From 0fd0a9e05df235553143e06478b4bf4fe448abfe Mon Sep 17 00:00:00 2001
From: Ralph Giles <giles@mozilla.com>
Date: Wed, 31 Aug 2016 16:11:33 -0700
Subject: [PATCH] Check for path dependencies.

Port registry::verify_dependencies to the `cargo package`
command to perform the local portion of that check. It
looks like the package operation doesn't generally make
reference to the registry, so skip variant-origin checks
until publish time.
---
 src/cargo/ops/cargo_package.rs | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/cargo/ops/cargo_package.rs b/src/cargo/ops/cargo_package.rs
index 3a6f51d5f..2ed76ab75 100644
--- a/src/cargo/ops/cargo_package.rs
+++ b/src/cargo/ops/cargo_package.rs
@@ -35,6 +35,8 @@ pub fn package(ws: &Workspace,
         try!(check_metadata(pkg, config));
     }
 
+    try!(verify_dependencies(&pkg));
+
     if opts.list {
         let root = pkg.root();
         let mut list: Vec<_> = try!(src.list_files(&pkg)).iter().map(|file| {
@@ -119,6 +121,20 @@ fn check_metadata(pkg: &Package, config: &Config) -> CargoResult<()> {
     Ok(())
 }
 
+// check that the package dependencies are safe to deploy.
+fn verify_dependencies(pkg: &Package) -> CargoResult<()> {
+    for dep in pkg.dependencies() {
+        if dep.source_id().is_path() {
+            if !dep.specified_req() {
+                bail!("all path dependencies must have a version specified \
+                       when packaging.\ndependency `{}` does not specify \
+                       a version.", dep.name())
+            }
+        }
+    }
+    Ok(())
+}
+
 fn check_not_dirty(p: &Package, src: &PathSource) -> CargoResult<()> {
     if let Ok(repo) = git2::Repository::discover(p.root()) {
         if let Some(workdir) = repo.workdir() {
-- 
2.30.2