error: no matching version ^0.5.2 found for package dwrote

[alexanderwe]

Description

I followed the steps for installing Azul mentioned in the wiki. When I try to build the initial "hello world" application with Azul as an dependency I get the following error:

error: no matching version `^0.5.2` found for package `dwrote`
location searched: registry `https://github.com/rust-lang/crates.io-index`
versions found: 0.6.0, 0.5.1, 0.5.0, ...
required by package `webrender v0.57.2 (https://github.com/servo/webrender?rev=f4941fb8d126f893f01f3511ab9bb4d15dbbab70#f4941fb8)`
    ... which is depended on by `azul v0.1.0 (https://github.com/maps4print/azul#170bd198)`
    ... which is depended on by `azul_app v0.1.0 (file:///Users/myuser/Documents/Programming/RustProjects/azul_app)`

My Cargo.toml file looks like this

[package]
name = "azul_app"
version = "0.1.0"
authors = ["Alexander Weiß"]

[dependencies]
# use the latest commit (time of writing it is #170bd1980e9833894be7678dfe2d2c429957b934)
azul = { git = "https://github.com/maps4print/azul"} 

Version / OS

• azul version: 0.1.0
• Operating system: Mac OS 10.14 (Mojave)

Steps to Reproduce

Follow the installation steps in the wiki

Expected Behavior

Azul should build fine

Actual Behavior

Azul does not build with the error mentioned above

Additional Information

I looked in the dependencies and it seems that the servo WebRender project updated it's dwrote dependency to 0.6.0. (Commit in servo) I think it should be fine to change the servo/webrender in Azul to the commit where the dwrote dependency was updated.

[Yatekii]

The problem here is that dwrote was yanked.
This commit includes the lockfile: 70ebb52
When you checkout current master it should work with the committed lockfile for now.

[alexanderwe]

I used the current master commit, but the error is still present. With older commits it’s working, so I am fine with using them, no worries.

I just wanted to mention that in some time in the future it would be nice to update the servo dependency to cope with the dwrote error.

[Yatekii]

Hmm ok that seems weird. Maybe it is because it did some weird stuff because the lockfile wasn't tracked before.
Anyways, it's surely good that you opened this issue. @fschutt is aware tho.

[fschutt]

Right, yeah, it only builds when you copy the Cargo.lock file from this repo. Even if I have the lock file, you don't, so cargo ignores the lockfile from this repository (which is stupid IMO). The general problem with this is that crates.io allows anybody to yank crates even though that might break dependents (see rust-lang/cargo#5263). This is essentially, the npm-leftpad problem - because you don't have a lock file yet and you don't have the hashes of dwrote, you can't build the crate.

I'll update servo, but of course this isn't a permanent solution and might happen again in the future, however solving this "properly" is out of my control. Please complain to cargo if this appears again.

[alexanderwe]

@fschutt I see the problem there, and I am aware that this is not really an issue with azul itself. Thanks for the clarification. That’s a really bad feature of crates.io... potentially very risky.

Thank you all a lot for your fast responses on this, very appreciate it !