[tor-bugs] #27130 [Core Tor/Tor]: rust dependency updating instructions don't work

[Tor Bug Tracker & Wiki]

#27130: rust dependency updating instructions don't work
-----------------------------------------------+---------------------------
 Reporter:  cyberpunks                         |          Owner:  nickm
     Type:  defect                             |         Status:  accepted
 Priority:  Medium                             |      Milestone:  Tor:
                                               |  0.4.2.x-final
Component:  Core Tor/Tor                       |        Version:  Tor:
                                               |  0.3.3.9
 Severity:  Normal                             |     Resolution:
 Keywords:  rust, doc, 033-unreached-backport  |  Actual Points:
Parent ID:                                     |         Points:
 Reviewer:  nickm                              |        Sponsor:
-----------------------------------------------+---------------------------
Changes (by nickm):

 * owner:  (none) => nickm
 * status:  needs_review => accepted


Comment:

 Trying to pick this up again.

 Looking at the branch, I see several changes.
   1. It makes the `updateRustDependencies.sh` script exit on error.
   2. It changes the crate dependency versions listed in our Cargo.toml
 files to be no longer pinned, under the theory that Cargo.lock is the
 correct mechanism for pinning versions.
   3. It updates the instructions for updating versions so that:
        * they no longer recommend version pinning with Cargo.toml
        * they give more information about the correct sequence of action
 in git.

 I agree with 1 and 3; we should discuss 2 as a team.

 When I try to use this script, I see two problems:

 First, cargo now includes "cargo vendor", but it has been updated to no
 longer support the `--explicit-version` flag.  We should investigate why,
 and what to do about it.

 Second, I get: "./scripts/maint/updateRustDependencies.sh: line 51: test:
 too many arguments".  This is an easy fix.

 My next step here is to read up on why --explicit-version is no longer
 supported here, and to start a discussion on what we actually want to do
 about versions.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/27130#comment:24>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online