Add missing truncate when writing .crate files

[Embers-of-the-Fire]

What does this PR try to resolve?

Fixes #16683 by adding manuall truncate.

How to test and review this PR?

See the original issue for mCVE.

[rustbot]

r? @epage

rustbot has assigned @epage.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

• Owners of files modified in this PR: @ehuss, @epage, @weihanglo
• @ehuss, @epage, @weihanglo expanded to ehuss, epage, weihanglo
• Random selection from ehuss, epage, weihanglo

[weihanglo]

Thanks for the fix. Would you mind adding a test for it?

For bugfixes, we usually follow a variant of atomic commit pattern:

1. Commit a test that asserts the current buggy behavior (passes).
2. In the next commit, fix the bug and update the test/snapshot.

Every commit passes, and the test/snapshot diff shows the behavior change.

View changes since this review

[ehuss]

Should we consider backporting this to beta (now 1.95)? Looks like this was introduced in 1.93.

[weihanglo]

Should we consider backporting this to beta (now 1.95)? Looks like this was introduced in 1.93.

Agreed. Thanks for pointing this out.

@rustbot label +beta-nominated

[0xPoe]

Thanks!

I believe the temp registry has the same issue. Could you please fix it as well?

This case cloud help us catch the bug:

#[cargo_test]
fn repackage_smaller_local_dep_tmp_registry_checksum_match() {
    let reg = registry::init();
    let big_file_contents = "x".repeat(100_000);
    let p = project()
        .file(
            "Cargo.toml",
            r#"
                [workspace]
                members = ["foo", "bar"]
                resolver = "2"
            "#,
        )
        .file(
            "foo/Cargo.toml",
            r#"
                [package]
                name = "foo"
                version = "0.0.1"
                edition = "2021"

                [dependencies]
                bar = { path = "../bar", version = "0.0.1" }
            "#,
        )
        .file("foo/src/lib.rs", "pub fn foo() { bar::bar(); }")
        .file(
            "bar/Cargo.toml",
            r#"
                [package]
                name = "bar"
                version = "0.0.1"
                edition = "2021"
                include = ["src/**", "Cargo.toml", "big.txt"]
            "#,
        )
        .file("bar/src/lib.rs", "pub fn bar() {}")
        .file("bar/big.txt", &big_file_contents)
        .build();

    p.cargo("package --workspace --no-verify")
        .replace_crates_io(reg.index_url())
        .run();

    fs::remove_file(p.root().join("bar/big.txt")).unwrap();
    p.change_file(
        "bar/Cargo.toml",
        r#"
            [package]
            name = "bar"
            version = "0.0.1"
            edition = "2021"
            include = ["src/**", "Cargo.toml"]
        "#,
    );
    p.cargo("package --workspace --no-verify")
        .replace_crates_io(reg.index_url())
        .run();

    let index_line = read_to_string(p.root().join("target/package/tmp-registry/index/3/b/bar"))
        .unwrap()
        .lines()
        .last()
        .unwrap()
        .to_owned();
    let expected_cksum = serde_json::from_str::<serde_json::Value>(&index_line)
        .unwrap()
        .get("cksum")
        .and_then(|value| value.as_str())
        .unwrap()
        .to_owned();

    let crate_contents = fs::read(p.root().join("target/package/tmp-registry/bar-0.0.1.crate"))
        .unwrap();
    let actual_cksum = registry::cksum(&crate_contents);

    assert_eq!(
        expected_cksum, actual_cksum,
        "tmp-registry crate checksum should match index entry"
    );

    p.cargo("package --workspace")
        .replace_crates_io(reg.index_url())
        .run();
}

I would suggest that when adding the test, the Conventional Commit Message should start with test: instead of add: .

View changes since this review

[rustbot]

Reminder, once the PR becomes ready for a review, use @rustbot ready.

[Embers-of-the-Fire]

Well, seems irrelavent with my code. @rustbot ready

[weihanglo]

Thanks!

View changes since this review

PR author has made the test and change.