feat(package): add --exclude-lockfile flag

When `--exclude-lockfile` is enabled,
`cargo package` will not verify the lock file if present,
nor will it generate a new one if absent.
Cargo.lock will not be included in the resulting tarball.

Together with `--no-verify`,
this flag decouples packaging from checking the registry index.
While this is useful for some non-normal workflows that requires
to assemble packages having unpublished dependencies.
It is recommended to use `-Zpackage-workspace` to package the entire
workspace, instead of opting out lockfile.

src/bin/cargo/commands/package.rs

@@ -26,6 +26,10 @@ pub fn cli() -> Command {
             "allow-dirty",
             "Allow dirty working directories to be packaged",
         ))
+        .arg(flag(
+            "exclude-lockfile",
+            "Don't include the lock file when packaging",
+        ))
         .arg_silent_suggestion()
         .arg_package_spec_no_all(
             "Package(s) to assemble",
@@ -79,6 +83,7 @@ pub fn exec(gctx: &mut GlobalContext, args: &ArgMatches) -> CliResult {
             list: args.flag("list"),
             check_metadata: !args.flag("no-metadata"),
             allow_dirty: args.flag("allow-dirty"),
+            include_lockfile: !args.flag("exclude-lockfile"),
             to_package: specs,
             targets: args.targets()?,
             jobs: args.jobs()?,

src/cargo/ops/cargo_package/mod.rs

@@ -46,6 +46,7 @@ pub struct PackageOpts<'gctx> {
     pub list: bool,
     pub check_metadata: bool,
     pub allow_dirty: bool,
+    pub include_lockfile: bool,
     pub verify: bool,
     pub jobs: Option<JobsConfig>,
     pub keep_going: bool,
@@ -194,6 +195,7 @@ fn do_package<'a>(
         .as_path_unlocked()
         .join(LOCKFILE_NAME)
         .exists()
+        && opts.include_lockfile
     {
         // Make sure the Cargo.lock is up-to-date and valid.
         let dry_run = false;
@@ -389,7 +391,7 @@ fn prepare_archive(
     // Check (git) repository state, getting the current commit hash.
     let vcs_info = vcs::check_repo_state(pkg, &src_files, gctx, &opts)?;
 
-    build_ar_list(ws, pkg, src_files, vcs_info)
+    build_ar_list(ws, pkg, src_files, vcs_info, opts.include_lockfile)
 }
 
 /// Builds list of files to archive.
@@ -399,6 +401,7 @@ fn build_ar_list(
     pkg: &Package,
     src_files: Vec<PathEntry>,
     vcs_info: Option<vcs::VcsInfo>,
+    include_lockfile: bool,
 ) -> CargoResult<Vec<ArchiveFile>> {
     let mut result = HashMap::new();
     let root = pkg.root();
@@ -453,15 +456,17 @@ fn build_ar_list(
         ))?;
     }
 
-    let rel_str = "Cargo.lock";
-    result
-        .entry(UncasedAscii::new(rel_str))
-        .or_insert_with(Vec::new)
-        .push(ArchiveFile {
-            rel_path: PathBuf::from(rel_str),
-            rel_str: rel_str.to_string(),
-            contents: FileContents::Generated(GeneratedFile::Lockfile),
-        });
+    if include_lockfile {
+        let rel_str = "Cargo.lock";
+        result
+            .entry(UncasedAscii::new(rel_str))
+            .or_insert_with(Vec::new)
+            .push(ArchiveFile {
+                rel_path: PathBuf::from(rel_str),
+                rel_str: rel_str.to_string(),
+                contents: FileContents::Generated(GeneratedFile::Lockfile),
+            });
+    }
 
     if let Some(vcs_info) = vcs_info {
         let rel_str = VCS_INFO_FILE;

src/cargo/ops/registry/publish.rs

@@ -146,6 +146,7 @@ pub fn publish(ws: &Workspace<'_>, opts: &PublishOpts<'_>) -> CargoResult<()> {
             list: false,
             check_metadata: true,
             allow_dirty: opts.allow_dirty,
+            include_lockfile: true,
             // `package_with_dep_graph` ignores this field in favor of
             // the already-resolved list of packages
             to_package: ops::Packages::Default,

src/doc/man/cargo-package.md

@@ -27,8 +27,8 @@ stored in the `target/package` directory. This performs the following steps:
     - `[patch]`, `[replace]`, and `[workspace]` sections are removed from the
       manifest.
     - `Cargo.lock` is always included. When missing, a new lock file will be
-      generated. {{man "cargo-install" 1}} will use the packaged lock file if
-      the `--locked` flag is used.
+      generated unless the `--exclude-lockfile` flag is used. {{man "cargo-install" 1}}
+      will use the packaged lock file if the `--locked` flag is used.
     - A `.cargo_vcs_info.json` file is included that contains information
       about the current VCS checkout hash if available, as well as a flag if the
       worktree is dirty.
@@ -98,6 +98,14 @@ or the license).
 Allow working directories with uncommitted VCS changes to be packaged.
 {{/option}}
 
+{{#option "`--exclude-lockfile`" }}
+Don't include the lock file when packaging.
+
+This flag is not for general use.
+Some tools may expect a lock file to be present (e.g. `cargo install --locked`).
+Consider other options before using this.
+{{/option}}
+
 {{> options-index }}
 
 {{#option "`--registry` _registry_"}}

src/doc/man/generated_txt/cargo-package.txt

@@ -27,8 +27,9 @@ DESCRIPTION
              manifest.
 
           o  Cargo.lock is always included. When missing, a new lock file will
-             be generated. cargo-install(1) will use the packaged lock file if
-             the --locked flag is used.
+             be generated unless the --exclude-lockfile flag is used.
+             cargo-install(1) will use the packaged lock file if the --locked
+             flag is used.
 
           o  A .cargo_vcs_info.json file is included that contains information
              about the current VCS checkout hash if available, as well as a
@@ -96,6 +97,13 @@ OPTIONS
            Allow working directories with uncommitted VCS changes to be
            packaged.
 
+       --exclude-lockfile
+           Don’t include the lock file when packaging.
+
+           This flag is not for general use. Some tools may expect a lock file
+           to be present (e.g. cargo install --locked). Consider other options
+           before using this.
+
        --index index
            The URL of the registry index to use.
 

src/doc/src/commands/cargo-package.md

@@ -22,8 +22,8 @@ stored in the `target/package` directory. This performs the following steps:
     - `[patch]`, `[replace]`, and `[workspace]` sections are removed from the
       manifest.
     - `Cargo.lock` is always included. When missing, a new lock file will be
-      generated. [cargo-install(1)](cargo-install.html) will use the packaged lock file if
-      the `--locked` flag is used.
+      generated unless the `--exclude-lockfile` flag is used. [cargo-install(1)](cargo-install.html)
+      will use the packaged lock file if the `--locked` flag is used.
     - A `.cargo_vcs_info.json` file is included that contains information
       about the current VCS checkout hash if available, as well as a flag if the
       worktree is dirty.
@@ -94,6 +94,13 @@ or the license).</dd>
 <dd class="option-desc">Allow working directories with uncommitted VCS changes to be packaged.</dd>
 
 
+<dt class="option-term" id="option-cargo-package---exclude-lockfile"><a class="option-anchor" href="#option-cargo-package---exclude-lockfile"></a><code>--exclude-lockfile</code></dt>
+<dd class="option-desc">Don’t include the lock file when packaging.</p>
+<p>This flag is not for general use.
+Some tools may expect a lock file to be present (e.g. <code>cargo install --locked</code>).
+Consider other options before using this.</dd>
+
+
 <dt class="option-term" id="option-cargo-package---index"><a class="option-anchor" href="#option-cargo-package---index"></a><code>--index</code> <em>index</em></dt>
 <dd class="option-desc">The URL of the registry index to use.</dd>
 

src/etc/man/cargo-package.1

@@ -36,8 +36,8 @@ manifest.
 .sp
 .RS 4
 \h'-04'\(bu\h'+03'\fBCargo.lock\fR is always included. When missing, a new lock file will be
-generated. \fBcargo\-install\fR(1) will use the packaged lock file if
-the \fB\-\-locked\fR flag is used.
+generated unless the \fB\-\-exclude\-lockfile\fR flag is used. \fBcargo\-install\fR(1)
+will use the packaged lock file if the \fB\-\-locked\fR flag is used.
 .RE
 .sp
 .RS 4
@@ -127,6 +127,15 @@ or the license).
 Allow working directories with uncommitted VCS changes to be packaged.
 .RE
 .sp
+\fB\-\-exclude\-lockfile\fR
+.RS 4
+Don\[cq]t include the lock file when packaging.
+.sp
+This flag is not for general use.
+Some tools may expect a lock file to be present (e.g. \fBcargo install \-\-locked\fR).
+Consider other options before using this.
+.RE
+.sp
 \fB\-\-index\fR \fIindex\fR
 .RS 4
 The URL of the registry index to use.