Why does crates.io not allow republishing a crate under new name?

help
1

I have a crate that some of my other libraries depend on, elara-log. It's very basic but I use it a lot in those other libraries (code + documentation). Unfortunately, I didn't realize (similar to this post) that I used an underscore rather than a hyphen, which breaks consistency with my other libraries. Thus it is named elara_log in the Cargo.toml rather than elara-log (which is my standard convention).

So I have made the crate with the old name deprecated, setup a deprecation notice in the README, and even created a new repository for the renamed crate. However, when I try to publish the renamed elara-log I get this error message:

error: failed to publish to registry at https://crates.io

Caused by:
  the remote server responded with an error (status 400 Bad Request): crate was previously named `elara_log`

I am not sure what to do now, and I haven't been able to find anything to resolve the issue. Any help would be much appreciated!

1 Like
2

I think the problem is not the republishing itself (it's fine, from crates.io POV you will just create a new crate not connected with old one in any way), it's the conflict due to normalization. In Rust code, crate names have hyphens replaced with underscores, therefore, I guess, crates.io does not allow two crates whose names normalize to the same thing coexist at once - otherwise depending on both on them at once would be ambiguous.

2 Likes
3

Allowing both "_" and "-" seems like a great opportunity for supply chain attacks.

  1. You publish you publish a crate "bla_bla"
  2. I publish my malware crate as "bla-bla"
  3. I wait for people to make the mistake and end up using my malware than your crate.
2 Likes
4

Ah, thank you very much for your suggestions, I see that these are good reasons. I guess I will have to bite the bullet and rename everything to a new name, prehaps elara-logger, then :frowning: not much that I can do.

1 Like
5

Conflicts are already possible! The name of the library can be customised to be anything, and it doesn't have to match the package name.

1 Like