We are getting occasional, but infrequent, failures in our CI which uses cargo vendor. Looking into it, it seems that this could be due to alexcrichton/cargo-vendor#131, where cargo vendor will delete downloaded crates in the package cache, even though those crates could be concurrently used by other build processes.

This is done without holding the package cache lock, but even if it did I'm not sure this is correct since other cargo commands will read from the package cache (e.g. cargo build will read the code from extracted crates) without holding the package cache lock.