It seems that .cargo is checked into git and it shouldn't be.

[dhylands]

It means that we can't use it to point other stuff locally without running into problems with git.

Shouldn't we just specify in the Cargo.toml file that it's using a local fork?

[JohanLorenzo]

Based on the cargo documentation, this is the only way to recursively override dependencies. But, since rust-lang/cargo#2385 landed a week ago, we can define it in Cargo.toml. One note though, we can can only override a package with a given version.

As of today, iron is used by these packages:

• foxbox
• foxbox_users
• iron-cors
• mount
• router
• staticfile
• xml-rs
• bodyparser
• persistent
• urlencoded

Cargo.lock lists 2 version used: 0.3.0 and 0.2.6. We can't bypass 2 versions by the same package => Cargo checked Cargo.toml to see if the version of the crates match. Hence, we have to clean our Cargo.lock to make sure we only use 0.2.6.

[JohanLorenzo]

I noticed there's a bad dependency in staticfile. It depends on mount ^0 which points to mount 0.1.0, which depends on iron 0.3.0.

I wonder if it would be easier to upgrade our dependencies to iron 0.3.0. Would the CORS patch still apply to that version, @samgiles @ferjm ?

[ferjm]

Which CORS patch?

[samgiles]

The problem is, iron upstream doesn't support SNI, the fork that the .cargo/config file points to does. This change hasn't landed upstream yet so there isn't an "official" crates version of Iron we can use.

I had issues where Cargo would use crates as the source of all truth, ignoring what you'd specify local for top level dependencies, leading to things like, expected trait 'Foo' was 'Foo'. Looks like the cargo update fixes this.

[JohanLorenzo]

My apologies I mixed CORS and SNI. The purpose of the solution would be to keep the forked version (locally), but upgrade it to v0.3.0 and apply the SNI changes on it.

Then, we would be able to change Cargo.toml to force iron:0.3.0 to be the forked one. Does it sound feasible, @samgiles ?

[samgiles]

@JohanLorenzo certainly seems like it should work, at least with Cargo nightly.

[samgiles]

The ideal solution involves working to get the update merged upstream - but an API change was suggested - so I've put it off for now.