Consider replacing chrono with jiff?

[ww-oai]

Hi folks,

We're looking at integrating tough into uv, by way of sigstore-rust (which has various crates, some of which depend on tough for TUF operations against the Sigstore root of trust).

As part of that integration, we're looking for ways to reduce our dependency tree/de-proliferate our transitive deps. We're currently avoiding a dependency on chrono entirely, but tough introduces it.

So, the request: would you all consider (optionally) replacing your dependency on chrono with jiff? This has some direct advantages on your end (a smaller and more misuse-resistant API), but admittedly it's primarily an advantage for us as a downstream 😅. I can see at least two possible routes here, although others may exist:

1. Remove chrono entirely and replace it with jiff. This shouldn't be externally disruptive (FWICT, your usage of chrono is entirely internal), but it does mean changing every downstream's dependencies.
2. Keep chrono as a default-but-optional dependency, while allowing downstreams to opt into a jiff via a separate optional feature. This would allow uv (and other interested downstreams) to selecitvely opt into jiff while not disturbing the default resolution.

Please let me know if either of these sounds interesting or appealing to you all! I'm happy to implement whatever works best.

[ww-oai]

(For context, sigstore/sigstore-rust#90 is tracking a similar request, but one level up the dependency tree from uv's perspective.)

[jmt-lab]

Hello there, thanks for reaching out. We understand the desire to reduce dependency trees and requirements. However, datetimes are a pretty critical part of TUF. While using jiff might just be drop in replacement with some minor changes, this sort of change would require a lot more of manual evaluation and testing on our side, so we cannot say whether or not we can do this soon. I do want to explore this and create an analysis of this.

[CathalMullan]

Worth noting that chrono has been soft-deprecated, with jiff recommended as an alternative: chronotope/chrono#1768

[ww-oai]

Thanks @CathalMullan, I forgot to mention that! Indeed, I think that's worth noting.

(I'm happy to help with whatever validation would clear your bar here, since the use of chrono in tough is a blocker for our adoption. Anecdotally, I can say that uv's internal use of jiff has been rock-solid, and we similarly make use of time APIs in various load bearing parts of uv's functionality.)

[woodruffw]

By way of an update: we've fully removed chrono from sigstore-rust with sigstore/sigstore-rust#90, so this would be the last instance of chrono in any sigstore/uv dependency tree.

[jmt-lab]

Oh wow, was not aware of the chrono deprecation. If chrono is being deprecated then we should probably do a replace and cut over. We will need to test though to make sure we don't break backwards compatibility.

[BurntSushi]

I'm the author/maintainer of Jiff, so if there are any hurdles you run into or questions pop up, please ping me!

[jmt-lab]

PR is up: #948

@BurntSushi if you want to take a look yourself feel free to. It would be nice to have your input on it.

[jmt-lab]

We have release tough now using jiff instead of chrono! Thank you all.

[ginglis13]

Re-opening. See #950 and #951