Add warning when `cargo tree -i <spec>` can not find packages
### What does this PR try to resolve?
close https://github.com/rust-lang/cargo/issues/11315
Add warning when `cargo tree -i <spec>` can not find packages.
### How should we test and review this PR?
Please run the unit test.
Clean profile, patch, and replace in cargo remove
### What does this PR try to resolve?
This PR is part of the continued work on cargo remove (#11099, see deferred work).
After a successful removal of a dependency, clean up the profile, patch, and replace sections to remove all references to it.
**Note** the GC process was expanded to clean up not just references to the dependencies just removed, but also references of all dependencies. This was because there's not an easy way to determine which dependencies correspond to the given TOML keys, without either 1) figuring that out before the removal (therefore having to predict the behavior), or 2) returning that information from the remove function (somewhat unorthodox for an op).
### How should we review and test this PR?
Verify that the implementation makes sense and that the tests are sufficient.
chore: Upgrade miow
Upgrade `miow` to the latest release.
The main change from miow is the upgrade of transitive dependency `windows-sys` from 0.28 to 0.42, which removes a duplicate dependency for cargo.
Fix several tests that are waiting 60 seconds for publishing to time out
Several tests are missing the pre-publishing hack to avoid the 60 second wait-for-publish timeout.
r? `@epage`
Implement RFC 3139: alternative registry authentication support
Allows registries to request Cargo to send the authentication token for all requests, rather than just publish/yank, implementing [RFC 3139](https://github.com/rust-lang/cargo/issues/10474).
### Items from the [tracking issue](https://github.com/rust-lang/cargo/issues/10474)
> Do registries need a more fine-grained switch for which API commands require authentication?
This PR uses the `auth_required` boolean as described in the RFC.
> The RFC mentions adding --token to additional commands like install and search
These flags are not added by this PR.
> Consider changing the name and form of the X- header
Changed to the `www-authenticate` header as suggested by the comments.
> Will there be any concerns with the interaction with https://github.com/rust-lang/rfcs/pull/3231
Not that I know of.
-------------
Adds a new field `"auth-required": true` to `config.json` that indicates Cargo should include the token in all requests to a registry.
For HTTP registries, Cargo first attempts an un-authenticated request, then if that fails with HTTP 401, an authenticated request is attempted. The registry server may include a `www-authenticate` header with the HTTP 401 to instruct Cargo with URL the user can visit to acquire a token (crates.io/me).
Since the API URL is not known (because it's stored in the index), the unstable credential provider feature is modified to key off the index url, and the registry name is no longer provided.
To handle the case where an alternative registry's name is not known (such as coming from a lock file, or via `--index`), Cargo can now look up the token in the configuration by matching on the index URL. This introduces a new error if two alternative registries are configured with the same index URL.
Several operations, such as `cargo install` could have had a `--token` argument added, however it appears that Cargo would like to move away from passing the token on the command line for security reasons. In this case, users would need to configure the registry via the config file (or environment variables) when using `cargo install --index ...` or similar.
Fix cargo install --index when used with registry.default
Setting `registry.default` causes the `args.registry` call to return the default registry as if it were passed through `--registry`, which leaves the `--index` argument ignored in `cargo install`, since `registry` is checked first.
Fixes#11301 by checking for `index` before `registry`.
Note that if you try to pass both `--index` and `--registry`, then a command-line parser error (correctly) occurs:
```
The argument '--registry <REGISTRY>' cannot be used with '--index <INDEX>'
```
improve error message for cargo add/remove
### What does this PR try to resolve?
When I see the old error:
```
> cargo add paste
error: 2 packages selected. Please specify one with `-p <PKGID>`
```
I was a little bit confused, and thought it says there are 2 packages called "paste". The new message is similar to `cargo run`
Fix git2 safe-directory disable
The call to `set_verify_owner_validation` was not getting called unless a network configuration was found. This means in the common case that `cargo new` will fail when there is a safe-directory error. This fixes the issue by making sure that `set_verify_owner_validation` is called before the early-exits in `init_git_transports`.
Fixes#11365
fix: return non UTF-8 error message
Fixes https://github.com/rust-lang/cargo/issues/11311
### Test Steps
1. Create a new empty Git repository
2. Create a `.gitignore` that is not valid UTF-8, for instance `printf '\xFF\xFE' > .gitignore`
3. `cargo init`
Extract `two_kinds_of_msg_format_err` message to de-duplicate it
### What does this PR try to resolve?
Extract `two_kinds_of_msg_format_err` message to de-duplicate it.
I guess this would be helpful for changing this message.
### Additional information
Just found it when I read the code. So if you prefer the former code style, please feel free to close my PR.
Fix wait-for-publish with sparse registry
The `wait-for-publish` feature doesn't work when publishing a new version of an existing crate on a sparse registry.
The `invalidate_cache` method doesn't clear the `fresh` list, so repeated requests just use the in-memory data if it's available. This didn't show up in the tests, because the test only simulated the `not found` to `crate available` transition, rather than the `old file` to `crate available` transition.
This change modifies the test by capturing the publish request, then deferring it until after later request for the index file.
r? `@epage`
Fixes#11314
Add `registries.crates-io.protocol` docs
### What does this PR try to resolve?
close https://github.com/rust-lang/cargo/issues/11343.
Add `registries.crates-io.protocol` docs to explain this unstable option.
