Regression 1.33.0: Cargo doesn't resolve yanked crates when using local registry

[hugwijst]

Problem

When using a local registry, building a crate that depends on a yanked crate will fail with error message: error: failed to select a version for the requirement.

The crate builds correctly when using the crates.io remote registry.

Steps

On 1.33.0 or nightly:

1. cargo init test-lib
2. cd test-lib
3. echo 'libc = "0.1.11"' >> Cargo.toml
4. Populate Cargo.lock:

cat << EOF > Cargo.lock
[[package]]
name = "libc"
version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"

[[package]]
name = "test-bin"
version = "0.1.0"
dependencies = [
 "libc 0.1.11 (registry+https://github.com/rust-lang/crates.io-index)",
]

[metadata]
"checksum libc 0.1.11 (registry+https://github.com/rust-lang/crates.io-index)" = "0f005973c230985173e16b763cc28801eb4367d500ebdb85b79f790e9a5c1f7e"
EOF

5. cargo local-registry -s Cargo.lock registry
6. mkdir .cargo
7. Populate .cargo/config:

cat << EOF > .cargo/config
[source.crates-io]
registry = 'https://github.com/rust-lang/crates.io-index'
replace-with = 'local-registry'

[source.local-registry]
local-registry = '`pwd`/registry'
EOF

8. cargo check
9. Observe the following error: error: failed to select a version for the requirement `libc = "= 0.1.11"` .

Possible Solution(s)

Possibly introduced by #6655, as a local registry isn't provided the yanked_whitelist when constructed (RegistrySource::local in src/cargo/sources/registry/mod.rs).

Notes

• Introduced in Cargo 1.33.0, not observed on 1.25.0 up to and including 1.32.0.
• This issue is quite severe, as updating the local registry will break compilation of crates that compiled on the same compiler version.

Output of cargo version:
cargo 1.33.0 (f099fe94b 2019-02-12).

[hugwijst]

Can we backport this into beta? Getting a 1.33.1 is probably a long shot.

We'll need to skip 1.33.0 internally, as having commits that cannot be successfully build anymore due to an update to the local registry is unacceptable.

[alexcrichton]

Backporting seems reasonable to me! @hugwijst would you be up for sending a PR to the rust-1.34.0 branch of this repository?