--dry-run does not validate dependencies

[VictorKoenders]

Currently running cargo publish --dry-run succeeds if the crate has wildcard dependencies. It would be nice if --dry-run would fail or give a warning if there are wildcard dependencies

When running cargo publish, the user then gets (correctly) prompted this error:

error: api errors: wildcard (`*`) dependency constraints are not allowed on crates.io. See https://doc.rust-lang.org/cargo/faq.html#can-libraries-use--as-a-version-for-their-dependencies for more information

Possibly other validations could be performed on a dry run as well

[eminence]

Triage: a cargo publish --dry-run today will still not give an error.

But I'm wondering: as best I can tell, the decision to reject packages with wildcard dependencies is a policy decision by crates.io, not cargo. Given that cargo can work with other registries, it doesn't seem like cargo itself should be checking this. In order to implement this feature, we could imagine an extension to the /api/v1/crates/new API could be used to ask the registry to do its own dry-run validation and return the results (but this obviously would require a bit of design work and coordination).

[ehuss]

Yea, there's a brief overview of what a new publish API should handle at rust-lang/crates-io-cargo-teams#82. Dry-run and staged publishing would all be nice things to have.

[epage]

Another perspective on this is that from cargo-release. I'd like everything validated before I've prompted the user on whether to release or not. It can be frustrating for users to get part way through to find an error, even if its recoverable (revert the release commit); its still speed bumps they have to deal with.

No idea what the right answer is though.

[epage]

Added to #4377 and closing in favor of that