Challenges in Publishing Zebra v2.0.0-rc.0 to crates.io

[oxarbitrage]

We successfully published the Zebra v2.0.0-rc.0 release on GitHub on 2024-10-11. The corresponding release pull request can be found here: PR #8927.

However, due to the patches introduced in Zebra PR #8918, we encountered issues when attempting to publish the release to crates.io.

You can replicate the error by running the following command in the main branch:

cargo release publish --verbose --workspace --execute

In my first attempt, only the zebra-tests crate was successfully published. This crate is now updated on crates.io: zebra-test, while all other crates failed to publish.

Unfortunately, the dry-run feature didn't catch this issue ahead of time. It would be ideal if such errors were detected before the actual publishing attempt. Tools like cargo-sanitize could potentially help, but I haven't had the chance to test them yet.

There are several potential solutions to resolve this issue, though there may be more:

1. Request ECC to Publish Patches
   We could request the ECC to publish the patched versions as minor releases on crates.io. For example, in Cargo.toml, zcash_primitives is at version 0.17, with a patch below for local builds. Requesting ECC to publish the patch as zcash_primitives version 0.17.x would allow us to update our dependencies accordingly. This would need to be done for all affected patches. We likely wouldn’t need to create a patch release ourselves, just merging the changes to main should suffice.

2. Use the --no-verify Option
   Another approach would be to try using the --no-verify option when publishing, bypassing the build step. However, it's unclear if this will resolve the issue.

3. Delay crates.io Publishing
   Alternatively, we could wait for the next release (scheduled for less than five weeks from now) before upgrading the crates on crates.io and go directly to a new version.