Panic on crate `imageproc`

bjornwein commented 2 years ago

Describe the bug cargo-deny 0.13.1 seems to panic if the checked project includes the "imageproc" crate.

thread '<unnamed>' panicked at 'no entry found for key', /home/user/.cargo/registry/src/github.com-1ecc6299db9ec823/krates-0.12.2/src/builder.rs:1052:36

This doesn't happen with cargo-deny 0.12.2 It seems to happen both on older imageproc version 0.20.0, as well as current 0.23.0

To Reproduce Initialize a new empty project with a single dependency

[dependencies]
imageproc = "0.23.0"

run cargo deny check

Expected behavior With a default deny.toml I get the following result with cargo-deny 0.12.2:

advisories ok, bans ok, licenses FAILED, sources ok

Device:

OS: Debian 11.5

Jake-Shadle commented 2 years ago

@bjornwein What version of cargo are you using? I am guessing it is <1.60.0?

bjornwein commented 2 years ago

@bjornwein What version of cargo are you using? I am guessing it is <1.60.0?

Good question. I had to look myself:

cargo --version
cargo 1.64.0 (387270bc7 2022-09-16)

If this is not easily reproducible outside of my environment, I can try to help as much as possible with backtraces or whatever you need.

Jake-Shadle commented 2 years ago

I can't repro, I am guessing you have features enabled that you have not listed.

bjornwein commented 2 years ago

I guess it could be something in my env. To be clear, this is exactly how I can reproduce it from scratch:

>cargo init cargo-deny-test
>cd cargo-deny-test
>cargo add imageproc
    Updating crates.io index
      Adding imageproc v0.23.0 to dependencies.
             Features:
             + rayon
             - display-window
             - property-testing
             - quickcheck
             - sdl2
>cargo deny init
>cargo deny check
thread '<unnamed>' panicked at 'no entry found for key', /home/bjornwein/.cargo/registry/src/github.com-1ecc6299db9ec823/krates-0.12.2/src/builder.rs:1052:36

Cargo.toml:

[package]
name = "cargo-deny-test"
version = "0.1.0"
edition = "2021"

# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[dependencies]
imageproc = "0.23.0"

Backtrace:

   0: rust_begin_unwind
             at /rustc/a55dd71d5fb0ec5a6a3a9e8c27b2127ba491ce52/library/std/src/panicking.rs:584:5
   1: core::panicking::panic_fmt
             at /rustc/a55dd71d5fb0ec5a6a3a9e8c27b2127ba491ce52/library/core/src/panicking.rs:142:14
   2: core::panicking::panic_display
             at /rustc/a55dd71d5fb0ec5a6a3a9e8c27b2127ba491ce52/library/core/src/panicking.rs:72:5
   3: core::panicking::panic_str
             at /rustc/a55dd71d5fb0ec5a6a3a9e8c27b2127ba491ce52/library/core/src/panicking.rs:56:5
   4: core::option::expect_failed
             at /rustc/a55dd71d5fb0ec5a6a3a9e8c27b2127ba491ce52/library/core/src/option.rs:1874:5
   5: core::ops::function::impls::<impl core::ops::function::FnMut<A> for &mut F>::call_mut
   6: <alloc::vec::Vec<T> as alloc::vec::spec_from_iter::SpecFromIter<T,I>>::from_iter
   7: krates::builder::Builder::build_with_metadata
   8: cargo_deny::common::KrateContext::gather_krates
   9: <core::panic::unwind_safe::AssertUnwindSafe<F> as core::ops::function::FnOnce<()>>::call_once
  10: std::panicking::try
  11: <rayon_core::job::HeapJob<BODY> as rayon_core::job::Job>::execute
  12: rayon_core::registry::WorkerThread::wait_until_cold
  13: rayon_core::registry::ThreadBuilder::run

Please let me know if you have any ideas on something else I can try.

Jake-Shadle commented 2 years ago

So, this seems to have exposed a discrepancy between the index, which has a default and std feature on the conv:0.3.3 crate, but the actual crate package from crates.io doesn't have those features, so the cargo metadata has an inner conflict, where the node that cargo resolves for conv has the std and default features enabled, but the actual package metadata doesn't actually have those features. I'm going to have to file a bug against I guess cargo? for this, but will make a workaround for this issue as well, thanks for reporting!

bjornwein commented 2 years ago

Great, It sounds like you have it cornered! I'll pin cargo-deny to 0.12.2 for now, but I'll be happy to try out your workaround. Thank you for an excellent piece of software! <3

EmbarkStudios / krates

Panic on crate `imageproc` #46