Include Cargo.lock into sdist

[hombit]

I'd like to make the package build more reproducible, because I've already seen how my package doesn't build because of some update of a transitive dependency. I've found that I can add

[tool.maturin]
cargo-extra-args = "--frozen --locked"

to prevent Cargo.lock update. But Cargo.lock itself is missed in a sdist, is there any way to include there for a mixed pyo3 project w/o any binaries?

[messense]

Were you putting Cargo.lock in .gitignore? I think it's automatically included in sdist if it's not ignored. You can run cargo package --list --allow-dirty to see the list of files to be included in sdist.

[hombit]

There is no workspace in this project and repo and I haven't moved Cargo.lock there, it was created by cargo and located just near Cargo.toml

[messense]

Oh I missed that. Now why cargo package --list --allow-dirty doesn't list Cargo.lock? Is it related to Cargo.toml being a symlink?

[messense]

light-curve-python/light-curve-python on  cargo-lock is 📦 v0.5.4-beta.0 via 🐍 v3.9.2 via 🦀 v1.57.0
❯ cargo b
error: failed to parse manifest at `/Users/messense/Projects/light-curve-python/light-curve-python/Cargo.toml`

Caused by:
  can't find library `light_curve`, rename file to `src/lib.rs` or specify lib.path

That branch doesn't even build.

[messense]

OK, I looked at Cargo's source code and it looks it cargo package ignore Cargo.lock unless there is an example or binary target.

1. https://github.com/rust-lang/cargo/blob/3787309df66b32995f91bbf4d251e17e90fca4af/src/cargo/ops/cargo_package.rs#L230
2. https://github.com/rust-lang/cargo/blob/3787309df66b32995f91bbf4d251e17e90fca4af/src/cargo/ops/cargo_package.rs#L245-L251
3. https://github.com/rust-lang/cargo/blob/2e2a16e983f597da62bc132eb191bc3276d4b1bb/src/cargo/core/package.rs#L206-L209

[hombit]

Thank you so much!

[messense]

I think you can add Cargo.lock to it by adding the following content in your pyproject.toml

[tool.maturin]
sdist-include = ["Cargo.lock"]

But I do think maturin should do it automatically if user specified --locked or --frozen in cargo-extra-args.

[messense]

Implemented in #749

[hombit]

I've checked it works like a charm!