Add an option to allow installing Rust tools with `--locked`

[34j]

Without the --locked option and without dependencies properly specified in the hook, a new version release of a dependency can cause the hook that previously worked to suddenly stop working. Therefore, I propose adding an option to use --locked, as propsed in pre-commit/pre-commit#3162 .

Alternatively, as proposed in #681, supporting cargo-binstall would also resolve this issue for users with limited security concerns.

[j178]

I think we should probably always use --locked, would that be a breaking change?

[j178]

would that be a breaking change?

Yeah. For crates that don’t ship a Cargo.lock, cargo install --locked will fail.

[mlegner]

would that be a breaking change?

Yeah. For crates that don’t ship a Cargo.lock, cargo install --locked will fail.

Are you sure? The Cargo Book states (emphasis added)

The --locked flag can be used to force Cargo to use the packaged Cargo.lock file if it is available.

Also, I just tested a random newly published crate that doesn't have a lock file checked in on GitHub and only got a warning:

$ cargo install boltffi_cli --locked --git https://github.com/boltffi/boltffi
    Updating git repository `https://github.com/boltffi/boltffi`
warning: no Cargo.lock file published in boltffi_cli v0.1.1 (https://github.com/boltffi/boltffi#178caabf)
  Installing boltffi_cli v0.1.1 (https://github.com/boltffi/boltffi#178caabf)
[...]

[j178]

I didn't verify that, I read it from here: https://doc.rust-lang.org/cargo/commands/cargo-install.html#option-cargo-install---locked

--locked
Asserts that the exact same dependencies and versions are used as when the existing Cargo.lock file was originally generated.
Cargo will exit with an error when either of the following scenarios arises:

• The lock file is missing.
• Cargo attempted to change the lock file due to a different dependency resolution.

[mlegner]

I didn't verify that, I read it from here: https://doc.rust-lang.org/cargo/commands/cargo-install.html#option-cargo-install---locked

Oh, interesting. Seems there is a contradiction within the same page. 😅

I'll check and try to fix in the https://github.com/rust-lang/cargo repo.

[mlegner]

Created an issue: rust-lang/cargo#16649