fix(package): check dirtiness of symlinks source files

This adds a special case for checking source files are symlinks
and have been modified when under a VCS control

This is required because those paths may link to a file outside the
current package root, but still under the git workdir, affecting the
final packaged `.crate` file.

This may have potential performance issue. If a package contains
thousands of symlinks, Cargo will fire `git status` for each of them.

Author: weihanglo

src/cargo/ops/cargo_package.rs

@@ -1,3 +1,4 @@
+use std::collections::HashSet;
 use std::collections::{BTreeSet, HashMap};
 use std::fs::{self, File};
 use std::io::prelude::*;
@@ -827,11 +828,14 @@ fn check_repo_state(
         // be packaged. This is a lazy n^2 check, but seems fine with
         // thousands of files.
         let cwd = gctx.cwd();
+
+        let mut dirty_files_outside_pkg_root = dirty_symlinks(pkg, repo, src_files)?;
+        dirty_files_outside_pkg_root.extend(dirty_metadata_paths(pkg, repo)?);
         let mut dirty_src_files: Vec<_> = src_files
             .iter()
             .filter(|src_file| dirty_files.iter().any(|path| src_file.starts_with(path)))
             .map(|p| p.as_path_buf())
-            .chain(dirty_metadata_paths(pkg, repo)?.iter())
+            .chain(dirty_files_outside_pkg_root.iter())
             .map(|path| {
                 pathdiff::diff_paths(path, cwd)
                     .as_ref()
@@ -899,6 +903,36 @@ fn check_repo_state(
         Ok(dirty_files)
     }
 
+    /// Checks whether source files are symlinks and have been modified.
+    ///
+    /// This is required because those paths may link to a file outside the
+    /// current package root, but still under the git workdir, affecting the
+    /// final packaged `.crate` file.
+    fn dirty_symlinks(
+        pkg: &Package,
+        repo: &git2::Repository,
+        src_files: &[PathEntry],
+    ) -> CargoResult<HashSet<PathBuf>> {
+        let workdir = repo.workdir().unwrap();
+        let mut dirty_symlinks = HashSet::new();
+        for rel_path in src_files
+            .iter()
+            .filter(|p| p.is_symlink())
+            .map(|p| p.as_path())
+            // If inside package root. Don't bother checking git status.
+            .filter(|p| paths::strip_prefix_canonical(*p, pkg.root()).is_err())
+            // Handle files outside package root but under git workdir,
+            .filter_map(|p| paths::strip_prefix_canonical(p, workdir).ok())
+        {
+            // TODO: Should we warn users if there are like thousands of symlinks,
+            // which may hurt the performance?
+            if repo.status_file(&rel_path)? != git2::Status::CURRENT {
+                dirty_symlinks.insert(workdir.join(rel_path));
+            }
+        }
+        Ok(dirty_symlinks)
+    }
+
     // Helper to collect dirty statuses for a single repo.
     fn collect_statuses(
         repo: &git2::Repository,

tests/testsuite/package.rs

@@ -1375,10 +1375,11 @@ fn dirty_file_outside_pkg_root_considered_dirty() {
     p.cargo("package --workspace --no-verify")
         .with_status(101)
         .with_stderr_data(str![[r#"
-[ERROR] 2 files in the working directory contain changes that were not yet committed into git:
+[ERROR] 3 files in the working directory contain changes that were not yet committed into git:
 
 LICENSE
 README.md
+lib.rs
 
 to proceed despite this and include the uncommitted changes, pass the `--allow-dirty` flag