Cargo fails to vendor jiter-0.9.0 without updating the lock file

[a-ovchinnikov]

When trying to vendor jiter-0.9.0 (as distributed via PyPI) with --locked flag there is a failure to do so because of a mismatch between Cargo.toml and Cargo.lock.

Observed behavior:

$ cargo vendor --locked                                                                             
error: failed to sync                                                                               
                                                                                                    
Caused by:                                                                                          
  failed to load pkg lockfile                                                                       
                                                                                                    
Caused by:                                                                                          
  the lock file [...]/jiter-0.9.0/Cargo.lock needs to be updated but --locked was passed to prevent this
  If you want to try to generate the lock file without accessing the network, remove the --locked flag and use --offline instead.

Expected behavior: cargo vendors dependencies successfully.

This behavior was observed with several cargo versions including 1.84.0 and 1.86.0.

Regenerating Cargo.lock with either cargo generate-lockfile or maturin resolves the problem however that makes the build non-deterministic.

[davidhewitt]

Reported upstream at PyO3/maturin#2609

[goneri]

The same problem happens with 0.10.0

$ cargo vendor --locked --versioned-dirs --no-delete                                                               
Updating crates.io index
error: failed to sync

Caused by:
  failed to load lockfile for /var/home/goneri/tmp/jiter-0.10.0

Caused by:
  the lock file /var/home/goneri/tmp/jiter-0.10.0/Cargo.lock needs to be updated but --locked was passed to prevent this
  If you want to try to generate the lock file without accessing the network, remove the --locked flag and use --offline instead.