Exact dependencies here make the SDK less useful

[kevinheavey]

phoenix-v1 is a program so it's good that it has exact dependencies, however phoenix-v1 is also used as a library in phoenix-sdk-core so anyone using phoenix-sdk-core gets locked into a specific version of stuff like spl-token.

This probably requires a separate library crate for stuff that's common between the SDK and the program?

[jarry-xiao]

This is a really good point. Do you have a suggestion for a good way to do this? I'm happy to publish another crate without locking dependencies, but it would be good for that to live elsewhere -- maybe a dedicated branch?

[kevinheavey]

I would suggest just making a phoenix-common crate that has loose dependencies. phoenix-sdk-core would depend on phoenix-common and not on phoenix-v1. phoenix-v1 would also depend on phoenix-common. If you want you could keep all the exact dependencies in phoenix-v1 even if some of them aren't direct dependencies anymore

[jarry-xiao]

I think I'm okay with creating phoenix-common and having phoenix-sdk depend on phoenix-common but would prefer to keep the main program unchanged to ensure the build remain verifiable

[kevinheavey]

How would it break the verifiable build?

[jarry-xiao]

I'm concerned about Cargo pulling in updated versions of packages during the build. I think the Cargo.lock might help with this, but to avoid having deal with that issue I've created phoenix-common:

https://crates.io/crates/phoenix-common

[jarry-xiao]

It was published from the crate branch

[kevinheavey]

Yeah that was what I was referring to by:

If you want you could keep all the exact dependencies in phoenix-v1 even if some of them aren't direct dependencies anymore

[jarry-xiao]

Good to close the issue? I'm updating all of the other packages to relax the dependency constraints

[kevinheavey]

I still think it would be better to make phoenix-common a dependency of phoenix-v1 and add exact constraints for spl-token & co in the phoenix-v1 Cargo.toml, but up to you since the sdk problem is fixed either way 👍