Fix deeply nested registries

[szlend]

Motivation

This allows building packages with crates from custom registries that reference other custom registries.

It works by scanning packages from Cargo.lock and adding any missing registries to crane's generated .cargo/config.toml. This matches Cargo's behavior where the top level project doesn't necessarily have to explicitly define all transitive registries.

Fixes #456

Checklist

• added tests to verify new behavior
• added an example template or updated an existing one
• updated docs/API.md (or general documentation) with changes
• updated CHANGELOG.md

[szlend]

Not sure what the best way would be to add a regression test. We already rely on alexandria for alt-registry tests, but we'd need another registry. In my reproduction example (https://github.com/szlend/crane-reg-test) I simply forked the alexandria index to have a second copy of the registry.

[ipetkov]

Thank you so much for fixing this @szlend ! This solution looks great, the cargo docs on source replacement do not cover this at all but using the registry url in place of [source.${name}] is definitely the correct thing to do because this is exactly what cargo vendor does. I also confirmed that this does fix the build for https://github.com/szlend/crane-reg-test (after adding in pkg-config and openssl to the inputs that is).

Not sure what the best way would be to add a regression test. We already rely on alexandria for alt-registry tests, but we'd need another registry. In my reproduction example (https://github.com/szlend/crane-reg-test) I simply forked the alexandria index to have a second copy of the registry.

I do think your reproduction is a great addition to have, but happy to do the same under my own name so you aren't on the hook for not breaking the test suite ;)

[ipetkov]

Is there anything you had to do to get cargo to mix and match the registries in the Cargo.lock file or did you manually edit one in to reproduce the issue?

[ipetkov]

Oh I see you published an actual crate to the upstream index

[ipetkov]

Not sure the best way to proceed tbh, seems like we'd need to push more versions of crane test crates to the alexandrie index to untangle but I'm not 100% sure if we want to have to rely on them that way. Perhaps at some point it may be worth looking into standing up a https://kellnr.io instance just for our own testing (maybe even an ephemeral one in a NixOS VM test?), but I definitely don't want to block on that. Happy to merge this as in and fix the issue and we can circle back if we ever have a regression