Scan untracked files in git for packaging/deps

[alexcrichton]

Closes #797
Closes #1575

This is a reopening of #1170 but I see the two closed issues as important enough that this needs to land in some form or another, and I'm more comfortable with always taking into account untracked files than only if there isn't a commit yet.

[alexcrichton]

r? @brson

cc @huonw

[rust-highfive]

r? @huonw

(rust_highfive has picked a reviewer for you, use r? to override)

[brson]

@bors r+

[bors]

📌 Commit a8e9ce2 has been approved by brson

[bors]

⌛ Testing commit a8e9ce2 with merge aa8ee2d...

[bors]

☀️ Test successful - cargo-linux-32, cargo-linux-64, cargo-mac-32, cargo-mac-64, cargo-win-32, cargo-win-64

[bluss]

Using the today's latest rustc+cargo, I see a lot of junk files in the generated cargo package. Crates.io thankfully refused the upload.

Crate was usually 30K to upload, went up to 18M (yeah, I had some untracked junk in my working directory..).

cargo package (used by cargo publish) will include all non-ignored untracked files in the working directory. Untidy crate authors will have to be careful!

Is that caused by this?

cargo 0.2.0-nightly (0d75eb6 2015-05-07) (built 2015-05-08)

[Manishearth]

Can these be printed in the normal cargo publish output as a yellow note about "these files are being uploaded" ?

[shepmaster]

Can these be printed in the normal cargo publish

And hopefully in cargo package as well, so we can fix the issue before our files are uploaded? This scares me that someone might accidentally have a file full of secure information that gets uploaded somewhere...

[alexcrichton]

@bluss yes those extra contents were likely caused by this patch, thanks for opening #1597 as well!

---

@shepmaster this change mirrors the behavior for path sources and other possible VCSs, so it's just bringing the git implementation more in-line with other repositories. Note that this should still be respecting .gitignore, however, which I would expect all credentials of various sorts to be located in.

[Manishearth]

I would expect all credentials of various sorts to be located in.

In situations involving security it's better to assume laziness/incompetence/whatever. Especially when this seems like a nuance in Cargo's functionality that most folks won't know in the first place.