Cargo and/or other tools add Cargo.lock files and other build artifacts to registry

[mykmelez]

As described in bug 1461553, comment 2 and later comments, Cargo and/or other tools that are using Cargo's global registry sometimes add Cargo.lock files to the crate directories (i.e. unpacked tarballs) in the registry. And they've been known to add other files as well, f.e. the lalrpop crate directory sometimes sprouts the file src/parser/lrgrammar.rs.

Cargo.lock and src/parser/lrgrammar.rs are both build artifacts, so presumably this is caused by a tool that is building the crate directly within the registry directory. Unfortunately, Cargo and tools like cargo-vendor assume that the registry is immutable, so these added files cause unwanted effects, like unexpected changes to already-vendored crates when vendoring unrelated ones (or even simply re-running cargo-vendor after adding no new crates).

Over in that bug, @alexcrichton notes a few options for resolving the issue:

One change would be to have cargo-vendor work directly from the tarballs instead of the checked-out state, but such a change isn't entirely trivial to implement today. Otherwise Cargo could also do something like periodically execute a sanity check to make sure checked out crates look alright.
…
I'd personally prefer to dig in and discover what crates are modifying the registry. I suspect it's actually very few but perhaps heavily depended on ones that have consequences for the ecosystem.

In the meantime, a workaround is to delete the registry (rm -rf ~/.cargo/registry), which Cargo will then repopulate as needed.

[epage]

The reasond packages may be doing this

• build.rs files that don't follow the rules of writing to OUT_DIR
• build.rs running cargo commands within the PACKAGE_DIR to do various forms of introspection.

A combination of the following would fix this

• Sandboxing (Sandbox/jail build scripts #5720)
• Never extracting .crate files (https://internals.rust-lang.org/t/jar-for-rust-single-file-crate-support-for-rustc/19576)

However, as the underlying need was resolved in cargo-vendor#131, I'm going to go ahead and close this.

[weihanglo]

The other relevant issue is #9455 for making unpacked tarballs and directories "read-only".