Cargo always updates the registry index with `-Zbuild-std`

[alexcrichton]

It looks like currently Cargo will always update the registry index when using -Zbuild-std:

$ cargo new foo
$ cd foo
$ cargo +nightly build -Zbuild-std --target ...
    Updating crates.io index
...

Bisection points to this being a regression from #8834, I'm currently poking around to see if I can find something.

[ehuss]

☹️ Oh, that's a tricky one. I think the issue is that the original Cargo.lock has rustc-workspace-std-* packages registered as local path packages (because the lock was built with those in the [patch] table), but the vendored dependencies (like cfg-if) are registered in the lock as crates.io packages. By adding cfg-if to the patch set, cfg-if ends up with an unlocked dependency for rustc-workspace-std-core (because cfg-if is expecting that dependency to be from crates.io), which triggers the update.

I can't think of a simple way to fix that. Vendoring should probably use source replacement (not patches), but source replacement is a global setting that can't be easily enabled just for resolving std.

[jgouly]

I think this also stops you from using --offline with build-std.

[alexcrichton]

Hm so this is one possible solution:

diff --git a/src/cargo/core/registry.rs b/src/cargo/core/registry.rs
index 0380c447d..38f00d045 100644
--- a/src/cargo/core/registry.rs
+++ b/src/cargo/core/registry.rs
@@ -726,7 +726,9 @@ fn lock(
 
         // If this dependency did not have a locked version, then we query
         // all known locked packages to see if they match this dependency.
-        // If anything does then we lock it to that and move on.
+        // If anything does then we lock it to that and move on. This will help
+        // us to use an existing lock file as much as possible, even when new
+        // nodes and dependencies are introduced.
         let v = locked
             .get(&(dep.source_id(), dep.package_name()))
             .and_then(|vec| vec.iter().find(|&&(id, _)| dep.matches_id(id)));
@@ -737,6 +739,25 @@ fn lock(
             return dep;
         }
 
+        // Ok and failing all that, we make one last ditch attempt to search the
+        // patches as well. If our dependency matches a patch and that patch is
+        // additionally locked already, then we unconditionally use the locked
+        // patched dependency's version.
+        let v = patches
+            .get(dep.source_id().canonical_url())
+            .and_then(|vec| vec.iter().find(|id| dep.matches_ignoring_source(**id)));
+        if let Some(id) = v {
+            if let Some(locked_list) = locked.get(&(id.source_id(), id.name())) {
+                if locked_list.iter().any(|(a, _)| id == a) {
+                    trace!("\tthird hit on {}", id);
+                    let mut dep = dep;
+                    let req = VersionReq::exact(id.version());
+                    dep.set_version_req(req);
+                    return dep;
+                }
+            }
+        }
+
         trace!("\tnope, unlocked");
         dep
     })
diff --git a/tests/testsuite/patch.rs b/tests/testsuite/patch.rs
index 8e2a3b1a3..20a82b32d 100644
--- a/tests/testsuite/patch.rs
+++ b/tests/testsuite/patch.rs
@@ -2012,3 +2012,66 @@ fn can_update_with_alt_reg() {
         )
         .run();
 }
+
+#[cargo_test]
+fn use_for_new_registry_dependencies() {
+    Package::new("dep1", "0.1.0").dep("bar", "0.1").publish();
+    Package::new("bar", "0.1.0").publish();
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+                 [package]
+                 name = "foo"
+                 version = "0.1.0"
+
+                 [dependencies]
+                 dep1 = "0.1"
+
+                 [patch.crates-io]
+                 bar = { path = "bar" }
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .file("bar/Cargo.toml", &basic_manifest("bar", "0.1.0"))
+        .file("bar/src/lib.rs", "")
+        .file(
+            "dep2/Cargo.toml",
+            r#"
+                 [package]
+                 name = "dep2"
+                 version = "0.1.0"
+
+                 [dependencies]
+                 bar = "0.1"
+            "#,
+        )
+        .file("dep2/src/lib.rs", "")
+        .build();
+
+    p.cargo("check").run();
+    p.change_file(
+        "Cargo.toml",
+        r#"
+             [package]
+             name = "foo"
+             version = "0.1.0"
+
+             [dependencies]
+             dep1 = "0.1"
+             dep2 = { path = 'dep2' }
+
+             [patch.crates-io]
+             bar = { path = "bar" }
+        "#,
+    );
+    p.cargo("check")
+        .with_stderr(
+            "\
+[CHECKING] dep2 [..]
+[CHECKING] foo [..]
+[FINISHED] [..]
+",
+        )
+        .run();
+}

This is arguably a preexisting bug where if you add a dependency which transitively depends on something already patched it updates the index unnecessarily. I'm not overly confident in this diff though, it feels a bit too situation-specific and possibly runs afoul of making a too-constrained dependency graph.

[alexcrichton]

Hm with this and #8963 should we consider backing out #8834? This is probably more breakage than expected...

[ehuss]

There is also rust-lang/rust#79218. Unless @Gankra wants to put significant effort to fix the issues before the next beta, I think it might be a good idea to revert that and rust-lang/rust#78790. I am unlikely to put in the effort over the next 3 weeks to fix those issues.

[Mark-Simulacrum]

Yeah I think reverting is entirely reasonable, we can always reland

[alexcrichton]

Fixed with #8968 being merged