itsscb/cargo
1
0
Fork 0
mirror of https://github.com/rust-lang/cargo.git synced 2025-10-01 11:30:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(vendor): trust crate version only when coming from registries

Browse Source
This commit is contained in:
Guillaume Dallenne 2024-09-11 11:32:13 +02:00
parent 5fa43ee1c5
commit a53b81a49d
No known key found for this signature in database
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/cargo/ops/vendor.rs
View File

@ -207,8 +207,10 @@ fn sync(
let dst = canonical_destination.join(&dst_name); let dst = canonical_destination.join(&dst_name);
to_remove.remove(&dst); to_remove.remove(&dst);
let cksum = dst.join(".cargo-checksum.json"); let cksum = dst.join(".cargo-checksum.json");
if dir_has_version_suffix && cksum.exists() { // Registries are the only immutable sources,
// Always re-copy directory without version suffix in case the version changed // path and git dependencies' versions cannot be trusted to mean "no change"
if dir_has_version_suffix && id.source_id().is_registry() && cksum.exists() {
// Don't re-copy directory with version suffix in case it comes from a registry
continue; continue;
} }

2
tests/testsuite/vendor.rs
View File

@ -1626,7 +1626,7 @@ fn git_update_rev() {
.run(); .run();
let lib = p.read_file("vendor/a-0.1.0/src/lib.rs"); let lib = p.read_file("vendor/a-0.1.0/src/lib.rs");
assert_e2e().eq(lib, ""); assert_e2e().eq(lib, "pub fn f() {}");
} }
#[cargo_test] #[cargo_test]