apache / apache/teaclave-sgx-sdk
rustls & webpki dependencies are messed up in mesalock
- Dominant language
- Rust
- Stars
- 1.2k
- Forks
- 268
- PR merge metrics
- No merged PRs in 30d
Description
There are inconsistencies between referencing crates with `branch=mesalock_sgx` and tag=`sgx_v1.1.0`
i.e. this here causes trouble:
https://github.com/mesalock-linux/rustls/blob/d9a91f5037f5c85f761279d97b838256285a1314/Cargo.toml#L19
rustls `tag sgx_v1.1.0` depends on webpki `branch=mesaloch_sgx` but I'd expect it to depend on `tag sgx_v1.1.0`
In [our Cargo.toml](https://github.com/scs/substraTEE-worker/blob/dd9c6051c4145262bb0beae9da7a8538fcf793d9/enclave/Cargo.toml#L54) we now have a mess between branch and tag dependencies leading to this (after a cargo update):
```
error: failed to select a version for the requirement `webpki-roots = "^0.17.0"`
candidate versions found which didn't match: 0.19.0
location searched: Git repository https://github.com/mesalock-linux/webpki-roots?branch=mesalock_sgx
required by package `substratee_worker_enclave v4.0.0 (/home/abrenzikofer/substraTEE-worker/enclave)`
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the linked rustls Cargo.toml at the referenced commit and enclave/Cargo.toml in substraTEE-worker, then reproduce the dependency resolution failure with cargo update. Trace the mesalock_sgx branch and sgx_v1.1.0 tag references across rustls, webpki, and webpki-roots; done means the dependency graph resolves consistently without the reported webpki-roots version error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100