Generate checksums for vendored git archives

Cargo.toml

@@ -22,6 +22,7 @@ all = "deny"
 anyhow = "1.0.102"
 cargo = "0.96.0"
 cargo-platform = "0.3.2"
+cargo-util = "0.2.28"
 clap = { version = "4.6.1", features = ["derive"] }
 env_logger = "0.11.9"
 flate2 = "1.1.9"

src/main.rs

@@ -6,6 +6,7 @@ use cargo::sources::PathSource;
 use cargo::util::GlobalContext;
 use cargo::util::errors::*;
 use cargo_platform::Platform;
+use cargo_util::Sha256;
 use clap::Parser as _;
 use flate2::write::GzEncoder;
 use rayon::prelude::*;
@@ -108,6 +109,14 @@ struct RegistryPackage {
     yanked: Option<bool>,
 }
 
+struct PackageMetadata {
+    archive_path: PathBuf,
+    index_path: PathBuf,
+    registry_package: RegistryPackage,
+    version: String,
+    generated_archive: bool,
+}
+
 #[derive(Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
 struct RegistryDependency {
     name: String,
@@ -439,12 +448,13 @@ fn sync_lockfile(
         // Store metadata for index creation
         let index_dst = get_index_path(id.name().as_str(), &canonical_local_dst);
 
-        package_metadata.push((
-            dst,
-            index_dst,
-            serde_json::to_string(&registry_pkg(pkg, &resolve)).unwrap(),
-            id.version().to_string(),
-        ));
+        package_metadata.push(PackageMetadata {
+            archive_path: dst,
+            index_path: index_dst,
+            registry_package: registry_pkg(pkg, &resolve),
+            version: id.version().to_string(),
+            generated_archive: id.source_id().is_git(),
+        });
     }
 
     // Phase 2: Execute file tasks in parallel
@@ -478,14 +488,21 @@ fn sync_lockfile(
     let mut added_crates = HashSet::new();
     let mut added_index = HashSet::new();
 
-    for (crate_dst, index_dst, line, version) in package_metadata {
-        added_crates.insert(crate_dst);
+    for mut metadata in package_metadata {
+        if metadata.generated_archive {
+            let mut hasher = Sha256::new();
+            hasher.update_path(&metadata.archive_path)?;
+            metadata.registry_package.cksum = hasher.finish_hex();
+        }
+        let line = serde_json::to_string(&metadata.registry_package).unwrap();
+
+        added_crates.insert(metadata.archive_path);
 
         // Keep old versions if no_delete is set OR if we already updated this index file in this run
-        let keep_old = no_delete || added_index.contains(&index_dst);
-        update_index_entry(&index_dst, &line, &version, keep_old)?;
+        let keep_old = no_delete || added_index.contains(&metadata.index_path);
+        update_index_entry(&metadata.index_path, &line, &metadata.version, keep_old)?;
 
-        added_index.insert(index_dst);
+        added_index.insert(metadata.index_path);
     }
 
     if !no_delete {

tests/all.rs

@@ -1,5 +1,6 @@
 extern crate tempfile;
 
+use cargo_util::Sha256;
 use std::env;
 use std::fs::{self, File};
 use std::io::prelude::*;
@@ -228,8 +229,16 @@ source = "git+https://github.com/rust-lang/libc#36bec35aeb600bb1b8b47f4985a84a8d
     run(cmd().arg(&registry).arg("--sync").arg(&lock).arg("--git"));
 
     assert!(registry.join("index").is_dir());
-    assert!(registry.join("index/li/bc/libc").is_file());
-    assert!(registry.join("libc-0.2.16.crate").is_file());
+    let index_path = registry.join("index/li/bc/libc");
+    let archive_path = registry.join("libc-0.2.16.crate");
+    assert!(index_path.is_file());
+    assert!(archive_path.is_file());
+
+    let entry: serde_json::Value =
+        serde_json::from_str(&fs::read_to_string(index_path).unwrap()).unwrap();
+    let mut hasher = Sha256::new();
+    hasher.update_path(archive_path).unwrap();
+    assert_eq!(entry["cksum"], hasher.finish_hex());
 }
 
 #[test]