Repository: trailofbits/cargo-unmaintained (language: rust)

Issue:
crates in private registries result in lots of warnings
We have workspace dependencies like

```toml
depA = { version = "1.2.3", registry = "our-private-registry" }
```

I see this warning repeated many times
```
warning: failed to get latest version of `my-private-crate`: failed to find `my-private-crate` in index
```

and then it is listed as ` (no repository)`, which is reasonable, but this message could be improved because it is known that the dep was not able to be followed.


Discussion / hints:
> but this message could be improved because it is known that the dep was not able to be followed.

So, to be sure I understand, the behavior you would prefer is a more informative warning message? Would you like to propose one?
Most important is the tool should recognise that the dependency has specified a custom `registry = ".."` and should not attempt to find it in crates.io , as that is unnecessary network traffic, and is also leaking private crate names in the API queries going across public networks.

I am less worried about the "(no repository)" bit for the moment.


Fix patch:
diff --git a/fixtures/private-registry/.cargo/config.toml b/fixtures/private-registry/.cargo/config.toml
new file mode 100644
index 00000000..8918286e
--- /dev/null
+++ b/fixtures/private-registry/.cargo/config.toml
@@ -0,0 +1,5 @@
+# smoelius: The contents of this file are based on:
+# https://doc.rust-lang.org/cargo/reference/registries.html#using-an-alternate-registry
+
+[registries]
+my-registry = { index = "https://github.com/rust-lang/crates.io-index" }
diff --git a/fixtures/private-registry/Cargo.lock b/fixtures/private-registry/Cargo.lock
new file mode 100644
index 00000000..59ac8d1b
--- /dev/null
+++ b/fixtures/private-registry/Cargo.lock
@@ -0,0 +1,60 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "crates-io"
+version = "0.1.0"
+dependencies = [
+ "syn",
+]
+
+[[package]]
+name = "my-registry"
+version = "0.1.0"
+dependencies = [
+ "syn",
+]
+
+[[package]]
+name = "private-registry"
+version = "0.1.0"
+dependencies = [
+ "crates-io",
+ "my-registry",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.86"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e719e8df665df0d1c8fbfd238015744736151d4445ec0836b8e628aae103b77"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
diff --git a/fixtures/private-registry/Cargo.toml b/fixtures/private-registry/Cargo.toml
new file mode 100644
index 00000000..d96a883e
--- /dev/null
+++ b/fixtures/private-registry/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "private-registry"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+crates-io = { path = "crates-io" }
+my-registry = { path = "my-registry" }
+
+[workspace]
diff --git a/fixtures/private-registry/crates-io/Cargo.toml b/fixtures/private-registry/crates-io/Cargo.toml
new file mode 100644
index 00000000..a5f8699b
--- /dev/null
+++ b/fixtures/private-registry/crates-io/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "crates-io"
+version = "0.1.0"
+edition = "2021"
+
+# smoelius: The next `dependencies` entry should match what is in ../my-registry/Cargo.toml, except
+# that file's entry has a `registry` field.
+
+[dependencies]
+syn = { version = "1.0" }
diff --git a/fixtures/private-registry/crates-io/src/lib.rs b/fixtures/private-registry/crates-io/src/lib.rs
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/fixtures/private-registry/crates-io/src/lib.rs
@@ -0,0 +1,1 @@
+
diff --git a/fixtures/private-registry/my-registry/Cargo.toml b/fixtures/private-registry/my-registry/Cargo.toml
new file mode 100644
index 00000000..b03cd2d0
--- /dev/null
+++ b/fixtures/private-registry/my-registry/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "my-registry"
+version = "0.1.0"
+edition = "2021"
+
+# smoelius: The next `dependencies` entry should match what is in ../crates-io/Cargo.toml, except
+# that file's entry does not have a `registry` field.
+
+[dependencies]
+syn = { version = "1.0", registry = "my-registry" }
diff --git a/fixtures/private-registry/my-registry/src/lib.rs b/fixtures/private-registry/my-registry/src/lib.rs
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/fixtures/private-registry/my-registry/src/lib.rs
@@ -0,0 +1,1 @@
+
diff --git a/fixtures/private-registry/src/lib.rs b/fixtures/private-registry/src/lib.rs
new file mode 100644
index 00000000..e69de29b
diff --git a/src/main.rs b/src/main.rs
index a7036722..fe9fe8c9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -636,6 +636,10 @@ fn outdated_deps<'a>(metadata: &'a Metadata, pkg: &'a Package) -> Result<Vec<Out
     }
     let mut deps = Vec::new();
     for dep in &pkg.dependencies {
+        // smoelius: Don't check dependencies in private registries.
+        if dep.registry.is_some() {
+            continue;
+        }
         // smoelius: Don't check dependencies specified by path.
         if dep.path.is_some() {
             continue;


Test patch:
diff --git a/tests/cases/private-registry.stderr b/tests/cases/private-registry.stderr
new file mode 100644
index 00000000..75ffe10b
--- /dev/null
+++ b/tests/cases/private-registry.stderr
@@ -0,0 +1,1 @@
+Scanning 7 packages and their dependencies (pass --verbose for more information)
diff --git a/tests/cases/private-registry.stdout b/tests/cases/private-registry.stdout
new file mode 100644
index 00000000..82fef69d
--- /dev/null
+++ b/tests/cases/private-registry.stdout
@@ -0,0 +1,2 @@
+crates-io (no repository)
+    syn (requirement: ^1.0, version used: 1.0.109, latest: [..])
diff --git a/tests/cases/private-registry.toml b/tests/cases/private-registry.toml
new file mode 100644
index 00000000..56868726
--- /dev/null
+++ b/tests/cases/private-registry.toml
@@ -0,0 +1,1 @@
+path = "fixtures/private-registry"