Zeroize version 0.10.1 is no longer on crates.io

[sandeepmukh]

Title pretty much says it all, but it looks like the authors of Zeroize removed the version that this library requires. Is there a fix for this?
Here's the error I'm getting when trying to build:

$ cargo build

    Updating crates.io index
    Updating git repository `https://github.com/RustMania/rust-paillier`
    Updating git repository `https://github.com/vnermolaev/trace.git`
error: failed to select a version for the requirement `zeroize = "^0.10.1"`
candidate versions found which didn't match: 1.3.0, 1.2.0, 1.1.1, ...
location searched: crates.io index
required by package `ecdsa-mpc v0.3.0 (/Users/sandeepmukherjee/Documents/projects/threshold-signatures)`

I've tried manually updating the Cargo.toml file but got a bit tangled up in the dependency tree.

EDIT: It can be compiled using local versions of curv and rust-paillier that are all upgraded to version "1" of zeroize. I haven't tested out anything besides its compilation.

[RustMania]

Hi, Thanks for noticing this. I regret that the crate has been yanked. The entire Rust ecosystem is built largely upon dozens of small contributions of various people. These people make decisions which sometimes can not be explained by common sense. In our case there is another key dependency , *curv* , which also depends on *zeroize* 0.10.1. The crate has been upgraded a lot since I started to use it in 2020, and the changes are not backward compatible. The latest update of *curv* accommodates *zeroize* 1.3.0, as the response to yanking event obviously. But I can't switch to this version of *curv* as this will ruin the entire API and a great deal of code will have to be rewritten in my lib. So I think of some quick solution instead. I think of cloning the old 0.10.1 code and using a git-style reference to it. It may take some time though. I will keep you posted, Best regards Oleg

…

On Sat, Jul 17, 2021 at 1:31 AM sandeepmukh ***@***.***> wrote: Title pretty much says it all, but it looks like the authors of Zeroize removed the version that this library requires. Is there a fix for this? Here's the error I'm getting when trying to build: $ cargo build Updating crates.io index Updating git repository `https://github.com/RustMania/rust-paillier` <https://github.com/RustMania/rust-paillier> Updating git repository `https://github.com/vnermolaev/trace.git` <https://github.com/vnermolaev/trace.git> error: failed to select a version for the requirement `zeroize = "^0.10.1"` candidate versions found which didn't match: 1.3.0, 1.2.0, 1.1.1, ... location searched: crates.io index required by package `ecdsa-mpc v0.3.0 (/Users/sandeepmukherjee/Documents/projects/threshold-signatures)` I've tried manually updating the Cargo.toml file but got a bit tangled up in the dependency tree. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#24>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJA357KV55BAJR5KXBSGURDTYC6NRANCNFSM5AQNV6MA> .

[sandeepmukh]

Oops accidentally closed the issue.

[survived]

Hi, I'm from ZenGo team maintaining both curv and rust-paillier crates. From our side, we can release an update for version you depend on with newer zeroize. This should solve a problem until next accident 🙂 Also, we'd love to suggest our help in migrating to newest curv version!

[RustMania]

Hello, ZenGo team! I seem having some time finally for this issue, while being away from the job.
It is very kind of you to offer the help with these crates. First I think of taking your suggestion to migrate to new version of curv. The attempt has already been made in January to do it as a quick fix/uptick, but the volume of changes did not look like one-day effort. Another less preferred option is to retrofit latest zeroize into old curv/paillier. How much time would it take?

[sandeepmukh]

Hi! I was actually able to get the library to work doing just that. Its pretty simple as both of the ZenGo libraries can be upgraded to version “1” of zeroize without breaking. I just edited their Cargo.toml and they compiled and have been running without complaint.

[survived]

We're currently releasing major update for the library that improves elliptic curve and bigint interfaces — v0.8.0-rc1 is already available, check out new elliptic curves interface. Once work on bigint is finished, v0.8.0 will be published.

You can already start migrating to v0.8.0-rc1 to match new elliptic curves interface. In a nutshell — in the version you depend on, there are GE and FE representing elliptic point and scalar respectively. To match the new interface you need to replace them with Point<Secp256k1> and Scalar<Secp256k1>. All arithmetic operations are supported - you can add, subtract two points, negate a point, multiply it at scalar, and so on, also point/scalar implement a bunch of convenient traits, see their documentation.

One major challenge you might have is that serialization format has been changed for points and scalars (and therefore for anything else in the library). So if you need to deserialize points/scalar/anything else from older curv, then you'll need a mapping from old format to a new one.

I can help you with any issues during migration — reach me via email denis@zengo.com or telegram @dsurv

[survived]

As a quick fix — I've released curv v0.2.8 with updated zeroize dependency. As @sandeepmukh pointed out — it required only modifying Cargo.toml.

[RustMania]

The dependencies are updated. Thank you very much for your help with curv!