bump dependencies

[erickt]

This updates the dependencies the following dependencies to the latest version: derp, itoa, log, tempfile, lazy_static, maplit

The only remaining outdated dependencies are on hyper (which is going to be a doozy to update) and untrusted, which is blocked on ring 0.13's release.

[heartsucker]

Hey thanks for this. I'll probably eventually move to reqwest over hyper because it's easier to use an I don't really need to worry about async operations since use of TUF is inherently a bit blocking. Are you on a Windows machine, because debugging these appveyor errors is going to be a total pain. It looks like it's just temp file errors in one of the tests.

[erickt]

Hello! Since I have your attention, thanks for the library. We are trying to use it for the fuchsia’s update system, so you’ll be seeing a bit more of me :)

Speaking of which, request would be fine (and I might just do that switch) or staying on hyper could work too. Fuchsia is mostly all async, so there may be some benefits to us to switch over to a more futures based model. Especially with async/await coming soon (which is being implemented by a coworker of mine).

Anyway, I did happen to have a windows machine to test this, but I didn’t try it on the gnu runtime. I can poke at this new error later on today.

[heartsucker]

I think that's totally fair to want hyper and futures for this, and my suggestion for reqwest was more meant to make the changes easier. That might be a good first step just because it would be considerably more fiddling to get this async.

As for the error, I actually suspect it has something to do with appveyor and not that crate being incompatible with windows. I'll see if I can figure something out this weekend too.

Also since you're planning on implementing it, please stay in touch since my original plan of getting this in to rustup kinda got halted because I kept banging my head into walls while integrating it (more my fault as a dev than this lib's). I did integrate it into a demo CLI at some point just to prove it works, so if it needs tweaks or additions, I'm all ears.

[heartsucker]

Apparently I already saw this error in #131. 🙄

[tarcieri]

For what it's worth, reqwest has an obnoxious number of dependencies. I've removed it from a few security-critical projects just to cut down on that:

https://twitter.com/bascule/status/984627292470050817

[heartsucker]

That is a super fair reason to not use reqwest. Scrap that idea :)

[heartsucker]

I merged this even with the appveyor failure because that is clearly unrelated to this PR. Thanks for the contribution. :)