Description
As described in bug 1461553, comment 2 and later comments, Cargo and/or other tools that are using Cargo's global registry sometimes add Cargo.lock files to the crate directories (i.e. unpacked tarballs) in the registry. And they've been known to add other files as well, f.e. the lalrpop crate directory sometimes sprouts the file src/parser/lrgrammar.rs.
Cargo.lock and src/parser/lrgrammar.rs are both build artifacts, so presumably this is caused by a tool that is building the crate directly within the registry directory. Unfortunately, Cargo and tools like cargo-vendor assume that the registry is immutable, so these added files cause unwanted effects, like unexpected changes to already-vendored crates when vendoring unrelated ones (or even simply re-running cargo-vendor after adding no new crates).
Over in that bug, @alexcrichton notes a few options for resolving the issue:
One change would be to have cargo-vendor work directly from the tarballs instead of the checked-out state, but such a change isn't entirely trivial to implement today. Otherwise Cargo could also do something like periodically execute a sanity check to make sure checked out crates look alright.
…
I'd personally prefer to dig in and discover what crates are modifying the registry. I suspect it's actually very few but perhaps heavily depended on ones that have consequences for the ecosystem.
In the meantime, a workaround is to delete the registry (rm -rf ~/.cargo/registry), which Cargo will then repopulate as needed.