"no hash listed" error with -Zpackage-workspace
#14396
Labels
C-bug
Category: bug
Command-package
S-needs-info
Status: Needs more info, such as a reproduction or more background for a feature request.
Z-package-workspace
Nightly: package-workspace
Comments
workingjubilee
added
C-bug
|
CC @jneem |
|
@workingjubilee can you help me obtain that commit? A fresh clone doesn't give me it... Running that |
4 tasks
weihanglo
added
S-needs-info
|
@workingjubilee any help you can give on reproducing this? This is one of the last open questions before stabilization. |
epage
added a commit
to epage/cargo
that referenced
this issue
Jun 5, 2025
A user will now be able to use flags like `--workspace` with `cargo publish`. `cargo package` will now also work with those flags without having to pass `--no-verify --exclude-lockfile`. Many release tools have come out that solve this problem. They will still need a lot of the logic that went into that for other parts of the release process. However, a cargo-native solution allows for: - Verification during dry-run - Better strategies for waiting for the publish timeout `cargo publish` is non-atomic at this time. If there is a server side error, network error, or rate limit during the publish, the workspace will be left in a partially published state. Verification is done before any publishing so that won't affect things. There are multiple strategies we can employ for improving this over time, including - atomic publish - `--idempotent` (rust-lang#13397) - leave this to release tools to manage This includes support for `--dry-run` verification. As release tools didn't have a way to do this before, users may be surprised at how slow this is because a `cargo build` is done instead of a `cargo check`. This is being tracked in rust-lang#14941. This adds to `cargo package` the `--registry` and `--index` flags to help with resolving dependencies when depending on a package being packaged at that moment. These flags are only needed when a `cargo package --workspace` operation would have failed before due to inability to find a locally created dependency. Regarding the publish timeout, `cargo publish --workspace` publishes packages in batches and we only timeout if nothing in the batch has finished being published within the timeout, deferring the rest to the next wait-for-publish. So for example, if you have packages `a`, `b`, `c` then we'll wait up to 60 seconds and if only `a` and `b` were ready in that time, we'll then wait another 60 seconds for `c`. During testing, users ran into issues with `.crate` checksums that we've not been able to reproduce since: - rust-lang#1169 (comment) - rust-lang#14396 By stabilizing this, Cargo's behavior becomes dependent on an overlay registry. When generating a lockfile or verifying a package, we overlay the locally generated `.crate` files on top of the registry so the registry appears as it would and everything works. If there is a conflict with a version, the local version wins which is important for the dry-run mode of release tools as they won't have bumped the version yet. Our concern for the overlay registry is dependency confusion attacks. Considering this is not accessible for general user operations, this should be fine. Fixes rust-lang#1169 Fixes rust-lang#10948
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Problem
In the pgrx repo, on commit https://github.com/pgcentralfoundation/pgrx/commits/47e8465c048773bec8399fd3b50455e736ba8056
Command:
Result:
baffling? no idea what I did beyond running this command to cause this. I just dropped everything to open a report first. I've run almost this precise command several times successfully...? Now every time I run this command in that repo, with that working state, I get the error:
cargo +nightly package --workspace -Zpackage-workspace --allow-dirty --features "pg14"I saved my entire repo directory as a duplicate before I did anything else.
Steps
No response
Possible Solution(s)
No response
Notes
No response
Version
The text was updated successfully, but these errors were encountered: