Add --locked in CI and Makefile

.github/workflows/test.yaml

@@ -152,7 +152,7 @@ jobs:
         uses: dtolnay/rust-toolchain@nightly
 
       - name: cargo test (debug; all features; -Z minimal-versions)
-        run: cargo -Z minimal-versions test --all-features
+        run: cargo -Z minimal-versions test --all-features --locked
 
   format:
     name: Format
@@ -190,7 +190,7 @@ jobs:
         # (below) will have a new lint that we want to suppress.
         # If we suppress (e.g. #![allow(clippy::arc_with_non_send_sync)]),
         # we would get an unknown-lint error from older clippy versions.
-        run: cargo clippy --workspace -- -D warnings -A unknown-lints
+        run: cargo clippy --locked --workspace -- -D warnings -A unknown-lints
 
   clippy-nightly-optional:
     name: Clippy nightly (optional)
@@ -205,7 +205,7 @@ jobs:
         with:
           components: clippy
       - name: Check clippy
-        run: cargo clippy --workspace -- -D warnings
+        run: cargo clippy --locked --workspace -- -D warnings
 
   clang-tidy:
     name: Clang Tidy

CMakeLists.txt

@@ -11,7 +11,7 @@ ExternalProject_Add(
 	DOWNLOAD_COMMAND ""
 	CONFIGURE_COMMAND ""
 	BUILD_COMMAND cbindgen --lang C --output "${CMAKE_SOURCE_DIR}/src/rustls.h" "${CMAKE_SOURCE_DIR}"
-	COMMAND cargo build "$<IF:$<CONFIG:Release>,--release,-->"
+	COMMAND cargo build --locked "$<IF:$<CONFIG:Release>,--release,-->"
 	# Rely on cargo checking timestamps, rather than tell CMake where every
 	# output is.
 	BUILD_ALWAYS true
@@ -20,5 +20,5 @@ ExternalProject_Add(
 	# of "error" in stdout as an error, and we have some test functions that
 	# end in "_error". Quiet mode suppresses test names, so this is a
 	# sufficient workaround.
-	TEST_COMMAND cargo test "$<IF:$<CONFIG:Release>,--release,-->" --quiet
+	TEST_COMMAND cargo test --locked "$<IF:$<CONFIG:Release>,--release,-->" --quiet
 )

Makefile

@@ -5,6 +5,7 @@ else
 endif
 
 CARGO ?= cargo
+CARGOFLAGS += --locked
 
 CFLAGS := -Werror -Wall -Wextra -Wpedantic -g -I src/
 PROFILE := release
@@ -32,7 +33,7 @@ test: all test-rust
 	./tests/client-server.py ./target/client ./target/server
 
 test-rust:
-	${CARGO} test
+	${CARGO} test --locked
 
 target:
 	mkdir -p $@

Makefile.Windows

@@ -38,11 +38,11 @@ test: all
 	$(call green_msg, getting 'https://httpbin.org/headers' ...)
 	target/client.exe httpbin.org 443 /headers
 	$(call green_msg, Running 'cargo test')
-	cargo test
+	cargo test --locked
 
 $(RUSTLS_LIB): src/lib.rs Cargo.toml
 	$(call green_msg, Building '$@')
-	RUSTFLAGS="--print native-static-libs" cargo build --release
+	RUSTFLAGS="--print native-static-libs" cargo build --release --locked
 	@echo
 
 %.obj: tests/%.c