test: pass --locked to all cargo invocations

Passing --locked makes cargo fail if a command would cause an update to
a Cargo.lock file. This can happen if, for example, someone modified a
Cargo.toml file, yet forgot to check in the corresponding change to
Cargo.lock.

Signed-off-by: Patrick Roy <[email protected]>

Author: roypat

tests/host_tools/cargo_build.py

@@ -31,7 +31,9 @@
 @with_filelock
 def cargo_build(path, extra_args="", src_dir="", extra_env=""):
     """Trigger build depending on flags provided."""
-    cmd = "CARGO_TARGET_DIR={} {} cargo build {}".format(path, extra_env, extra_args)
+    cmd = "CARGO_TARGET_DIR={} {} cargo build --locked {}".format(
+        path, extra_env, extra_args
+    )
     if src_dir:
         cmd = "cd {} && {}".format(src_dir, cmd)
 
@@ -43,7 +45,7 @@ def cargo_test(path, extra_args=""):
     path = os.path.join(path, CARGO_UNITTEST_REL_PATH)
     cmd = (
         "CARGO_TARGET_DIR={} RUST_TEST_THREADS=1 RUST_BACKTRACE=1 "
-        'RUSTFLAGS="{}" cargo test {} --all --no-fail-fast'.format(
+        'RUSTFLAGS="{}" cargo test --locked {} --all --no-fail-fast'.format(
             path, get_rustflags(), extra_args
         )
     )
@@ -66,8 +68,8 @@ def get_firecracker_binaries():
     if not fc_bin_path.exists():
         cd_cmd = "cd {}".format(FC_WORKSPACE_DIR)
         flags = 'RUSTFLAGS="{}"'.format(get_rustflags())
-        cargo_default_cmd = f"cargo build --release --target {target}"
-        cargo_jailer_cmd = f"cargo build -p jailer --release --target {target}"
+        cargo_default_cmd = f"cargo build --locked --release --target {target}"
+        cargo_jailer_cmd = f"cargo build --locked -p jailer --release --target {target}"
         cmd = "{0} && {1} {2} && {1} {3}".format(
             cd_cmd, flags, cargo_default_cmd, cargo_jailer_cmd
         )
@@ -100,7 +102,7 @@ def run_seccompiler_bin(bpf_path, json_path=defs.SECCOMP_JSON_DIR, basic=False):
     if json_path == defs.SECCOMP_JSON_DIR:
         json_path = json_path / "{}.json".format(cargo_target)
 
-    cmd = "cargo run -p seccompiler --target-dir {} --target {} --\
+    cmd = "cargo run --locked -p seccompiler --target-dir {} --target {} --\
         --input-file {} --target-arch {} --output-file {}".format(
         defs.SECCOMPILER_TARGET_DIR,
         cargo_target,
@@ -127,7 +129,7 @@ def run_rebase_snap_bin(base_snap, diff_snap):
     """
     cargo_target = "{}-unknown-linux-musl".format(platform.machine())
 
-    cmd = "cargo run -p rebase-snap --target {} --\
+    cmd = "cargo run --locked -p rebase-snap --target {} --\
         --base-file {} --diff-file {}".format(
         cargo_target, base_snap, diff_snap
     )

tests/integration_tests/build/test_clippy.py

@@ -25,5 +25,6 @@ def test_rust_clippy(target):
     @type: build
     """
     utils.run_cmd(
-        "cargo clippy --target {} --all --profile test" " -- -D warnings".format(target)
+        "cargo clippy --locked --target {} --all --profile test"
+        " -- -D warnings".format(target)
     )

tests/integration_tests/build/test_coverage.py

@@ -62,7 +62,7 @@ def test_coverage(monkeypatch, record_property, metrics):
         f'\
         RUSTFLAGS="-Cinstrument-coverage" \
         LLVM_PROFILE_FILE="coverage-%p-%m.profraw" \
-        cargo test --all --target={TARGET} -- --test-threads=1 \
+        cargo test --locked --all --target={TARGET} -- --test-threads=1 \
     '
     )
 

tests/integration_tests/build/test_dependencies.py

@@ -26,7 +26,9 @@ def test_licenses():
     toml_file = os.path.normpath(
         os.path.join(os.path.dirname(os.path.realpath(__file__)), "../../../Cargo.toml")
     )
-    utils.run_cmd("cargo deny --manifest-path {} check licenses".format(toml_file))
+    utils.run_cmd(
+        "cargo deny --locked --manifest-path {} check licenses".format(toml_file)
+    )
 
 
 @pytest.mark.parametrize("dep_file", ["framework/dependencies.txt"])
@@ -35,7 +37,9 @@ def test_num_dependencies(dep_file):
 
     @type: build
     """
-    _, stdout, _ = utils.run_cmd("cargo tree --prefix none -e no-dev " "--workspace")
+    _, stdout, _ = utils.run_cmd(
+        "cargo tree --locked --prefix none -e no-dev " "--workspace"
+    )
     deps = stdout.splitlines()
 
     current_deps = set()

tests/integration_tests/performance/test_versioned_serialization_benchmark.py

@@ -91,7 +91,7 @@ def test_serialization_benchmark(monkeypatch, record_property):
     monkeypatch.chdir(BENCHMARK_DIRECTORY)
 
     # Run benchmark test
-    cmd = "cargo bench --target {}".format(DEFAULT_BUILD_TARGET)
+    cmd = "cargo bench --locked --target {}".format(DEFAULT_BUILD_TARGET)
     result = utils.run_cmd_sync(cmd)
     assert result.returncode == 0
 

tests/integration_tests/security/test_sec_audit.py

@@ -21,6 +21,6 @@ def test_cargo_audit():
     """
     # Run command and raise exception if non-zero return code
     utils.run_cmd(
-        "cargo audit --deny warnings -q  --ignore RUSTSEC-2021-0145",
+        "cargo audit --locked --deny warnings -q  --ignore RUSTSEC-2021-0145",
         cwd=defs.FC_WORKSPACE_DIR,
     )