search

mozilla / cargo-vet

supply-chain security for Rust
Apache License 2.0
649 stars 43 forks source link

Support crates.io installs using the http crates.io registry #496

Closed mystor closed 1 year ago

mystor commented 1 year ago

Since Rust 1.70.0, the default protocol for the crates.io registry has been the sparse protocol. This protocol uses a different directory for its caches than the previous git-based protocol, and stores the index cache very differently on disk.

We already support using the sparse protocol for reading the index directly, however we were still relying on the non-sparse index on disk in order to locate cached source directories when computing diffs and generating suggest output.

This patch stops using crates-index to locate the crates.io index, as we don't need to handle more advanced features like custom indexes. The simplified logic now checks for both the sparse and non-sparse crates.io indexes, and gracefully falls back if neither is found to downloading the crates ourselves.

mystor commented 1 year ago

This patch should also fix the windows CI failures which we observed in #492, as it is likely those errors occur because the CI machines no longer had a git registry.