feat(generate-lockfile): Add unstable --publish-time flag

Implementation for #5221

Use cases:
- Improved reproduction steps using cargo scripts without including a
  lockfile
- Debugging issues in the past
- Manual stop gap for #15973

Unresolved questions:
- How do we compensate for the caveats, with one option being to leave
  this perma-unstable?
- How should we deal with Summary `pubtime` parse errors?
- How strict should we be on the Summary `pubtime` format?
- Should we offer a convenient way of getting a compatible timestamp?

Future possibilities:
- Ability to lock to a timestamp with `cargo update` updating the
  timestamp (could be useful for cargo scripts)

This seemed like the shortest path to testing the proposed `pubtime`
index entries so we can unblock other work on it like #15973.
While this has some big caveats, the design is straightforward.
In contrast, #15973 has a lot more design questions (is this a
resolver-wide setting or a per-registry setting, what formats are
accepted, etc) that could slow down development and testing `pubtime`.

Author: epage

src/bin/cargo/commands/generate_lockfile.rs

@@ -9,13 +9,26 @@ pub fn cli() -> Command {
         .arg_manifest_path()
         .arg_lockfile_path()
         .arg_ignore_rust_version_with_help("Ignore `rust-version` specification in packages")
+        .arg(
+            clap::Arg::new("publish-time")
+                .long("publish-time")
+                .value_name("yyyy-mm-ddThh:mm:ssZ")
+                .help("Latest publish time allowed for registry packages (unstable)")
+                .help_heading(heading::MANIFEST_OPTIONS)
+        )
         .after_help(color_print::cstr!(
             "Run `<bright-cyan,bold>cargo help generate-lockfile</>` for more detailed information.\n"
         ))
 }
 
 pub fn exec(gctx: &mut GlobalContext, args: &ArgMatches) -> CliResult {
-    let ws = args.workspace(gctx)?;
+    let publish_time = args.get_one::<String>("publish-time");
+    let mut ws = args.workspace(gctx)?;
+    if let Some(publish_time) = publish_time {
+        gctx.cli_unstable()
+            .fail_if_stable_opt("--publish-time", 5221)?;
+        ws.set_resolve_publish_time(publish_time.parse().map_err(anyhow::Error::from)?);
+    }
     ops::generate_lockfile(&ws)?;
     Ok(())
 }

src/cargo/core/resolver/version_prefs.rs

@@ -22,6 +22,7 @@ pub struct VersionPreferences {
     prefer_patch_deps: HashMap<InternedString, HashSet<Dependency>>,
     version_ordering: VersionOrdering,
     rust_versions: Vec<PartialVersion>,
+    publish_time: Option<jiff::Timestamp>,
 }
 
 #[derive(Copy, Clone, Default, PartialEq, Eq, Hash, Debug)]
@@ -53,6 +54,10 @@ impl VersionPreferences {
         self.rust_versions = vers;
     }
 
+    pub fn publish_time(&mut self, publish_time: jiff::Timestamp) {
+        self.publish_time = Some(publish_time);
+    }
+
     /// Sort (and filter) the given vector of summaries in-place
     ///
     /// Note: all summaries presumed to be for the same package.
@@ -77,6 +82,15 @@ impl VersionPreferences {
                     .map(|deps| deps.iter().any(|d| d.matches_id(*pkg_id)))
                     .unwrap_or(false)
         };
+        if let Some(max_publish_time) = self.publish_time {
+            summaries.retain(|s| {
+                if let Some(summary_publish_time) = s.pubtime() {
+                    summary_publish_time <= max_publish_time
+                } else {
+                    true
+                }
+            });
+        }
         summaries.sort_unstable_by(|a, b| {
             let prefer_a = should_prefer(&a.package_id());
             let prefer_b = should_prefer(&b.package_id());

src/cargo/core/workspace.rs

@@ -122,6 +122,8 @@ pub struct Workspace<'gctx> {
     resolve_honors_rust_version: bool,
     /// The feature unification mode used when building packages.
     resolve_feature_unification: FeatureUnification,
+    /// Latest publish time allowed for packages
+    resolve_publish_time: Option<jiff::Timestamp>,
     /// Workspace-level custom metadata
     custom_metadata: Option<toml::Value>,
 
@@ -259,6 +261,7 @@ impl<'gctx> Workspace<'gctx> {
             resolve_behavior: ResolveBehavior::V1,
             resolve_honors_rust_version: false,
             resolve_feature_unification: FeatureUnification::Selected,
+            resolve_publish_time: None,
             custom_metadata: None,
             local_overlays: HashMap::new(),
         }
@@ -717,6 +720,14 @@ impl<'gctx> Workspace<'gctx> {
         self.resolve_feature_unification
     }
 
+    pub fn set_resolve_publish_time(&mut self, publish_time: jiff::Timestamp) {
+        self.resolve_publish_time = Some(publish_time);
+    }
+
+    pub fn resolve_publish_time(&self) -> Option<jiff::Timestamp> {
+        self.resolve_publish_time
+    }
+
     pub fn custom_metadata(&self) -> Option<&toml::Value> {
         self.custom_metadata.as_ref()
     }

src/cargo/ops/cargo_update.rs

@@ -722,6 +722,9 @@ fn status_locking(ws: &Workspace<'_>, num_pkgs: usize) -> CargoResult<()> {
             write!(&mut cfg, " Rust {rust_version}")?;
         }
         write!(&mut cfg, " compatible version{plural}")?;
+        if let Some(publish_time) = ws.resolve_publish_time() {
+            write!(&mut cfg, " as of {publish_time}")?;
+        }
     }
 
     ws.gctx()

src/cargo/ops/resolve.rs

@@ -448,6 +448,9 @@ pub fn resolve_with_previous<'gctx>(
         }
         version_prefs.rust_versions(rust_versions);
     }
+    if let Some(publish_time) = ws.resolve_publish_time() {
+        version_prefs.publish_time(publish_time);
+    }
 
     let avoid_patch_ids = if register_patches {
         register_patch_entries(registry, ws, previous, &mut version_prefs, keep_previous)?

src/doc/man/cargo-generate-lockfile.md

@@ -32,6 +32,14 @@ lockfile and has more options for controlling update behavior.
 
 {{> options-ignore-rust-version }}
 
+{{#option "`--publish-time` _yyyy-mm-ddThh:mm:ssZ_" }}
+Latest publish time allowed for registry packages (Unstable)
+
+This is a best-effort filter on allowed packages, including:
+- packages from unsupported registries are always accepted
+- only the latest yank status is respected
+{{/option}}
+
 {{> options-locked }}
 
 {{> options-lockfile-path }}

src/doc/man/generated_txt/cargo-generate-lockfile.txt

@@ -49,6 +49,15 @@ OPTIONS
        --ignore-rust-version
            Ignore rust-version specification in packages.
 
+       --publish-time yyyy-mm-ddThh:mm:ssZ
+           Latest publish time allowed for registry packages (Unstable)
+
+           This is a best-effort filter on allowed packages, including:
+
+           o  packages from unsupported registries are always accepted
+
+           o  only the latest yank status is respected
+
        --locked
            Asserts that the exact same dependencies and versions are used as
            when the existing Cargo.lock file was originally generated. Cargo

src/doc/src/commands/cargo-generate-lockfile.md

@@ -67,6 +67,16 @@ terminal.</li>
 </dd>
 
 
+<dt class="option-term" id="option-cargo-generate-lockfile---publish-time"><a class="option-anchor" href="#option-cargo-generate-lockfile---publish-time"><code>--publish-time</code> <em>yyyy-mm-ddThh:mm:ssZ</em></a></dt>
+<dd class="option-desc"><p>Latest publish time allowed for registry packages (Unstable)</p>
+<p>This is a best-effort filter on allowed packages, including:</p>
+<ul>
+<li>packages from unsupported registries are always accepted</li>
+<li>only the latest yank status is respected</li>
+</ul>
+</dd>
+
+
 <dt class="option-term" id="option-cargo-generate-lockfile---locked"><a class="option-anchor" href="#option-cargo-generate-lockfile---locked"><code>--locked</code></a></dt>
 <dd class="option-desc"><p>Asserts that the exact same dependencies and versions are used as when the
 existing <code>Cargo.lock</code> file was originally generated. Cargo will exit with an

src/doc/src/reference/unstable.md

@@ -78,6 +78,7 @@ Each new feature described below should explain how to use it.
     * [sbom](#sbom) --- Generates SBOM pre-cursor files for compiled artifacts
     * [update-breaking](#update-breaking) --- Allows upgrading to breaking versions with `update --breaking`
     * [feature-unification](#feature-unification) --- Enable new feature unification modes in workspaces
+    * [publish-time] --- Limit resolver to packages older than the specified time
 * Output behavior
     * [artifact-dir](#artifact-dir) --- Adds a directory where artifacts are copied to.
     * [build-dir-new-layout](#build-dir-new-layout) --- Enables the new build-dir filesystem layout
@@ -1913,6 +1914,13 @@ Specify which packages participate in [feature unification](../reference/feature
 * `package`: Dependency features are considered on a package-by-package basis,
   preferring duplicate builds of dependencies when different sets of features are activated by the packages.
 
+## publish-time
+
+* Tracking Issue: [#5221](https://github.com/rust-lang/cargo/issues/5221)
+
+With `cargo generate-lockfile -Zunstable-options --publish-time <time>`,
+package resolution will not consider any package newer than the specified time.
+
 ## Package message format
 
 * Original Issue: [#11666](https://github.com/rust-lang/cargo/issues/11666)

src/etc/man/cargo-generate-lockfile.1

@@ -67,6 +67,21 @@ Path to the \fBCargo.toml\fR file. By default, Cargo searches for the
 Ignore \fBrust\-version\fR specification in packages.
 .RE
 .sp
+\fB\-\-publish\-time\fR \fIyyyy\-mm\-ddThh:mm:ssZ\fR
+.RS 4
+Latest publish time allowed for registry packages (Unstable)
+.sp
+This is a best\-effort filter on allowed packages, including:
+.sp
+.RS 4
+\h'-04'\(bu\h'+03'packages from unsupported registries are always accepted
+.RE
+.sp
+.RS 4
+\h'-04'\(bu\h'+03'only the latest yank status is respected
+.RE
+.RE
+.sp
 \fB\-\-locked\fR
 .RS 4
 Asserts that the exact same dependencies and versions are used as when the