From 8d6464000e8facfa88f0bc9a122b4ec98fbca704 Mon Sep 17 00:00:00 2001
From: Arlo Siemsen <arsiem@microsoft.com>
Date: Wed, 30 Nov 2022 15:34:45 -0600
Subject: [PATCH 1/2] Crate checksum lookup includes build metadata

---
 src/cargo/sources/registry/index.rs | 12 +++++++-----
 src/cargo/sources/registry/mod.rs   |  1 +
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/cargo/sources/registry/index.rs b/src/cargo/sources/registry/index.rs
index d82a0d24742..05bfe71af05 100644
--- a/src/cargo/sources/registry/index.rs
+++ b/src/cargo/sources/registry/index.rs
@@ -379,7 +379,9 @@ impl<'cfg> RegistryIndex<'cfg> {
     pub fn hash(&mut self, pkg: PackageId, load: &mut dyn RegistryData) -> Poll<CargoResult<&str>> {
         let req = OptVersionReq::exact(pkg.version());
         let summary = self.summaries(&pkg.name(), &req, load)?;
-        let summary = ready!(summary).next();
+        let summary = ready!(summary)
+            .filter(|s| s.summary.version() == pkg.version())
+            .next();
         Poll::Ready(Ok(summary
             .ok_or_else(|| internal(format!("no hash listed for {}", pkg)))?
             .summary
@@ -623,10 +625,10 @@ impl<'cfg> RegistryIndex<'cfg> {
         load: &mut dyn RegistryData,
     ) -> Poll<CargoResult<bool>> {
         let req = OptVersionReq::exact(pkg.version());
-        let found = self
-            .summaries(&pkg.name(), &req, load)
-            .map_ok(|mut p| p.any(|summary| summary.yanked));
-        found
+        let found = ready!(self.summaries(&pkg.name(), &req, load))?
+            .filter(|s| s.summary.version() == pkg.version())
+            .any(|summary| summary.yanked);
+        Poll::Ready(Ok(found))
     }
 }
 
diff --git a/src/cargo/sources/registry/mod.rs b/src/cargo/sources/registry/mod.rs
index ac29f25093e..c1ff8b12e09 100644
--- a/src/cargo/sources/registry/mod.rs
+++ b/src/cargo/sources/registry/mod.rs
@@ -694,6 +694,7 @@ impl<'cfg> RegistrySource<'cfg> {
             .summaries(&package.name(), &req, &mut *self.ops)?
             .expect("a downloaded dep now pending!?")
             .map(|s| s.summary.clone())
+            .filter(|s| s.version() == package.version())
             .next()
             .expect("summary not found");
         if let Some(cksum) = summary_with_cksum.checksum() {

From fb98f3fcbac5d85f88c156da37f00475bb07019f Mon Sep 17 00:00:00 2001
From: Arlo Siemsen <arsiem@microsoft.com>
Date: Fri, 11 Aug 2023 18:42:40 -0500
Subject: [PATCH 2/2] Add test differ_only_by_metadata

---
 tests/testsuite/registry.rs | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tests/testsuite/registry.rs b/tests/testsuite/registry.rs
index bd5e42b4559..8982b1cb6c5 100644
--- a/tests/testsuite/registry.rs
+++ b/tests/testsuite/registry.rs
@@ -3529,3 +3529,38 @@ fn unpack_again_when_cargo_ok_is_unrecognized() {
     let ok = fs::read_to_string(&cargo_ok).unwrap();
     assert_eq!(&ok, r#"{"v":1}"#);
 }
+
+#[cargo_test]
+fn differ_only_by_metadata() {
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+                [package]
+                name = "foo"
+                version = "0.0.1"
+                authors = []
+
+                [dependencies]
+                baz = "=0.0.1"
+            "#,
+        )
+        .file("src/main.rs", "fn main() {}")
+        .build();
+
+    Package::new("baz", "0.0.1+b").publish();
+    Package::new("baz", "0.0.1+c").yanked(true).publish();
+
+    p.cargo("check")
+        .with_stderr(
+            "\
+[UPDATING] `dummy-registry` index
+[DOWNLOADING] crates ...
+[DOWNLOADED] [..] v0.0.1+b (registry `dummy-registry`)
+[CHECKING] baz v0.0.1+b
+[CHECKING] foo v0.0.1 ([CWD])
+[FINISHED] dev [unoptimized + debuginfo] target(s) in [..]s
+",
+        )
+        .run();
+}