EmbarkStudios / cargo-deny

❌ Cargo plugin for linting your dependencies πŸ¦€

Home Page:http://embark.rs

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Bug: Checking for yanked crates fails with local registry

sgasse opened this issue Β· comments

Describe the bug

When using a local registry mirror setup with cargo-local-registry, cargo deny check fails to check for yanked versions.

To reproduce

  1. Install cargo-local-registry
  2. Run cargo local-registry --sync Cargo.lock registry
  3. Update .cargo/config.toml according to the instructions, replacing crates.io with the local registry
  4. Run cargo deny check

Every dependency will be reported with something like this:

warning[index-failure]: unable to check for yanked crates
   β”Œβ”€ /<censored>/workspace/examples/local_reg_yanked/Cargo.lock:15:1
   β”‚
15 β”‚ tokio 1.38.0 registry+https://github.com/rust-lang/crates.io-index
   β”‚ ------------------------------------------------------------------ crate whose registry we failed to query
   β”‚
   = the url '/<censored>/workspace/examples/local_reg_yanked/registry' is invalid
   = tokio v1.38.0
     └── local_reg_yanked v0.1.0

cargo-deny version

0.14.24

What OS were you running cargo-deny on?

Linux

Additional context

I don't know if a local registry mirror created with cargo-local-registry theoretically contains the information about yanked crates. If so, did the way cargo deny queries for it change? I think this still worked a while back with the same local registry setup.