{"id":"8a7663b18517d488","repo":"rust-lang/cargo","slug":"source-directory-was-modified-by-build-rs-during-c","errorCode":null,"errorMessage":"Source directory was modified by build.rs during cargo publish. Build scripts should not modify anything outside of OUT_DIR.\n{}\n\nTo proceed despite this, pass the `--no-verify` flag.","messagePattern":"Source directory was modified by build\\.rs during cargo publish\\. Build scripts should not modify anything outside of OUT_DIR\\.\n(.+?)\n\nTo proceed despite this, pass the `--no-verify` flag\\.","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/ops/cargo_package/verify.rs","lineNumber":123,"sourceCode":"            cli_features: opts.cli_features.clone(),\n            spec: ops::Packages::Packages(Vec::new()),\n            filter: ops::CompileFilter::Default {\n                required_features_filterable: true,\n            },\n            target_rustdoc_args: None,\n            target_rustc_args: rustc_args,\n            target_rustc_crate_types: None,\n            rustdoc_document_private_items: false,\n            honor_rust_version: None,\n        },\n        &exec,\n    )?;\n\n    // Check that `build.rs` didn't modify any files in the `src` directory.\n    let ws_fingerprint = hash_all(&dst)?;\n    if pkg_fingerprint != ws_fingerprint {\n        let changes = report_hash_difference(&pkg_fingerprint, &ws_fingerprint);\n        anyhow::bail!(\n            \"Source directory was modified by build.rs during cargo publish. \\\n             Build scripts should not modify anything outside of OUT_DIR.\\n\\\n             {}\\n\\n\\\n             To proceed despite this, pass the `--no-verify` flag.\",\n            changes\n        )\n    }\n\n    Ok(())\n}\n\n/// Hashes everything under a given directory.\n///\n/// This is for checking if any source file inside a `.crate` file has changed\n/// durint the compilation. It is usually caused by bad build scripts or proc\n/// macros trying to modify source files. Cargo disallows that.\nfn hash_all(path: &Path) -> CargoResult<HashMap<PathBuf, u64>> {\n    fn wrap(path: &Path) -> CargoResult<HashMap<PathBuf, u64>> {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/ops/cargo_package/verify.rs#L105-L141","documentation":"During `cargo publish` verification, Cargo hashes every file under the unpacked source before and after running the verification build. If the hashes differ it concludes a build script or proc-macro wrote outside of OUT_DIR (typically into src/), which would make the published crate non-deterministic. It bails at verify.rs:123 unless --no-verify is passed.","triggerScenarios":"A build.rs (or proc-macro invoked during the verify build) that writes/modifies files inside src/ or anywhere outside OUT_DIR; in-place code generators.","commonSituations":"Build scripts that patch source files; codegen tools that write into the crate source rather than emitting to OUT_DIR; accidental `include_str!`/codegen writing back to source.","solutions":["Fix the build script to write only to the OUT_DIR path passed via the environment variable, and include generated code via `include!(concat!(env!(\"OUT_DIR\"), \"/generated.rs\"))`.","If the modification is benign and you accept the risk, pass `--no-verify` to `cargo publish`.","Audit proc-macros / build deps for any that write to the crate source tree."],"exampleFix":"// before - build.rs writes into src/\nfn main() {\n    std::fs::write(\"src/generated.rs\", \"...\").unwrap();\n}\n\n// after - write to OUT_DIR and include it\nfn main() {\n    let out = std::env::var(\"OUT_DIR\").unwrap();\n    std::fs::write(format!(\"{out}/generated.rs\"), \"...\").unwrap();\n}\n// in lib.rs:\n//   include!(concat!(env!(\"OUT_DIR\"), \"/generated.rs\"));","handlingStrategy":"validation","validationCode":"# Verify the source tree is unchanged after a local build:\nbefore=$(find src -type f -exec sha256sum {} + | sha256sum)\ncargo build\nafter=$(find src -type f -exec sha256sum {} + | sha256sum)\n[ \"$before\" = \"$after\" ] || { echo \"build.rs mutated src/\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Constrain build scripts to write only under OUT_DIR.","Review proc-macro crates in your dep tree for source mutation.","Run `cargo publish --dry-run` locally to exercise the verify step before the real publish."],"tags":["packaging","publish","build-scripts","verify","determinism"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}