Replace unmaintained cbor implementation

[apoelstra]

I noticed when trying to check minimal dependency versions that cbor depends on rustc_serialize 0.3.0 (lol) which doesn't compile. rustc_serialize 0.3.24 does compile, so there is no problem, except when you try to use -Z minimal-versions.

However apparently, cbor has been unmaintained for the last 4 years.. Furthermore, its replacement serde_cbor has been unmaintained for 18 months. So maybe we need to move away from it anyway.

It looks like a good replacement would be minicbor but I haven't investigated yet. Noting for later.

[apoelstra]

rustc-serialize 0.3.20 is the oldest version that compiles, for future reference.

[apoelstra]

In addition to replacing cbor we also need cargo update -p serde_test --precise 1.0.19 (or rather, a minimal serde_test version of 1.0.19) because we depend on the Configure struct which is not available in earlier versions.

[Kixunil]

Since it's only used in test I think just using serde_test deferring to this statement is OK?

If the crate works for you there is no need to switch to another implementation.

Security vulnerabilities shouldn't be a problem unless they start needlessly annoying people using cargo audit or something.

we also need cargo update -p serde_test --precise 1.0.19

No, that's actually our Cargo.toml being wrong. It should say serde_test = "1.0.19", not serde_test = "1.0".

[apoelstra]

I think we need to move away from cbor, because right now we cannot compile this library with -Z minimal-versions, and one reason is that cbor has mis-specified their rustc-serialize dependency as being too low, and we can't fix it because the library is unmaintained.

[apoelstra]

I'm pretty skeptical of using serde_test and nothing else. AFAICT serde_test provides zero value for something where all the objects are bytestrings, because it interprets ownership in ways that aren't consistent with actual deserializers.

[Kixunil]

we can't fix it because the library is unmaintained.

Actually we can if we rename cbor crate and have cbor feature which depends on whichever rustc-serialize version is the right one. I'm not suggesting this is great, moving is better.

I'm pretty skeptical of using serde_test and nothing else.

Yeah, while it's annoying to have to test multiple formats it seems to be the least bad solution.