cargo publish says that the tarball can not be verified after having compiled successfully the crate

[dupgit]

Problem

My crate compiles successfully and I wanted to publish it with cargo publish but, right after recompiling it, it gives me the following error:

->  cargo publish
    Updating crates.io index
   Packaging createdir-bash-builtin v0.1.0 (/home/dup/Dossiers_Perso/projets/rust-projects/createdir-bash-builtin)
   Verifying createdir-bash-builtin v0.1.0 (/home/dup/Dossiers_Perso/projets/rust-projects/createdir-bash-builtin)
    Updating crates.io index
   Compiling proc-macro2 v1.0.79
   Compiling unicode-ident v1.0.12
   Compiling syn v1.0.109
   Compiling libc v0.2.153
   Compiling quote v1.0.35
   Compiling bash_builtins_macro v0.2.0
   Compiling bash-builtins v0.4.1
   Compiling createdir-bash-builtin v0.1.0 (/home/dup/Dossiers_Perso/projets/rust-projects/createdir-bash-builtin/target/package/createdir-bash-builtin-0.1.0)
warning: field `0` is never read
  --> src/lib.rs:17:16
   |
17 |     Identifier(String),
   |     ---------- ^^^^^^
   |     |
   |     field in this variant
   |
   = note: `#[warn(dead_code)]` on by default
help: consider changing the field to be of unit type to suppress this warning while preserving the field numbering, or remove the field
   |
17 |     Identifier(()),
   |                ~~

warning: `createdir-bash-builtin` (lib) generated 1 warning
    Finished dev [unoptimized + debuginfo] target(s) in 3.33s
error: failed to verify package tarball

Caused by:
  Source directory was modified by build.rs during cargo publish. Build scripts should not modify anything outside of OUT_DIR.
  Added: /home/dup/Dossiers_Perso/projets/rust-projects/createdir-bash-builtin/target/package/createdir-bash-builtin-0.1.0/Cargo.lock

  To proceed despite this, pass the `--no-verify` flag.

I do not want to use --no-verify flag. I can not figure out how to know what is going on that cargo doesn't like.

Steps

trying to publish my library on crate.io: https://github.com/dupgit/createdir

Possible Solution(s)

It may be somehow related to bash_builtin dependency. Any hint to be able to figure this out is welcome.

Notes

Using cargo publish -vv options does not provide more information after the building process and before the error.

Version

cargo version -v
cargo 1.77.0 (3fe68eabf 2024-02-29)
release: 1.77.0
commit-hash: 3fe68eabf93cbf3772bbcad09a9206c783e2de3f
commit-date: 2024-02-29
host: x86_64-unknown-linux-gnu
libgit2: 1.7.2 (sys:0.18.2 vendored)
libcurl: 8.5.0-DEV (sys:0.4.70+curl-8.5.0 vendored ssl:OpenSSL/1.1.1w)
ssl: OpenSSL 1.1.1w  11 Sep 2023
os: Debian 12 (bookworm) [64-bit]

[epage]

The error is saying your Cargo.lock changed. It doesn't look like your dependency tree includes a non-standard build.rs. There is libc but that is deployed enough that if it had a problem, it would likely be fixed quickly. There is the proc-macro you depend on. I didn't see anything suspicious in it. Unfortunately, we can't say for sure about either until we have #5720. You could potentially experiment with cackle but that is a lot of work just to uncover what is happening.

I tried running cargo package and cargo publish --dry-run on your repo and I didn't see this error myself.

[dupgit]

@epage Thanks a lot for taking the time looking at this issue.

Thanks to your remarks I managed to figure out that this is related to cargo auditable. I have defined it as an alias to cargo command : alias cargo="cargo auditable". Using \cargo publish just works fine again. I'll try to open a bug report there.

Thank you again !