Limit --exclude to workspace packages

[tautschnig]

Previously, --exclude would start from the set of all packages referenced in a workspace, i.e., the workspace's packages plus any dependencies. Without --exclude, we would at most look at all the workspace's packages, so --exclude would result in possibly verifying a larger set of packages.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 and MIT licenses.

[jaisnan]

Thanks!

[adpaco-aws]

Previously, --exclude would start from the set of all packages referenced in a workspace, i.e., the workspace's packages plus any dependencies. Without --exclude, we would at most look at all the workspace's packages, so --exclude would result in possibly verifying a larger set of packages.

Is this true? I thought that the problem is that --exclude started from a smaller set of packages (i.e., the set that only includes that package), which wouldn't compile in the case we've seen because of features defined in other packages.

The fix makes sense to me, I'm only having problems understanding the reasoning behind it.

[tautschnig]

Previously, --exclude would start from the set of all packages referenced in a workspace, i.e., the workspace's packages plus any dependencies. Without --exclude, we would at most look at all the workspace's packages, so --exclude would result in possibly verifying a larger set of packages.

Is this true? I thought that the problem is that --exclude started from a smaller set of packages (i.e., the set that only includes that package), which wouldn't compile in the case we've seen because of features defined in other packages.

The fix makes sense to me, I'm only having problems understanding the reasoning behind it.

I admit that I am struggling to decipher https://docs.rs/cargo_metadata/latest/cargo_metadata/struct.Metadata.html#method.workspace_packages -- "Get the workspace packages." is not much more insightful than the name of the method. So even from that documentation I am not really able to tell the difference between metadata.packages and metadata.workspace_packages(). All I can say is that one case that previously caused trouble now works fine.

[adpaco-aws]

Cargo Workspaces are explained here. I wouldn't expect that to be explained in the API since workspaces are the main mechanism in cargo to group up packages which do not necessarily depend among each other, but are simply developed on at the same time.