1842331 - ./mach cargo vet: There are some issues with your policy.audit-as-crates-io entries

Status: RESOLVED FIXED

(Firefox Build System :: General, defect)

Description

[Jeff Muizelaar [:jrmuizel]]

I get the following when trying to run ./mach cargo vet

 0:24.22 Vet error: There are some issues with your policy.audit-as-crates-io entries
 0:24.44  related error: Some non-crates.io-fetched packages match published crates.io versions
  mozilla-central-workspace-hack:0.1.0

This seems to have been caused by bug 1838354

Comment 1

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1838354

Comment 2

[Mike Hommey [:glandium]]

Bobby, can we get to the bottom of why this is happening for some people and not others? (Jeff, I suppose you're running on Windows?)

Comment 3

[Nika Layzell [:nika] (ni? for response)]

There is a published version of mozilla-central-workspace-hack on crates.io which appears to have been published by you on June 15th (https://crates.io/crates/mozilla-central-workspace-hack). This version has the same "description" as the local crate, so should be considered to match, requiring an audit-as-crates-io = false in the policy table (https://searchfox.org/mozilla-central/rev/6220909421e5cdb2e706a87f77ba7c6f4f21e4d0/supply-chain/config.toml#107-109).

I'm unsure why this wouldn't be appearing for some people. Theoretically this should be appearing for all people who run ./mach cargo vet locally (I also see it as well). Are you not seeing this show up locally? I wonder if you're ending up with an older version of cargo-vet or similar?

Comment 4

[Mike Hommey [:glandium]]

Yeah, I'm not seeing it locally.

$ ./mach cargo vet -- --version
cargo-vet 0.8.0

Are you on Windows?

Comment 5

[Mike Hommey [:glandium]]

I was able to reproduce on another machine on Linux. I'm baffled...

Comment 6

[Nika Layzell [:nika] (ni? for response)]

(In reply to Mike Hommey [:glandium] from comment #4)

Yeah, I'm not seeing it locally.

$ ./mach cargo vet -- --version
cargo-vet 0.8.0

Are you on Windows?

I tested locally on Linux. I'm curious what your crates-io-cache looks like (cargo-vet might have some cache invalidation issue for the description/repository metadata), could you try running:

jq '.crates["mozilla-central-workspace-hack"]' ~/.cache/cargo-vet/crates-io-cache.json

Comment 7

[Mike Hommey [:glandium]]

Attachment: Bug 1842331 - Add policy.mozilla-central-workspace-hack.audit-as-crates-io.

Comment 8

[Mike Hommey [:glandium]]

Figured on matrix: there is some cache invalidation issue.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/500b5babd3f3
Add policy.mozilla-central-workspace-hack.audit-as-crates-io. r=supply-chain-reviewers,bholley

Comment 10

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/500b5babd3f3