> 4) Missing dependency lockfiles (Cargo.lock, yarn.lock, ...). Some distros like Debian do not make use of these files, but in Arch Linux they are used to decl

> 4) Missing dependency lockfiles (Cargo.lock, yarn.lock, ...). Some distros like Debian do not make use of these files, but in Arch Linux they are used to declare a resolved dependency tree to another ecosystem, like crates.io or npm. If this file is missing, the dependency tree might get resolved at build time (which is not guaranteed to match the versions you'd get when resolving dependencies in a week or three). Technically accurate but worth mentioning that this does not mean that Debian will just fetch dependencies based on SemVer at Cargo.toml/package.json,... at build time and hope for the best. Debian requires that every dependency no matter the language is its own Debian package with everything it entails. This is why it sometimes takes longer for a package to appear in Debian, even in the testing branch - you have to package every single dependency in the tree first. Arch Linux with lock file: https://gitlab.archlinux.org/archlinux/packaging/packages/fd/-/blob/37b19231d33340896d541d01f11eaa3e241ce319/PKGBUILD#L13 https://gitlab.archlinux.org/archlinux/packaging/packages/fd... Debian with its own packages: https://sources.debian.org/src/rust-fd-find/9.0.0-1/debian/control/#L4-L37 https://sources.debian.org/src/rust-fd-find/9.0.0-1/debian/c...