Adding rsa dependency introduces non-additive lazy_static feature that breaks other code

Open
#358 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
rust
Domain
build-system, cryptography

Research direction

Start by tracing the rsa to num-bigint-dig to lazy_static dependency chain and reproducing the failure with a non-Send lazy_static value like the example in image.rs. Determine how the non-additive spin_no_std feature is enabled and whether the dependency declarations expose a way to avoid it. Done means the rsa dependency no longer breaks unrelated workspace code and the regression is covered by a reproducible check.

Written by the indexing model from the issue text.

Description

This is the same problem as #219, but since that issue wasn't fully evaluated, I wanted to add my report, with a bit more context.

Dependency chain:

  • rsa depends on num-bigint-dig
  • num-bigint-dig depends on lazy_static with features = ["spin_no_std"].

lazy_static's spin_no_std feature is non-additive; it causes lazy_static to replace use of std::sync::Once with spin:once::Once. This may seem like a harmless replacement, but:

  • spin::once::Once<T> has different trait bounds. Namely, it only implements Sync where T: Send + Sync while lazy_static using std::sync::Once only requires T: Sync.
  • This means that anyone using lazy_static on a non-Send type will see their code break if the spin_no_std feature is enabled.
  • Adding rsa as a dependency to a large workspace means that every crate in that workspace now gets the modified lazy_static code using spin with stricter trait bounds.

This is currently happening to me: I added rsa to a large workspace, and that change causes compile errors in unrelated (previously working) code:

error[E0277]: `*const u8` cannot be sent between threads safely
    --> image.rs:25:1
     |
25   | / lazy_static::lazy_static! {
26   | |     pub(crate) static ref HELLO_IMAGE: Option<ImageBuffer> = {
27   | |         let image_bytes = std::fs::read("hello.png").ok()?;
28   | |
...    |
36   | |     };
37   | | }
     | |_^ `*const u8` cannot be sent between threads safely

I'm not sure how to handle this, but it would be nice if there were a feature in rsa (and num-bigint-dig) to disable this behavior. As it is, I'm unable to add an rsa dependency unless I fork+patch num-bigint-dig.

Dominant language
Rust
Stars
673
Forks
190
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from RustCrypto/RSA

All issues in RustCrypto/RSA

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.