Older versions of zeroize (<1.5.0) don't work with Rust 1.58

[raphaelrobert]

When trying to compile the x25519-dalek-ng crate with Rust 1.58, I get the following errors:

error[E0405]: cannot find trait `ZeroizeOnDrop` in crate `zeroize`
  --> src/x25519.rs:64:10
   |
64 | #[derive(Zeroize)]
   |          ^^^^^^^ not found in `zeroize`
   |
   = note: this error originates in the derive macro `Zeroize` (in Nightly builds, run with -Z macro-backtrace for more info)

error[E0405]: cannot find trait `ZeroizeOnDrop` in crate `zeroize`
   --> src/x25519.rs:112:17
    |
112 | #[derive(Clone, Zeroize)]
    |                 ^^^^^^^ not found in `zeroize`
    |
    = note: this error originates in the derive macro `Zeroize` (in Nightly builds, run with -Z macro-backtrace for more info)

error[E0405]: cannot find trait `ZeroizeOnDrop` in crate `zeroize`
   --> src/x25519.rs:158:10
    |
158 | #[derive(Zeroize)]
    |          ^^^^^^^ not found in `zeroize`
    |
    = note: this error originates in the derive macro `Zeroize` (in Nightly builds, run with -Z macro-backtrace for more info)

The crate depend on zeroize 1.2.0, but updating it to 1.4.x doesn't help. Only 1.5.0 seems to work.

[tarcieri]

I'm guessing this is a regression related to zeroize_derive, namely trying to use zeroize_derive v1.3.0 with older versions of zeroize

/cc @daxpedda

[dovahcrow]

here is the repro:

set dependencies as:

zeroize = { version = "=1.4.3", features = ["zeroize_derive"] }
zeroize_derive = "~1.3.0-pre"

then use the derive macro.

[tarcieri]

@daxpedda it looks like #[zeroize(drop)] is adding an impl of ZeroizeOnDrop. That won't work with <1.5 versions of zeroize

[daxpedda]

I actually thought it's fine like that. zeroize-derive would simply not be compatible with older versions of zeroize. What's RustCrypto's stance on that?

In any case, if the decision is to make #[zeroize(drop)] not implement ZeroizeOnDrop, I can make the PR asap @tarcieri.

[tarcieri]

I would personally consider changing #[zeroize(drop)] to add a ZeroizeOnDrop impl a breaking change which I missed during review.

They're both post-1.0 crates, so we can't have breaking changes.

Eventually I'd like to figure out a solution to get #[zeroize(drop)] to add a deprecation warning so we can get people moved over to derive(ZeroizeOnDrop).

[daxpedda]

Alright, PR coming in.

[tarcieri]

Fix released in 1.3.1

[raphaelrobert]

Thanks for fixing it!