cargo install --frozen tries to access the internet despite vendoring

[stevenroose]

cargo install --frozen with a vendor directory set in .cargo/config is updating the crates-io index while it shouldn't do that.

This can currently be solved with --offline, but it should not attempt reach out to the internet with --frozen.

Also, --offline doesn't exist before v1.36.0.

---

Reproducing this:

• Cargo.toml

[package]
name = "cargo-install-vendor"
version = "0.1.0"

[build-dependencies]
cbindgen = "0.9.1"

• .cargo/config

[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "[redacted pwd]/vendor"

$ cargo vendor
[...]
$ cargo install --frozen cbindgen
error: attempting to make an HTTP request, but --frozen was specified

[ehuss]

cargo install --frozen cbindgen

This command is asking Cargo to install cbindgen from crates.io, so it inherently needs to be online.

If you want to install something that is downloaded locally, the --path option can be used. In this example, perhaps something like cargo install --path vendor/cbindgen --offline. The choice of --locked vs --frozen vs --offline is maybe a little subtle, and in this case no flag is also an option if you already have vendoring configured, as it doesn't need the network in that case.