Support local crates with private dependencies

!22 (merged) added the ability to package crates from local sources. However this doesn't work when it has private dependencies that are themselves not published on crates.io. For example rustup has a private path dependency called download which is understandably not published on crates.io. We'll have to figure out how to this in order to support packaging rustup.