I am trying to package svgbob for Alpine. The universal command to fetch the dependencies with any Rust package there is cargo fetch --locked, which uses the Cargo.lock file to make sure that we get the exact dependencies that were used for the official release, not any dependency that could have been released later and caused a bug or something similar.
As explained in Cargo's FAQ, a Cargo.lock file should be checked into the repository to ensure that builds are reproducible, but only for binaries. So in this repo, this should mean there should be a packages/cli/Cargo.lock, and not a packages/svgbob/Cargo.lock.
Alpine's packaging rules are pretty strict, so this is likely to be the only thing blocking me from getting this package out of testing. This might also help any future distro package maintainers who build from source.
I am trying to package svgbob for Alpine. The universal command to fetch the dependencies with any Rust package there is
cargo fetch --locked
, which uses theCargo.lock
file to make sure that we get the exact dependencies that were used for the official release, not any dependency that could have been released later and caused a bug or something similar.As explained in Cargo's FAQ, a
Cargo.lock
file should be checked into the repository to ensure that builds are reproducible, but only for binaries. So in this repo, this should mean there should be apackages/cli/Cargo.lock
, and not apackages/svgbob/Cargo.lock
.Alpine's packaging rules are pretty strict, so this is likely to be the only thing blocking me from getting this package out of testing. This might also help any future distro package maintainers who build from source.