crates-io 0.32.0 published but then (accidentally) downgraded and published again as 0.31.1?

[decathorpe]

The version of the crates-io crate was bumped to 0.32.0 in this commit:
5a1862c

It looks like this exact commit was published to crates.io as version 0.32.0.
It's hard to tell, because the published crate does not contain a .cargo_cvs_info.json file for some reason?

However, the immediately next commit reverted the version back to 0.31.0, and was incremented to 0.31.1 in a later commit, which was then published to crates.io as 0.31.1. This is also reflected by the fact that 0.31.1 was published later than 0.32.0: https://crates.io/crates/crates-io/versions

I found this discrepancy because I hit a strange issue where the crates-io crate source code is missing the is_url_crates_io function in the "latest" version (0.32.0) but the function is definitely there in the git repo.

[ehuss]

I don't know how that happened. It looks like it was published on 2020-04-23 as part of the 1.43 release, but the version on that branch https://github.com/rust-lang/cargo/blob/rust-1.43.0/crates/crates-io/Cargo.toml#L3 is 0.31.0.

@Mark-Simulacrum Did someone maybe manually change the version in crates-io and publish it? Unfortunately it looks like cargo:0.44.0 was also manually modified to depend on crates-io:0.32, so we can't yank it.

I'm not sure if T-release is using the publish.py script or not, but it was intended to avoid problems like this.

I don't think there's anything we can do at this point. We'll need to remember to skip 0.32 next time there is a breaking change to the crates-io crate.

[Mark-Simulacrum]

It... is plausible? 1.43 was so far back that I don't actually remember anything :)

The current release instructions say:

Tag Cargo the same way as rust-lang/rust and then run cargo publish for the tag you just created. You'll first need to comment out cargo-test-macro from Cargo.toml, then publish crates-io (in crates/crates-io) and finally publish cargo itself.

To publish Cargo you may have to bump the version numbers for the crates-io and Cargo crates; there's no need to do that in a formal commit though, so your tag and the published code may differentiate in that way.

That doesn't mention publish.py, but I think I have been using it -- I'm not sure about @pietroalbini. We should rework those instructions to use publish.py -- ideally, before the next release December 31st so that I can verify they match reality.

[ehuss]

Posted rust-lang/rust-forge#478 to update the instructions.

[decathorpe]

If it helps, this is the commit that downgraded the crates-io version from 0.32 to 0.31:
944f504#diff-fd44edb3791b8a3306d2d525ec270889e82bfafca9de71d1b39f29a14073b2cc

- this commit was pushed after 0.32 was published to crates.io.

This later commit bumped the version from 0.31 to 0.31.1, which was then published at some point, as well:
65274ea#diff-fd44edb3791b8a3306d2d525ec270889e82bfafca9de71d1b39f29a14073b2cc

Because the crates also do not seem to be published with the standard process (cargo publish), they don't contain .cargo_vcs_info.json files, so I can't tell for sure which refs were published - which seems a bit bad concerning reproducibility, transparency, and accountability?