)

[kpcyrd]

I'm currently trying to prepare a bugfix release but I'm having trouble due to the ring dependency in the cookie crate. It's currently depending on an outdated ring version, but since I don't need cookies at all I would like to disable the need for ring.

It's already possible to build rocket without ring like this:

rocket = { version = "0.4", default-features = false }

This disables the private-cookies feature, which in turn disables the private-cookies feature in rocket_http, which disables the secure feature in cookie.

private-cookies = ["rocket_http/private-cookies"]

This works fine unless you also need rocket_contrib, which is the case for me. rocket_contrib depends on rocket with default features and no way to disable it, which means that the ring dependency in cookie is getting enabled again:

rocket = { version = "0.4.0", path = "../../core/lib/" }

Introducing a feature to disable ring in rocket_contrib would be the best solution for my problem, I'm currently trying to find an alternative solution since that specific version is faulty on aarch64.

Thanks!

[SuperHacker-liuan]

Confirmed. I had to use a git version of rocket contrib to fix the ring compile problem. Actually, private cookies is needn't by rocket_contrib.

[jebrosen]

It makes sense for rocket_contrib to only enable private cookies if it needs to and is probably doable as a small change in a minor release. If any features do need private-cookies it can be enabled on those features individually.

[jebrosen]

Resolved in 90296dd in master.

[kpcyrd]

@SergioBenitez any updates regarding a 0.4.1 release?

[SergioBenitez]

@kpcyrd Yes. I'm going through all issues and PRs now in hopes of getting out a new release in the next few days.

[kpcyrd]

Any news on this one?

[kpcyrd]

I've pushed my first release with a workaround in the meantime to address the AES-GCM issue on aarch64 (https://github.com/briansmith/ring/issues/628).

I've added this to my workspace:

[patch.crates-io]
rocket = { git = "https://github.com/SergioBenitez/Rocket.git", rev="c86f4312fb273c0380fb76a97bfb7fc227800542" }
rocket_contrib = { git = "https://github.com/SergioBenitez/Rocket.git", rev="c86f4312fb273c0380fb76a97bfb7fc227800542" }

During the release I disable this block, remove the server from the workspace, regenerate Cargo.lock and push a release. Afterwards I re-add the server to the workspace, re-enable the [patch] section and regenerate Cargo.lock. Building the rocket server from release tarballs isn't supported anymore in my project.

It seems this issue is also related to #650.

[kpcyrd]

@SergioBenitez any news?

[kpcyrd]

@SergioBenitez @jebrosen Any news here? I'm considering migrating away from rocket at this point.

[SergioBenitez]

@kpcyrd The release happened a couple of days ago, finally. Apologies for the delay.