Suggested Travis CI usage doesn't cache the build

[Nemo157]

Despite suggesting using cache: cargo to cache cargo-audit the script force-reinstalls it every time. Until -Z install-upgrade is stabilized I have been using a script like this for installing tools using the cache:

install:
- >
  [[ "$(wasm-bindgen --version)" == "wasm-bindgen 0.2.51" ]]
  || cargo install --force wasm-bindgen-cli --version 0.2.51

(I may open a PR to update this if I get around to setting up cargo-audit on any of my projects CI).

[tarcieri]

Good catch. I think ideally we could check what the current version of cargo-audit is via e.g. the crates.io API or local index, and only reinstall if there's a new version.

FWIW, I opened a rust-internals issue about the general problem: https://internals.rust-lang.org/t/idea-cargo-install-update/11072

[tarcieri]

Apparently there's a cargo install-update command on nightly:

rust-lang/cargo#6797

[tarcieri]

Seems like cargo install-update will be stabilizing soon:

rust-lang/cargo#7560

When it does, we can update the documentation to use it.

[tjodden]

The install-upgrade feature was stabilized in Cargo 1.41. However, it's not a new install-update command, but rather the install command will automatically upgrade the package, or do nothing if it is up-to-date:

$ cargo install cargo-audit
    Updating crates.io index
     Ignored package `cargo-audit v0.11.1` is already installed, use --force to override

However, with earlier versions the same command fails:

$ cargo +1.40.0 install cargo-audit
    Updating crates.io index
error: binary `cargo-audit` already exists in destination as part of `cargo-audit v0.11.1`

So the README would need some disclaimer about Rust version.