From ab33bc0c36d66acc0f1c19237fb7d631a286672e Mon Sep 17 00:00:00 2001
From: Eric Huss <eric@huss.org>
Date: Tue, 18 Feb 2020 11:40:04 -0800
Subject: [PATCH 1/2] Add a warning if license-file points to a file that does
 not exist.

---
 src/cargo/ops/cargo_package.rs | 20 ++++++++++++++++++++
 tests/testsuite/package.rs     | 30 ++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)

diff --git a/src/cargo/ops/cargo_package.rs b/src/cargo/ops/cargo_package.rs
index 21522c57307..0d0665a61c5 100644
--- a/src/cargo/ops/cargo_package.rs
+++ b/src/cargo/ops/cargo_package.rs
@@ -200,6 +200,26 @@ fn check_metadata(pkg: &Package, config: &Config) -> CargoResult<()> {
             things = things
         ))?
     }
+
+    if let Some(license_path) = &md.license_file {
+        let license_path = Path::new(license_path);
+        let abs_license_path = pkg.root().join(license_path);
+        if !abs_license_path.exists() {
+            let rel_msg = if license_path.is_absolute() {
+                "".to_string()
+            } else {
+                format!(" (relative to `{}`)", pkg.root().display())
+            };
+            config.shell().warn(&format!(
+                "license-file `{}` does not appear to exist{}.\n\
+                Please update the license-file setting in the manifest at `{}`\n\
+                This may become a hard error in the future.",
+                license_path.display(),
+                rel_msg,
+                pkg.manifest_path().display()
+            ))?;
+        }
+    }
     Ok(())
 }
 
diff --git a/tests/testsuite/package.rs b/tests/testsuite/package.rs
index dce30877139..ae3eb2a7444 100644
--- a/tests/testsuite/package.rs
+++ b/tests/testsuite/package.rs
@@ -1445,3 +1445,33 @@ fn exclude_dot_files_and_directories_by_default() {
          ",
     );
 }
+
+#[cargo_test]
+fn invalid_license_file_path() {
+    // Test warning when license-file points to a non-existent file.
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+            [package]
+            name = "foo"
+            version = "1.0.0"
+            license-file = "does-not-exist"
+            description = "foo"
+            homepage = "foo"
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .build();
+
+    p.cargo("package --no-verify")
+        .with_stderr(
+            "\
+[WARNING] license-file `does-not-exist` does not appear to exist (relative to `[..]/foo`).
+Please update the license-file setting in the manifest at `[..]/foo/Cargo.toml`
+This may become a hard error in the future.
+[PACKAGING] foo v1.0.0 ([..]/foo)
+",
+        )
+        .run();
+}

From 90887707ed5aea9f9a474d5708fc19e8966defcd Mon Sep 17 00:00:00 2001
From: Eric Huss <eric@huss.org>
Date: Wed, 19 Feb 2020 10:46:54 -0800
Subject: [PATCH 2/2] Copy license-file into package if outside of root.

---
 src/cargo/core/package.rs           |   5 +-
 src/cargo/ops/cargo_package.rs      | 409 +++++++++++++++-------------
 src/cargo/util/toml/mod.rs          |  22 +-
 tests/testsuite/git.rs              |   1 +
 tests/testsuite/package.rs          | 222 +++++++++++++--
 tests/testsuite/publish_lockfile.rs |  25 +-
 tests/testsuite/registry.rs         |   7 +-
 7 files changed, 464 insertions(+), 227 deletions(-)

diff --git a/src/cargo/core/package.rs b/src/cargo/core/package.rs
index f45867febde..ad1a536fa38 100644
--- a/src/cargo/core/package.rs
+++ b/src/cargo/core/package.rs
@@ -203,7 +203,10 @@ impl Package {
     }
 
     pub fn to_registry_toml(&self, config: &Config) -> CargoResult<String> {
-        let manifest = self.manifest().original().prepare_for_publish(config)?;
+        let manifest = self
+            .manifest()
+            .original()
+            .prepare_for_publish(config, self.root())?;
         let toml = toml::to_string(&manifest)?;
         Ok(format!(
             "# THIS FILE IS AUTOMATICALLY GENERATED BY CARGO\n\
diff --git a/src/cargo/ops/cargo_package.rs b/src/cargo/ops/cargo_package.rs
index 0d0665a61c5..9678dd4d368 100644
--- a/src/cargo/ops/cargo_package.rs
+++ b/src/cargo/ops/cargo_package.rs
@@ -1,26 +1,20 @@
 use std::collections::{BTreeSet, HashMap};
-use std::fmt::Display;
 use std::fs::{self, File};
 use std::io::prelude::*;
 use std::io::SeekFrom;
-use std::path::{self, Path, PathBuf};
+use std::path::{Path, PathBuf};
 use std::rc::Rc;
 use std::sync::Arc;
 use std::time::SystemTime;
 
 use flate2::read::GzDecoder;
-use flate2::write::GzEncoder;
 use flate2::{Compression, GzBuilder};
 use log::debug;
-use serde_json::{self, json};
 use tar::{Archive, Builder, EntryType, Header};
 
 use crate::core::compiler::{BuildConfig, CompileMode, DefaultExecutor, Executor};
-
-use crate::core::Feature;
-use crate::core::{
-    Package, PackageId, PackageSet, Resolve, Source, SourceId, Verbosity, Workspace,
-};
+use crate::core::{Feature, Verbosity, Workspace};
+use crate::core::{Package, PackageId, PackageSet, Resolve, Source, SourceId};
 use crate::ops;
 use crate::sources::PathSource;
 use crate::util::errors::{CargoResult, CargoResultExt};
@@ -41,7 +35,24 @@ pub struct PackageOpts<'cfg> {
     pub no_default_features: bool,
 }
 
-static VCS_INFO_FILE: &str = ".cargo_vcs_info.json";
+const VCS_INFO_FILE: &str = ".cargo_vcs_info.json";
+
+struct ArchiveFile {
+    /// The relative path in the archive (not including the top-level package
+    /// name directory).
+    rel_path: PathBuf,
+    /// String variant of `rel_path`, for convenience.
+    rel_str: String,
+    /// The contents to add to the archive.
+    contents: FileContents,
+}
+
+enum FileContents {
+    /// Absolute path to the file on disk to add to the archive.
+    OnDisk(PathBuf),
+    /// Contents of a file generated in memory.
+    Generated(String),
+}
 
 pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Option<FileLock>> {
     if ws.root().join("Cargo.lock").exists() {
@@ -68,40 +79,23 @@ pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Option
              the exclude list will be ignored",
         )?;
     }
-    // `list_files` outputs warnings as a side effect, so only do it once.
     let src_files = src.list_files(pkg)?;
 
-    // Make sure a VCS info file is not included in source, regardless of if
-    // we produced the file above, and in particular if we did not.
-    check_vcs_file_collision(pkg, &src_files)?;
-
     // Check (git) repository state, getting the current commit hash if not
-    // dirty. This will `bail!` if dirty, unless allow_dirty. Produce json
-    // info for any sha1 (HEAD revision) returned.
+    // dirty.
     let vcs_info = if !opts.allow_dirty {
-        check_repo_state(pkg, &src_files, config, opts.allow_dirty)?
-            .map(|h| json!({"git":{"sha1": h}}))
+        // This will error if a dirty repo is found.
+        check_repo_state(pkg, &src_files, config)?
+            .map(|h| format!("{{\n  \"git\": {{\n    \"sha1\": \"{}\"\n  }}\n}}\n", h))
     } else {
         None
     };
 
+    let ar_files = build_ar_list(ws, pkg, src_files, vcs_info)?;
+
     if opts.list {
-        let root = pkg.root();
-        let mut list: Vec<_> = src
-            .list_files(pkg)?
-            .iter()
-            .map(|file| file.strip_prefix(root).unwrap().to_path_buf())
-            .collect();
-        if pkg.include_lockfile() && !list.contains(&PathBuf::from("Cargo.lock")) {
-            // A generated Cargo.lock will be included.
-            list.push("Cargo.lock".into());
-        }
-        if vcs_info.is_some() {
-            list.push(Path::new(VCS_INFO_FILE).to_path_buf());
-        }
-        list.sort_unstable();
-        for file in list.iter() {
-            println!("{}", file.display());
+        for ar_file in ar_files {
+            println!("{}", ar_file.rel_str);
         }
         return Ok(None);
     }
@@ -121,7 +115,7 @@ pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Option
         .shell()
         .status("Packaging", pkg.package_id().to_string())?;
     dst.file().set_len(0)?;
-    tar(ws, &src_files, vcs_info.as_ref(), dst.file(), &filename)
+    tar(ws, ar_files, dst.file(), &filename)
         .chain_err(|| anyhow::format_err!("failed to prepare local package for uploading"))?;
     if opts.verify {
         dst.seek(SeekFrom::Start(0))?;
@@ -137,6 +131,131 @@ pub fn package(ws: &Workspace<'_>, opts: &PackageOpts<'_>) -> CargoResult<Option
     Ok(Some(dst))
 }
 
+/// Builds list of files to archive.
+fn build_ar_list(
+    ws: &Workspace<'_>,
+    pkg: &Package,
+    src_files: Vec<PathBuf>,
+    vcs_info: Option<String>,
+) -> CargoResult<Vec<ArchiveFile>> {
+    let mut result = Vec::new();
+    let root = pkg.root();
+    for src_file in src_files {
+        let rel_path = src_file.strip_prefix(&root)?.to_path_buf();
+        check_filename(&rel_path)?;
+        let rel_str = rel_path
+            .to_str()
+            .ok_or_else(|| {
+                anyhow::format_err!("non-utf8 path in source directory: {}", rel_path.display())
+            })?
+            .to_string();
+        match rel_str.as_ref() {
+            "Cargo.toml" => {
+                result.push(ArchiveFile {
+                    rel_path: PathBuf::from("Cargo.toml.orig"),
+                    rel_str: "Cargo.toml.orig".to_string(),
+                    contents: FileContents::OnDisk(src_file),
+                });
+                let generated = pkg.to_registry_toml(ws.config())?;
+                result.push(ArchiveFile {
+                    rel_path,
+                    rel_str,
+                    contents: FileContents::Generated(generated),
+                });
+            }
+            "Cargo.lock" => continue,
+            VCS_INFO_FILE => anyhow::bail!(
+                "invalid inclusion of reserved file name \
+                     {} in package source",
+                VCS_INFO_FILE
+            ),
+            _ => {
+                result.push(ArchiveFile {
+                    rel_path,
+                    rel_str,
+                    contents: FileContents::OnDisk(src_file),
+                });
+            }
+        }
+    }
+    if pkg.include_lockfile() {
+        let new_lock = build_lock(ws)?;
+        result.push(ArchiveFile {
+            rel_path: PathBuf::from("Cargo.lock"),
+            rel_str: "Cargo.lock".to_string(),
+            contents: FileContents::Generated(new_lock),
+        });
+    }
+    if let Some(vcs_info) = vcs_info {
+        result.push(ArchiveFile {
+            rel_path: PathBuf::from(VCS_INFO_FILE),
+            rel_str: VCS_INFO_FILE.to_string(),
+            contents: FileContents::Generated(vcs_info),
+        });
+    }
+    if let Some(license_file) = &pkg.manifest().metadata().license_file {
+        let license_path = Path::new(license_file);
+        let abs_license_path = paths::normalize_path(&pkg.root().join(license_path));
+        if abs_license_path.exists() {
+            match abs_license_path.strip_prefix(&pkg.root()) {
+                Ok(rel_license_path) => {
+                    if !result.iter().any(|ar| ar.rel_path == rel_license_path) {
+                        result.push(ArchiveFile {
+                            rel_path: rel_license_path.to_path_buf(),
+                            rel_str: rel_license_path
+                                .to_str()
+                                .expect("everything was utf8")
+                                .to_string(),
+                            contents: FileContents::OnDisk(abs_license_path),
+                        });
+                    }
+                }
+                Err(_) => {
+                    // The license exists somewhere outside of the package.
+                    let license_name = license_path.file_name().unwrap();
+                    if result
+                        .iter()
+                        .any(|ar| ar.rel_path.file_name().unwrap() == license_name)
+                    {
+                        ws.config().shell().warn(&format!(
+                            "license-file `{}` appears to be a path outside of the package, \
+                            but there is already a file named `{}` in the root of the package. \
+                            The archived crate will contain the copy in the root of the package. \
+                            Update the license-file to point to the path relative \
+                            to the root of the package to remove this warning.",
+                            license_file,
+                            license_name.to_str().unwrap()
+                        ))?;
+                    } else {
+                        result.push(ArchiveFile {
+                            rel_path: PathBuf::from(license_name),
+                            rel_str: license_name.to_str().unwrap().to_string(),
+                            contents: FileContents::OnDisk(abs_license_path),
+                        });
+                    }
+                }
+            }
+        } else {
+            let rel_msg = if license_path.is_absolute() {
+                "".to_string()
+            } else {
+                format!(" (relative to `{}`)", pkg.root().display())
+            };
+            ws.config().shell().warn(&format!(
+                "license-file `{}` does not appear to exist{}.\n\
+                Please update the license-file setting in the manifest at `{}`\n\
+                This may become a hard error in the future.",
+                license_path.display(),
+                rel_msg,
+                pkg.manifest_path().display()
+            ))?;
+        }
+    }
+    result.sort_unstable_by(|a, b| a.rel_path.cmp(&b.rel_path));
+
+    Ok(result)
+}
+
 /// Construct `Cargo.lock` for the package to be published.
 fn build_lock(ws: &Workspace<'_>) -> CargoResult<String> {
     let config = ws.config();
@@ -144,7 +263,12 @@ fn build_lock(ws: &Workspace<'_>) -> CargoResult<String> {
 
     // Convert Package -> TomlManifest -> Manifest -> Package
     let orig_pkg = ws.current()?;
-    let toml_manifest = Rc::new(orig_pkg.manifest().original().prepare_for_publish(config)?);
+    let toml_manifest = Rc::new(
+        orig_pkg
+            .manifest()
+            .original()
+            .prepare_for_publish(config, orig_pkg.root())?,
+    );
     let package_root = orig_pkg.root();
     let source_id = orig_pkg.package_id().source_id();
     let (manifest, _nested_paths) =
@@ -201,25 +325,6 @@ fn check_metadata(pkg: &Package, config: &Config) -> CargoResult<()> {
         ))?
     }
 
-    if let Some(license_path) = &md.license_file {
-        let license_path = Path::new(license_path);
-        let abs_license_path = pkg.root().join(license_path);
-        if !abs_license_path.exists() {
-            let rel_msg = if license_path.is_absolute() {
-                "".to_string()
-            } else {
-                format!(" (relative to `{}`)", pkg.root().display())
-            };
-            config.shell().warn(&format!(
-                "license-file `{}` does not appear to exist{}.\n\
-                Please update the license-file setting in the manifest at `{}`\n\
-                This may become a hard error in the future.",
-                license_path.display(),
-                rel_msg,
-                pkg.manifest_path().display()
-            ))?;
-        }
-    }
     Ok(())
 }
 
@@ -238,15 +343,14 @@ fn verify_dependencies(pkg: &Package) -> CargoResult<()> {
     Ok(())
 }
 
-// Checks if the package source is in a *git* DVCS repository. If *git*, and
-// the source is *dirty* (e.g., has uncommitted changes) and not `allow_dirty`
-// then `bail!` with an informative message. Otherwise return the sha1 hash of
-// the current *HEAD* commit, or `None` if *dirty*.
+/// Checks if the package source is in a *git* DVCS repository. If *git*, and
+/// the source is *dirty* (e.g., has uncommitted changes) then `bail!` with an
+/// informative message. Otherwise return the sha1 hash of the current *HEAD*
+/// commit, or `None` if no repo is found.
 fn check_repo_state(
     p: &Package,
     src_files: &[PathBuf],
     config: &Config,
-    allow_dirty: bool,
 ) -> CargoResult<Option<String>> {
     if let Ok(repo) = git2::Repository::discover(p.root()) {
         if let Some(workdir) = repo.workdir() {
@@ -259,7 +363,7 @@ fn check_repo_state(
                         "found (git) Cargo.toml at {:?} in workdir {:?}",
                         path, workdir
                     );
-                    return git(p, src_files, &repo, allow_dirty);
+                    return git(p, src_files, &repo);
                 }
             }
             config.shell().verbose(|shell| {
@@ -284,7 +388,6 @@ fn check_repo_state(
         p: &Package,
         src_files: &[PathBuf],
         repo: &git2::Repository,
-        allow_dirty: bool,
     ) -> CargoResult<Option<String>> {
         let workdir = repo.workdir().unwrap();
 
@@ -335,16 +438,13 @@ fn check_repo_state(
             let rev_obj = repo.revparse_single("HEAD")?;
             Ok(Some(rev_obj.id().to_string()))
         } else {
-            if !allow_dirty {
-                anyhow::bail!(
-                    "{} files in the working directory contain changes that were \
-                     not yet committed into git:\n\n{}\n\n\
-                     to proceed despite this and include the uncommitted changes, pass the `--allow-dirty` flag",
-                    dirty.len(),
-                    dirty.join("\n")
-                )
-            }
-            Ok(None)
+            anyhow::bail!(
+                "{} files in the working directory contain changes that were \
+                 not yet committed into git:\n\n{}\n\n\
+                 to proceed despite this and include the uncommitted changes, pass the `--allow-dirty` flag",
+                dirty.len(),
+                dirty.join("\n")
+            )
         }
     }
 
@@ -365,28 +465,9 @@ fn check_repo_state(
     }
 }
 
-// Checks for and `bail!` if a source file matches `ROOT/VCS_INFO_FILE`, since
-// this is now a Cargo reserved file name, and we don't want to allow forgery.
-fn check_vcs_file_collision(pkg: &Package, src_files: &[PathBuf]) -> CargoResult<()> {
-    let root = pkg.root();
-    let vcs_info_path = Path::new(VCS_INFO_FILE);
-    let collision = src_files
-        .iter()
-        .find(|&p| p.strip_prefix(root).unwrap() == vcs_info_path);
-    if collision.is_some() {
-        anyhow::bail!(
-            "Invalid inclusion of reserved file name \
-             {} in package source",
-            VCS_INFO_FILE
-        );
-    }
-    Ok(())
-}
-
 fn tar(
     ws: &Workspace<'_>,
-    src_files: &[PathBuf],
-    vcs_info: Option<&serde_json::Value>,
+    ar_files: Vec<ArchiveFile>,
     dst: &File,
     filename: &str,
 ) -> CargoResult<()> {
@@ -400,29 +481,19 @@ fn tar(
     let mut ar = Builder::new(encoder);
     let pkg = ws.current()?;
     let config = ws.config();
-    let root = pkg.root();
 
-    for src_file in src_files {
-        let relative = src_file.strip_prefix(root)?;
-        check_filename(relative)?;
-        let relative_str = relative.to_str().ok_or_else(|| {
-            anyhow::format_err!("non-utf8 path in source directory: {}", relative.display())
-        })?;
-        if relative_str == "Cargo.lock" {
-            // This is added manually below.
-            continue;
-        }
+    let base_name = format!("{}-{}", pkg.name(), pkg.version());
+    let base_path = Path::new(&base_name);
+    for ar_file in ar_files {
+        let ArchiveFile {
+            rel_path,
+            rel_str,
+            contents,
+        } = ar_file;
+        let ar_path = base_path.join(&rel_path);
         config
             .shell()
-            .verbose(|shell| shell.status("Archiving", &relative_str))?;
-        let path = format!(
-            "{}-{}{}{}",
-            pkg.name(),
-            pkg.version(),
-            path::MAIN_SEPARATOR,
-            relative_str
-        );
-
+            .verbose(|shell| shell.status("Archiving", &rel_str))?;
         // The `tar::Builder` type by default will build GNU archives, but
         // unfortunately we force it here to use UStar archives instead. The
         // UStar format has more limitations on the length of path name that it
@@ -443,68 +514,39 @@ fn tar(
         // look at rust-lang/cargo#2326.
         let mut header = Header::new_ustar();
         header
-            .set_path(&path)
-            .chain_err(|| format!("failed to add to archive: `{}`", relative_str))?;
-        let mut file = File::open(src_file)
-            .chain_err(|| format!("failed to open for archiving: `{}`", src_file.display()))?;
-        let metadata = file
-            .metadata()
-            .chain_err(|| format!("could not learn metadata for: `{}`", relative_str))?;
-        header.set_metadata(&metadata);
-
-        if relative_str == "Cargo.toml" {
-            let orig = Path::new(&path).with_file_name("Cargo.toml.orig");
-            header.set_path(&orig)?;
-            header.set_cksum();
-            ar.append(&header, &mut file)
-                .chain_err(|| format!("could not archive source file `{}`", relative_str))?;
-
-            let toml = pkg.to_registry_toml(ws.config())?;
-            add_generated_file(&mut ar, &path, &toml, relative_str)?;
-        } else {
-            header.set_cksum();
-            ar.append(&header, &mut file)
-                .chain_err(|| format!("could not archive source file `{}`", relative_str))?;
+            .set_path(&ar_path)
+            .chain_err(|| format!("failed to add to archive: `{}`", rel_str))?;
+        match contents {
+            FileContents::OnDisk(disk_path) => {
+                let mut file = File::open(&disk_path).chain_err(|| {
+                    format!("failed to open for archiving: `{}`", disk_path.display())
+                })?;
+                let metadata = file.metadata().chain_err(|| {
+                    format!("could not learn metadata for: `{}`", disk_path.display())
+                })?;
+                header.set_metadata(&metadata);
+                header.set_cksum();
+                ar.append(&header, &mut file).chain_err(|| {
+                    format!("could not archive source file `{}`", disk_path.display())
+                })?;
+            }
+            FileContents::Generated(contents) => {
+                header.set_entry_type(EntryType::file());
+                header.set_mode(0o644);
+                header.set_mtime(
+                    SystemTime::now()
+                        .duration_since(SystemTime::UNIX_EPOCH)
+                        .unwrap()
+                        .as_secs(),
+                );
+                header.set_size(contents.len() as u64);
+                header.set_cksum();
+                ar.append(&header, contents.as_bytes())
+                    .chain_err(|| format!("could not archive source file `{}`", rel_str))?;
+            }
         }
     }
 
-    if let Some(json) = vcs_info {
-        let filename: PathBuf = Path::new(VCS_INFO_FILE).into();
-        debug_assert!(check_filename(&filename).is_ok());
-        let fnd = filename.display();
-        config
-            .shell()
-            .verbose(|shell| shell.status("Archiving", &fnd))?;
-        let path = format!(
-            "{}-{}{}{}",
-            pkg.name(),
-            pkg.version(),
-            path::MAIN_SEPARATOR,
-            fnd
-        );
-        let mut header = Header::new_ustar();
-        header
-            .set_path(&path)
-            .chain_err(|| format!("failed to add to archive: `{}`", fnd))?;
-        let json = format!("{}\n", serde_json::to_string_pretty(json)?);
-        add_generated_file(&mut ar, &path, &json, fnd)?;
-    }
-
-    if pkg.include_lockfile() {
-        let new_lock = build_lock(ws)?;
-
-        config
-            .shell()
-            .verbose(|shell| shell.status("Archiving", "Cargo.lock"))?;
-        let path = format!(
-            "{}-{}{}Cargo.lock",
-            pkg.name(),
-            pkg.version(),
-            path::MAIN_SEPARATOR
-        );
-        add_generated_file(&mut ar, &path, &new_lock, "Cargo.lock")?;
-    }
-
     let encoder = ar.into_inner()?;
     encoder.finish()?;
     Ok(())
@@ -785,26 +827,3 @@ fn check_filename(file: &Path) -> CargoResult<()> {
     }
     Ok(())
 }
-
-fn add_generated_file<D: Display>(
-    ar: &mut Builder<GzEncoder<&File>>,
-    path: &str,
-    data: &str,
-    display: D,
-) -> CargoResult<()> {
-    let mut header = Header::new_ustar();
-    header.set_path(path)?;
-    header.set_entry_type(EntryType::file());
-    header.set_mode(0o644);
-    header.set_mtime(
-        SystemTime::now()
-            .duration_since(SystemTime::UNIX_EPOCH)
-            .unwrap()
-            .as_secs(),
-    );
-    header.set_size(data.len() as u64);
-    header.set_cksum();
-    ar.append(&header, data.as_bytes())
-        .chain_err(|| format!("could not archive source file `{}`", display))?;
-    Ok(())
-}
diff --git a/src/cargo/util/toml/mod.rs b/src/cargo/util/toml/mod.rs
index 950783d8911..1333a8187be 100644
--- a/src/cargo/util/toml/mod.rs
+++ b/src/cargo/util/toml/mod.rs
@@ -835,7 +835,11 @@ struct Context<'a, 'b> {
 }
 
 impl TomlManifest {
-    pub fn prepare_for_publish(&self, config: &Config) -> CargoResult<TomlManifest> {
+    pub fn prepare_for_publish(
+        &self,
+        config: &Config,
+        package_root: &Path,
+    ) -> CargoResult<TomlManifest> {
         let mut package = self
             .package
             .as_ref()
@@ -843,6 +847,22 @@ impl TomlManifest {
             .unwrap()
             .clone();
         package.workspace = None;
+        if let Some(license_file) = &package.license_file {
+            let license_path = Path::new(&license_file);
+            let abs_license_path = paths::normalize_path(&package_root.join(license_path));
+            if abs_license_path.strip_prefix(package_root).is_err() {
+                // This path points outside of the package root. `cargo package`
+                // will copy it into the root, so adjust the path to this location.
+                package.license_file = Some(
+                    license_path
+                        .file_name()
+                        .unwrap()
+                        .to_str()
+                        .unwrap()
+                        .to_string(),
+                );
+            }
+        }
         let all = |_d: &TomlDependency| true;
         return Ok(TomlManifest {
             package: Some(package),
diff --git a/tests/testsuite/git.rs b/tests/testsuite/git.rs
index 8410be80a74..adbe8ab396b 100644
--- a/tests/testsuite/git.rs
+++ b/tests/testsuite/git.rs
@@ -2314,6 +2314,7 @@ fn include_overrides_gitignore() {
         .with_stdout(
             "\
 Cargo.toml
+Cargo.toml.orig
 ignored.txt
 src/lib.rs
 ",
diff --git a/tests/testsuite/package.rs b/tests/testsuite/package.rs
index ae3eb2a7444..083b984b34d 100644
--- a/tests/testsuite/package.rs
+++ b/tests/testsuite/package.rs
@@ -1,7 +1,7 @@
 //! Tests for the `cargo package` command.
 
 use std;
-use std::fs::File;
+use std::fs::{read_to_string, File};
 use std::io::prelude::*;
 use std::path::Path;
 
@@ -50,6 +50,7 @@ See [..]
             "\
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 src/main.rs
 ",
         )
@@ -154,10 +155,11 @@ fn package_verbose() {
 [WARNING] manifest has no description[..]
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.
 [PACKAGING] foo v0.0.1 ([..])
-[ARCHIVING] Cargo.toml
-[ARCHIVING] src/main.rs
 [ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] Cargo.lock
+[ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
+[ARCHIVING] src/main.rs
 ",
         )
         .run();
@@ -193,9 +195,10 @@ See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for
 [WARNING] manifest has no description[..]
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.
 [PACKAGING] a v0.0.1 ([..])
+[ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
 [ARCHIVING] src/lib.rs
-[ARCHIVING] .cargo_vcs_info.json
 ",
         )
         .run();
@@ -251,7 +254,7 @@ fn vcs_file_collision() {
         .with_status(101)
         .with_stderr(
             "\
-[ERROR] Invalid inclusion of reserved file name .cargo_vcs_info.json \
+[ERROR] invalid inclusion of reserved file name .cargo_vcs_info.json \
 in package source
 ",
         )
@@ -370,7 +373,10 @@ fn exclude() {
 [WARNING] manifest has no description[..]
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.
 [PACKAGING] foo v0.0.1 ([..])
+[ARCHIVING] .cargo_vcs_info.json
+[ARCHIVING] Cargo.lock
 [ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
 [ARCHIVING] file_root_3
 [ARCHIVING] file_root_4
 [ARCHIVING] file_root_5
@@ -382,8 +388,6 @@ See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for
 [ARCHIVING] some_dir/file_deep_4
 [ARCHIVING] some_dir/file_deep_5
 [ARCHIVING] src/main.rs
-[ARCHIVING] .cargo_vcs_info.json
-[ARCHIVING] Cargo.lock
 ",
         )
         .run();
@@ -397,6 +401,7 @@ See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for
 .cargo_vcs_info.json
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 file_root_3
 file_root_4
 file_root_5
@@ -443,12 +448,13 @@ fn include() {
 See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for more info.
 [WARNING] both package.include and package.exclude are specified; the exclude list will be ignored
 [PACKAGING] foo v0.0.1 ([..])
+[ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] .dotfile
+[ARCHIVING] Cargo.lock
 [ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
 [ARCHIVING] foo.txt
 [ARCHIVING] src/main.rs
-[ARCHIVING] .cargo_vcs_info.json
-[ARCHIVING] Cargo.lock
 ",
         )
         .run();
@@ -572,6 +578,7 @@ fn no_duplicates_from_modified_tracked_files() {
             "\
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 src/main.rs
 ",
         )
@@ -618,7 +625,8 @@ See https://doc.rust-lang.org/cargo/reference/manifest.html#package-metadata for
             "\
 Cargo.lock
 Cargo.toml
-src[..]main.rs
+Cargo.toml.orig
+src/main.rs
 ",
         )
         .run();
@@ -648,11 +656,7 @@ fn package_weird_characters() {
             "\
 warning: [..]
 See [..]
-[PACKAGING] foo [..]
-[ERROR] failed to prepare local package for uploading
-
-Caused by:
-  cannot package a filename with a special character `:`: src/:foo
+[ERROR] cannot package a filename with a special character `:`: src/:foo
 ",
         )
         .run();
@@ -1236,7 +1240,7 @@ fn include_cargo_toml_implicit() {
         .build();
 
     p.cargo("package --list")
-        .with_stdout("Cargo.toml\nsrc/lib.rs\n")
+        .with_stdout("Cargo.toml\nCargo.toml.orig\nsrc/lib.rs\n")
         .run();
 }
 
@@ -1284,6 +1288,7 @@ fn package_include_ignore_only() {
         "[]",
         &["src/lib.rs", "src/abc1.rs", "src/abc2.rs", "src/abc/mod.rs"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/abc/mod.rs\n\
          src/abc1.rs\n\
          src/abc2.rs\n\
@@ -1299,6 +1304,7 @@ fn gitignore_patterns() {
         "[]",
         &["src/lib.rs", "foo", "a/foo", "a/b/foo", "x/foo/y", "bar"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          a/b/foo\n\
          a/foo\n\
          foo\n\
@@ -1311,6 +1317,7 @@ fn gitignore_patterns() {
         "[]",
         &["src/lib.rs", "foo", "a/foo", "a/b/foo", "x/foo/y", "bar"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          foo\n\
          ",
     );
@@ -1320,6 +1327,7 @@ fn gitignore_patterns() {
         r#"["foo/"]"#, // exclude
         &["src/lib.rs", "foo", "a/foo", "x/foo/y", "bar"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          a/foo\n\
          bar\n\
          foo\n\
@@ -1343,6 +1351,7 @@ fn gitignore_patterns() {
             "z",
         ],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          c\n\
          other\n\
          src/lib.rs\n\
@@ -1354,6 +1363,7 @@ fn gitignore_patterns() {
         "[]",
         &["src/lib.rs", "a/foo/bar", "foo", "bar"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          a/foo/bar\n\
          ",
     );
@@ -1363,6 +1373,7 @@ fn gitignore_patterns() {
         "[]",
         &["src/lib.rs", "a/foo/bar", "foo/x/y/z"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          foo/x/y/z\n\
          ",
     );
@@ -1372,6 +1383,7 @@ fn gitignore_patterns() {
         "[]",
         &["src/lib.rs", "a/b", "a/x/b", "a/x/y/b"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          a/b\n\
          a/x/b\n\
          a/x/y/b\n\
@@ -1387,6 +1399,7 @@ fn gitignore_negate() {
         &["src/lib.rs", "foo.rs", "!important"],
         "!important\n\
          Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/lib.rs\n\
          ",
     );
@@ -1400,6 +1413,7 @@ fn gitignore_negate() {
         "[]",
         &["src/lib.rs", "src/foo.rs"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/lib.rs\n\
          ",
     );
@@ -1409,6 +1423,7 @@ fn gitignore_negate() {
         "[]",
         &["src/lib.rs", "foo.rs", "src/foo.rs", "src/bar/foo.rs"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/lib.rs\n\
          ",
     );
@@ -1418,6 +1433,7 @@ fn gitignore_negate() {
         r#"["*.rs", "!foo.rs", "\\!important"]"#, // exclude
         &["src/lib.rs", "foo.rs", "!important"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          foo.rs\n\
          ",
     );
@@ -1430,6 +1446,7 @@ fn exclude_dot_files_and_directories_by_default() {
         "[]",
         &["src/lib.rs", ".dotfile", ".dotdir/file"],
         "Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/lib.rs\n\
          ",
     );
@@ -1441,6 +1458,7 @@ fn exclude_dot_files_and_directories_by_default() {
         ".dotdir/file\n\
          .dotfile\n\
          Cargo.toml\n\
+         Cargo.toml.orig\n\
          src/lib.rs\n\
          ",
     );
@@ -1475,3 +1493,175 @@ This may become a hard error in the future.
         )
         .run();
 }
+
+#[cargo_test]
+fn license_file_implicit_include() {
+    // license-file should be automatically included even if not listed.
+    let p = git::new("foo", |p| {
+        p.file(
+            "Cargo.toml",
+            r#"
+            [package]
+            name = "foo"
+            version = "1.0.0"
+            license-file = "subdir/LICENSE"
+            description = "foo"
+            homepage = "foo"
+            include = ["src"]
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .file("subdir/LICENSE", "license text")
+    });
+
+    p.cargo("package --list")
+        .with_stdout(
+            "\
+.cargo_vcs_info.json
+Cargo.toml
+Cargo.toml.orig
+src/lib.rs
+subdir/LICENSE
+",
+        )
+        .with_stderr("")
+        .run();
+
+    p.cargo("package --no-verify -v")
+        .with_stderr(
+            "\
+[PACKAGING] foo v1.0.0 [..]
+[ARCHIVING] .cargo_vcs_info.json
+[ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
+[ARCHIVING] src/lib.rs
+[ARCHIVING] subdir/LICENSE
+",
+        )
+        .run();
+    let f = File::open(&p.root().join("target/package/foo-1.0.0.crate")).unwrap();
+    validate_crate_contents(
+        f,
+        "foo-1.0.0.crate",
+        &[
+            ".cargo_vcs_info.json",
+            "Cargo.toml",
+            "Cargo.toml.orig",
+            "subdir/LICENSE",
+            "src/lib.rs",
+        ],
+        &[("subdir/LICENSE", "license text")],
+    );
+}
+
+#[cargo_test]
+fn relative_license_included() {
+    // license-file path outside of package will copy into root.
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+            [package]
+            name = "foo"
+            version = "1.0.0"
+            license-file = "../LICENSE"
+            description = "foo"
+            homepage = "foo"
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .file("../LICENSE", "license text")
+        .build();
+
+    p.cargo("package --list")
+        .with_stdout(
+            "\
+Cargo.toml
+Cargo.toml.orig
+LICENSE
+src/lib.rs
+",
+        )
+        .with_stderr("")
+        .run();
+
+    p.cargo("package")
+        .with_stderr(
+            "\
+[PACKAGING] foo v1.0.0 [..]
+[VERIFYING] foo v1.0.0 [..]
+[COMPILING] foo v1.0.0 [..]
+[FINISHED] [..]
+",
+        )
+        .run();
+    let f = File::open(&p.root().join("target/package/foo-1.0.0.crate")).unwrap();
+    validate_crate_contents(
+        f,
+        "foo-1.0.0.crate",
+        &["Cargo.toml", "Cargo.toml.orig", "LICENSE", "src/lib.rs"],
+        &[("LICENSE", "license text")],
+    );
+    let manifest =
+        std::fs::read_to_string(p.root().join("target/package/foo-1.0.0/Cargo.toml")).unwrap();
+    assert!(manifest.contains("license-file = \"LICENSE\""));
+    let orig =
+        std::fs::read_to_string(p.root().join("target/package/foo-1.0.0/Cargo.toml.orig")).unwrap();
+    assert!(orig.contains("license-file = \"../LICENSE\""));
+}
+
+#[cargo_test]
+fn relative_license_include_collision() {
+    // Can't copy a relative license-file if there is a file with that name already.
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+            [package]
+            name = "foo"
+            version = "1.0.0"
+            license-file = "../LICENSE"
+            description = "foo"
+            homepage = "foo"
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .file("../LICENSE", "outer license")
+        .file("LICENSE", "inner license")
+        .build();
+
+    p.cargo("package --list")
+        .with_stdout(
+            "\
+Cargo.toml
+Cargo.toml.orig
+LICENSE
+src/lib.rs
+",
+        )
+        .with_stderr("[WARNING] license-file `../LICENSE` appears to be [..]")
+        .run();
+
+    p.cargo("package")
+        .with_stderr(
+            "\
+[WARNING] license-file `../LICENSE` appears to be [..]
+[PACKAGING] foo v1.0.0 [..]
+[VERIFYING] foo v1.0.0 [..]
+[COMPILING] foo v1.0.0 [..]
+[FINISHED] [..]
+",
+        )
+        .run();
+    let f = File::open(&p.root().join("target/package/foo-1.0.0.crate")).unwrap();
+    validate_crate_contents(
+        f,
+        "foo-1.0.0.crate",
+        &["Cargo.toml", "Cargo.toml.orig", "LICENSE", "src/lib.rs"],
+        &[("LICENSE", "inner license")],
+    );
+    let manifest = read_to_string(p.root().join("target/package/foo-1.0.0/Cargo.toml")).unwrap();
+    assert!(manifest.contains("license-file = \"LICENSE\""));
+    let orig = read_to_string(p.root().join("target/package/foo-1.0.0/Cargo.toml.orig")).unwrap();
+    assert!(orig.contains("license-file = \"../LICENSE\""));
+}
diff --git a/tests/testsuite/publish_lockfile.rs b/tests/testsuite/publish_lockfile.rs
index 3fc380b4d8a..9bd5598975c 100644
--- a/tests/testsuite/publish_lockfile.rs
+++ b/tests/testsuite/publish_lockfile.rs
@@ -85,6 +85,7 @@ fn package_lockfile() {
             "\
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 src/main.rs
 ",
         )
@@ -114,6 +115,7 @@ fn package_lockfile_git_repo() {
 .cargo_vcs_info.json
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 src/main.rs
 ",
         )
@@ -123,10 +125,11 @@ src/main.rs
         .with_stderr(
             "\
 [PACKAGING] foo v0.0.1 ([..])
-[ARCHIVING] Cargo.toml
-[ARCHIVING] src/main.rs
 [ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] Cargo.lock
+[ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
+[ARCHIVING] src/main.rs
 [VERIFYING] foo v0.0.1 ([..])
 [COMPILING] foo v0.0.1 ([..])
 [RUNNING] `rustc --crate-name foo src/main.rs [..]
@@ -221,9 +224,10 @@ fn note_resolve_changes() {
         .with_stderr_unordered(
             "\
 [PACKAGING] foo v0.0.1 ([..])
+[ARCHIVING] Cargo.lock
 [ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
 [ARCHIVING] src/main.rs
-[ARCHIVING] Cargo.lock
 [UPDATING] `[..]` index
 [NOTE] package `mutli v0.1.0` added to the packaged Cargo.lock file, was originally sourced from `[..]/foo/mutli`
 [NOTE] package `patched v1.0.0` added to the packaged Cargo.lock file, was originally sourced from `[..]/foo/patched`
@@ -294,8 +298,8 @@ fn no_warn_workspace_extras() {
         .cwd("a")
         .with_stderr(
             "\
-[PACKAGING] a v0.1.0 ([..])
 [UPDATING] `[..]` index
+[PACKAGING] a v0.1.0 ([..])
 ",
         )
         .run();
@@ -325,10 +329,10 @@ fn warn_package_with_yanked() {
     p.cargo("package --no-verify")
         .with_stderr(
             "\
-[PACKAGING] foo v0.0.1 ([..])
 [UPDATING] `[..]` index
 [WARNING] package `bar v0.1.0` in Cargo.lock is yanked in registry \
     `crates.io`, consider updating to a version that is not yanked
+[PACKAGING] foo v0.0.1 ([..])
 ",
         )
         .run();
@@ -426,6 +430,7 @@ fn ignore_lockfile() {
 .cargo_vcs_info.json
 Cargo.lock
 Cargo.toml
+Cargo.toml.orig
 src/main.rs
 ",
         )
@@ -435,10 +440,11 @@ src/main.rs
         .with_stderr(
             "\
 [PACKAGING] foo v0.0.1 ([..])
-[ARCHIVING] Cargo.toml
-[ARCHIVING] src/main.rs
 [ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] Cargo.lock
+[ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
+[ARCHIVING] src/main.rs
 [VERIFYING] foo v0.0.1 ([..])
 [COMPILING] foo v0.0.1 ([..])
 [RUNNING] `rustc --crate-name foo src/main.rs [..]
@@ -463,10 +469,11 @@ fn ignore_lockfile_inner() {
         .with_stderr(
             "\
 [PACKAGING] bar v0.0.1 ([..])
-[ARCHIVING] Cargo.toml
-[ARCHIVING] src/main.rs
 [ARCHIVING] .cargo_vcs_info.json
 [ARCHIVING] Cargo.lock
+[ARCHIVING] Cargo.toml
+[ARCHIVING] Cargo.toml.orig
+[ARCHIVING] src/main.rs
 ",
         )
         .run();
diff --git a/tests/testsuite/registry.rs b/tests/testsuite/registry.rs
index 7e06afa942c..708d93e2882 100644
--- a/tests/testsuite/registry.rs
+++ b/tests/testsuite/registry.rs
@@ -365,10 +365,7 @@ fn package_with_path_deps() {
         .with_status(101)
         .with_stderr_contains(
             "\
-[ERROR] failed to prepare local package for uploading
-
-Caused by:
-  no matching package named `notyet` found
+[ERROR] no matching package named `notyet` found
 location searched: registry [..]
 required by package `foo v0.0.1 ([..])`
 ",
@@ -380,8 +377,8 @@ required by package `foo v0.0.1 ([..])`
     p.cargo("package")
         .with_stderr(
             "\
-[PACKAGING] foo v0.0.1 ([CWD])
 [UPDATING] `[..]` index
+[PACKAGING] foo v0.0.1 ([CWD])
 [VERIFYING] foo v0.0.1 ([CWD])
 [DOWNLOADING] crates ...
 [DOWNLOADED] notyet v0.0.1 (registry `[ROOT][..]`)