Implement --locked for build-std

src/cargo/core/compiler/standard_lib.rs

@@ -75,13 +75,8 @@ pub fn resolve_std<'gctx>(
     let src_path = detect_sysroot_src_path(target_data)?;
     let std_ws_manifest_path = src_path.join("Cargo.toml");
     let gctx = ws.gctx();
-    // TODO: Consider doing something to enforce --locked? Or to prevent the
-    // lock file from being written, such as setting ephemeral.
     let mut std_ws = Workspace::new(&std_ws_manifest_path, gctx)?;
-    // Don't require optional dependencies in this workspace, aka std's own
-    // `[dev-dependencies]`. No need for us to generate a `Resolve` which has
-    // those included because we'll never use them anyway.
-    std_ws.set_require_optional_deps(false);
+    std_ws.set_is_locked(true);
     // `sysroot` is not in the default set because it is optional, but it needs
     // to be part of the resolve in case we do need it or `libtest`.
     let mut spec_pkgs = Vec::from(crates);

src/cargo/core/workspace.rs

@@ -103,6 +103,12 @@ pub struct Workspace<'gctx> {
     /// file. This is set for `cargo install` without `--locked`.
     ignore_lock: bool,
 
+    /// If `true`, then the resolver will not update the `Cargo.lock` file and
+    /// return an error if the lockfile is missing or out of date, similar
+    /// to the `GlobalContext::locked()` behaviour. Note that
+    /// the lockfile is not written if `require_optional_deps` is false.
+    is_locked: bool,
+
     /// Requested path of the lockfile (i.e. passed as the cli flag)
     requested_lockfile_path: Option<PathBuf>,
 
@@ -240,6 +246,7 @@ impl<'gctx> Workspace<'gctx> {
             member_ids: HashSet::new(),
             default_members: Vec::new(),
             is_ephemeral: false,
+            is_locked: false,
             require_optional_deps: true,
             loaded_packages: RefCell::new(HashMap::new()),
             ignore_lock: false,
@@ -635,6 +642,14 @@ impl<'gctx> Workspace<'gctx> {
         self
     }
 
+    pub fn is_locked(&self) -> bool {
+        self.is_locked
+    }
+
+    pub fn set_is_locked(&mut self, is_locked: bool) {
+        self.is_locked = is_locked
+    }
+
     /// Returns the directory where the lockfile is in.
     pub fn lock_root(&self) -> Filesystem {
         if let Some(requested) = self.requested_lockfile_path.as_ref() {

src/cargo/ops/lockfile.rs

@@ -66,6 +66,14 @@ pub fn write_pkg_lockfile(ws: &Workspace<'_>, resolve: &mut Resolve) -> CargoRes
         );
     }
 
+    if ws.is_locked() {
+        anyhow::bail!(
+            "Attempted to write to the standard library's lockfile.\n\
+            This most likely means the lockfile has been previously modified by mistake.\
+            Try removing and readding the `rust-src` component."
+        );
+    }
+
     // While we're updating the lock file anyway go ahead and update its
     // encoding to whatever the latest default is. That way we can slowly roll
     // out lock file updates as they're otherwise already updated, and changes