Vetting the cargo

As far as I can see, you're not expected to publish Cargo.lock alongside your audits. Importing is done by just giving the URL of audits.toml and there's no general way to find a Cargo.lock from that.

From the discussion in https://github.com/mozilla/cargo-vet/issues/79 , it sounds like they considered storing the crate's checksum alongside the version in the audit file, and then decided not to because it didn't seem to protect against any plausible attacks. Instead you have to trust that crates.io has not been compromised and is not serving different code for the same crate version to different users, or that if it was then someone would very quickly notice checksum failures with all the other cargo commands that use Cargo.lock.