fix(vendor): state the real cargo floor for two versions

Cargo before 1.56 resolves every source-less Cargo.lock entry for a crate
through ONE [patch.crates-io] path — the entry whose key sorts last — so
with two vendored versions one lock entry is pinned to the other
version's copy and cargo build --locked fails closed with "patch for
<crate> did not resolve to any crates". The docs claimed older cargo
needed only a populated crates.io index; the index does not help. The
old-toolchain e2e passed because its fixture uuids happened to sort so
that the lower version's key came last, the one order 1.41 can take.

Verified on the rust:1.41-slim and rust:1.56-slim images with two crates
(cfg-if 1.0.5/0.1.10, lazy_static 1.5.0/0.2.11) and with three versions
(bitflags 1.2.1/0.9.1/0.8.2): only the key sort order decides, the lock
entry order does not, and 1.56 builds either way.

The e2e fixture now uses uuids whose keys sort adversarially, asserts
that order so a future uuid cannot quietly make the test toothless, and
pins the refusal below 1.56 while requiring 1.56 to build both copies.
Vendoring a second version of a crate warns with
cargo_multi_version_old_cargo unless the project's rust-version or
rust-toolchain[.toml] promises cargo 1.56 or newer; socket-patch never
runs cargo, so those files are the only signal it has. A single vendored
version still builds on 1.41.

A key-naming scheme that puts the lowest version's key last does make
1.41 resolve every entry correctly, but it would replace the documented
<name>-socket-<uuid8> key with a version-rank encoding in every project's
committed manifest, and rest correctness on an undocumented cargo
iteration order. Left out deliberately; the failure is loud, not silent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

CHANGELOG.md

@@ -97,12 +97,13 @@ into the new version's section — see docs/releasing.md.
   of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
   the patch uuid from the manifest alone and single-version wiring builds
   on cargo older than 1.56 (the floor of config-file `[patch]`; proven on
-  cargo 1.41 with no network); two vendored versions of one crate make older cargo
-  load the crates.io index to tell the two entries apart: `--offline` from
-  an empty `$CARGO_HOME` is enough on cargo 1.56, while older cargo such as
-  1.41 needs the index itself (the crates.io index in `$CARGO_HOME`, or
-  network access), and without `--offline` either one first tries to update
-  the index and fails when it is unreachable. The edit is
+  cargo 1.41 with no network). TWO vendored versions of one crate need
+  cargo 1.45 or newer: from 1.45 `--offline` from an empty `$CARGO_HOME` is
+  enough (without `--offline` it first tries to update the crates.io index
+  and fails when that is unreachable), while cargo before 1.45 resolves
+  every source-less lock entry for a crate through one `[patch]` path and
+  fails closed on the other — see the `cargo_multi_version_old_cargo`
+  entry under Fixed. The edit is
   format-preserving (comments, ordering, CRLF / mixed line endings, a
   UTF-8 BOM and the trailing-newline state survive; a revert restores the
   manifest byte for byte and keeps a user's own `[patch]` /
@@ -726,6 +727,24 @@ into the new version's section — see docs/releasing.md.
   `setup --remove` could not land byte-identical on the pre-setup file.
   `package.json` is now written in its own layout (BOM, indent, line ending,
   trailing-newline shape), the same helper the vendored backends use.
+- **Two vendored versions of one cargo crate are documented — and now
+  warned about — as needing cargo 1.45.** The docs said older cargo (1.41)
+  only needed a populated crates.io index. It needs more than that: cargo
+  before 1.45 resolves every source-less `Cargo.lock` entry for a crate
+  through ONE `[patch.crates-io]` path — the entry whose KEY sorts last —
+  so one of the two versions is pinned to the other's copy and `cargo build
+  --locked` fails closed with ``patch for `<crate>` … did not resolve to
+  any crates``, index or no index. The old-toolchain e2e passed only
+  because its fixture uuids happened to sort the other way; it now uses the
+  adversarial order, and the floor was measured rather than assumed — on
+  one two-version fixture in both key orders, 1.41.1, 1.42, 1.43 and 1.44
+  refuse the adversarial order while 1.45, 1.49, 1.53, 1.56 and current
+  stable resolve either order, each lock entry to its own copy. Vendoring a
+  second version of a crate warns with `cargo_multi_version_old_cargo`
+  unless the project's `rust-version` or `rust-toolchain[.toml]` promises
+  cargo 1.45 or newer (socket-patch never runs `cargo`, so those files are
+  the only signal it has). A SINGLE vendored version still builds on cargo
+  1.41, as before.
 - **A CRLF `Cargo.lock` stays CRLF, and reverts byte-for-byte.** Vendoring
   rewrote every line of a lock committed with Windows line endings as LF
   (`toml_edit` renders LF only), and `vendor --revert` then "restored" the

crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs

@@ -36,8 +36,8 @@
 //! tagged lock build the patched copy with no network on cargo 1.41 / 1.56
 //! — the local `rust:1.41-slim` / `rust:1.56-slim` docker images, preferred,
 //! else installed rustup toolchains 1.36..=1.56 (type-check only) —
-//! config-file `[patch]` needs 1.56+; two versions of one crate there need
-//! `--offline`; skipped when neither is available, required by the
+//! config-file `[patch]` needs 1.56+; two versions of one crate need cargo
+//! 1.45+ and `--offline`; skipped when neither is available, required by the
 //! `cargo-old-toolchains` CI leg). Also: a
 //! URL-spelled crates.io `[patch]` table is refused, an ancestor-directory
 //! config entry cannot silently shadow the vendored copy, and the pre-v5
@@ -1190,7 +1190,14 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
 
 // ── v5 manifest wiring: multi-version, legacy migration, old toolchains ─
 
-const UUID_OLD: &str = "3c4d5e6f-7081-4b2c-9d3e-123456789abc";
+/// The second patch uuid of the multi-version fixtures. Deliberately
+/// ADVERSARIAL: its `cfg-if-socket-1a2b3c4d` key sorts BEFORE `UUID`'s, so
+/// the HIGHER version's `[patch.crates-io]` key sorts LAST — the order
+/// cargo before 1.45 cannot resolve (see
+/// `cargo_vendored_two_versions_are_refused_by_cargo_below_1_45`). With the
+/// opposite order 1.41 happens to build, so a favorable pair would let a
+/// regression in the modern-cargo path go unnoticed here.
+const UUID_OLD: &str = "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
 const PATCH_SUFFIX_OLD: &str =
     "\n/// Socket-patch marker for the OLD major (added by the vendored patch).\npub fn socket_patched_old() -> u32 { 2 }\n";
 
@@ -2070,6 +2077,12 @@ const OLD_TOOLCHAINS_REQUIRED_ENV: &str = "SOCKET_PATCH_CARGO_OLD_TOOLCHAINS_REQ
 /// locally (the test never pulls; the CI leg does).
 const OLD_CARGO_IMAGES: [(&str, u32); 2] = [("rust:1.41-slim", 41), ("rust:1.56-slim", 56)];
 
+/// The cargo minor from which two vendored versions of one crate resolve in
+/// EITHER `[patch.crates-io]` key order — the floor
+/// `socket_patch_core`'s `MULTI_VERSION_CARGO_MINOR` warns below. Measured
+/// on 1.41.1/1.42/1.43/1.44 (refuse) and 1.45/1.49/1.53/1.56 (build).
+const MULTI_VERSION_FLOOR: u32 = 45;
+
 /// One old cargo under test.
 #[derive(Clone, Debug)]
 enum OldCargo {
@@ -2312,26 +2325,33 @@ fn cargo_vendored_manifest_patch_builds_on_old_toolchains() {
     }
 }
 
-/// OLD TOOLCHAIN, TWO VERSIONS of one crate: older cargo loads the
-/// crates.io index to tell two same-named `[patch]` entries apart. Every
-/// clause of the documented constraint is ASSERTED here, in both
-/// directions, because both arms run with no network (docker `--network
-/// none`, rustup pointed at a dead proxy):
+/// OLD TOOLCHAIN, TWO VERSIONS of one crate: cargo 1.45 is the FLOOR.
+///
+/// Cargo before 1.45 resolves every source-less `Cargo.lock` entry for a
+/// crate through ONE `[patch.crates-io]` path — the entry whose KEY sorts
+/// last — so with two vendored versions one lock entry is pinned to the
+/// other version's copy. The fixture uuids are chosen so the HIGHER
+/// version's key sorts last (see `UUID_OLD`), the order 1.41 cannot take;
+/// with the opposite order 1.41 happens to build, which is how the
+/// limitation went unnoticed. Asserted in every direction, with no network
+/// (docker `--network none`, rustup pointed at a dead proxy):
 ///
-/// * without `--offline` the build MUST fail, and fail on the unreachable
-///   index — the negative control for "pass `--offline`";
-/// * cargo 1.56 then builds under `--offline` from an EMPTY CARGO_HOME;
-/// * older cargo (1.41) MUST first fail even under `--offline` (no registry
-///   cache to read), and the documented remedy — a populated crates.io
-///   index in `$CARGO_HOME` — must then build (and run) both patched
-///   copies with no network. That step is unconditional below 1.56, so a
-///   cargo that stops needing it fails this test instead of silently
-///   skipping the remedy.
+/// * without `--offline` EVERY old cargo fails on the unreachable
+///   crates.io index (it loads the index to tell two same-named `[patch]`
+///   entries apart) — the negative control for "pass `--offline`";
+/// * cargo 1.45 and later then build BOTH copies under `--offline` from an
+///   EMPTY CARGO_HOME (measured on 1.45, 1.49, 1.53 and 1.56);
+/// * below 1.45 `--offline` fails on the patch resolution itself —
+///   ``patch for `cfg-if` … did not resolve to any crates`` — from an empty
+///   CARGO_HOME AND with the index remedy that makes a single vendored
+///   version work there (measured on 1.41.1, 1.42, 1.43 and 1.44). A cargo
+///   below 1.45 that starts building this fails the test instead of
+///   silently widening the supported range.
 ///
-/// Current stable needs neither — see
+/// Current stable needs none of it — see
 /// `cargo_vendor_two_versions_of_one_crate_locked_build`.
 #[test]
-fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
+fn cargo_vendored_two_versions_are_refused_by_cargo_below_1_45() {
     const SUITE: &str = "e2e_vendor_cargo_build (old-toolchain multi-version)";
     let Some(cargos) = old_cargos_or_skip(SUITE) else {
         return;
@@ -2345,6 +2365,22 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
     };
     let env = vendor_ok(&fx.proj, &fx.cargo_home, "old-toolchain multi-version");
     assert_eq!(env["summary"]["failed"], 0, "{env}");
+    // The vendor says the project now needs cargo 1.45 (the fixture
+    // declares no `rust-version` and pins no toolchain).
+    assert!(
+        env["events"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|e| e["errorCode"] == "cargo_multi_version_old_cargo"),
+        "the second version must warn about the cargo floor: {env}"
+    );
+    // The adversarial key order is what this test pins.
+    let manifest = std::fs::read_to_string(fx.proj.join("Cargo.toml")).unwrap();
+    assert!(
+        socket_key(UUID_OLD) < socket_key(UUID),
+        "the HIGHER version's key must sort last: {manifest}"
+    );
     std::fs::write(fx.proj.join("src/main.rs"), TWO_VERSION_MAIN).unwrap();
     let lock = std::fs::read_to_string(fx.proj.join("Cargo.lock")).unwrap();
     if !lock.contains("version = 4\n") {
@@ -2373,43 +2409,66 @@ fn cargo_vendored_two_versions_on_old_toolchains_need_offline() {
              wiring:\n{online_stderr}"
         );
         println!("old-toolchain multi-version {name} without --offline: needs the index");
-        let mut run = old_cargo_run(&old, &fresh, &["--offline"]);
-        if old.minor() < 56 {
-            let stderr = String::from_utf8_lossy(&run.out.stderr).into_owned();
-            assert!(
-                !run.out.status.success(),
-                "{name}: below 1.56 an EMPTY CARGO_HOME cannot tell the two [patch] \
-                 entries apart offline — the reason the index remedy is documented:\n\
-                 {stderr}"
-            );
+
+        let run = old_cargo_run(&old, &fresh, &["--offline"]);
+        let stderr = String::from_utf8_lossy(&run.out.stderr).into_owned();
+        if old.minor() >= MULTI_VERSION_FLOOR {
             assert!(
-                stderr.contains("unable to fetch registry") && stderr.contains("in offline mode"),
-                "{name}: the only accepted failure below 1.56 is the missing registry \
-                 index:\n{stderr}"
+                run.out.status.success(),
+                "{name}: 1.{MULTI_VERSION_FLOOR}+ must build two vendored versions under \
+                 --offline from an empty CARGO_HOME:\n{stderr}"
             );
-            println!("old-toolchain multi-version {name}: needs a registry index (documented)");
-            seed_old_crates_io_index(&fresh.join(".old-cargo-home"), &[&fx.new_v, &fx.old_v]);
-            run = old_cargo_run(&old, &fresh, &["--offline"]);
+            if matches!(old, OldCargo::Docker { .. }) {
+                assert!(
+                    String::from_utf8_lossy(&run.out.stdout).contains("MARKER:1:2"),
+                    "{name}: both patched copies run: {}",
+                    String::from_utf8_lossy(&run.out.stdout)
+                );
+            }
+            let _ = std::fs::remove_dir_all(&fresh);
+            continue;
         }
+
+        // Below 1.45 the patch resolution itself fails, with an empty
+        // CARGO_HOME and with the documented index remedy alike.
         assert!(
-            run.out.status.success(),
-            "{name}: two vendored versions must build under --offline:\n{}",
-            String::from_utf8_lossy(&run.out.stderr)
+            !run.out.status.success(),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} two vendored versions must NOT build \
+             offline:\n{stderr}"
+        );
+        assert!(
+            stderr.contains("did not resolve to any crates"),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} the failure is the unresolvable second \
+             `[patch]` entry:\n{stderr}"
+        );
+        seed_old_crates_io_index(&fresh.join(".old-cargo-home"), &[&fx.new_v, &fx.old_v]);
+        let seeded = old_cargo_run(&old, &fresh, &["--offline"]);
+        let seeded_stderr = String::from_utf8_lossy(&seeded.out.stderr).into_owned();
+        assert!(
+            !seeded.out.status.success(),
+            "{name}: below 1.{MULTI_VERSION_FLOOR} two vendored versions must NOT build \
+             even with a populated crates.io index — if this cargo now resolves both \
+             `[patch]` entries, the documented floor is wrong:\nstdout:\n{}\nstderr:\n\
+             {seeded_stderr}",
+            String::from_utf8_lossy(&seeded.out.stdout)
+        );
+        assert!(
+            seeded_stderr.contains("did not resolve to any crates"),
+            "{name}: the pinned failure is the unresolvable second `[patch]` entry, not \
+             something else:\n{seeded_stderr}"
+        );
+        println!(
+            "old-toolchain multi-version {name}: refused below 1.{MULTI_VERSION_FLOOR} \
+             (documented)"
         );
-        if matches!(old, OldCargo::Docker { .. }) {
-            assert!(
-                String::from_utf8_lossy(&run.out.stdout).contains("MARKER:1:2"),
-                "{name}: both patched copies run: {}",
-                String::from_utf8_lossy(&run.out.stdout)
-            );
-        }
         let _ = std::fs::remove_dir_all(&fresh);
     }
 }
 
-/// The documented remedy for two vendored versions on cargo older than
-/// 1.56: a populated crates.io index in `$CARGO_HOME`. Writes the minimal
-/// one an old cargo reads offline — the git index at the pre-1.85
+/// A populated crates.io index in `$CARGO_HOME` — what an old cargo needs
+/// before it can even look at two same-named `[patch]` entries offline, and
+/// the state in which the sub-1.45 refusal is pinned. Writes the minimal
+/// index an old cargo reads offline — the git index at the pre-1.85
 /// `registry/index/github.com-1ecc6299db9ec823` path (`origin/HEAD` names
 /// the tree cargo loads), listing `versions` of the patched crate. No
 /// `.crate` is cached: every listed version is patched to a path copy, so