How to generate Cargo.lock based on last month's crates.io?

Question

I want to create a Cargo.lock file in a Rust project from Cargo.toml based on what was available on 22 Feb 2017. I need to make version selection compatible to what would happen on that specific day. (No, don't have a version controlled Cargo.lock around somewhere.)

I tried this to no avail:

Clone the crates.io index into a local directory and check out an older commit that matches the desired date.

Use the following lines in .cargo/config:

[source.mycrates]
registry = "file:///path/to/crates.io-index"  # contains old checkout

[source.crates-io]
replace-with = "mycrates"

Nevertheless, cargo resolves dependencies in Cargo.toml to the newest ones available, not to the newest ones in the specified checkout.

How could I warp Cargo's version selection back in time?

Sounds a bit like an [XY Problem](https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem). What exactly are you trying to achieve with this? — Jan Hohenheim, Jul 07 '17 at 07:41
My concrete use case is to create a Cargo.lock that works with a specific crates.io snapshot in NixOS' Rust infrastructure. — Christian Kauhaus, Jul 12 '17 at 12:51
I get that, but why does it have to be a snapshot? Why can't it be live? — Jan Hohenheim, Jul 13 '17 at 13:54

score 1 · Answer 1 · edited Jun 20 '20 at 09:12

Since you say you've already tried cloning the index, I'll assume you still have it lying around. For the benefit of other readers, the repository appears to be maintained in Git and is available at https://github.com/rust-lang/crates.io-index.

You'll need to tell cargo to run with --frozen so that it doesn't touch the network, q.v. the Cargo FAQ, and it will blow up if it thinks it needs to. If it has already downloaded stuff, you'll need to cargo clean too, or otherwise nuke the cache.

If you don't already all of the packages you need in the checkout, you'll also need to download the specific versions you're interested in. Dissecting Crates.io: Bare Minimum Mirror has an explanation, which I'll summarize here in case the link blows up.

config.json in the root of the Crates repo has the URLs for downloading packages, which are officially considered unstable, but works right now.

The example from the libc crate used by the "gmjosack" shows a path of /api/v1/crates/libc/0.1.10/download to download it, based upon the dl key of https://crates.io/api/v1/crates in config.json and the version available at the time of the post.

You'll probably need to script the downloads in order to build up your mirror. See also: Downloading Rust crates using a web browser on stackoverflow.

How to generate Cargo.lock based on last month's crates.io?

1 Answers1

Linked