Cargo can use a local registry replacement

Cargo finds its packages in a "source". The default source is crates.io. However, youcan choose a different source in your .cargo/config:

[source.crates-io]
replace-with = 'my-awesome-registry'
[source.my-awesome-registry]
registry = 'https://github.com/my-awesome/registry-index'

This configuration means that instead of using crates.io, Cargo will querythe my-awesome-registry source instead (configured to a different indexhere). This alternate source must be the exact same as the crates.io index.Cargo assumes that replacement sources are exact 1:1 mirrors in this respect,and the following support is designed around that assumption.

When generating a lock file for crate using a replacement registry, theoriginal registry will be encoded into the lock file. For example in theconfiguration above, all lock files will still mention crates.io as theregistry that packages originated from. This semantically represents howcrates.io is the source of truth for all crates, and this is upheld becauseall replacements have a 1:1 correspondance.

Overall, this means that no matter what replacement source you're workingwith, you can ship your lock file to anyone else and you'll all still haveverifiably reproducible builds!

This has enabled tools likecargo-vendor andcargo-local-registry,which are often useful for "offline builds." They prepare the list of allRust dependencies ahead of time, which lets you ship them to a build machinewith ease.