search

M4SS-Code / cargo-goggles

Verify that registry crates in your Cargo.lock are reproducible from the git repository
https://crates.io/crates/cargo-goggles
Apache License 2.0
36 stars 2 forks source link

False positive on utf8parse 0.2.1 #5

Closed VorpalBlade closed 3 months ago

VorpalBlade commented 3 months ago

Your tag heuristics doesn't work for the crate utf8parse. It is part of a larger workspace. The correct tag to use is utf8parse_v0.2.1 not v0.2.1 (which refers to the containing project vte I believe). This is part of https://github.com/alacritty/vte

VorpalBlade commented 3 months ago

rand_core is another one that would fail in this way, except that they forgot to tag version 0.6.4 of rand_core outright.

paolobarbolini commented 3 months ago

rand_core is another one that would fail in this way, except that they forgot to tag version 0.6.4 of rand_core outright.

I think in this case we can open an issue. I've already opened a few of them like https://github.com/rust-analyzer/smol_str/issues/73

VorpalBlade commented 3 months ago

rand_core is another one that would fail in this way, except that they forgot to tag version 0.6.4 of rand_core outright.

I think in this case we can open an issue. I've already opened a few of them like rust-analyzer/smol_str#73

I already did: https://github.com/rust-random/rand/issues/1423

But even if fixed, I believe cargo-goggles would still go for the wrong tag (having the exact same issue as utf8parse in that there is both a plain 0.6.3 tag and a rand_core-0.6.3 tag, would have the exact same issue for 0.6.4 except they forgot to tag it).