Skip to content

bug: update zip2 dependency to something that exists. #2097

Open

Description

@dngray

lean-ctx version: 3.11.4

Looks like zip crate has had every version yanked due to a security issue including 8.6 which all builds of this use. Related: zip-rs/zip2#1075 (comment)

I tried to patch it to the latest 9.0.4 but there's some errors.

error[E0308]: mismatched types=======> ] 616/618: lean-ctx                                                                                                                  
   --> src/core/calibrator/selection.rs:340:34
    |
340 |         if !is_safe_archive_path(&path) || entry.is_dir() {
    |             -------------------- ^^^^^ expected `&str`, found `&Result<Cow<'_, str>, ZipError>`
    |             |
    |             arguments to this function are incorrect
    |
    = note: expected reference `&str`
               found reference `&std::result::Result<Cow<'_, str>, ZipError>`
note: function defined here
   --> src/core/calibrator/selection.rs:518:4
    |
518 | fn is_safe_archive_path(path: &str) -> bool {
    |    ^^^^^^^^^^^^^^^^^^^^ ----------

error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
   --> src/core/calibrator/selection.rs:342:62
    |
342 |                 "selection evidence bundle has unsafe entry '{path}'"
    |                                                              ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
    |
    = help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
    = note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead

error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
   --> src/core/calibrator/selection.rs:348:44
    |
348 |                 "selection evidence entry '{path}' exceeds size limit"
    |                                            ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
    |
    = help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
    = note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead

error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
   --> src/core/calibrator/selection.rs:362:70
    |
362 |             .map_err(|error| format!("read selection evidence entry '{path}': {error}"))?;
    |                                                                      ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
    |
    = help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
    = note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead

error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
   --> src/core/calibrator/selection.rs:365:44
    |
365 |                 "selection evidence entry '{path}' has an invalid size"
    |                                            ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
    |
    = help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
    = note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead

error[E0277]: the trait bound `ZipError: std::cmp::Ord` is not satisfied
   --> src/core/calibrator/selection.rs:368:18
    |
368 |         if files.insert(path.clone(), contents).is_some() {
    |                  ^^^^^^ the trait `std::cmp::Ord` is not implemented for `ZipError`
    |
help: the trait `std::cmp::Ord` is conditionally implemented for `std::result::Result<T, E>`
   --> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:554:42
   ::: /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:558:19
    |
    = note: unsatisfied requirement introduced here: `ZipError: std::cmp::Ord`
    = note: required for `std::result::Result<Cow<'_, str>, ZipError>` to implement `std::cmp::Ord`
note: required by a bound in `BTreeMap::<K, V, A>::insert`
   --> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/alloc/src/collections/btree/map.rs:1045:4

error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
   --> src/core/calibrator/selection.rs:370:62
    |
370 |                 "selection evidence bundle duplicates entry '{path}'"
    |                                                              ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
    |
    = help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
    = note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead

error[E0308]: mismatched types
   --> src/core/calibrator/selection.rs:374:8
    |
368 |         if files.insert(path.clone(), contents).is_some() {
    |            -----        ------------ this argument has type `std::result::Result<Cow<'_, str>, ZipError>`...
    |            |
    |            ... which causes `files` to have type `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, Vec<u8>>`
...
374 |     Ok(files)
    |     -- ^^^^^ expected `BTreeMap<String, Vec<u8>>`, found `BTreeMap<Result<Cow<'_, str>, ZipError>, _>`
    |     |
    |     arguments to this enum variant are incorrect
    |
    = note: expected struct `BTreeMap<std::string::String, _>`
               found struct `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, _>`
help: the type constructed contains `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, Vec<u8>>` due to the type of the argument passed
   --> src/core/calibrator/selection.rs:374:5
    |
374 |     Ok(files)
    |     ^^^-----^
    |        |
    |        this argument influences the type of `Ok`
note: tuple variant defined here
   --> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:562:4

error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
    --> src/core/updater.rs:1392:32
     |
1392 |         let name = file.name().to_string();
     |                                ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
     |
     = note: the following trait bounds were not satisfied:
             `std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
             which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`

error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
   --> src/cli/dispatch/evidence.rs:663:33
    |
663 |         let name = entry.name().to_string();
    |                                 ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
    |
    = note: the following trait bounds were not satisfied:
            `std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
            which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`

error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
   --> src/cli/dispatch/verify.rs:135:33
    |
135 |         let name = entry.name().to_string();
    |                                 ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
    |
    = note: the following trait bounds were not satisfied:
            `std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
            which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`

Some errors have detailed explanations: E0277, E0308, E0599.
For more information about an error, try `rustc --explain E0277`.
error: could not compile `lean-ctx` (lib) due to 11 previous errors
error: failed to compile `lean-ctx v3.11.4 (/tmp/lean-ctx/rust)`, intermediate artifacts can be found at `/tmp/lean-ctx/rust/target`.
To reuse those artifacts with a future compilation, set the environment variable `CARGO_BUILD_BUILD_DIR` to that path.
Error: while running runtime: exit status 101

So this is going to need fixing.

Activity

  1. changed the title [-]bug:[/-] [+]bug: update zip2 dependency to something that exists.[/+] on Oct 16, 2026
  2. yvgude commented on Oct 16, 2026

    @yvgude
    Owner

    checking it! thanks for reporting

  3. yvgude commented on Oct 16, 2026

    @yvgude
    Owner

    Thanks for the report! This is already fixed on main via #2096 (zip 9.0.4, all ZipFile::name() call sites adapted to the new Result return type).

    It will ship with the next release. Since the zip maintainers note that 9.0.0–9.0.4 still carry known issues and a clean release is planned, we'll pick up that version for the release rather than ship twice.

    Until then:

    • cargo install lean-ctx --locked should still resolve the yanked 8.6 from the published lockfile (but carries the advisories), or
    • build from main, which compiles against zip 9.0.4.

    Prebuilt binaries (install script, release assets, lean-ctx update) are not affected by the yank.

  4. dngray commented on Oct 16, 2026

    @dngray
    Author

    That indeed works, i was able to build main against zip 9.0.4 from the upstream repo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions