Warning and disambiguation of crates that are in both crates.io and alternative registries

[kornelski]

The dependency confusion attack could exploit human error in editing of Cargo.toml. If a user wrote:

[dependencies]
company-internal-utils = "1"

when they've meant:

[dependencies]
company-internal-utils = { version = "1", registry = "internal" }

cargo build could end up fetching and running code from a wrong crate in the public crates.io registry.

I think this mistake could be detected by checking whether a dependency is in both internal and public crates.io registry. I'm not sure if Cargo could treat it as a hard error — that would be a breaking change, but at least it could warn about it.

Now, if Cargo detects such accidentally-from-crates.io dependencies as ambiguous, there needs to be a way to specify that a dependency was really meant to come from crates.io. For this I suggest supporting registry="crates.io", e.g.

[dependencies]
# Not an accident, I really mean the public one:
company-internal-utils = { version = "1", registry = "crates.io" } 

[Eh2406]

I like the registry = "crates.io" way to disambiguate. I will need to think about the rest.

[epage]

Some quick thoughts from looking at the description for #11906. I've not done a more thorough look and this is independent of whatever else @Eh2406 was thinking of.

One alternative is to handle this in cargo-add. See #10656.

In general, cargo has been cautious about adding warnings because we do not have a mechanism for users to control them. rust-lang/rfcs#3389 might provide such a mechanism but it isn't here yet.

However, since this is easily silenceable, maybe that isn't so bad that we don't have such a mechanism.

[Eh2406]

I have completely lost track of my concerns from the previous comment. Sorry.

With the sparse registry, it is now possible for the owner of registry to find out what crates people are looking for. So we need to be careful about dependency disclosure, where we leak the names of private packages to unrelated repositories.

[kornelski]

dupe #10656