Rejects publishing packages with wildcard version constraints (#5941)

[joelgallant]

This should reject both --dry-run and a full cargo publish. It also only applies for the crates.io registry, which is probably fine, but easy to change.

[rust-highfive]

r? @matklad

(rust_highfive has picked a reviewer for you, use r? to override)

[alexcrichton]

Thanks for the PR! I'm not really sure what the best way is to handle this though. These types of checks are left to be server-side on crates.io intentionally so crates.io can curate packages as necessary (and allow for different behavior across different registries). I'm wary about duplicating this sort of work across multiple locations, and if we want this to be a guarantee on crates.io we must implement it in on crates.io at least.

To that end I definitely agree that it's not great that --dry-run doesn't perform 100% of the checks of cargo publish, but I'm not sure it ever realistically can as crates.io can tweak various heuristics over time

[sfackler]

One option could be to add a dry-run API to crates.io itself - the crate is still uploaded but crates.io only runs its checks and doesn't actually commit the publish.

[alexcrichton]

That sounds like a great idea to me!

[joelgallant]

Note that @sgrif has opened rust-lang/crates.io#1517, so once that lands this would be doable via hitting the API with dry_run=1 instead.

[sgrif]

If, not when :)

[alexcrichton]

Ok for now I'm going to close this as I think we probably won't want to take this particular strategy, but rust-lang/crates.io#1522 should hopefully provide a number of improvements for Cargo here!