假设是一个git 依赖，私有源需CARGO_NET_GIT_FETCH_WITH_CLI=true:

1. cargo update -p [package] –precise [commit-id]
2. cargo vendor

非git依赖:

1. cargo update -p [package]
2. cargo vendor