Cargo doesn't understand build metadata in versions

[jethrogb]

Semver allows specifying versions such as 1.0.0+20130313144700, see http://semver.org/#spec-item-10 . Cargo can't handle such versions. See e.g. https://crates.io/crates/core_rustc-serialize which has these versions:

• 0.3.19
• 0.3.19+patch1

Specifying a dependency core_rustc-serialize = "*" (or core_rustc-serialize = "^0.3") results in Cargo choosing 0.3.19. There is simply no way to select 0.3.19+patch1. Putting it in the Cargo.toml results in the error message "the given version requirement is invalid". You also can't select it using cargo update --precise. This results in a crate existing on crates.io that can effectively not be used by anyone.

See also #2222 #2935

[steveklabnik]

What if you specify the build metadata version exactly?

On Jul 31, 2016, 18:49 -0700, jethrogb notifications@github.com, wrote:

Semver allows specifying versions such as 1.0.0+20130313144700, see http://semver.org/#spec-item-10 . Cargo can't handle such versions. See e.g. https://crates.io/crates/core_rustc-serialize which has these versions:

0.3.19
0.3.19+patch1

Specifying a dependency core_rustc-serialize = "*" (or core_rustc-serialize = "^0.3") results in Cargo choosing 0.3.19. There is simply no way to select 0.3.19+patch1. Putting it in the Cargo.toml results in the error message "the given version requirement is invalid". You also can't select it using cargo update --precise. This results in a crate existing on crates.io that can effectively not be used by anyone.

See also #2222 (#2222) #2935 (#2935)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub (#2939), or mute the thread (https://github.com/notifications/unsubscribe-auth/AABsiuwuv3eg0_WvbypJNgqckr7d1__aks5qbVCpgaJpZM4JZLiF).

[steveklabnik]

Oh, sorry, I mis-read, you clearly tried that. Sorry. What does --verbose say?

On Jul 31, 2016, 18:49 -0700, jethrogb notifications@github.com, wrote:

Semver allows specifying versions such as 1.0.0+20130313144700, see http://semver.org/#spec-item-10 . Cargo can't handle such versions. See e.g. https://crates.io/crates/core_rustc-serialize which has these versions:

0.3.19
0.3.19+patch1

Specifying a dependency core_rustc-serialize = "*" (or core_rustc-serialize = "^0.3") results in Cargo choosing 0.3.19. There is simply no way to select 0.3.19+patch1. Putting it in the Cargo.toml results in the error message "the given version requirement is invalid". You also can't select it using cargo update --precise. This results in a crate existing on crates.io that can effectively not be used by anyone.

See also #2222 (#2222) #2935 (#2935)

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub (#2939), or mute the thread (https://github.com/notifications/unsubscribe-auth/AABsiuwuv3eg0_WvbypJNgqckr7d1__aks5qbVCpgaJpZM4JZLiF).

[jethrogb]

The quoted text.

[steveklabnik]

That seems very strange. As part of the SemVer crates tests, I attempt to parse every version on crates.io, so it should know how to parse it...

I suspect that this is more of a SemVer bug than a Cargo bug; I'll try to investigate more in the next few days.

On Jul 31, 2016, 19:31 -0700, jethrogb notifications@github.com, wrote:

The quoted text.

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub (#2939 (comment)), or mute the thread (https://github.com/notifications/unsubscribe-auth/AABsistuj0W-7Z54RWBWjC2u-7rJ1rfRks5qbVp6gaJpZM4JZLiF).

[alexcrichton]

@steveklabnik I wonder if this is related to version requirements vs version themselves? Maybe version requirements don't parse build metadata?

[steveklabnik]

Ah ha! That is the case.

"1.2.3+250".parse::<Version>(); // this is fine
"= 1.2.3+250".parse::<VersionReq>();  // this is not fine

So yes, this is actually a semver issue that will then make it into Cargo once that happens.

I've opened an issue: dtolnay/semver#88 so closing in favor of that.