temp: use forked ed25519-dalek, bump rand

This commit cannot be included in a release, because it makes the codebase
rely on an unreleased crate.

Author: daviddrysdale

Cargo.lock

@@ -25,6 +25,8 @@ members = [
 
 # Patch dependencies on tink crates so that they refer to the versions within this same repository.
 [patch.crates-io]
+# TODO(#7): remove if/when https://github.com/dalek-cryptography/ed25519-dalek/pull/160 is merged.
+ed25519-dalek = { git = "https://github.com/daviddrysdale/ed25519-dalek", branch = "rand-bump" }
 rinkey = { path = "rinkey" }
 tink-aead = { path = "aead" }
 tink-awskms = { path = "integration/awskms" }

Cargo.toml

@@ -17,7 +17,7 @@ aes-gcm-siv = "^0.10"
 chacha20poly1305 = "^0.8"
 generic-array = "^0.14.4"
 prost = { version = "^0.8", default-features = false }
-rand = { version = "^0.7", default-features = false, features = ["alloc", "getrandom"] }
+rand = { version = "^0.8", default-features = false, features = ["alloc", "getrandom"] }
 spin = { version = "^0.9.2", features = ["once"] }
 tink-core = "^0.3"
 tink-mac = "^0.3"

aead/Cargo.toml

@@ -26,7 +26,7 @@ digest = "^0.9"
 hkdf = "^0.11"
 lazy_static = { version = "^1.4", features = ["spin_no_std"] }
 prost = { version = "^0.8", default-features = false }
-rand = { version = "^0.7", default-features = false, features = ["alloc", "getrandom"] }
+rand = { version = "^0.8", default-features = false, features = ["alloc", "getrandom"] }
 serde = { version = "^1.0.126", features = ["derive"], optional = true }
 serde_json = { version = "^1.0.64", optional = true }
 sha-1 = { version = "^0.9.7", default-features = false }

core/Cargo.toml

@@ -9,6 +9,9 @@ targets = [
     { triple = "x86_64-pc-windows-msvc" },
 ]
 
+[sources]
+allow-git = [ "https://github.com/daviddrysdale/ed25519-dalek" ]
+
 # Deny all advisories unless explicitly ignored.
 [advisories]
 vulnerability = "deny"
@@ -50,21 +53,6 @@ version = "=0.4.4"
 name = "security-framework-sys"
 version = "=0.4.3"
 
-# ed25519-dalek(v1.0.1) => rand_core(v0.5.x), {rand(v0.7.3) => getrandom(v0.1.*)}
-# tonic(v0.4.0) ..=> rand(v0.8.3) ..=> {rand_core(v0.6.x), getrandom(v0.2.x)}
-[[bans.skip]]
-name = "getrandom"
-version = "0.1.15"
-[[bans.skip]]
-name = "rand"
-version = "0.7.3"
-[[bans.skip]]
-name = "rand_core"
-version = "0.5.1"
-[[bans.skip]]
-name = "rand_chacha"
-version = "0.2.2"
-
 # hyper-rustls(v0.22.1) => rustls => ring(v0.16.20) => spin(v0.5.2)
 [[bans.skip]]
 name = "spin"