Skip to content

Check entries' paths rather than path_bytes#114

Merged
Shnatsel merged 1 commit intorust-secure-code:masterfrom
smoelius:deleted-crates
Feb 5, 2026
Merged

Check entries' paths rather than path_bytes#114
Shnatsel merged 1 commit intorust-secure-code:masterfrom
smoelius:deleted-crates

Conversation

@smoelius
Copy link
Collaborator

@smoelius smoelius commented Feb 5, 2026

This PR changes how db-dump.tar.gz entries are checked. Instead of using path_bytes, the new code uses path.

crates.io recently started publishing deleted crates in a file deleted_crates.csv: rust-lang/crates.io#12803

That file would match this line:

} else if entry.path_bytes().ends_with(b"crates.csv") {

Thus, if deleted_crates.csv appeared later than crates.csv in db-dump.tar.gz, deleted_crates.csv would be used to populate crates.json.

The net effect was the following. If a user did cargo supply-chain update --cache-max-age=0s, everything would appear to update fine. But if the user then did cargo supply-chain json, the wrong crates would be in crates.json and they would have to be downloaded (i.e., the cache would provide no benefit).

Nits are welcome.


Separate from the above, would you consider a PR to rename --cache-max-age to --max-age, but keep --cache-max-age as an alias?

@Shnatsel Shnatsel merged commit bd853ad into rust-secure-code:master Feb 5, 2026
3 checks passed
@Shnatsel
Copy link
Member

Shnatsel commented Feb 5, 2026

Separate from the above, would you consider a PR to rename --cache-max-age to --max-age, but keep --cache-max-age as an alias?

Not really. --max-age is an awkward middle ground that's neither descriptive nor quick to type. If you need something that can be quickly typed, we should add a single-letter alias.

@smoelius
Copy link
Collaborator Author

smoelius commented Feb 5, 2026

Thanks for your response, and thanks for the rapid merger of this PR! ⚡

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants