Cargo vendor: add source rewriting for private registries included in deps #14716
Conversation
|
Thanks for the pull request, and welcome! The Rust team is excited to review your changes, and you should hear from @ehuss (or someone else) some time within the next two weeks. Please see the contribution instructions for more information. Namely, in order to ensure the minimum review times lag, PR authors and assigned reviewers should ensure that the review label (
|
rustbot
added
Command-vendor
S-waiting-on-review
P-E-Meunier
force-pushed
the
master
branch
2 times, most recently
from
8017eaa to
8e9e0ce
Compare
… deps In the case where the exact same dependency is supplied by two different registries, Cargo.lock keeps only one. However, in that case, the output of `cargo vendor` contains only the registry from Cargo.lock, which isn't enough to compile with `--offline`. This commit adds the dependencies' registries of all vendored packages to the output of `cargo vendor`.
There was a problem hiding this comment.
Thanks for the pull request. Could you provide a bug reproduction and open an issue first? Without that it is not immediately clear what this patch is for. That workflow is also encouraged in Cargo Contributor Guide.
There was a problem hiding this comment.
The contributing guide also encourages writing tests. Tests added before the commit of the actual fix can be seen as an MRE, letting people understand the problematic behavior indeed exists. See https://doc.crates.io/contrib/process/working-on-cargo.html#submitting-a-pull-request
There was a problem hiding this comment.
This only happens when you have two copies of the same private registry, which is hard to test. But I'd of course welcome guidance on that if this is implemented somewhere.
|
Thanks for the review, I added a detailed explanation in a new issue. |
|
Minimal reproduction: https://github.com/P-E-Meunier/cargo-vendor-test |
In the case where the exact same dependency (hash-wise) is supplied by two different registries, Cargo.lock keeps only one sources. However, in that case, the output of
cargo vendorcontains only the registry from Cargo.lock, which isn't enough to compile with--offline.This PR fixes this by adding the dependencies' registries of all vendored packages to the output of
cargo vendor.