Install cargo tools with locked dependencies - #17377
Merged
Merged
Conversation
rustbot
added
A-documenting-cargo-itself
Collaborator
|
r? @epage rustbot has assigned @epage. Use Why was this reviewer chosen?The reviewer was selected based on:
|
weihanglo
approved these changes
Aug 20, 2026
Member
There was a problem hiding this comment.
FWIW, the change to cargo install --locked being the default has been accepted: #7169 (comment).
| [`cargo-local-registry`][cargo-local-registry] subcommand, | ||
| [available on crates.io][cargo-local-registry] and can be installed with | ||
| `cargo install cargo-local-registry`. | ||
| `cargo install --locked cargo-local-registry`. |
Member
There was a problem hiding this comment.
I always have ? about this tool and local registries. They are like second-class citizens, but anyway.
Installing cargo tools (`cargo install`) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Using `cargo install --locked` reduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies. I went through all `rg "cargo install"` hits in the rust-lang/rust and added `--locked` to all but explanatory examples (such as cargo's docs on `cargo install` itself). I validated that those tools publish functioning `Cargo.lock`s with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. These are the broken out changes for cargo. rust-lang/rust#161428
konstin
force-pushed
the
konsti/cargo-install-locked
branch
from
August 21, 2026 09:25
8a7c146 to
33e72b9
Compare
Collaborator
|
This PR was rebased onto a different master commit. Here's a range-diff highlighting what actually changed. Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers. |
Contributor
Author
|
I had to rebase for clippy (#17378). |
rustbot
removed
the
S-waiting-on-review
rust-bors Bot
pushed a commit
to rust-lang/rust
that referenced
this pull request
Aug 22, 2026
Update cargo submodule 5 commits in 514c56dd7321eecbfdcf9b6479519cf4edfab906..e8cb624d5701824f46a2ec5873cfd59ee3d2f66c 2026-08-19 00:31:04 +0000 to 2026-08-22 00:23:45 +0000 - feat(config): Add build.fingerprint (rust-lang/cargo#17382) - chore: bump to 0.101.0; update changelog (rust-lang/cargo#17379) - Install cargo tools with locked dependencies (rust-lang/cargo#17377) - test(compile): Clean up freshness tests (rust-lang/cargo#17376) - Fix clippy warning (rust-lang/cargo#17378) r? ghost
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installing cargo tools (
cargo install) without locked dependencies exposes users to supply-chain attacks to all the dependencies of the tool (https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/). Usingcargo install --lockedreduces this risk to a compromise of the tool itself, while using the locked and hashed version of the dependencies.I went through all
rg "cargo install"hits in the rust-lang/rust and added--lockedto all but explanatory examples (such as cargo's docs oncargo installitself). I validated that those tools publish functioningCargo.locks with https://gist.github.com/konstin/bcb1169c1c1120c259dca64e777a64d0. These are the broken out changes for cargo.rust-lang/rust#161428