[cesarb]

> those are things that can be fetched at build time

At least for Linux distributions, the package builders are normally not allowed any network access; this was an issue for packages using Rust before cargo-vendor and the introduction of a flag to cargo to never try to update the lockfile.

Not allowing network access for build hosts is probably not limited to Linux distributions, so this use case will have to be addressed sooner or later.

[infogulch]

It's a simple system. If the modules are already present in your local cache it will just use them directly. So not having network access for build time is trivial to work around: just put the packages you depend on in your local cache and you're done. Note that with this system the selected versions are deterministic, so if the modules are present there's no reason to access the network anyways.