crypto_box: zeroize is locked into an old version

[jpdoyle]

I have a project using both elliptic-curves and crypto_box, and when I updated elliptic-curves I could no longer build because crypto_box requires zeroize < 1.5. A minimized reproduction is available at https://github.com/jpdoyle/cryptobox-zeroize-issue

The error reported is:

$ cargo build
    Updating crates.io index
error: failed to select a version for `zeroize`.
    ... required by package `xsalsa20poly1305 v0.8.0`
    ... which satisfies dependency `xsalsa20poly1305 = "^0.8"` of package `crypto_box v0.7.0`
    ... which satisfies dependency `crypto_box = "^0.7.0"` of package `cryptobox-zeroize-issue v0.1.0 (/home/joe/Sync/cryptobox-zeroize-issue)`
versions that meet the requirements `>=1, <1.4` are: 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.0

all possible versions conflict with previously selected packages.

  previously selected package `zeroize v1.5.1`
    ... which satisfies dependency `zeroize = "^1.5"` of package `elliptic-curve v0.11.9`
    ... which satisfies dependency `elliptic-curve = "^0.11.9"` of package `cryptobox-zeroize-issue v0.1.0 (/home/joe/Sync/cryptobox-zeroize-issue)`

failed to select a version for `zeroize` which could resolve this conflict

It looks like fixing this also requires updating xsalsa20poly1305 in https://github.com/RustCrypto/AEADs

My local cargo version is:

$ cargo --version
cargo 1.56.0

[tarcieri]

This is a problem across all of our projects. We lock zeroize to preserve MSRV, but it's becoming very difficult to maintain across projects.

The best solution for now is probably to revert the changes to elliptic-curve and punt on zeroize updates until the next release.

[tarcieri]

I've opened a tracking issue for this: RustCrypto/utils#723

[tarcieri]

@jpdoyle for now I've released a new version of elliptic-curve v0.11 which downgrades the zeroize dependency and will hopefully address your immediate problems

[jpdoyle]

That fixed the immediate issue! thanks a ton.