Inconsistent wording in `cargo yank` documentation

[laurmaedje]

The documentation for cargo yank says:

This command does not delete any data, and the crate will still be available for download via the registry's download link.

Later on, it then says:

Yanking the crate only prevents new users from downloading it, but cannot stop those who have already downloaded it from keeping or even spreading the leaked credentials.

The second sentence sounds like it's not possible to download anymore, which is in conflict with the first quoted sentence. In the context of credentials, I think it would be good to emphasize that it remains fully public to download for anyone.

[weihanglo]

Good catch. Feel free to throw some suggestions. Mine:

Yanking only prevents Cargo from selecting this version when resolving new dependencies by default. Existing lock files or direct downloads are not affected, so yanking cannot stop those who have already downloaded it from keeping or even spreading the leaked credentials.

[laurmaedje]

I think your suggestions for the first sentence and the second half of the second sentence are quite nice.

The phrasing "cannot stop those who have already downloaded it" still feels kinda inconsistent with the first part. How about simplifying it to just "yanking cannot stop further spreading of the leaked credentials"?

So in total:

Yanking only prevents Cargo from selecting this version when resolving new dependencies by default. Existing lock files or direct downloads are not affected, so yanking cannot stop further spreading of the leaked credentials.

[weihanglo]

Looks great! A minor tweak needed (my fault): It is about resolving dependencies not only "new" dependencies.

Feel free to open a new pull request!