Cargo fails to add dependency if it is renamed, gated, and in private registry

[sukhmel]

Problem

When a dependency is renamed (e.g. http@0.2 is referred as http_0_2 to be able to add compatibility features), gated behind a feature (e.g. compat-http), and published to a private registry, this dependency does not make it into Cargo.lock, output of cargo tree, and fails to compile with a message about undeclared module, e.g.:

8 |  pub use http_0_2::{
  |         ^^^^^^^^ use of undeclared crate or module `http_0_2`

Steps

1. Add renamed optional dependency

   http_0_2 = { package = "http", version = "0.2", optional = true }

2. use it from another crate

   example-dependency = { registry = "kellnr", version = "0.1", features = ["compat-http"] }

3. Run kellnr locally:

   docker run --rm -it \
       -p 8000:8000 \
       -e "KELLNR_ORIGIN__HOSTNAME=localhost" ghcr.io/kellnr/kellnr:5.0.0

4. Publish example-dependency:

   cargo publish --registry kellnr -p example-dependency

5. Build a dependent crate:

   cargo build -p usage-registry

Example repository: https://github.com/sukhmel/renamed-dependency-missing-for-feature

Possible Solution(s)

I think, this may be mitigated by adding a crate that reimports the crate that was supposed to be renamed (or several crates at once)

Notes

both feature gate and rename are required to produce a failure:

# feature gated, but not renamed - OK
http = { package = "http", version = "1.0", optional = true }
# feature gated and renamed - does not work
http_0_2 = { package = "http", version = "0.2", optional = true }
# renamed, but not feature gated - OK
either_1_13 = { package = "either", version = "1.13" }
# not renamed, not feature gated - OK
void = "1.0"

Possibly a bug in https://github.com/kellnr/kellnr but Cargo.toml for the package seems correct: example-dependency-0.1.1-Cargo.toml

Version

▷ cargo version --verbose
cargo 1.79.0 (ffa9cf99a 2024-06-03)
release: 1.79.0
commit-hash: ffa9cf99a594e59032757403d4c780b46dc2c43a
commit-date: 2024-06-03
host: aarch64-apple-darwin
libgit2: 1.7.2 (sys:0.18.3 vendored)
libcurl: 8.8.0 (sys:0.4.72+curl-8.6.0 system ssl:OpenSSL/3.0.14)
ssl: OpenSSL 1.1.1w  11 Sep 2023
os: Mac OS 14.6.0 [64-bit]

[epage]

Could you give full reproduction steps? This leaves out any of how kellnr needs to be setup.

Have you verified if any of that combination of situations can be removed and still reproduce?

• renaming, optional dep, and custom registry are involved
• the config file seems to have more content than should be relevant

[sukhmel]

I haven't set up kellnr, but will try to do so and add.

All of the other combinations are presented to demonstrate correct behaviour, both renaming and feature gate must be done

I am hesitant to publish a crate to crates.io just to try to reproduce a bug. I can add that to my existing crate and then yank a version, though

Update: I've added minimal config file and steps to run kellnr, wasn't as hard as I thought

[weihanglo]

Thank you for setting up the reproduction. It's quote smooth to follow it step-by-step!

This is a duplicate of #14321, and is fixed via #14325. The current nightly and beta channel should contain that fix.

This is the diff of old/new crate index file.

 {
   "name": "example-dependency",
   "vers": "0.1.0",
   "deps": [
      // omit...
   ],
   "cksum": "6a57a2a0b45843db52c2aef915f659de5d50a1e4ae1b3b15372d95308e434d39",
   "features": {
     "compat-http": [
+      "dep:http_0_2",
       "dep:http"
     ],
     "default": []
   },
   "yanked": false,
   "v": 1
 }

Close as the fix is already in beta and will be stable in 1.81.0

[epage]

For some extra context from the other issue: 1.78, 1.79. and 1.80 were affected. 1.81 is 4 weeks from release.

[sukhmel]

Thank you! Appreciate your answer and the details

I've tried to find an issue before opening one, but unfortunately was not fruitful in that 😅
will be looking forward to 1.81 release then