In older versions of Cargo, which don't support custom registries or --offline flag yet, is it possible to set the registry state (HEAD) to an older version and make cargo use it in this state instead of updating to latest master?
I'm trying to check, for all crates-io crates, what is the oldest Rust version they build with. But to do this reliably (without false negatives from broken deps), I want to "rewind" the registry to the same date as publication date of the crate being tested, to ensure it's tested with old versions of all deps. Rewinding of the index is relatively easy on the git repo level, but then it's hard to convince cargo to create Cargo.lock without updating the index to the latest state.
It seems that Cargo not only uses a "bare" git repo for the index, but also doesn't use git's config of the remote (sets the URL directly when telling git2 to fetch, so I can't replace the URL with my index fork), and doesn't even use git's refs for HEAD and remote hash (so I can't set remote/origin/refs/heads/master to and old commit), and there's github_up_to_date fast path that checks github API (which can't be easily spoofed, and gives cargo the latest hash to fetch).
So is there a way to make Cargo from 2016/2017/2018 use the index state from 2016/2017/2018?
That seems like the simplest answer for the moment.
It'd be interesting to have a flag saying "use this index hash" or "use this index date" (or anything libgit2 can parse unambiguously as a committish).
I've found that .cargo/config's [source.crates-io] replace-with has been supported since at least 1.13! I assumed it'd be supported only since the alternative registries were stabilized, but it seems to work fine even in ancient versions!
Yes, a lot of Chinese users are using the replace-with mechanism. A lot of ISPs in mainland China provides horrible or even totally unusable connection to the crates.io index from time to time. Several organizations use this mechanism to provide mirrors for crates.io here.