`const-random` should be listed as optional.

[xieyubo]

Bug description

const-random is not required for default/std feature but it is listed as required dependency always.

• Would you like to work on a fix? [y/n] N

[sgodwincs]

Hm I don't think there's a way in Cargo to require the dependency if the std feature is turned off. If it was optional, how do you propose it'll be enabled for no std users? Only option I see is to have another no_std flag that is meant to be mutually exclusive with std.

[xieyubo]

I think so, or add no_std feature and remove std feature?

Some company (e.g. Microsoft...), will scan all packages in the dependency list, const-random has some dependency which contains crypto algorithm. All such packages are not allowed to use except special approval.

[zmrow]

I can open a PR for this.

Having a std feature seems to be in line with what the Cargo docs recommend. In that vein, I think the best we can do to avoid breaking existing users of default feature std is to:

• make const-random optional
• add a new feature const-random that brings in the dependency
• add a compile error to the code if std and const-random features are both enabled (cargo doc reference)

It's not perfect, but I think it achieves the goal of eliminating the const-random dependency while not breaking existing users of default features; though no_std users will need to add the new const-random feature.

@sgodwincs thoughts on that?