fix(resolver): Make min-publish-age relative to --publish-time

src/ops/cargo_add/mod.rs

@@ -849,7 +849,7 @@ fn get_latest_dependency(
 
             // `cargo add` selects a version outside the resolver,
             // so the `min-publish-age` policy must be applied here too.
-            let publish_age = PublishAgePolicy::new(gctx)?;
+            let publish_age = PublishAgePolicy::new(None, gctx)?;
             if let Some(publish_age) = &publish_age {
                 let mut too_new = Vec::new();
                 possibilities.retain(|s| match publish_age.too_new(s) {

src/ops/cargo_update.rs

@@ -806,7 +806,9 @@ fn publish_age_policy_for_report(ws: &Workspace<'_>) -> Option<PublishAgePolicy>
     if !ws.resolve_honors_publish_age() {
         return None;
     }
-    PublishAgePolicy::for_report(ws.gctx()).ok().flatten()
+    PublishAgePolicy::for_report(ws.resolve_publish_time(), ws.gctx())
+        .ok()
+        .flatten()
 }
 
 fn report_required_rust_version(resolve: &Resolve, change: &PackageChange) -> Option<String> {

src/ops/resolve.rs

@@ -473,7 +473,7 @@ pub fn resolve_with_previous<'gctx>(
         version_prefs.publish_time(publish_time);
     }
     if ws.resolve_honors_publish_age() {
-        if let Some(policy) = PublishAgePolicy::new(ws.gctx())? {
+        if let Some(policy) = PublishAgePolicy::new(ws.resolve_publish_time(), ws.gctx())? {
             version_prefs.publish_age(policy);
         }
     }

src/resolver/version_prefs.rs

@@ -176,7 +176,7 @@ impl PublishAgePolicy {
     /// * the `-Zmin-publish-age` gate is off
     /// * the resolver is configured to allow pubtime-incompatible versions
     /// * no threshold is configured at all
-    pub fn new(gctx: &GlobalContext) -> CargoResult<Option<Self>> {
+    pub fn new(now: Option<jiff::Timestamp>, gctx: &GlobalContext) -> CargoResult<Option<Self>> {
         let resolver_config = gctx.get::<Option<CargoResolverConfig>>("resolver")?;
         if resolver_config
             .and_then(|c| c.incompatible_publish_age)
@@ -185,12 +185,15 @@ impl PublishAgePolicy {
             return Ok(None);
         }
 
-        Self::for_report(gctx)
+        Self::for_report(now, gctx)
     }
 
     /// Like [`PublishAgePolicy::new`] but ignore config from `[resolver]`,
     /// so it report too-new packages regardess they are allowed or denied.
-    pub fn for_report(gctx: &GlobalContext) -> CargoResult<Option<Self>> {
+    pub fn for_report(
+        now: Option<jiff::Timestamp>,
+        gctx: &GlobalContext,
+    ) -> CargoResult<Option<Self>> {
         if !gctx.cli_unstable().min_publish_age {
             return Ok(None);
         }
@@ -239,7 +242,7 @@ impl PublishAgePolicy {
         }
 
         Ok(Some(Self {
-            invocation_time: gctx.invocation_time(),
+            invocation_time: now.unwrap_or_else(|| gctx.invocation_time()),
             global,
             crates_io,
             per_registry,

tests/testsuite/min_publish_age.rs

@@ -2051,3 +2051,65 @@ fn cargo_add_all_versions_too_new() {
 "#]])
         .run();
 }
+
+#[cargo_test]
+fn generate_lockfile_with_publish_time_and_min_publish_age() {
+    publish_packages();
+
+    let p = project()
+        .file(
+            "Cargo.toml",
+            r#"
+                [package]
+                name = "foo"
+
+                [dependencies]
+                bar = "1.0"
+            "#,
+        )
+        .file(
+            ".cargo/config.toml",
+            r#"
+                [registry]
+                global-min-publish-age = "7 days"
+            "#,
+        )
+        .file("src/lib.rs", "")
+        .build();
+
+    p.cargo(&format!(
+        "generate-lockfile --publish-time {NOW} -Zmin-publish-age -Zunstable-options"
+    ))
+    .masquerade_as_nightly_cargo(&["publish-time", "min-publish-age"])
+    .with_stderr_data(str![[r#"
+[UPDATING] `dummy-registry` index
+[LOCKING] 1 package to highest compatible version as of 2006-08-08T00:00:00Z
+[ADDING] bar v1.0.0 (available: v1.1.0, published 2 days ago)
+
+"#]])
+    .run();
+
+    let lock = p.read_lockfile();
+    assert_e2e().eq(
+        lock,
+        str![[r##"
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bar"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75120345f1869de1197d82823818e8151ad3325d58f084044181fc4457c087c4"
+
+[[package]]
+name = "foo"
+version = "0.0.0"
+dependencies = [
+ "bar",
+]
+
+"##]],
+    );
+}