Skip to content

Conversation

@moabo3li
Copy link
Contributor

registry-index is an internal-only field that Cargo uses when
packaging crates. It should not appear in user-written Cargo.toml
files as it allows bypassing the documented pattern of using
registry = "name" with .cargo/config.toml.

Fixes #15503

@rustbot rustbot added A-manifest Area: Cargo.toml issues S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Nov 23, 2025
@rustbot
Copy link
Collaborator

rustbot commented Nov 23, 2025

r? @weihanglo

rustbot has assigned @weihanglo.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

@moabo3li moabo3li force-pushed the limit_registry_index branch 2 times, most recently from fcbe47d to dfc940d Compare November 25, 2025 03:22
@rustbot
Copy link
Collaborator

rustbot commented Nov 25, 2025

This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

authors = []
[dependencies]
bar = { version = "0.1.0", registry-index = "https://example.com/index" }
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry, I didn't think about this before.

This test is relying on connecting to a third-party service and hoping it returns a 404.

  1. We generally attach public_network_test, attribute to tests connecting to third party services
  2. We should probably limit it to real ones

If we could instead get the URL for the alt registry that is setup, that would probably work better.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

@moabo3li moabo3li force-pushed the limit_registry_index branch from dfc940d to ab36df1 Compare November 25, 2025 22:49
gctx,
&mut warnings,
&mut errors,
true, // cargo_generated - this is a Cargo-generated manifest
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather than document what a boolean is, create a local variable with that name

Comment on lines +1308 to +1312
is_embedded: bool,
gctx: &GlobalContext,
warnings: &mut Vec<String>,
_errors: &mut Vec<String>,
cargo_generated: bool,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

normally gctx, warnings, and _errors would go last. feels weird to have this come after

Comment on lines +2340 to +2344
// Check if this is a packaged manifest (in target/package or target\package)
// by checking if the path contains the pattern
let path_str: Cow<'_, str> = manifest_ctx.root.to_string_lossy();
let is_packaged_manifest =
path_str.contains("target/package") || path_str.contains("target\\package");
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cargo package packages are not guaranteed to be at that location (and we have a pending PR for making cargo publish never have them there) and user packages can be at that location

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-manifest Area: Cargo.toml issues S-waiting-on-review Status: Awaiting review from the assignee but also interested parties.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Limit registry-index dependency field to registry sources only

4 participants