Wire vendored cargo patches through Cargo.toml and tag the copy

[Mikola Lysenko (mikolalysenko)]

Branch feat/cargo-vendor-manifest-patch: 10 signed commits on main @ 1bfe5326; 43 files, +10558/−851.

Summary

Vendored cargo patches move their wiring out of .cargo/config* and into the project itself, so the patch is recoverable from the files a scanner already reads:

• Wiring lives in the workspace-root Cargo.toml: [patch.crates-io] <name>-socket-<uuid8> = { package = "<name>", path = ".socket/vendor/cargo/<uuid>/<name>-<version>" }. Pre-v5 .cargo/config* wiring migrates on the next vendor / scan / get / repair, and every revert path removes both spellings.
• The vendored copy's version is tagged: 1.0.4 becomes 1.0.4+socket.<uuid>, and a version that already carries build metadata keeps it (2.0.1+zstd.1.5.2 → 2.0.1+zstd.1.5.2.socket.<uuid>). Cargo ignores build metadata when matching requirements, so =1.0.4, 1 and a transitive ^1 all still resolve to the copy — and Cargo.lock now records which patch was actually built.

Two consequences worth stating plainly:

• CARGO_PKG_VERSION inside the patched crate carries the tag. Documented in the CHANGELOG and docs/ecosystems.md.
• A Socket-owned key, not the bare crate name. Cargo lets any config-file [patch] entry replace a manifest entry with the same key, whatever its version, so a bare key let a user's cfg-if config entry silently win over the patched copy. With the Socket key a same-version conflict is a loud cargo error instead.

Why

A vendored Cargo.lock entry only loses its source and checksum, so the lock could not say which patch produced it, and .cargo/config* can hold proxy credentials and registry tokens that a scanner should not have to ingest. Tagging closes both: the identity is in the lock, and the file that carries it is one every Rust project already commits.

Three bugs this also fixes

Found by a 1,232-cell real-cargo matrix (cargo 1.41 → stable, lock formats v1–v4, both modes), all pre-existing on main:

• Build-metadata versions could never be vendored (397259cf). parse_name_version returned the purl's name and version raw, but the API percent-encodes them, so vendored cargo compared 0.11.0%2Bwasi-snapshot-preview1 against the lock's 0.11.0+wasi-snapshot-preview1 and refused. wasi is in most Rust dependency trees. The parsers now decode each component exactly once, after the split; two double-decode paths (python_crawler, takeover::find_record_key) are removed. This touches all eight ecosystems, and subsumes the golang-only decode main shipped in Stop hosted Go redirects claiming unpatched deps #252.
• CRLF Cargo.lock was rewritten as LF (4247daa8), so vendor --revert did not restore the original bytes. toml_edit renders LF only; the lock edits now map the rendering back onto the original text, the way Cargo.toml already did.
• The documented old-cargo floor was wrong (a18ffd14). Cargo before 1.45 resolves every source-less lock entry for a crate through whichever [patch] key sorts last, so two vendored versions of one crate fail --locked with did not resolve to any crates. Measured across 1.41.1–stable in docker: 1.41–1.44 refuse the adversarial key order, 1.45+ resolve either order, each entry to its own copy — no silent mis-resolution anywhere. The e2e previously passed only because its test UUIDs happened to sort favourably; it now asserts the key order itself and exercises both sides of the boundary. A second vendored version warns cargo_multi_version_old_cargo unless the project pins cargo ≥ 1.45 via rust-version or a toolchain file.

A [patch] key scheme that makes the lowest version's key sort last would let two versions build on 1.41–1.44 as well. It is not adopted here: it would replace the documented key with a version-rank encoding in every committed manifest and lean on an undocumented cargo iteration order, to rescue a case that currently fails loudly rather than silently. The rule and the reproduction are in a18ffd14's commit message if we want it later.

Refusals (all fail before any write)

cargo_manifest_unreadable, cargo_manifest_unparseable, cargo_manifest_symlink_unsupported, cargo_manifest_not_workspace_root, cargo_manifest_patch_source_alias (a [patch."https://github.com/rust-lang/crates.io-index"] table, which cargo treats as crates-io and which would silently drop our table), cargo_lock_untaggable, cargo_copy_untaggable, and user_authored_patch_entry. Dry runs preview each of them.

Testing

• cargo test -p socket-patch-core 4883 pass, -p socket-patch-cli 3992 pass, clippy --workspace --all-features --all-targets -D warnings clean.
• Real-cargo suites across SOCKET_PATCH_CARGO_E2E_LOCK_VERSION 1–4, plus docker rust:1.41-slim / rust:1.56-slim old-toolchain legs (14/14): the lock and copy carry the tag, cargo metadata reports it, --locked --offline builds the patched bytes, and revert is byte-identical.
• Every fix in the review rounds was reverted in turn to confirm its test fails without it.

Known gaps, stated in the tests rather than papered over: a mixed-ending lock cannot revert byte-identically (a removed-then-reinserted source line has no recoverable original ending), and toml_edit still drops a UTF-8 BOM from a lock.

---

Note

High Risk
Major semver behavior change to committed Cargo.toml/Cargo.lock wiring plus cross-ecosystem PURL decoding; incorrect tagging or migration could break --locked builds or mis-attribute patches in VEX.

Overview
v5 breaking change for vendored Rust: patch wiring moves from .cargo/config* into the workspace-root Cargo.toml under Socket-owned keys (<crate>-socket-<uuid8>), and vendored copies plus detached Cargo.lock entries are rewritten to tagged versions (<ver>+socket.<uuid>) so scanners and builds can recover which patch was applied. Pre-v5 config wiring migrates on vendor / scan / get / repair; hosted takeover and VEX discovery are updated to read manifest wiring first and treat tag/ledger mismatches as dead wiring.

Also fixes three pre-existing gaps: percent-decoded PURL coordinates across ecosystems (so build-metadata crates like wasi can vendored), CRLF-preserving Cargo.lock edits on revert, and accurate cargo ≥ 1.45 documentation/warning for two vendored versions of one crate. CI adds a cargo-old-toolchains job (docker rust:1.41-slim / 1.56-slim) and the cargo e2e suite grows to cover migration, multi-version, old toolchains, transitive deps, and refusal cases.

^{Reviewed by Cursor Bugbot for commit a18ffd1. Configure here.}