Crates.io: Cannot publish crates with crates repository mirrored
In my region, the connection to crates.io is extremely slow, so I change the repository of crates to the mirror by this reference, and my ~/.cargo/config is:
[source.crates-io]
registry = "https://github.com/rust-lang/crates.io-index"
replace-with = 'ustc'
[source.ustc]
registry = "git://mirrors.ustc.edu.cn/crates.io-index"
But when I publish a crate use cargo publish, the following error occurs:
Updating `git://mirrors.ustc.edu.cn/crates.io-index` index
error: crates cannot be published to crates.io with dependencies sourced from other
registries. `serde` needs to be published to crates.io before publishing this crate.
(crate `xxxx` is pulled from registry `https://github.com/rust-lang/crates.io-index`)
"xxxx" is a crate in my dependencies.
And if I delete the ~/.cargo/config, there is no error.
Evian-Zhang
>All comments
@Evian-Zhang unfortunately mirroring of the index isn't really something we officially support at the moment. However, we do have some ideas for improvements that we are working on. I'll ping this thread for feedback once we have the initial proposal together.
The error message is confusing in this situation, but appears to come from these lines in cargo.
While it does not appear that a request was ever sent to crates.io (or your configured mirror), you should be aware of the risks and mitigations described in rust-lang/cargo#6545. If you think it's possible your token was ever sent to a mirror, then you should revoke your current API token and create a new one at https://crates.io/me.
As a temporary solution, when publishing you can comment out the replace-with line to avoid triggering this error message in cargo and ensure that you are hitting the upstream index. Please also ensure to apply any needed mitigations to protect other cargo commands, like cargo yank and cargo owner.
jtgeibel
on 7 Mar 2020
Related issues
ehuss
路
5Comments
vignesh-sankaran
路
5Comments
seeekr
路
7Comments
tomaka
路
6Comments
est31
路
8Comments
Most helpful comment
@Evian-Zhang unfortunately mirroring of the index isn't really something we officially support at the moment. However, we do have some ideas for improvements that we are working on. I'll ping this thread for feedback once we have the initial proposal together.
The error message is confusing in this situation, but appears to come from these lines in cargo.
While it does not appear that a request was ever sent to crates.io (or your configured mirror), you should be aware of the risks and mitigations described in rust-lang/cargo#6545. If you think it's possible your token was ever sent to a mirror, then you should revoke your current API token and create a new one at https://crates.io/me.
As a temporary solution, when publishing you can comment out the
replace-withline to avoid triggering this error message in cargo and ensure that you are hitting the upstream index. Please also ensure to apply any needed mitigations to protect other cargo commands, likecargo yankandcargo owner.