edgelet/Cargo.lock a bit rotten?

[patheikkinen]

I'm trying to make Azure IoT build on Yocto 6.0 (caveat emptor, I know!). In the process I ran into a problem with conflicting version requirements. On the other hand, the code directly requires http 1.4.1, but on the other hand, a dependency requires http ^0.2.

Expected Behavior

I should be getting some error or, after sufficient troubleshooting, none at all. That's on me. But in any case, not a version conflict from the source code cloned directly from the official git repo :(

Current Behavior

See logs below.

Logs

A snippet of the build log

Log data follows:
| DEBUG: Executing shell function do_compile
| NOTE: Using rust targets from /home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/rust-targets/
| NOTE: cargo = /home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/recipe-sysroot-native/usr/bin/cargo
| NOTE: cargo build -v --frozen --target x86_64-poky-linux-gnu --release --manifest-path=/home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/sources/iotedge-1.5.40/edgelet/Cargo.toml -p iotedge
| error: failed to select a version for the requirement `http = "^0.2"`
| candidate versions found which didn't match: 1.4.1
| location searched: directory source `/home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/sources/cargo_home/bitbake` (which is replacing registry `crates-io`)
| required by package `aziot-identity-client-async v0.1.0 (/home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/sources/identity/aziot-identity-client-async)`
|     ... which satisfies git dependency `aziot-identity-client-async` (locked to 0.1.0) of package `aziot-edged v0.1.0 (/home/pauhei/xxx-iot-yocto/build/tmp/work/corei7-64-poky-linux/iotedge/1.5.40/sources/iotedge-1.5.40/edgelet/aziot-edged)`
| perhaps a crate was updated and forgotten to be re-vendored?
| As a reminder, you're using offline mode (--frozen) which can sometimes cause surprising resolution failures, if this error is too confusing you may wish to retry without `--frozen`.
| WARNING: exit code 101 from a shell command.

Additional Information

I think the problem is with edgelet/Cargo.lock containing updated git references but ancient version numbers, like this:

[[package]]
name = "aziot-identity-client-async"
version = "0.1.0"
source = "git+https://github.com/Azure/iot-identity-service?branch=main#3fc8a1441971ee315dcbfa31a0e1e17e994ef8bf"

I'm new to Rust but I think the Yocto/OpenEmbedded build process won't make Cargo/Rustc check the git reference, instead version 0.1.0 will be fetched from crates.io based on the version number and that one is actually ancient so no wonder there is a problem.

Shouldn't the version numbers in edgelet/Cargo.lock reflect the correct version numbers of the referenced dependencies?

[patheikkinen]

Never mind - the referenced dependencies state in Cargo.toml that their version number is 0.1.0 so the reference in Cargo.lock is correct. There must be something wrong with the Yocto recipes.

Since these are source code references the Bitbake crate list updater doesn't even include these. It only looks for dependencies that are found in crates.io and these are not.