Misleading failure when using --frozen --offline with no Cargo.lock #10503
Description
Problem
Trying to build a crate with:
cargo build --frozen --offline
when no Cargo.lock file is provided in the crate source repository leads to the following error message:
error: the lock file /path/to/Cargo.lock needs to be updated but --frozen was passed to prevent this
If you want to try to generate the lock file without accessing the network, remove the --frozen flag and use --offline instead.
which is either misleading or a bad suggestion (e.g. reproducible builds desired but Cargo.lock was forgotten).
On a side note, how this error message is formulated is confusing to me. Why would a Cargo.lock need to be updated if I pass --locked to it? Isn't it the whole point of --locked (or --frozen) to use possibly outdated but fixed-version crates? This suggests the user needs to fix something with their Cargo.lock. FWIW, the docs (https://doc.rust-lang.org/cargo/commands/cargo-build.html#manifest-options) do mention that if Cargo.lock file is missing cargo build will fail but the error message mislead me in believing my Cargo.lock file was outdated (whatever that means) instead of just having forgotten to push it. Still the docs do not provide more info on what needs to be done to make sure my Cargo.lock file is up-to-date.
Disclaimer: I integrate SW in build systems and have virtually no experience with cargo and rust at the moment.
Steps
No response
Possible Solution(s)
Check on Cargo.lock file presence when --locked or --frozen is passed. If missing, error out stating that in order to use --locked or --frozen a Cargo.lock file needs to be provided.
Notes
This was discovered for a project of mine when trying to build it with Buildroot using the cargo-pkg package type, c.f. https://git.busybox.net/buildroot/tree/package/pkg-cargo.mk#n101 where --offline and --locked are passed.
Version
No response