Can't publish to our crates registry if git is also specified

[luciusmagn]

Hello,
I have an issue with introducing a custom registry at our company.

It's essentially described by this test:

cargo/tests/testsuite/alt_registry.rs

Lines 220 to 247 in 6b8e192

	fn registry_incompatible_with_git() {
	registry::alt_init();
	let p = project()
	.file(
	"Cargo.toml",
	r#"
	[project]
	name = "foo"
	version = "0.0.1"
	authors = []
	[dependencies.bar]
	git = ""
	registry = "alternative"
	"#,
	)
	.file("src/main.rs", "fn main() {}")
	.build();
	p.cargo("build")
	.with_status(101)
	.with_stderr_contains(
	" dependency (bar) specification is ambiguous. \
	Only one of `git` or `registry` is allowed.",
	)
	.run();
	}

We need to be able to specify both, I don't see why it should be any different from git + crates.io registry.

Why is this?

If possible, what can I do implement this ASAP?

Thanks a lot in advance for any information. 🙏

[weihanglo]

Sorry for the late reply. If I get you correct, you want something similar to multiple dependency location but for publishing to an alternative registry. Is that true?

To tell the truth, Cargo's source and registry management is undergoing a series of scrutinies and developments in recent. For example,

• issue Tracking Issue for source replacement ambiguity #10894 deals with ambiguity of source replacement when interacting with registry API.
• Issue Tracking Issue for alternative registry authentication (RFC 3139) #10474 works on authorization to make operating alternative registries more secure.
• Issue Tracking Issue for RFC 3231: Asymmetric Tokens #10519 tries to add asymmetric authentication mechanism when communicating with registries.
• Let alone one of the coolest feature HTTP sparse registry index Tracking Issue for serving an index over HTTP #9069.

Your feature request is quite an interesting use case, though from my point of view, it either directly or indirectly related to aforementioned issues. I feel like this area is somehow stuffed and may not have enough room to accept a new sizable feature at this moment.

That's my own opinion only. If someone is willing to have a discussion in depth, and able to find Cargo team members also willing to discuss, go ahead! We'd love to see thing get improved! I just doubt that chance is high. Sorry for the bad news 😞 (Or good? At least registry has been renewed these days)

[luciusmagn]

Hi, yeah, I want multiple dependency location with git + alternative registry just like how git + crates.io works. I patched it and tested it by removing the test and mimicking the behavior, and it works well enough, but of course, I don't think I have thought through all the corner cases :D

I don't think it's that big of a feature, looks to me to be more about allowing it... :)

I will look into the issues you have mentioned, thank you!

[epage]

We talked about this in the Cargo team meeting and we agree that if a user can use a git + crates.io dep, then they should be able to use a git +alt registry dep.

[luciusmagn]

Awesome, thanks a lot for discussing it!