this post was submitted on 31 Mar 2024
16 points (86.4% liked)
Rust
7827 readers
68 users here now
Welcome to the Rust community! This is a place to discuss about the Rust programming language.
Wormhole
Credits
- The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
All good points. I will address them in a later version.
The Cargo.lock thing is weird though, but apparently the builtin .gitignore of codeberg/forgejo has Cargo.lock in it.
In addition to the sibling comment, note that reproducible build systems from Docker to Nix require a lockfile in order to be reproducible, and if you don't provide one, then somebody downstream will provide it instead. By checking in
Cargo.lock, you ensure control over the precise versions of your dependencies for all downstream users.Regarding
Cargo.lock, the recommendation always was to include it in version control for application/binary crates, but not library ones. But tendencies changed over time to include it even for libraries. If arust-toolchainfile is tracked by version control, and is pinned to a specific stable release, thenCargo.lockshould definitely be tracked too [1][2].It's strictly more information tracked, so there is no logical reason not to include it. There was this concern about people not being aware of
--lockednot being the default behaviour ofcargo install, giving a false sense of security/reliability/reproducibility. But "false sense" is never a good technical argument in my book.Anyway, your crate is an application/binary one. And if you were to not change the
"*"dependency version requirement, then it is almost guaranteed that building your crate will break in the future without trackingCargo.lock;)