In most books the inportant --locked cargo flag is not mentioned.

[StefanSalewski]

We just had a discussion in the Rust forum, see https://users.rust-lang.org/t/why-old-versions-of-crate-get-downloaded-equally-everyday/130042/16

Our current feeling is, that the Cargo.lock file is ignored, unless the --locked flag is passed to cargo install (or cargo build). I never read that before somewhere, but from the Cargo book it seems to be true:

https://doc.rust-lang.org/cargo/faq.html#why-have-cargolock-in-version-control

"cargo install will select the latest dependencies unless --locked is passed in."

We are still not sure about "cargo build", that command might use the Cargo.lock by default. But "--locked" seems to be important for "cargo install".

[StefanSalewski]

Also see rust-lang/cargo#7169

For cargo build Cargo.lock is used automatically. But for cargo install we have to pass the --locked flag, otherwise the Cargo.lock is ignored. At least that is how I understand the comments in "cargo install" apparently ignores "Cargo.lock" as opposed to "cargo build" · Issue #7169 · rust-lang/cargo · GitHub. And the Cargo book seems to mention the --locked flag only for cargo install , see cargo install - The Cargo Book

[iampi31415]

They talk about the cargo install command here. It is very introductory so I think it is enough for them to point to the documentation. And they do it at the beginning of the chapter.

I do think it is an interesting finding, but I am unsure that this book needs modifications to the cargo chapter.

---

Also a nitpick: rephrase the title ("In most books" is not needed), format `--locked` and fix typo (notice the m on important):

In most books The important --locked cargo flag is not mentioned

@StefanSalewski

[StefanSalewski]

Well, the fact is that many people do not know the importance of the --locked flag for the "cargo --install" command when a reproducible build is required. See the forum discussion for details. One user studied the cargo source code, and I finally found the GitHub issue. The cargo --help command is not really helpful, as the --locked flag is mentioned, but it is not clear that only "cargo install" for application package is effected.

I think it is an information that most people should want to know, but most resources does not mention it. For my book I decided to mention it in conjunction with the "cargo install" command -- I agree that for "cargo build" and "cargo run" it is not necessary to explicitly mention it.

Maintainers might close this issue as "will not fix", or I might close it myself in a few days.

[iampi31415]

So the build command uses the lock file by default, as expected.

The install command needs clarification since it does not use the lock file by default and needs --locked.

It could be useful to have that clarification.