--offline, --locked, --frozen and --config are not passed to cargo metadata

[Shnatsel]

Running cargo auditable build --offline will make cargo metadata still try to access the network, because cargo auditable does not pass on this argument to cargo metadata.

According to cargo help metadata, this may impact dependency resolution, so this may make the audit info inaccurate:

       --offline
           Prevents Cargo from accessing the network for any reason. Without this flag, Cargo
           will stop with an error if it needs to access the network and the network is not
           available. With this flag, Cargo will attempt to proceed without the network if
           possible.

           Beware that this may result in different dependency resolution than online mode. Cargo
           will restrict itself to crates that are downloaded locally, even if there might be a
           newer version as indicated in the local copy of the index. See the cargo-fetch(1)
           command to download dependencies before going offline.

           May also be specified with the net.offline config value
           <https://doc.rust-lang.org/cargo/reference/config.html>.

[Shnatsel]

Passing the CARGO_NET_OFFLINE environment variable and setting configuration in the Cargo config file are available as workarounds.