From 584f57be6b41407e2da639de3f1db2904dec3633 Mon Sep 17 00:00:00 2001 From: Glenn Gore Date: Tue, 8 Sep 2026 13:46:50 +0200 Subject: [PATCH] chore(deps): take vta-sdk 0.34 and TDK 0.12 so the consumer can move MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `vta-sdk` is a 0.x crate, so `"0.32"` here excludes 0.34. OpenVTC depends on both this crate and vta-sdk directly, and it is moving to the line VTI main deploys — vta-sdk 0.34, vta-service 0.24, trust-tasks 0.18, TDK 0.12. Until this requirement moves, its graph carries two sdks, and that is not merely untidy: `vti-common` re-exports `vta_sdk::acl::{ActScope, ApproveScope, ContextDirection}` as its own public API, so the copies carry types that cannot unify and the workspace stops building. That is the sixth consecutive time this edge has been the blocker (0.23, 0.25, 0.27, 0.31, 0.32, 0.34), so it is a standing obligation rather than an incident. Nothing here needs 0.34. What 0.33/0.34 change is the shape of the wire bodies — VTI #1270/#1271 made `AclEntry` and `AppStateWrite` `#[non_exhaustive]`, and #1280 replaced `create_acl`'s positional arguments with `CreateAclParams` — and this workspace names none of those types. It reaches the VTA through `connect_auto` and takes display names. No source change; check, clippy, fmt and tests are green. `affinidi-tdk` goes to 0.12 in the same step because that is what vta-sdk 0.34 declares, and `affinidi-messaging-sdk` follows to 0.22 in the lockfile for the same reason. One duplicate remains and it is the documented, bounded one: `trql-client` is still pinned at the trust-registry PR head, which is built on trust-tasks-rs 0.17.3, so the tree holds 0.17.3 beside 0.18.6. It reaches only `verify-trust`, which passes no trust-tasks type across the trql-client boundary, and `did-git-sign` — the crate OpenVTC consumes — has no trql-client edge at all. So the check reverts from its unnarrowed form to asserting the single expected parent, which the manifest comment now spells out. It clears when the registry moves to 0.18 and publishes. Signed-off-by: Glenn Gore --- Cargo.lock | 35 +++++++++++++++++++++++++---------- Cargo.toml | 35 ++++++++++++++++++++++++++++++----- 2 files changed, 55 insertions(+), 15 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index d7b2f08..75f4592 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -307,9 +307,9 @@ dependencies = [ [[package]] name = "affinidi-messaging-sdk" -version = "0.21.0" +version = "0.22.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "72f32712a19146d4a5353a98a60b676b572976a85abf318a412863389cc8f064" +checksum = "b579af2fee18048f092391f3c73e1b6a7be44fed38ed2bf79e03b58b9cafc84b" dependencies = [ "affinidi-crypto", "affinidi-did-authentication", @@ -335,7 +335,7 @@ dependencies = [ "tokio", "tokio-tungstenite", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.18.6", "uuid", ] @@ -453,9 +453,9 @@ dependencies = [ [[package]] name = "affinidi-tdk" -version = "0.10.0" +version = "0.12.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "715c365fa19276fb50332e10b922822b25d52d6119721f28abb6cac02029a365" +checksum = "796229a5640d2c8e1ae81242ff86a1147994210542e3d1cdd59ec1df12bce3ea" dependencies = [ "affinidi-crypto", "affinidi-data-integrity", @@ -5304,7 +5304,7 @@ dependencies = [ "serde_json", "thiserror", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.17.3", ] [[package]] @@ -5312,6 +5312,21 @@ name = "trust-tasks-rs" version = "0.17.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "41d841bf16638473fed22f94ce446cadcc932afc60ca3f623eef184d546d945b" +dependencies = [ + "async-trait", + "chrono", + "regress", + "serde", + "serde_json", + "serde_with", + "thiserror", +] + +[[package]] +name = "trust-tasks-rs" +version = "0.18.6" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "fe43bd5d03b468c49ffa6c75d53afca9fe27cb70b35384941db3a8c42c1da4b8" dependencies = [ "async-trait", "chrono", @@ -5538,9 +5553,9 @@ checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" [[package]] name = "vta-sdk" -version = "0.32.0" +version = "0.34.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "8f3ea9dbdad04080277acd9a57224003a73bf1300980837228792620e2d46bb5" +checksum = "e8afb6ae8320688356666abaafbcead756e5de6b728e5658a5337b9d013547f2" dependencies = [ "affinidi-crypto", "affinidi-data-integrity", @@ -5555,7 +5570,7 @@ dependencies = [ "affinidi-tdk", "affinidi-vc", "agent-names", - "base64 0.22.1", + "base64 0.23.1", "chrono", "ciborium", "curve25519-dalek 5.0.0", @@ -5573,7 +5588,7 @@ dependencies = [ "thiserror", "tokio", "tracing", - "trust-tasks-rs", + "trust-tasks-rs 0.18.6", "url", "uuid", "x25519-dalek 3.0.0", diff --git a/Cargo.toml b/Cargo.toml index 362d7dc..43c432d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -49,9 +49,24 @@ vgi-core = { version = "0.4.7", path = "crates/vgi-core" } # on the PR path is affected (CI runs fmt/clippy/check/test only) — but do not # cut a release until the registry publishes and this goes back to a version. # -# The check is the one this comment has always carried, and it now passes -# unnarrowed again: `cargo tree -d -e normal,build` lists no trust-tasks-rs and -# no vta-sdk, and `cargo tree -i vta-sdk` resolves a single node. +# The check is the one this comment has always carried, and with the stack on +# trust-tasks 0.18 it is back to the *narrowed* form rather than the unnarrowed +# one: `cargo tree -i vta-sdk` still resolves a single node, but +# `cargo tree -i trust-tasks-rs@0.17.3` now lists one parent chain and it must +# be exactly this — +# +# trust-tasks-rs v0.17.3 +# └── trql-client v0.15.0 (git ...) +# └── verify-trust +# +# The residue is tolerable only because of where it lands: `verify-trust` sends +# TRQP queries through trql-client's HTTPS transport and passes no trust-tasks +# type across that boundary, and `did-git-sign` — the crate OpenVTC actually +# consumes — has no trql-client edge at all, so the duplicate does not reach a +# graph where a type has to unify. The test is not "is there a duplicate" but +# "does it reach somewhere that has to unify", and the way to keep that honest +# is to assert the single expected parent rather than to drop the check. +# It goes away when the registry moves to 0.18 and publishes. trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", rev = "22bb9a33da6379e09027948e6c8118aeb1533754" } # VTA client for signing with DID-held keys, and the `display_name` module # (NameBook / shorten_did / verified agent names) shared with the PNM, CNM @@ -94,6 +109,16 @@ trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", # (`ClientIdentity` grew a `verification_method` member in 0.32 — VTI #1193 — # and nothing here names that type). The bump exists so the ceiling moves. # +# 0.32 -> 0.34 is the sixth, and the same shape again: OpenVTC is moving to the +# line VTI main deploys (vta-sdk 0.34, vta-service 0.24, trust-tasks 0.18, TDK +# 0.12), and this requirement is the edge that decides whether its graph holds +# one sdk or two. What 0.33/0.34 change is the shape of the wire bodies — VTI +# #1270/#1271 made `AclEntry` and `AppStateWrite` `#[non_exhaustive]`, and +# #1280 replaced `create_acl`'s positional arguments with `CreateAclParams` — +# and this workspace names none of those types, so again the bump exists only so +# the ceiling moves. `affinidi-tdk` goes to 0.12 in the same step because that +# is what vta-sdk 0.34 declares. +# # Same discipline as the trust-tasks pin below: the requirement follows what the # rest of the stack resolves, and `cargo tree -i vta-sdk` in a consumer is the # check that it worked — one row, not two. @@ -101,8 +126,8 @@ trql-client = { git = "https://github.com/affinidi/affinidi-trust-registry-rs", # Old floor notes (0.21.10 for trust-tasks-rs 0.4; the 0.23 move in #26) are # below this line by construction and kept in git history rather than as a wall # of satisfied constraints. -vta-sdk = { version = "0.32", default-features = false } -affinidi-tdk = "0.10" +vta-sdk = { version = "0.34", default-features = false } +affinidi-tdk = "0.12" multibase = "0.9" pgp = "0.20" clap = { version = "4.6", features = ["derive"] }