fn verify_dependencies( pkg: &Package, registry: &Registry, registry_src: SourceId ) -> CargoResult<()>