[librsvg/hospitality: 10/12] COMPILING.md: Mention Cargo's shenanigans of downloading sources

[Federico Mena Quintero <federico src gnome org>]

commit ef4f54f32a010dc8b81d3f1e19359505a06f77aa
Author: Federico Mena Quintero <federico gnome org>
Date:   Thu Nov 30 09:20:43 2017 -0600

    COMPILING.md: Mention Cargo's shenanigans of downloading sources

 COMPILING.md |    7 +++++--
 1 files changed, 5 insertions(+), 2 deletions(-)
---
diff --git a/COMPILING.md b/COMPILING.md
index 9d8b085..5edda4d 100644
--- a/COMPILING.md
+++ b/COMPILING.md
@@ -88,12 +88,15 @@ make
 
 Automated build systems generally avoid network access so that they
 can compile from known-good sources, instead of pulling random updates
-from the net every time.
+from the net every time.  However, normally Cargo likes to download
+dependencies when it first compiles a Rust project.
 
 We use [`cargo vendor`][cargo-vendor] to ship librsvg release tarballs
 with the source code for Rust dependencies **embedded within the
 tarball**.  If you unpack a librsvg tarball, these sources will appear
-in the `rust/vendor` subdirectory.
+in the `rust/vendor` subdirectory.  If you build librsvg from a
+tarball, instead of git, it should not need to access the network to
+download extra sources at all.
 
 Build systems can use [Cargo's source replacement
 mechanism][cargo-source-replacement] to override the location of the