`cargo --locked` only checks a lockfile against its own manifest. The
conformance suites build openshell-sdk from a separate workspace with its
own Cargo.lock, so the two lockfiles could resolve shared crates to
different versions without any check failing. That is how aws-lc-sys 0.46
was picked up, which does not link against the AWS-LC Nix provides.
- Add check_cargo_lockfile_alignment.py: aligned workspaces must lock every
registry crate they share with the root at a version the root lockfile
has. `--fix` re-locks a workspace from the root lockfile, which keeps
coupled crate families such as futures-* consistent.
- Enroll tests/suites/conformance and re-lock it from the root lockfile.
The other workspaces that path-depend on root crates also drift and can
be enrolled once aligned.
- Run the check in rust:lockfiles:check and the Cargo lockfiles CI job,
and its tests in `mise run test`.
- Build test archives and run the test runner with --locked so a stale
lockfile fails instead of being re-resolved.
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Evan Lezar
a37ebe9174