In addition to the sibling comment, note that reproducible build systems from Docker to Nix require a lockfile in order to be reproducible, and if you don’t provide one, then somebody downstream will provide it instead. By checking in Cargo.lock, you ensure control over the precise versions of your dependencies for all downstream users.