carton.lock is updated when run `carton install` at remote.