Repository navigation
bug: update zip2 dependency to something that exists. #2097
Copy link
Copy link
Open
Labels
bugSomething isn't workingSomething isn't working
Description
lean-ctx version: 3.11.4
Looks like zip crate has had every version yanked due to a security issue including 8.6 which all builds of this use. Related: zip-rs/zip2#1075 (comment)
I tried to patch it to the latest 9.0.4 but there's some errors.
error[E0308]: mismatched types=======> ] 616/618: lean-ctx
--> src/core/calibrator/selection.rs:340:34
|
340 | if !is_safe_archive_path(&path) || entry.is_dir() {
| -------------------- ^^^^^ expected `&str`, found `&Result<Cow<'_, str>, ZipError>`
| |
| arguments to this function are incorrect
|
= note: expected reference `&str`
found reference `&std::result::Result<Cow<'_, str>, ZipError>`
note: function defined here
--> src/core/calibrator/selection.rs:518:4
|
518 | fn is_safe_archive_path(path: &str) -> bool {
| ^^^^^^^^^^^^^^^^^^^^ ----------
error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
--> src/core/calibrator/selection.rs:342:62
|
342 | "selection evidence bundle has unsafe entry '{path}'"
| ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
|
= help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
= note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead
error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
--> src/core/calibrator/selection.rs:348:44
|
348 | "selection evidence entry '{path}' exceeds size limit"
| ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
|
= help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
= note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead
error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
--> src/core/calibrator/selection.rs:362:70
|
362 | .map_err(|error| format!("read selection evidence entry '{path}': {error}"))?;
| ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
|
= help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
= note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead
error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
--> src/core/calibrator/selection.rs:365:44
|
365 | "selection evidence entry '{path}' has an invalid size"
| ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
|
= help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
= note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead
error[E0277]: the trait bound `ZipError: std::cmp::Ord` is not satisfied
--> src/core/calibrator/selection.rs:368:18
|
368 | if files.insert(path.clone(), contents).is_some() {
| ^^^^^^ the trait `std::cmp::Ord` is not implemented for `ZipError`
|
help: the trait `std::cmp::Ord` is conditionally implemented for `std::result::Result<T, E>`
--> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:554:42
::: /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:558:19
|
= note: unsatisfied requirement introduced here: `ZipError: std::cmp::Ord`
= note: required for `std::result::Result<Cow<'_, str>, ZipError>` to implement `std::cmp::Ord`
note: required by a bound in `BTreeMap::<K, V, A>::insert`
--> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/alloc/src/collections/btree/map.rs:1045:4
error[E0277]: `std::result::Result<Cow<'_, str>, ZipError>` doesn't implement `std::fmt::Display`
--> src/core/calibrator/selection.rs:370:62
|
370 | "selection evidence bundle duplicates entry '{path}'"
| ^^^^^^ `std::result::Result<Cow<'_, str>, ZipError>` cannot be formatted with the default formatter
|
= help: the trait `std::fmt::Display` is not implemented for `std::result::Result<Cow<'_, str>, ZipError>`
= note: in format strings you may be able to use `{:?}` (or `{:#?}` for pretty-print) instead
error[E0308]: mismatched types
--> src/core/calibrator/selection.rs:374:8
|
368 | if files.insert(path.clone(), contents).is_some() {
| ----- ------------ this argument has type `std::result::Result<Cow<'_, str>, ZipError>`...
| |
| ... which causes `files` to have type `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, Vec<u8>>`
...
374 | Ok(files)
| -- ^^^^^ expected `BTreeMap<String, Vec<u8>>`, found `BTreeMap<Result<Cow<'_, str>, ZipError>, _>`
| |
| arguments to this enum variant are incorrect
|
= note: expected struct `BTreeMap<std::string::String, _>`
found struct `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, _>`
help: the type constructed contains `BTreeMap<std::result::Result<Cow<'_, str>, ZipError>, Vec<u8>>` due to the type of the argument passed
--> src/core/calibrator/selection.rs:374:5
|
374 | Ok(files)
| ^^^-----^
| |
| this argument influences the type of `Ok`
note: tuple variant defined here
--> /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library/core/src/result.rs:562:4
error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
--> src/core/updater.rs:1392:32
|
1392 | let name = file.name().to_string();
| ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
|
= note: the following trait bounds were not satisfied:
`std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`
error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
--> src/cli/dispatch/evidence.rs:663:33
|
663 | let name = entry.name().to_string();
| ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
|
= note: the following trait bounds were not satisfied:
`std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`
error[E0599]: the method `to_string` exists for enum `std::result::Result<Cow<'_, str>, ZipError>`, but its trait bounds were not satisfied
--> src/cli/dispatch/verify.rs:135:33
|
135 | let name = entry.name().to_string();
| ^^^^^^^^^ method cannot be called on `std::result::Result<Cow<'_, str>, ZipError>` due to unsatisfied trait bounds
|
= note: the following trait bounds were not satisfied:
`std::result::Result<Cow<'_, str>, ZipError>: std::fmt::Display`
which is required by `std::result::Result<Cow<'_, str>, ZipError>: ToString`
Some errors have detailed explanations: E0277, E0308, E0599.
For more information about an error, try `rustc --explain E0277`.
error: could not compile `lean-ctx` (lib) due to 11 previous errors
error: failed to compile `lean-ctx v3.11.4 (/tmp/lean-ctx/rust)`, intermediate artifacts can be found at `/tmp/lean-ctx/rust/target`.
To reuse those artifacts with a future compilation, set the environment variable `CARGO_BUILD_BUILD_DIR` to that path.
Error: while running runtime: exit status 101
So this is going to need fixing.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
bugSomething isn't workingSomething isn't working
Activity
[-]bug:[/-][+]bug: update zip2 dependency to something that exists.[/+]yvgude commentedon Oct 16, 2026
checking it! thanks for reporting
yvgude commentedon Oct 16, 2026
Thanks for the report! This is already fixed on
mainvia #2096 (zip9.0.4, allZipFile::name()call sites adapted to the newResultreturn type).It will ship with the next release. Since the zip maintainers note that 9.0.0–9.0.4 still carry known issues and a clean release is planned, we'll pick up that version for the release rather than ship twice.
Until then:
cargo install lean-ctx --lockedshould still resolve the yanked 8.6 from the published lockfile (but carries the advisories), ormain, which compiles against zip 9.0.4.Prebuilt binaries (install script, release assets,
lean-ctx update) are not affected by the yank.dngray commentedon Oct 16, 2026
That indeed works, i was able to build
mainagainst zip 9.0.4 from the upstream repo.