Implement fail-closed ignored workspace routing

tools/materialize-fuser

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+root="$(cd "$(dirname "$0")/.." && pwd)"
+version=0.17.0
+crate_checksum=80a5eca878900c2e39e9e52fd797954b7fc39eeefc8558257114bfea6a698fcf
+patch_file="$root/patches/fuser-$version-lock-flags.patch"
+destination="$root/.lazaret/vendor/fuser-$version"
+cargo_home="${CARGO_HOME:-$HOME/.cargo}"
+fetch_tests=false
+
+if [ "${1:-}" = "--test-dependencies" ] && [ "$#" -eq 1 ]; then
+    fetch_tests=true
+elif [ "$#" -ne 0 ]; then
+    printf '%s\n' "usage: tools/materialize-fuser [--test-dependencies]" >&2
+    exit 2
+fi
+
+fail() {
+    printf '%s\n' "materialize-fuser: $*" >&2
+    exit 1
+}
+
+for command in cargo patch sha256sum tar; do
+    command -v "$command" >/dev/null 2>&1 || fail "$command is required"
+done
+
+[ -f "$patch_file" ] || fail "missing patch: $patch_file"
+patch_checksum="$(sha256sum "$patch_file" | cut -d ' ' -f 1)"
+stamp="$crate_checksum $patch_checksum"
+
+fetch_test_dependencies() {
+    local manifest="$destination/Cargo.toml"
+    if ! cargo fetch --manifest-path "$manifest" --locked --offline >/dev/null 2>&1; then
+        cargo fetch --manifest-path "$manifest" --locked
+    fi
+}
+
+if [ -f "$destination/.lazaret-materialization" ] &&
+    [ "$(tr -d '\n' < "$destination/.lazaret-materialization")" = "$stamp" ]; then
+    if $fetch_tests; then
+        fetch_test_dependencies
+    fi
+    exit 0
+fi
+
+find_archive() {
+    local candidate actual
+    for candidate in "$cargo_home"/registry/cache/*/"fuser-$version.crate"; do
+        [ -f "$candidate" ] || continue
+        actual="$(sha256sum "$candidate" | cut -d ' ' -f 1)"
+        if [ "$actual" = "$crate_checksum" ]; then
+            printf '%s\n' "$candidate"
+            return 0
+        fi
+    done
+    return 1
+}
+
+archive="$(find_archive || true)"
+if [ -z "$archive" ]; then
+    cargo --manifest-path "$root/Cargo.toml" --config 'paths=[]' fetch --locked
+    archive="$(find_archive || true)"
+fi
+[ -n "$archive" ] || fail "Cargo did not fetch the checksum-matching fuser archive"
+
+mkdir -p "$root/.lazaret/vendor"
+temporary="$(mktemp -d "$root/.lazaret/vendor/.fuser-$version.XXXXXX")"
+trap 'rm -rf "$temporary"' EXIT
+
+tar -xzf "$archive" -C "$temporary"
+source="$temporary/fuser-$version"
+[ -d "$source" ] || fail "archive did not contain fuser-$version"
+patch --directory="$source" --strip=1 --batch --forward < "$patch_file"
+printf '%s\n' "$stamp" > "$source/.lazaret-materialization"
+
+rm -rf "$destination"
+mv "$source" "$destination"
+if $fetch_tests; then
+    fetch_test_dependencies
+fi