Rebar3 offline mode

[zuiderkwast]

Some build environments are, for security and legal reasons, forbidden to download any online content. All dependencies need to be downloaded and approved in advance. This is the case at some enterprises including Ericsson's internal projects. Bootstrapping rebar3 in offline mode is also necessary.

Some background and similar use cases: erlang/rebar3#1281

The idea is to separate the building and verification of the deps from the download, so we can just skip the download step. Placing deps under _checkouts seems to work for the most part, but it's a hack and not intended for this purpose. We need a better way. Some vendoring mechanism has been mentioned.

Here's an idea from @ferd (erlang/rebar3#2643 (comment)):

About the local hex index, it's more about re-packaging the local cache (which is by default in ~/.cache/rebar3, containing tarballs and a copy of the hex index) in another directory (say vendored/) with only the deps required so that we wouldn't hit the network even if we could.

This could possibly be done by having a {vendored_deps, false | "local/path"} config value and calling rebar3 vendor to create that "snapshot."

IIUC, we'd need to vendor the deps and a hex cache so that rebar can verify their hashes against the hex cache, is that right?

For git deps, there is some verification too. I can't see what's needed to support vendored git deps, but I hope it will be possible too.

About "so that we wouldn't hit the network even if we could" is better than would, but even better would be a flag or environment variable to forbid rebar3 from even trying to download anything, at least for hex and git dependencies supported by plain rebar3. (External plugins which download stuff is another thing, but we can't really do anything about that, can we?) If I understand this erlang/rebar3#1281 (comment) right, this is Ericsson's wish, is that right @jhogberg?

Any feedback from @tsloughter is much appreciated. I'm willing to spend time on this, if I only know how to proceed.