Check for path dependencies.

Port registry::verify_dependencies to the `cargo package`
command to perform the local portion of that check. It
looks like the package operation doesn't generally make
reference to the registry, so skip variant-origin checks
until publish time.

diff --git a/src/cargo/ops/cargo_package.rs b/src/cargo/ops/cargo_package.rs
index 3a6f51d5f130002396612af17b273ba1f5c39bdc..2ed76ab7595b5f338638f443825b8b1cbc115a98 100644 (file)
--- a/src/cargo/ops/cargo_package.rs
+++ b/src/cargo/ops/cargo_package.rs
@@ -35,6 +35,8 @@ pub fn package(ws: &Workspace,
         try!(check_metadata(pkg, config));
     }
 
+    try!(verify_dependencies(&pkg));
+
     if opts.list {
         let root = pkg.root();
         let mut list: Vec<_> = try!(src.list_files(&pkg)).iter().map(|file| {
@@ -119,6 +121,20 @@ fn check_metadata(pkg: &Package, config: &Config) -> CargoResult<()> {
     Ok(())
 }
 
+// check that the package dependencies are safe to deploy.
+fn verify_dependencies(pkg: &Package) -> CargoResult<()> {
+    for dep in pkg.dependencies() {
+        if dep.source_id().is_path() {
+            if !dep.specified_req() {
+                bail!("all path dependencies must have a version specified \
+                       when packaging.\ndependency `{}` does not specify \
+                       a version.", dep.name())
+            }
+        }
+    }
+    Ok(())
+}
+
 fn check_not_dirty(p: &Package, src: &PathSource) -> CargoResult<()> {
     if let Ok(repo) = git2::Repository::discover(p.root()) {
         if let Some(workdir) = repo.workdir() {