remove cargo dependency

[MarcoIeni]

Motivations

cargo increases the compile time of release-plz.
We only use it to download crates from the registries.

Solution

After reading this docs, I think we can implement the download of the crate by ourselves.

Example code doing this (not sure if they work with private registries):

• https://github.com/Nullus157/cargo-dl
• https://github.com/Xion/cargo-download
• https://github.com/nakabonne/rhack

Things to check:

• can we re-use the cargo cache folder?

• make sure it works with private registries: both sparse and git protocol

• support authentication with cargo login. This is from cargo help login:

  For the default cargo:token credential provider, the token is saved in $CARGO_HOME/credentials.toml.
  CARGO_HOME defaults to .cargo in your home directory.
  
  If a registry has a credential-provider specified, it will be used.
  Otherwise, the providers from the config value registry.global-credential-providers will be attempted, starting from the end of the list.
  

Alternatives

It would be much better if cargo offered this out of the box. I.e. cargo download my-crate.
We could open an RFC to add this functionality to cargo.
However, this might take a lot of time until we see it implemented.

Note

I'm not an expert on this, so I'm happy to discuss this with somebody with more knowledge about cargo. Feel free to challenge me on this decision :)

[mbodmer]

I am not sure whether you would get all the information you need from cargo search <CRATENAME> [--registry myregistry].

Do we need to actually download the crate?

[MarcoIeni]

Yes. Release-plz compares the current project with the published version file by file, going back to history commit by commit.

When the two projects match release-plz stops looking back in git history and that is the last commit that goes into the changelog for the new release.

[MarcoIeni]

The best would be to have this command built into cargo, i.e. rust-lang/cargo#1861