doc(cargo-package): explain no guarantee of vcs provenance

Author: weihanglo

src/doc/man/cargo-package.md

@@ -61,6 +61,13 @@ Will generate a `.cargo_vcs_info.json` in the following format
 `path_in_vcs` will be set to a repo-relative path for packages
 in subdirectories of the version control repository.
 
+The compatibility of this file is maintained under the same policy
+as the JSON output of {{man "cargo-metadata" 1}}.
+
+Note that this file provides a best-effort snapshot of the VCS information.
+However, the provenance of the package is not verified.
+There is no guarantee that the source code in the tarball matches the VCS information.
+
 ## OPTIONS
 
 ### Package Options

src/doc/man/generated_txt/cargo-package.txt

@@ -59,6 +59,14 @@ DESCRIPTION
        path_in_vcs will be set to a repo-relative path for packages in
        subdirectories of the version control repository.
 
+       The compatibility of this file is maintained under the same policy as
+       the JSON output of cargo-metadata(1).
+
+       Note that this file provides a best-effort snapshot of the VCS
+       information. However, the provenance of the package is not verified.
+       There is no guarantee that the source code in the tarball matches the
+       VCS information.
+
 OPTIONS
    Package Options
        -l, --list

src/doc/src/commands/cargo-package.md

@@ -56,6 +56,13 @@ Will generate a `.cargo_vcs_info.json` in the following format
 `path_in_vcs` will be set to a repo-relative path for packages
 in subdirectories of the version control repository.
 
+The compatibility of this file is maintained under the same policy
+as the JSON output of [cargo-metadata(1)](cargo-metadata.html).
+
+Note that this file provides a best-effort snapshot of the VCS information.
+However, the provenance of the package is not verified.
+There is no guarantee that the source code in the tarball matches the VCS information.
+
 ## OPTIONS
 
 ### Package Options

src/etc/man/cargo-package.1

@@ -83,6 +83,13 @@ Will generate a \fB\&.cargo_vcs_info.json\fR in the following format
 .sp
 \fBpath_in_vcs\fR will be set to a repo\-relative path for packages
 in subdirectories of the version control repository.
+.sp
+The compatibility of this file is maintained under the same policy
+as the JSON output of \fBcargo\-metadata\fR(1).
+.sp
+Note that this file provides a best\-effort snapshot of the VCS information.
+However, the provenance of the package is not verified.
+There is no guarantee that the source code in the tarball matches the VCS information.
 .SH "OPTIONS"
 .SS "Package Options"
 .sp