cargo install should have an option to allow installing a yanked binary

[leighmcculloch]

Problem

Installing binaries using cargo install --version <version> <crate> will fail if version is yanked.

Crates can be yanked for different reasons. While some of those reasons are security related, not all are. Even for security related reasons, blocking the install of yanked tools is disruptive. Teams may need time to update CI, install scripts, systems, to be able to upgrade to a new version.

In CI systems it breaks and prevents reproducibility when versions of tools can disappear.

Proposed Solution

Add an option --allow-yanked to allow installing yanked binaries.

Or, change the --force option to allow installing yanked binaries.

Notes

No response

[weihanglo]

#4225 seems like a generalized version of this issue.

For cargo install specifically, could you run cargo install <pkg> --locked? It is the flag to achieve the reproducibility if the binary package had Cargo.lock committed.

[epage]

The problem with --locked is that is for when resolving dependencies. I believe this is for when choosing which package to install which is earlier in the process.

[epage]

I suspect the actual solution for this should be #2267 as it makes running the command subject to the lockfile which can bypass yanked.

[leighmcculloch]

For cargo install specifically, could you run cargo install <pkg> --locked? It is the flag to achieve the reproducibility if the binary package had Cargo.lock committed.

I use --locked, I just left it out of the example in the PR, and it doesn't make a difference. Cargo still disallows installing the binary.

[leighmcculloch]

I suspect the actual solution for this should be #2267 as it makes running the command subject to the lockfile which can bypass yanked.

The problem with relying on #2267 is that it doesn't solve the problem for users who wish to cargo install a binary globally, which is a very valid way to install a development tool. #2267 appears to be narrowly focused on a specific workflow where somebody is using a development tool for a Rust project specifically. This issue is specifically about the cargo install user flow which applies to a large variety of environments and setups which may not actually be in the context of a Rust project.