Tags with `+suffix` breaking vendoring?

[dpc]

We've tried to use a dependency in Cargo.lock that refers to a git repo with tag that contained +suffix, and we got a weird error:

pkgs-group-ci-deps> Caused by:
pkgs-group-ci-deps>   failed to load source for dependency `repo-core`
pkgs-group-ci-deps> Caused by:
pkgs-group-ci-deps>   Unable to update https://github.com/repo/repo-repo?tag=v0.3.0-alpha.0+suffix
pkgs-group-ci-deps> Caused by:
pkgs-group-ci-deps>   the source https://github.com/repo/repo-fedi?tag=v0.3.0-alpha.0+suffix requires a lock file to be present first before it can be
pkgs-group-ci-deps>   used against vendored source code
pkgs-group-ci-deps>   remove the source replacement configuration, generate a lock file, and then
pkgs-group-ci-deps>   restore the source replacement configuration to continue the build

cargo build and cargo vendor work locally just fine. After changing the tag name to not contains +suffix, the problem went away.

[ipetkov]

Hmm interesting, there's two parts of the code which come to mind:

1. Parsing the git dependency in Cargo.lock (though nothing about the code immediately jumps out as the culprit): https://github.com/ipetkov/crane/blob/10484f86201bb94bd61ecc5335b1496794fedb78/lib/vendorGitDeps.nix#L42-L75
2. How we specify the tag when asking Nix to download it: https://github.com/ipetkov/crane/blob/10484f86201bb94bd61ecc5335b1496794fedb78/lib/vendorGitDeps.nix#L91-L104

Do you have a reproduction I can test out further?