fix(vendor): trust crate version only when coming from registries

Author: stormshield-guillaumed

src/cargo/ops/vendor.rs

@@ -207,8 +207,10 @@ fn sync(
         let dst = canonical_destination.join(&dst_name);
         to_remove.remove(&dst);
         let cksum = dst.join(".cargo-checksum.json");
-        if dir_has_version_suffix && cksum.exists() {
-            // Always re-copy directory without version suffix in case the version changed
+        // Registries are the only immutable sources,
+        // path and git dependencies' versions cannot be trusted to mean "no change"
+        if dir_has_version_suffix && id.source_id().is_registry() && cksum.exists() {
+            // Don't re-copy directory with version suffix in case it comes from a registry
             continue;
         }
 

tests/testsuite/vendor.rs

@@ -1626,7 +1626,7 @@ fn git_update_rev() {
         .run();
 
     let lib = p.read_file("vendor/a-0.1.0/src/lib.rs");
-    assert_e2e().eq(lib, "");
+    assert_e2e().eq(lib, "pub fn f() {}");
 }
 
 #[cargo_test]