Build failure due to bitvec dependency

[PatrickLerner]

Describe the bug

Cargo deny fails to install on a clean docker image. I am posting here in case somebody else is wondering or if there is a fix that can be done for this here, although I think it boils down to a dependency's dependency (see below).

Give a docker file such as:

FROM rust:1.50

RUN cargo install cargo-deny

The build fails due to a dependency:

error[E0034]: multiple applicable items in scope
   --> /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/bitvec-0.19.4/src/order.rs:315:15
    |
315 |         if ct == R::BITS {
    |                     ^^^^ multiple `BITS` found
    |
note: candidate #1 is defined in the trait `BitMemory`
   --> /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/bitvec-0.19.4/src/mem.rs:29:2
    |
29  |     const BITS: u8 = mem::size_of::<Self>() as u8 * 8;
    |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
note: candidate #2 is defined in the trait `IsNumber`
   --> /usr/local/cargo/registry/src/github.com-1ecc6299db9ec823/funty-1.2.0/src/lib.rs:144:2
    |
144 |     const BITS: u32;
    |     ^^^^^^^^^^^^^^^^
help: disambiguate the associated constant for candidate #1
    |
315 |         if ct == BitMemory::BITS {
    |                  ^^^^^^^^^^^^^^^
help: disambiguate the associated constant for candidate #2
    |
315 |         if ct == IsNumber::BITS {
    |                  ^^^^^^^^^^^^^^

   Compiling cc v1.0.66
error: aborting due to 43 previous errors

Some errors have detailed explanations: E0034, E0308.
For more information about an error, try `rustc --explain E0034`.
error: could not compile `bitvec`

Error also reported there: ferrilab/bitvec#105

But traced back to yet another package funty

To Reproduce
Steps to reproduce the behavior:

1. Dockerfile above
2. docker build . -t cargo-deny-fail -f Dockerfile
3. See error

Expected behavior

It compiles on a clean system.

[repi]

Thanks for the report!

cargo install unfortunately defaults to ignore Cargo.lock in the crate when installing, so it will use the latest minor/patch versions of all crates which in this case, as you point out, there is a dependency with a semver incompatible breaking change.

I think easiest approach for now, until that downstream dependency has been fixed, and in general, would be to use cargo install cargo-deny --locked, where the --locked flag makes sure it builds the crate with the provided and tested exact dependencies from Cargo.lock that is checked into this repo.

This Cargo issue / design choice is further discussed in rust-lang/cargo#7169.

@Jake-Shadle we could change the cargo-deny docs to recommend cargo install cargo-deny --locked instead of cargo install cargo-deny?

[briansmith]

When using --locked, I get this warning:

package `miow v0.3.5` in Cargo.lock is yanked in registry `crates.io`, consider running without --locked

It seems like it is warranted to release a new version that has an updated miow in the Cargo.lock, at least.

[Jake-Shadle]

@briansmith I've made a 0.8.6 release that fixes your issue.