viirya commented on PR #31:
URL:
https://github.com/apache/spark-connect-gateway/pull/31#issuecomment-5725139796
Closing: this cannot be a dependency-only update, and the change it would
need is
not one to make for a test-only helper.
`rand` here is a dev-dependency of `crates/auth`, used in exactly one place
— the
OIDC tests generate an RSA key with `rsa`:
```rust
// crates/auth/src/oidc.rs
let mut rng = rand::thread_rng();
let priv_key = RsaPrivateKey::new(&mut rng, 2048).expect("generate RSA key");
```
Renaming the moved API (`rand::thread_rng()` -> `rand::rng()`) is not
enough. The
blocker is a trait-version mismatch:
```
error[E0277]: the trait bound `ThreadRng: CryptoRngCore` is not satisfied
```
`rsa` 0.9 takes `rand_core` 0.6's `CryptoRngCore`, while `rand` 0.10's
`ThreadRng` implements the newer `rand_core` 0.10 trait. So `rand` cannot
move to
0.10 here until `rsa` moves to a release built against the newer `rand_core`.
That is more entangled than it looks: `rsa` 0.9 is also a transitive
dependency of
`jsonwebtoken`'s `rust_crypto` provider (SPARK-59552), so the workspace
resolves a
single `rsa`, and bumping it pulls the JWT signing path along with it. Not
worth
doing to modernise a test helper — better to pick `rand` up when `rsa` itself
moves.
One other thing worth flagging for whoever triages the next batch: this
branch was
cut before #29 merged, so as filed it also reverted `jsonwebtoken` from
`{ version = "10", features = ["use_pem", "rust_crypto"] }` back to `"9"` and
dropped 272 lines from `Cargo.lock`. That would have silently undone the
crypto
provider selection while still compiling and passing tests. Rebasing onto
current
`main` reduces the real diff to the `rand` bump above.
Thanks, dependabot.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
