sdist generated from workspace contains outdated Cargo.lock

[davidhewitt]

Bug Description

Originally reported at pydantic/jiter#196

From debugging, I think what happens is:

• rewrite_cargo_toml removes workspace crates which are not included in the sdist (in jiter case, a dev tool fuzz)
• the Cargo.lock still contains metadata about this crate

It might be that running cargo metadata inside the sdist working dir will be good enough to invite cargo to fixup the Cargo.lock? That might be a good sanity check anyway... 🤔

Your maturin version (maturin --version)

1.8.3

Your Python version (python -V)

n/a

Your pip version (pip -V)

n/a

What bindings you're using

None

Does cargo build work?

• Yes, it works

If on windows, have you checked that you aren't accidentally using unix path (those with the forward slash /)?

• Yes

Steps to Reproduce

1. Run maturin sdist inside jiter repository at crates/jiter-python subdirectory.
2. cd to the target/wheels directory (will be at the workspace root)
3. Unzip the sdist
4. cd into the sdist
5. cargo build --locked

[messense]

It might be that running cargo metadata inside the sdist working dir will be good enough to invite cargo to fixup the Cargo.lock? That might be a good sanity check anyway... 🤔

Sounds good to me, though we dont actually have a sdist working dir currently, it's built in memory:

maturin/src/module_writer.rs

Lines 423 to 429 in be9db37

	/// Creates a .tar.gz archive containing the source distribution
	pub struct SDistWriter {
	tar: tar::Builder<GzEncoder<Vec<u8>>>,
	path: PathBuf,
	file_tracker: FileTracker,
	excludes: Override,
	}

[messense]

Alternatively, if the project layout is simple, consider using sdist-generator = "git" in [tool.maturin] instead so it does not try to rewrite anything.