Cargo package metadata not parsing correctly causing builds to fail

[joris.guex]

Hello,

A couple of weeks ago I opened an issue regarding an error with the Cargo feed for the Cargo package libssh2-sys (version 0.3.1). This was fixed in Proget 2026.3 but we are now seeing a different (but possibly related) issue with the same package and version.

Our cargo build commands are failing again:

$ cargo build
    Updating `cargo-proxy` index
error: failed to select a version for the requirement `libssh2-sys = "^0.3.1"` (locked to 0.3.1)
  version 0.3.1's index entry is invalid
location searched: `cargo-proxy` index (which is replacing registry `crates-io`)
required by package `ssh2 v0.9.5`
    ... which satisfies dependency `ssh2 = "^0.9.5"` (locked to 0.9.5)

After running the command with more verbose logs, we see the following:

1.940501134s DEBUG main:exec:compile_ws:create_bcx:resolve_with_registry:resolve_with_previous:resolve: cargo::sources::registry::http_remote: checking freshness of li/bs/libssh2-sys
1.940513252s DEBUG main:exec:compile_ws:create_bcx:resolve_with_registry:resolve_with_previous:resolve: cargo::sources::registry::index: slow path for "li/bs/libssh2-sys"
1.941615528s  INFO main:exec:compile_ws:create_bcx:resolve_with_registry:resolve_with_previous:resolve: cargo::sources::registry::index: recoverying from failed parse of registry package libssh2-sys@0.3.1: invalid type: null, expected a string at line 1 column 637

I think the metadata for the vcpkg build dependency is not being parsed correctly:

[target.'cfg(target_env = "msvc")'.build-dependencies]
vcpkg = "0.2"

For example, crates.io parses it as follows:

$ curl -s https://index.crates.io/li/bs/libssh2-sys | jq 'select(.vers == "0.3.1").deps[] | select(.name == "vcpkg")'
{
  "name": "vcpkg",
  "req": "^0.2",
  "features": [],
  "optional": false,
  "default_features": true,
  "target": "cfg(target_env = \"msvc\")",
  "kind": "build"
}

While Proget seems to parse it as follows:

$ curl -s https://${PROGET_URL}/repository/cargo-proxy/li/bs/libssh2-sys | jq 'select(.vers == "0.3.1").deps[] | select(.name | contains("msvc"))'
{
  "name": "cfg(target_env = \"msvc\")",
  "req": null,
  "optional": false,
  "kind": "normal",
  "default_features": true,
  "features": [],
  "registry": "https://github.com/rust-lang/crates.io-index",
  "target": null
}

[Dan_Woolf]

Hi @joris-guex,

I took a look at the ProGet change and talked with a couple of other Engineers and it looks like the issue is that the lobssh2-sys package is not included the version requirement on a dependency. According to cargo's specifications, the version specification is required. We are guessing that crates.io is handling the issue (whether it is a missing version or extra whitespace included in the manifest) and outputting it in a way it works with the cargo client. Could you please provide us with an example Cargo.toml that can recreate the build issues? This will allow us to implement a better solution to this issue.

Thanks,
Dan

[joris.guex]

Hi @Dan_Woolf,

Sure, here is an example Cargo.toml:

[package]
name = "example"
version = "0.1.0"
edition = "2024"
[dependencies]
libssh2-sys = "0.3.1"

And the ${CARGO_HOME}/config.toml:

[registries]
cargo-proxy = { index = "sparse+https://<PROGET_URL>/repository/cargo-proxy/" }
[source.crates-io]
replace-with = "cargo-proxy"

[rhessinger]

Hi @joris-guex,

Thanks for sending an example over. It looks like this is related to an issue in the libssh2-sys's manifest. I have created a ticket, PG-3321, to handle these issues better. We are expecting to have a fix out within the couple of maintenance releases of ProGet 2026.

Thanks,
Rich