Verify that src dir wasn't modified by build.rs when publishing

src/cargo/ops/cargo_package.rs

@@ -330,6 +330,7 @@ fn run_verify(ws: &Workspace, tar: &FileLock, opts: &PackageOpts) -> CargoResult
     let id = SourceId::for_path(&dst)?;
     let mut src = PathSource::new(&dst, &id, ws.config());
     let new_pkg = src.root_package()?;
+    let pkg_fingerprint = src.fingerprint(&new_pkg)?;
     let ws = Workspace::ephemeral(new_pkg, config, None, true)?;
 
     ops::compile_ws(
@@ -352,6 +353,15 @@ fn run_verify(ws: &Workspace, tar: &FileLock, opts: &PackageOpts) -> CargoResult
         Arc::new(DefaultExecutor),
     )?;
 
+    // Check that build.rs didn't modify any files in the src directory.
+    let ws_fingerprint = src.fingerprint(ws.current()?)?;
+    if pkg_fingerprint != ws_fingerprint {
+        bail!(
+            "Source directory was modified by build.rs during cargo publish. \
+             Build scripts should not modify anything outside of OUT_DIR."
+        )
+    }
+
     Ok(())
 }
 

tests/testsuite/publish.rs

@@ -872,3 +872,36 @@ fn block_publish_no_registry() {
         ),
     );
 }
+
+#[test]
+fn do_not_publish_if_src_was_modified() {
+    publish::setup();
+
+    let p = project("foo")
+        .file("Cargo.toml", r#"
+            [project]
+            name = "foo"
+            version = "0.0.1"
+            authors = []
+        "#)
+        .file("src/main.rs", r#"
+            fn main() { println!("hello"); }
+        "#)
+        .file("build.rs", r#"
+            use std::fs::File;
+            use std::io::Write;
+
+            fn main() {
+                let mut file = File::create("src/generated.txt").expect("failed to create file");
+                file.write_all(b"Hello, world of generated files.").expect("failed to write");
+            }
+        "#)
+        .build();
+
+    assert_that(
+        p.cargo("publish")
+            .arg("--index")
+            .arg(publish::registry().to_string()),
+        execs().with_status(101),
+    );
+}