Publish lockfile for binary crates

[matklad]

Implementation PR: #5093

Summary:

For binary crate, add

cargo-features = ["publish-lockfile"]`
[project]
publish-lockfile = true

to Cargo.toml. cargo install will then use the lockfile of binary crates.

Steps:

Feature ready for stabilization

Stabilization TODO:

• move docs from https://github.com/rust-lang/cargo/blob/5845464cf92a348f95dc6b43133c017c37fcb684/src/doc/src/reference/unstable.md#publish-lockfile to appropriate location.

• remove feature gate

[polyzen]

Any ETA on this, or anything I could do to help?

[dwijnand]

Continuing from #6556 (comment):

I think it would be good to start looking at fixing any known issues and moving towards stabilizing that. Although if it is optional, I'm not sure if most people will use it, so it may not help here. I wonder if it was considered if it should always be published, and let the installer decide whether or not to use it?

Why shouldn't it be published? Why would an installer not want to use it?

[Nemo157]

One reason would be if there were security issues with the any of the versions pinned in the lock file, even if those crates were yanked and semver compatible releases made the lock file would still cause the old versions to be used until the binary crate released a new patch version with an updated lock file.

[ehuss]

Why would an installer not want to use it?

My only thought is that using the latest versions will bring in the latest and greatest fixes. But maybe the frequency of "cargo install fails" outweighs that? Maybe it could be the default to always use Cargo.lock if available, and have an option to ignore it? 🤔

This bit me recently where mdbook would fail to install (rust-lang/mdBook#852).