release 0.4.4 broke semver contract

[japaric]

And cortex-m-rtfm no longer compiles after this release.

Though I don't really understand how since the changes between 0.4.3 and 0.4.4 are minimal

STR

$ cargo new --lib foo && cd foo
$ cargo new --lib bar
$ cargo add bar --path bar
$ cargo add tempdir --vers 0.3.7
$ cargo add rand --vers 0.5.5 # and disable default features
$ cd bar && cargo add rand --vers 0.4.4 && cd ..

$ cat Cargo.toml

[package]
name = "foo"
version = "0.1.0"
authors = ["Jorge Aparicio <jorge@japaric.io>"]
edition = "2018"

[dependencies]
bar = { path = "bar" }
tempdir = "0.3.7"

[dependencies.rand]
default-features = false
version = "0.5.5"

$ cat bar/Cargo.toml

[package]
name = "bar"
version = "0.1.0"
authors = ["Jorge Aparicio <jorge@japaric.io>"]
edition = "2018"

[dependencies]
rand = "0.4.4"

$ cargo +stable build
error[E0277]: the trait bound `rngs::jitter::TimerError: std::error::Error` is not satisfied
   --> /home/japaric/.cargo/registry/src/github.com-1ecc6299db9ec823/rand-0.5.5/src/rngs/jitter.rs:269:9
    |
269 |         Error::with_cause(ErrorKind::Unavailable,
    |         ^^^^^^^^^^^^^^^^^ the trait `std::error::Error` is not implemented for `rngs::jitter::TimerError`

---

If I pin the rand 0.4 version to 0.4.3 then this crate compiles:

$ cat bar/Cargo.toml

[package]
name = "bar"
version = "0.1.0"
authors = ["Jorge Aparicio <jorge@japaric.io>"]
edition = "2018"

[dependencies]
rand = "=0.4.3" # <-

$ rm Cargo.lock
$ cargo +stable build && echo OK
OK

Meta

$ rustc +stable -V
rustc 1.31.1 (b6c32da9b 2018-12-18)

[japaric]

Though I don't really understand how since the changes between 0.4.3 and 0.4.4 are minimal

If I had to guess, this addition

[target.'cfg(target_env = "sgx")'.dependencies]
rdrand = "0.4.0"
rand_core = "0.3.0"

is probably unconditionally enabling the "std" feature of the rand_core crate, even if the target target_env is not "sgx". If that's the case then this sounds like a Cargo bug.

[newpavlov]

It's incorrect configuration, the cited TOML should be:

[target.'cfg(target_env = "sgx")'.dependencies]
rdrand = "0.4.0"
rand_core = { version = "0.3", default-features = false }

And std feature for rand_core should be enabled together with rand std feature.

(I wonder if it's worth to do such backports, though.)

[dhardy]

Ah, the 0.4 series doesn't use rand_core. The extra dependency here... surely shouldn't do anything if you are not targetting SGX?

So your build uses Rand 0.4 and 0.5, and you are not using std but now somehow rand_core requires std (because this section doesn't disable default features)... @newpavlov beat me to it.

But I don't get why it matters since you're not targetting SGX?

[dhardy]

@newpavlov want to make the PR for 0.4.5?

[newpavlov]

I think it's the same bug in cargo which enables features enabled in dev-dependencies for non-dev builds.

[dhardy]

@japaric can you test 0.4.5 please?

[japaric]

@dhardy I checked and it works without a problem. Thanks for the quick fix!