Unable to cargo update git dependency with two branches used at the same time

[Riateche]

Problem

cargo update -p package doesn't work and produces a non-working suggestion.

Steps

Workspace archive attached for convenience: w1.zip

1. Create a workspace with two libraries, lib1 and lib2.
2. Add a dependency to lib1: rand = { git = "https://github.com/rust-random/rand.git" }
3. Add a dependency to lib2: rand = { git = "https://github.com/rust-random/rand.git", branch = "0.7" }
4. Run cargo check or anything that generates a lock file.
5. Run cargo update -p rand. Output:

error: There are multiple `rand` packages in your project, and the specification `rand` is ambiguous.
Please re-run this command with `-p <spec>` where `<spec>` is one of the following:
  https://github.com/rust-random/rand.git#rand:0.7.4
  https://github.com/rust-random/rand.git#rand:0.7.4

6. Run cargo update -p 'https://github.com/rust-random/rand.git#rand:0.7.4'

error: There are multiple `rand` packages in your project, and the specification `https://github.com/rust-random/rand.git#rand:0.7.4` is ambiguous.
Please re-run this command with `-p <spec>` where `<spec>` is one of the following:
  https://github.com/rust-random/rand.git#rand:0.7.4
  https://github.com/rust-random/rand.git#rand:0.7.4

There should be a way to disambiguate between these packages.

Notes

Output of cargo version:
cargo 1.44.1 (88ba85757 2020-06-11)

[ehuss]

Thanks for the report! Package ID specs are kinda wonky right now (#7725). I'm actually not really sure how this should work. It looks like this behavior dates back to the introduction of specs (#618). Just some rough thoughts:

• Should it even allow this state where two different git dependencies have the same package version?
  • This can cause confusing errors due to incompatible types. Perhaps its OK as long it is in independent parts of the dependency graph. I'm not sure if Cargo should work hard to deal with this.
• Should the pkgid spec allow ?branch ? I'm not sure why it explicitly forbids query strings like https://github.com/rust-random/rand.git?branch=0.7
• Should -p be allowed to match multiple packages? (probably not)

Tagged with command-pkgid since that's the only label related to specs.

[Riateche]

One problem is that it's very unclear why that happens at all. Until I tried to make a minimal repro, I had no idea what caused this. It seemed like it just randomly errors out sometimes. So just fixing the error message would already be good.

[real-felix]

I'm getting that issue when upgrading some dependency in a project I'm on. Any idea about how I can update that dependency?

EDIT: I've found by myself. That happened after doing this:

• I was pulling dependencies from a git repo, branch v1
• I updated all the dependencies to use the branch v2
• I cargo checked the code
• I tried to update the dependencies

After just reverting the changes in Cargo.lock, I could cargo update without issues.

[jameshiew]

It would be a big improvement if the error message indicated how the ambiguous package was being pulled in e.g. for the example workspace for this issue

error: There are multiple `rand` packages in your project, and the specification `rand` is ambiguous.
Please re-run this command with `-p <spec>` where `<spec>` is one of the following:
  lib1:0.1.0 -> https://github.com/rust-random/rand.git#rand:0.7.4
  lib2:0.1.0 -> https://github.com/rust-random/rand.git#rand:0.7.4

[jameshiew]

fwiw - with the example workspace w1.zip and cargo 1.64.0 (387270bc7 2022-09-16), the original issue seems fixed (probably because the default branch of https://github.com/rust-random/rand used by lib1 is now a different version to the one used in lib2). Running cargo update -p rand gives the following unambiguous output:

error: There are multiple `rand` packages in your project, and the specification `rand` is ambiguous.
Please re-run this command with `-p <spec>` where `<spec>` is one of the following:
  rand@0.7.4
  rand@0.8.5

In general though, this problem can still occur, e.g. if in lib1 you change the rand dependency to be pulled in to be:

rand = { git = "https://github.com/rust-random/rand.git", tag = "0.8.5" }

and in lib2:

rand = { git = "https://github.com/rust-random/rand.git", rev = "937320cbfeebd4352a23086d9c6e68f067f74644" }

Here, tag 0.8.5 points to commit 937320cbfeebd4352a23086d9c6e68f067f74644, but in this case the ambiguity returns.

error: There are multiple `rand` packages in your project, and the specification `rand` is ambiguous.
Please re-run this command with `-p <spec>` where `<spec>` is one of the following:
  https://github.com/rust-random/rand.git#rand@0.8.5
  https://github.com/rust-random/rand.git#rand@0.8.5

The underlying issue is that both of those rand dependencies as specified result in the same package ID spec (https://github.com/rust-random/rand.git#rand@0.8.5). This can be worked around by using different git paths when specifying the "clashing" dependencies e.g. https://github.com/rust-random/rand.git for one rand dependency, and https://github.com/rust-random/rand for the other, but ultimately it's still possible to get this situation.

[epage]

I tried to reproduce this

[package]
name = "cargo-8481"
version = "0.1.0"
edition = "2021"

[dependencies]
rand1 = { git = "https://github.com/rust-random/rand.git", rev = "937320c", package = "rand" }
rand2 = { git = "https://github.com/rust-random/rand.git", branch = "0.8", package = "rand" }

$ cargo update rand
warning: ignoring `resolver` config table without `-Zmsrv-policy`
error: There are multiple `rand` packages in your project, and the specification `rand` is ambiguous.
Please re-run this command with one of the following specifications:
  git+https://github.com/rust-random/rand.git?branch=0.8#rand@0.8.5
  git+https://github.com/rust-random/rand.git?rev=937320c#rand@0.8.5

$ cargo update git+https://github.com/rust-random/rand.git?branch=0.8#rand@0.8.5
warning: ignoring `resolver` config table without `-Zmsrv-policy`
    Updating git repository `https://github.com/rust-random/rand.git`
    Updating crates.io index
     Locking 0 packages to latest compatible versions

Looks like this was resolved by #12933.