Please honour CARGO_NET_OFFLINE for implicit installs

[ijackson]

Steps

1. Don't have +nightly-2023-12-19 installed
2. In any project, CARGO_NET_OFFLINE=true cargo +nightly-2023-12-19 check --locked --offline

Expected behaviour

Error message saying +nightly-2023-12-19 is not installed, mentioning CARGO_NET_OFFLINE

Actual behaviour

Starts to download the requested toolchain.

Discussion

CARGO_NET_OFFLINE is a way that cargo has provided for some time now to allow disabling network access. This can be very useful in a number of circumstances.

A user might set this because:

• The network is unavailable or very slow and they don't want to wait for it to time out
• The network is very expensive, or rationed, so they need to control downloads
• They want to prevent downloads for security or software-supply-chain reasons

See also #4264. I'm hoping that honouring CARGO_NET_OFFLINE will be uncontroversial, and won't be blocked on those wider discussions.

[djc]

As detailed in https://blog.rust-lang.org/2025/03/04/Rustup-1.28.1.html, you can already use RUSTUP_AUTO_INSTALL to control this behavior with 1.28.1, and 1.28.2 will enable persisting this in your user profile. I'm not convinced allowing a CARGO_ variable to additionally influence this will improve things.

[ijackson]

Yes, but people will already be setting CARGO_NET_OFFLINE because it was supported by older tooling. So looking at that variaable too can minimise the disruption caused by this new behaviour.

[djc]

So looking at that variaable too can minimise the disruption caused by this new behaviour.

I don't think this would help with that. CARGO_NET_OFFLINE would help in not doing implicit installs when people have suggested in their environment that they would prefer not downloading stuff, but it doesn't help in the other direction which is where we've had trouble -- with people who are expecting implicit downloads but not getting them.