Tracking Issue for min-publish-age RFC 3923

[ehuss]

Summary

RFC: #3923
Original issue: #15973
Implementation: #17012
Documentation: TODO

This RFC adds a configuration to set the minimum publish age used for dependency resolution.

Unresolved Issues

• How do we make it clear when things are held back?
  • The "locking" message for Cargo time machine (generate lock files based on old registry state) #5221 lists one time but the time here is dependent on where any given package is from
  • We list MSRVs for unselected packages, should we also list publish times? I'm assuming that should be in local time
  • Locking message for Cargo time machine (generate lock files based on old registry state) #5221 is in UTC time, see Tracking Issue for lockfile-publish-time #16271, when relative time differences likely make local time more relevant
• Implementation wise, will there be much complexity in getting per registry information into VersionPreferences and using it?
• deny precedence between this and incompatible-rust-version?
  • Both produce errors, but incompatible-rust-version will likely be evaluated first to increase the chance of builds succeeding.

Future Extensions

• Support fallback for resolver.incompatible-publish-age
• Add an exclude list for min-publish-age
• When all compatible older-than-min-age versions are yanked and a newer non-yanked version exists, Cargo could alert the user that they may want to override with --precise.
• Potentially support other source of publish time besides the pubtime field from a cargo registry.
• A resolver.now field for setting the reference time that min-publish-age is compared against. This could be useful for offline workflows where wall-clock time keeps advancing but the registry index may be stale.

(see RFC)

About tracking issues

Tracking issues are used to record the overall progress of implementation.
They are also used as hubs connecting to other relevant issues, e.g., bugs or open design questions.
A tracking issue is however not meant for large scale discussion, questions, or bug reports about a feature.
Instead, open a dedicated issue for the specific matter and add the relevant feature gate label.

[weihanglo]

@rustbot claims

I already have a local branch

[weihanglo]

@rustbot claim

[gilescope]

Given the rate at which AI is improving it's ability to allow bad actors to do supply chain attacks, it's far more important we get an MVP version of this out early than we gold plate it. Good luck and godspeed!