sp-core v39.0.0 broken: ark-vrf 0.1.x yanked from crates.io

[shawntabrizi]

Description

sp-core v39.0.0 (from polkadot-stable2512-2) depends on ark-vrf = "^0.1.0", but both 0.1.0 and 0.1.1 have been yanked from crates.io. This makes it impossible to resolve dependencies for any crate that transitively depends on sp-core.

Steps to reproduce

Any Cargo.toml using polkadot-stable2512-2 crate versions, e.g.:

[dependencies]
frame = { version = "0.14.0", package = "polkadot-sdk-frame" }

$ cargo build
error: failed to select a version for the requirement `ark-vrf = "^0.1.0"`
  version 0.1.0 is yanked
  version 0.1.1 is yanked
location searched: crates.io index
required by package `sp-core v39.0.0`
    ... which satisfies dependency `sp-core = "^39.0.0"` of package `polkadot-sdk-frame v0.14.0`

Notes

• ark-vrf 0.2.2 exists on crates.io but doesn't satisfy the ^0.1.0 semver range
• The source repo (davxy/ark-vrf) still has the v0.1.0 tag, so [patch.crates-io] with a git reference works as a workaround
• This blocks anyone starting a new project with polkadot-stable2512-2 published crates (no existing Cargo.lock to pin the yanked version)

[bkchr]

CC @davxy don't we already had this exact same issue before?

[davxy]

CC @davxy don't we already had this exact same issue before?

I never yanked any release of ark-vrf before.
We had an issue with ring-proof before publication to crates.io

BTW, I've unjanked the old versions. Yanking was not strictly necessary.

[bkchr]

@shawntabrizi is your issue resolved now?

[shawntabrizi]

Perhaps it is, but probably we should also do a crates update. Here is my cargo.toml:

[package]
name = "pallet-kitties"
version = "0.1.0"
description = "An NFT Marketplace for Kitties"
authors = ["Shawn Tabrizi <shawntabrizi@gmail.com>"]
homepage = "https://www.shawntabrizi.com/substrate-collectables-workshop/"
repository = "https://github.com/shawntabrizi/substrate-collectables-workshop"
edition = "2021"
publish = false

[package.metadata.docs.rs]
targets = ["x86_64-unknown-linux-gnu"]

[dependencies]
codec = { package = "parity-scale-codec", version = "3.7.5", default-features = false, features = ["derive"] }
scale-info = { version = "2.11.6", default-features = false, features = ["derive"] }
frame = { version = "0.14.0", package = "polkadot-sdk-frame", default-features = false, features = ["runtime"] }

[dev-dependencies]
frame-system = { version = "45.0.0" }
pallet-balances = { version = "46.0.0" }

[patch.crates-io]
# ark-vrf 0.1.x versions are yanked on crates.io
ark-vrf = { git = "https://github.com/davxy/ark-vrf", tag = "v0.1.1" }

[features]
default = [ "std" ]
std = [ "codec/std", "frame/std", "scale-info/std" ]
try-runtime = []

So the problem might be that the frame crate isn't getting updated