rebar3 hex publish incompatible with pkg_hash_ext rebar.lock

[seriyps]

It seems hex.pm publishing is broken when rebar3.lock contains pkg_hash_ext section.

$ rebar3 report hex publish                                                                                                                                                                    [18:09:44]
Rebar3 report
 version 3.13.0+build.4520.reff957b5a8
 generated at 2020-04-10T16:10:05+00:00
=================
Please submit this along with your issue at https://github.com/erlang/rebar3/issues (and feel free to edit out private information, if any)
-----------------
Task: hexpublish
Entered as:
  hexpublish
-----------------
Operating System: x86_64-pc-linux-gnu
ERTS: Erlang/OTP 22 [erts-10.4.4] [source] [64-bit] [smp:4:4] [ds:4:4:10] [async-threads:1]
Root Directory: /usr/lib/erlang
Library directory: /usr/lib/erlang/lib
-----------------
Loaded Applications:
bbmustache: 1.8.0
certifi: 2.5.1
cf: 0.2.2
common_test: 1.17.3
compiler: 7.4.4
crypto: 4.5.1
cth_readable: 1.4.8
dialyzer: 4.0.3
edoc: 0.11
erlware_commons: 1.3.1
eunit: 2.3.7
eunit_formatters: 0.5.0
getopt: 1.0.1
hipe: 3.19.1
inets: 7.0.9
kernel: 6.4.1
providers: 1.8.1
public_key: 1.6.7
relx: 3.33.0
sasl: 3.4
snmp: 5.3
ssl_verify_fun: 1.1.5
stdlib: 3.9.2
syntax_tools: 2.2
tools: 3.2

-----------------
Escript path: /usr/local/bin/rebar3
Providers:
  app_discovery as auto clean compile compile cover ct cut deps dialyzer do docs edoc escriptize eunit get-deps help install install_deps key list lock new owner path pkgs publish release relup repo report repos retire revert search shell state tar tree unlock update upgrade upgrade upgrade user version xref

rebar3_hex verion is 6.9.3.

I added some "io:format"'s for internal variables in rebar3_hex_publish.erl and that's what I found:
Here it expects Deps to be a tuple of the form {X, <tuple-of-4>, 0} but what it is in reality is {X, <tuple-of-5>, 0}

https://github.com/tsloughter/rebar3_hex/blob/d23afbb63ec91ddb37ec54a97c24407376840186/src/rebar3_hex_publish.erl#L142-L143

Example from jesse library:

publish/3: Deps=[{<<"jsx">>,                                                                                                                                                                                                       
                {pkg,<<"jsx">>,<<"2.9.0">>,                                                                                                                                                                                      
                     <<"D2F6E5F069C00266CAD52FB15D87C428579EA4D7D73A33669E12679E203329DD">>,                                                                                                                                     
                     <<"8EE1DB1CABAFDD578A2776A6AAAE87C2A8CE54B47B59E9EC7DAB5D7EB71CD8DC">>},                                                                                                                                    
                0},
               {<<"rfc3339">>,
                {pkg,<<"rfc3339">>,<<"0.2.2">>,
                     <<"1552DF616ACA368D982E9F085A0E933B6688A3F4938A671798978EC2C0C58730">>,
                     <<"986D7F9BAC6891AA4D5051690058DE4E623245620BBEADA7F239F85C4DF8F23C">>},
                0}]
TopLevel=[]
Excluded=[]
publish/8: Deps1=[]
ConfigDeps=[{jsx,"2.9.0"},{rfc3339,"0.2.2"}]
Deps=[]

This caused some troubles for a Jesse library release: it has 2 dependencies, but it was published to hex.pm like there is none: for-GET/jesse#88

[seriyps]

I guess it was broken by this PR: erlang/rebar3#2213

[tsloughter]

Damn, thanks for the detail into the issue, shouldn't be hard to fix.

[seriyps]

Oh, I tried to re-build my rebar3 from git 3.13.1 tag and it seems to work now! Even though it still reports itself as 3.13.0:

./rebar3 report hex publish
Rebar3 report
 version 3.13.0
 generated at 2020-04-10T16:46:07+00:00
=================
Please submit this along with your issue at https://github.com/erlang/rebar3/issues (and feel free to edit out private information, if any)
-----------------
Task: hexpublish
Entered as:
  hexpublish
-----------------
Operating System: x86_64-pc-linux-gnu
ERTS: Erlang/OTP 22 [erts-10.4.4] [source] [64-bit] [smp:4:4] [ds:4:4:10] [async-threads:1]
Root Directory: /usr/lib/erlang
Library directory: /usr/lib/erlang/lib
-----------------
Loaded Applications:
bbmustache: 1.8.0
certifi: 2.5.1
cf: 0.2.2
common_test: 1.17.3
compiler: 7.4.4
crypto: 4.5.1
cth_readable: 1.4.6
dialyzer: 4.0.3
edoc: 0.11
erlware_commons: 1.3.1
eunit: 2.3.7
eunit_formatters: 0.5.0
getopt: 1.0.1
hipe: 3.19.1
inets: 7.0.9
kernel: 6.4.1
providers: 1.8.1
public_key: 1.6.7
relx: 3.33.0
sasl: 3.4
snmp: 5.3
ssl_verify_fun: 1.1.5
stdlib: 3.9.2
syntax_tools: 2.2
tools: 3.2

-----------------
Escript path: /home/seriy/workspace/jesse/rebar3
Providers:
  app_discovery as auto clean compile compile cover ct cut deps dialyzer do docs edoc escriptize eunit get-deps help install install_deps key list lock new owner path pkgs publish release relup repo report repos retire revert
 search shell state tar tree unlock update upgrade upgrade upgrade user version xref 

So pparently I had some minor version incompatibilities here. Sorry for confusion, please feel free to close!

[tsloughter]

Oh ok, good to know, thanks.