`cargo new` failed to detect vcs if parent of path does not exist

[zhoukezi]

Problem

cargo new checks if the path of new package is inside a vcs repo. If there is one, it skips vcs initialize. However, if the parent of the package path does not exist, it failed to discover existing repo and initialize vsc redundantly.

Steps

Initialize git in an empty directory:

$ /bin/ls -a
.  ..
$ git init
Initialized empty Git repository in <path>/.git/

Create package in ./hello/world, note that ./hello/ does not exist:

$ cargo +nightly new hello/world
     Created binary (application) `hello/world` package
$ ls -d hello/world/.git
hello/world/.git

Create package in ./hello/rust, ./hello/ is create by previous cargo new call:

$ cargo +nightly new hello/rust
     Created binary (application) `hello/rust` package
$ ls -d hello/rust/.git
ls: cannot access 'hello/rust/.git': No such file or directory

Possible Solution(s)

No response

Notes

No response

Version

cargo 1.65.0-nightly (ce40690a5 2022-08-09)
release: 1.65.0-nightly
commit-hash: ce40690a5e4e315d3dab0aae1eae69d0252c52ac
commit-date: 2022-08-09
host: x86_64-unknown-linux-gnu
libgit2: 1.4.2 (sys:0.14.2 vendored)
libcurl: 7.83.1-DEV (sys:0.4.55+curl-7.83.1 vendored ssl:OpenSSL/1.1.1q)
os: Arch Linux Rolling Release [64-bit]

[weihanglo]

The code discovering existing vcs repo lives here. My own take is that we can first check the existence of path and search upward if not exist.

However, we should always heed security issues such like this RFC dictates when searching upward the filesystem. Though personally, I don't think the fix is unsecure.

[0xPoe]

My own take is that we can first check the existence of path and search upward if not exist.

What if it is many layers of directories? Should we keep checking upwards?
For example: cargo new /Users/rustin/code/testa.

[weihanglo]

My own take is that we can first check the existence of path and search upward if not exist.

What if it is many layers of directories? Should we keep checking upwards?
For example: cargo new /Users/rustin/code/testa.

That's exactly what I mean!

[0xPoe]

@rustbot claim

[0xPoe]

@weihanglo Sent a pull request for it. See #10987.
But I am considering whether should we fix it in libgit2 instead of in cargo. Because I think it's a bug or feature in git_repository_discover API.

[weihanglo]

I don't know what's going on in libgit2 here. It seems to work but turns out not? Anyway, I agree that we can solve it on libgit2 side.

[0xPoe]

Open a discussion for it. libgit2/libgit2#6380
Because I am not sure if this is a bug.

[0xPoe]

File a feature request for libgit2. libgit2/libgit2#6383

I would like to keep the #10987 open. At least its test cases are useful.