Rust/Cargo 1.85: `cargo audit --no-fetch` errors when checking for yanked crates

[laniakea64]

Environment:

$ rustc --version
rustc 1.85.0 (4d91de4e4 2025-02-17)
$ cargo --version
cargo 1.85.0 (d73d2caf9 2024-12-31)
$ cargo-audit --version
cargo-audit 0.21.1

Steps to reproduce:

1. create a project with some dependencies (the project's Rust edition can be either 2021 or 2024)

cargo new --vcs none foo
cd foo
cargo add clap

2. audit this project

cargo fetch
cargo audit

3. delete ~/.cargo/registry and ~/.cargo/.global-cache

4. audit this project offline

cargo fetch
cargo audit --no-fetch

Expected results: (2) and (4) should produce identical results

Actual results:

(2) works, but (4) produces lots of error: couldn't check if the package is yanked: not found: No such crate in crates.io index: messages.

Neither reinstalling cargo-audit to get latest crates.io dependencies, nor installing with cargo install --git 'https://github.com/rustsec/rustsec.git' cargo-audit, had any effect on this issue.

With downgrading to Rust/Cargo 1.84.1 and repeating the steps, the errors do not occur.

[Shnatsel]

Thanks for the detailed report!

Looks like the way the crates.io cache is laid out has changed in Rust 1.85, so tame-index crate can no longer locate it. cc @Jake-Shadle

[laniakea64]

Looks like the way the crates.io cache is laid out has changed in Rust 1.85, so tame-index crate can no longer locate it.

This has been added in tame-index 0.18.

As a quick test, tried simply bumping tame-index to 0.18.0 in this line...

rustsec/Cargo.toml

Line 41 in 2c9f6ea

tame-index = { version = "0.17.0", default-features = false }

... and this seems to work...

cargo fetch
cargo build --workspace
cargo run --bin=cargo-audit -- audit --no-fetch

... while using the crates.io version via cargo audit --no-fetch continues to produce the errors.

[Shnatsel]

Wonderful, I'm going to bump that and try to ship a new release soon.