alexcrichton / cargo-vendor Goto Github PK

Archived as subcommand is now part of Cargo itself

License: Apache License 2.0

Rust 99.46% Shell 0.54%

cargo-vendor's Introduction

cargo-vendor

Note: This crate is moving into upstream Cargo itself. If you're on the nightly channel as of 2019-06-20 you don't need to install cargo-vendor, but rather cargo vendor just works.

All future development of a vendor subcommand will happen in upstream Cargo itself, and issues/bugs should not be reported to this repository any more.

In other words this project is DEPRECATED since it's moved into Cargo.

This is a Cargo subcommand which vendors all crates.io dependencies into a local directory using Cargo's support for source replacement.

Installation

Currently this can be installed with:

$ cargo install cargo-vendor

You can also install precompiled binaries that are assembled on the CI for this crate.

Example Usage

Simply run cargo vendor inside of any Cargo project:

$ cargo vendor
add this to your .cargo/config for this project:

    [source.crates-io]
    replace-with = 'vendored-sources'

    [source.vendored-sources]
    directory = '/home/alex/code/cargo-vendor/vendor'

This will populate the vendor directory which contains the source of all crates.io dependencies. When configured, Cargo will then use this directory instead of looking at crates.io.

Also note that the output of cargo vendor that should be configuration is all on stdout (as opposed to stderr where other messages go), so you can also do:

$ cargo vendor > .cargo/config

to vendor and initialize your config in the same step!

Flag `--no-merge-sources`

If the vendored Cargo project makes use of [replace] sections it can happen that the vendoring operation fails, e.g. with an error like this:

found duplicate version of package `libc v0.2.43` vendored from two sources:
...

The flag --no-merge-sources should be able to solve that. Make sure to grab the .cargo/config file directly from standard output since the config gets more complicated and unpredictable.

Example:

$ cargo vendor --no-merge-sources > .cargo/config

License

This project is licensed under either of

Apache License, Version 2.0, (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in cargo-vendor by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

cargo-vendor's People

Contributors

Stargazers

Watchers

cargo-vendor's Issues

Install fails on Linux (error: Could not compile `serde_derive`.)

Running cargo install cargo-vendor (even with an empty registry) results in:

   ...
   Compiling curl v0.4.6
   Compiling serde_derive v0.9.15
error[E0523]: found two different crates with name `std` that are not distinguished by differing `-C metadata`. This will result in symbol conflicts between the two.
  --> $my_home/.cargo/registry/src/github.com-1ecc6299db9ec823/serde_derive-0.9.15/src/lib.rs:13:1
   |
13 | extern crate proc_macro;
   | ^^^^^^^^^^^^^^^^^^^^^^^^

error: Could not compile `serde_derive`.
Build failed, waiting for other jobs to finish...
error: failed to compile `cargo-vendor v0.1.7`, intermediate artifacts can be found at `/tmp/cargo-install.Y9F5h9aJKgW6`

Same happens when building master or 0.1.7 with cargo build, 0.1.6 works fine.

Env

Ubuntu 17.04
rustc 1.16.0
cargo-0.17.0 (built 2017-03-24)

To reproduce

docker run --rm -it ubuntu:zesty bash
$ apt update && apt install -y cargo pkg-config libssl-dev libssh2-1-dev
$ cargo install cargo-vendor

cargo-vendor as a standalone

Can cargo-vendor be used on it own without cargo? I tried to cargo build it and then run target/debug/cargo-vendor but am getting errors:

$ target/debug/cargo-vendor -h
Hello!
error: Invalid arguments.

Usage:
    cargo vendor [options] [<path>]

Checking vendor-ed crates fails when crate git ignores .*

The crate rust-crypto (https://crates.io/crates/rust-crypto) has a .gitignore file which ignores files maching pattern .*

https://github.com/DaGenix/rust-crypto/blob/master/.gitignore

I am vendoring this crate with cargo vendor and checking in my project. Unfortunately because of the .gitignore pattern the files .cargo-checksum.json do not get pushed to the internal git repo. This in turns breaks subsequent builds on the CI machine.

Not sure what a good approach is here, maybe keeping the cargo metadata files outside the repo?

cargo-vendor 0.1.9

No way to detect unused vendored crates with shared vendor directory

When using a shared vendor directory, there is no way to detect that a vendored crate is no longer referenced. Without post-processing, the vendor directory reflects all deps over time rather than the deps needed currently.

Mozilla appears to be working around this by blowing away the vendor directory every time they add something:

https://bugzilla.mozilla.org/show_bug.cgi?id=1336528#c5

This workaround is less than ideal because:

It needlessly uses bandwidth.
One must run cargo vendor /path/to/shared/vendor -s crateX X times, which means there needs to be a central registry, everything needs to be under the same directory, we need to use find to look for Cargo.tomls, or people need to do it manually.
- All these are non-starters with most big company codebases I have seen.
Requires a meta build system or at the very least a shell script to provide a nice developer experience.
- Cargo should have a nice experience without needing wrapper tools.

Mechanism to vendor binaries

We would love to vendor binaries normally installed by cargo install X that we use as developer tools (eg. sccache, cargo-vendor, etc).

cargo install will correctly respect the vendor directory with the appropriate .cargo/config, which is great.

However, we're not sure how to get cargo vendor to locate all the right items to vendor.
Our best idea was to have a dummy Cargo.toml with "dependencies" on the crates of the binaries (eg cargo-vendor and sccache). However, this means that dev-dependencies of the binaries don't end up in the vendor directory (eg assert_cli is a dev-dependency of sccache), which leads to cargo install failing.

Furthermore, it would be great if we could vendor in such a way that it would work cross platform. Eg if we vendor on a mac machine, the vendor directory would contain all dependent crates so that it could compile on windows as well.

Is there a way to do this today? Thanks!

A workspace with patch section functions for cargo build but not for cargo vendor

Sample here: https://github.com/rtsuk/vendoring

twonky:vendoring robtsuk$ cargo build
   Compiling bitflags v1.0.0
   Compiling libc v0.2.33
   Compiling rand v0.3.17
   Compiling enhunt v0.1.0 (file:///Users/robtsuk/projects/rust_stuff/vendoring/enhunt)
   Compiling frobulate v0.1.0 (file:///Users/robtsuk/projects/rust_stuff/vendoring/frobulate)
    Finished dev [unoptimized + debuginfo] target(s) in 2.68 secs

twonky:vendoring robtsuk$ cargo vendor
    Updating registry `https://github.com/rust-lang/crates.io-index`
error: failed to sync

Caused by:
  failed to load pkg lockfile

Caused by:
  no matching package named `enhunt` found (required by `frobulate`)
location searched: registry https://github.com/rust-lang/crates.io-index
version required: ^0.1.0

Hash checking conflicts with git file mangling

I'm trying to use cargo-vendor to download all the dependencies for a crate, then commit the crate source + dependencies into git as a single repo.

Git uses a .gitattributes file to allow you to match patterns and set file types - in particular, how to treat line endings.

If a vendored source base has a .gitattributes that changes the line endings (for example, unix-style endings for MSVC proj files), then git will apply those endings to the files when they're checked out. This causes cargo's hash check to fail, because cargo-vendor computes the hash on the original, unmodified file content.

This can't be fixed by putting a .gitattributes in the top-level repo of the directory, because the .gitattributes that's closer to the files in question (ie, in the vendored source), take precedence.

I'm not really sure how to fix this. The options I can think of are:

remove .gitattribute files on import
apply git attributes before computing hash (but that only works if the source is ultimately going to be stored in git)
exclude files that match .gitattributes from hash computation
include multiple hashes for each transformation
normalize files when computing + checking hashes
option to disable hash checking
...?

Option 6 seems like the simplest and quickest for now...

Drop rustc-serialize dependency

This is blocked on rust-lang/cargo#3944.

There should be tests for actually testing it against real cargo environment

Breakage like #27 (which suspiciously introduced by 1f73237) is pretty painful when people find their updated cargo-vendor doesn't work.

I think it would be helpful if there could be some tests in CI to test the common usage of cargo vendor, so that we can catch that kind of significant issues as soon as possible.

Generate crate directories by semantic version

It would be good if cargo-vendor could add an option to generate directories according to semantic version. This would help make it easier to spot incompatibilites between the vendored sources of different rust packages, but still be somewhat de-duplicable.

For example, if cargo-vendor needs to pack (foo-1.3, foo-1.2, foo-0.4), with no flag it would currently generate (AIUI):

vendor/foo
vendor/foo-1.2
vendor/foo-0.4

With --explicit-version

vendor/foo-1.3
vendor/foo-1.2
vendor/foo-0.4

With --semantic-version it could generate:

vendor/foo-1
vendor/foo-1.2
vendor/foo-0.4

It's then more visually obvious that we could try dropping foo-1.2 and things "should" still work, but also the path vendor/foo-1 would remain stable if we switched to using foo-1.3 later.

In fact cargo-vendor could have another flag --drop-compatible to automatically do this, perhaps with a warning that some crates might not actually follow semantic versioning.

Updating existing vendored crate

In our setup, when we want to upgrade an existing dependency we

Run the upgrade (eg futures 0.1.3 => 0.1.13) (get a new Cargo.lock file with the deps)
rm -r vendor/
Run cargo vendor

Ideally, it would be possible to eliminate step 2. Currently if vendor/futures/.cargo-checksum.json exists, it won't overwrite it. It would be nice if cargo vendor would verify if the crate is the right version.

This issue only comes up if --explicit-version is not set. If explicit version is set, then
vendor/futures-0.1.3/.cargo-checksum.json would be separate from
vendor/futures-0.1.13/.cargo-checksum.json

don't display configuration instructions if already configured

if .cargo/config is already correctly configured, cargo-vendor shouldn't display instructions stating that it needs to be configured.

Could you please provide 32bit version? NixOS fails to provide 32 bit FireFox without it.

Related NixOS issues:
NixOS/nixpkgs#32074
NixOS/nixpkgs#32655 (comment)

The cargo-vendor NixOS package:
https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/rust/cargo-vendor.nix

error: no source URL specified for `source.https://github.com/jwilm/libfontconfig`, need either `registry` or `local-registry` defined

How to reproduce:

$ git clone https://github.com/jwilm/alacritty.git
$ cd alacritty
$ mkdir .cargo
$ cargo vendor > .cargo/config # tweak accordingly
    Updating registry `https://github.com/rust-lang/crates.io-index`
    Updating git repository `https://github.com/jwilm/rust-fontconfig`
    Updating git repository `https://github.com/jwilm/libfontconfig`
 Downloading magenta v0.1.1
 Downloading regex v0.2.2
[snip]
$ rm -rf ~/.cargo
$ cargo build
error: no source URL specified for `source.https://github.com/jwilm/libfontconfig`, need either `registry` or `local-registry` defined

top-level Cargo.toml depends on ./fonts, which depends on https://github.com/jwilm/rust-fontconfig which depends on https://github.com/jwilm/libfontconfig

Both git dependencies are in vendor/servo-fontconfig and vendor/servo-fontconfig-sys respectively.
I suspect that the ~/.cargo/git cache is necessary to establish the map from the git repo to the package name?

url-0.5.9: failed to parse manifest

Trying to vendor cargo-vendor itself, I'm getting this error:

$ cargo vendor --verbose
 Downloading pnacl-build-helper v1.4.10
 Downloading gdi32-sys v0.2.0
error: unable to get packages from source

Caused by:
  failed to parse manifest at `/home/krig/.cargo/registry/src/github.com-88ac128001ac3a9a/url-0.5.9/Cargo.toml`

Caused by:
  could not parse input as TOML
/home/krig/.cargo/registry/src/github.com-88ac128001ac3a9a/url-0.5.9/Cargo.toml:14:3 expected a newline after table definition

error: third party subcommand `cargo-vendor` exited unsuccessfully

To learn more, run the command again with --verbose.

winapi

Hello,

I recently used cargo-vendor to create a snapshot of my program on Linux for an identical PC. I noticed that it captured the following crates:

winapi
winapi-0.2.8
winapi-build
winapi-i686-pc-windows-gnu
winapi-x86_64-pc-windows-gnu

If these crates are specific to Windows, why were they included in a Linux build?

Publishing vendored cargo tarballs

This would be really nice for packaging cargo. I'm working on a different distro now and it's not easy to package cargo (150+ dependencies - we also run the test suites for most packages).

This would be related to Task: Publish source tarballs of Cargo releases [0] and the issue on the cargo issue tracker [1].

Are there plans to do this (soon)?

[0] https://internals.rust-lang.org/t/perfecting-rust-packaging-the-plan/2767
[1] rust-lang/cargo#2107

Does this support vendoring git dependencies?

It looks like this tool only vendors packages that are fetched from the crates.io registry. Would it be possible to vendor dependencies that are directly fetched from git repositories as well?

add option for `cargo vendor` to (machine-readably) print out information about its operation

Mozilla would like to perform various checks on crates that get vendored into the mozilla-central tree: licensing checks (MPL-compatible code, making sure the license text is included in appropriate places) and ensuring some minimal vetting for code that won't format your hard drive would be two examples of the sorts of things we'd like to do.

cargo vendor doesn't print out any information about the packages being vendored currently (not even with -v in my admittedly limited experimentation). One could iterate over all the crates in your vendored/ directory after every cargo vendor invocation, but this is kind of a crude solution and doesn't capture nuances like "this crate was only upgraded", which might involve fewer (or no) checks.

Strawman design suggestion:

$ cargo vendor --machine-readable [...]
A crate1 ${crate1_VERSION} # added
U crate2 ${crate2_VERSION} # upgraded
N crate3 ${crate3_VERSION) # no change (maybe don't even print these?)
...
$

Bikeshedding on the particular syntax and/or option name welcome. The proposed flag would also suppress the usage information about what to add to .cargo/config, since if you're using said flag, you probably already know how to deal with the resulting vendor directory. Mixing --machine-readable and -v would be disallowed.

/cc @luser

Add a way to get configuration info programmatically

I'm trying to incorporate cargo-vendor into the preparation (network-accessible) phase of one of our builds. This works great if the only dependencies I'm pulling in are from crates.io. But some of the projects I'm trying to build (like rls) have Git dependencies.

The problem is that the cargo vendor configuration becomes specific to that version at that point, since it'll refer to e.g. branch = "master" or rev = "foobar". It would be great if the configuration could also be output to a file on the side so that my build step can grab it for later use.

Thanks!

The source release tar.gz configures vendored deps, but not .cargo/config

For example cargo-vendor-src-0.1.13.tar.gz from the releases page.

Inside the tar, we have all the source to cargo-vendor itself as well as vendored dependencies. However, if you fetch this tar and do a cargo build, it does not appear to use the vendored deps because .cargo/config is not set in that directory.

Looking at the .travis.yml, I think the pre-deploy step needs to set the .cargo/config.

".cargo-checksum.json" is not friendly to merge tools

The ".cargo-checksum.json" file generated by cargo vendor for each vendored crate is not very friendly to merge tools. It contains all data in one line, which makes it hard to figure out the change for merge tools (and human who handles the conflict).

Cargo should probably pretty-print the json to that file, and keep each file in separate lines.

Vendoring crate from git repo produces invalid .cargo-checksum.json

I'm trying to vendor tokio-uds into Gecko since the git repo has fixes my code needs. cargo-vendor version 0.1.12 produces "package": null in the jSON, which causes Gecko build to fail:

 0:01.99 error: failed to load source for a dependency on `log`
 0:01.99 
 0:01.99 Caused by:
 0:01.99   Unable to update registry https://github.com/rust-lang/crates.io-index
 0:01.99 
 0:01.99 Caused by:
 0:01.99   failed to update replaced source `registry https://github.com/rust-lang/crates.io-index`
 0:01.99 
 0:01.99 Caused by:
 0:01.99   failed to decode `.cargo-checksum.json` of tokio-uds v0.1.6
 0:02.00 
 0:02.00 Caused by:
 0:02.00   invalid type: unit value, expected a string at line 1 column 674

.cargo-checksum.json:

{"files":{".travis.yml":"931def7b1510d5bcefff1addb0c804de4b20dd57d6d71062aa5c31f5383dfb64","Cargo.toml":"c8e69d8e264381e1a3bbd0bb540c86f02db13f9f22ea1adeba1645241965a407","LICENSE-APACHE":"a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2","LICENSE-MIT":"69036b033e4bb951821964dbc3d9b1efe6913a6e36d9c1f206de4035a1a85cc4","README.md":"d99405dcf91b78024df7460186680c5334524232338cd9ddce0d39639958694a","src/frame.rs":"bf35e7134ce40679ca8125dbb008871db54af50450b6b389284d505e110bd0bd","src/lib.rs":"04b1cbf5a0fa2f62a0e1f9441caaed877e008eb43cc7b3fa15ac52e7da37904a","src/ucred.rs":"c60465ebe515eefea6de9a09e5ae67538ed28509a5c6553ef67541dca6a80bb2"},"package":null}

Compilation failed with `cargo install cargo-vendor`

OSX 10.10.5

libgit2_sys is referencing _libiconv_* symbols that are undefined. This is eerily familiar, but I can't place when exactly I had this kind of issue before. IIRC, I think on OSX the symbols don't have an underscore or something like that?

Has anyone else had issues like this?

$ cargo install cargo-vendor
    Updating registry `https://github.com/rust-lang/crates.io-index`
 Downloading cargo-vendor v0.1.2
 Downloading cargo v0.12.0
 Downloading docopt v0.6.85
 Downloading filetime v0.1.10
 Downloading git2-curl v0.5.0
 Downloading url v1.2.0
 Downloading libgit2-sys v0.4.5
 Downloading curl v0.3.6
 Downloading num_cpus v0.2.13
 Downloading tar v0.4.8
 Downloading advapi32-sys v0.1.2
 Downloading semver v0.2.3
 Downloading git2 v0.4.4
 Downloading tempdir v0.3.5
 Downloading env_logger v0.3.5
 Downloading miow v0.1.3
 Downloading crossbeam v0.2.10
 Downloading regex v0.1.77
 Downloading crates-io v0.4.0
 Downloading flate2 v0.2.14
 Downloading thread_local v0.2.7
 Downloading aho-corasick v0.5.3
 Downloading idna v0.1.0
 Downloading matches v0.1.2
 Downloading unicode-bidi v0.2.3
 Downloading unicode-normalization v0.1.2
 Downloading curl-sys v0.2.2
 Downloading bitflags v0.1.1
 Downloading libssh2-sys v0.1.39
 Downloading ws2_32-sys v0.2.1
 Downloading miniz-sys v0.1.7
 Downloading openssl-sys v0.7.17
 Downloading xattr v0.1.10
   Compiling bitflags v0.1.1
   Compiling rustc-serialize v0.3.19
   Compiling nom v1.2.4
   Compiling matches v0.1.2
   Compiling strsim v0.5.1
   Compiling regex-syntax v0.3.5
   Compiling libc v0.2.16
   Compiling winapi-build v0.1.1
   Compiling winapi v0.2.8
   Compiling glob v0.2.11
   Compiling advapi32-sys v0.1.2
   Compiling kernel32-sys v0.2.2
   Compiling ws2_32-sys v0.2.1
   Compiling gcc v0.3.35
   Compiling log v0.3.6
   Compiling memchr v0.1.11
   Compiling filetime v0.1.10
   Compiling aho-corasick v0.5.3
   Compiling crossbeam v0.2.10
   Compiling term v0.4.4
   Compiling pkg-config v0.3.8
   Compiling semver v0.2.3
   Compiling utf8-ranges v0.1.3
   Compiling xattr v0.1.10
   Compiling tar v0.4.8
   Compiling num_cpus v0.2.13
   Compiling rand v0.3.14
   Compiling openssl-sys v0.7.17
   Compiling unicode-bidi v0.2.3
   Compiling miniz-sys v0.1.7
   Compiling libz-sys v1.0.6
   Compiling tempdir v0.3.5
   Compiling curl-sys v0.2.2
   Compiling cmake v0.1.17
   Compiling lazy_static v0.2.1
   Compiling unicode-normalization v0.1.2
   Compiling cfg-if v0.1.0
   Compiling net2 v0.2.26
   Compiling thread-id v2.0.0
   Compiling thread_local v0.2.7
   Compiling fs2 v0.2.5
   Compiling flate2 v0.2.14
   Compiling miow v0.1.3
   Compiling idna v0.1.0
   Compiling curl v0.3.6
   Compiling libssh2-sys v0.1.39
   Compiling libgit2-sys v0.4.5
   Compiling regex v0.1.77
   Compiling url v1.2.0
   Compiling toml v0.1.30
   Compiling crates-io v0.4.0
   Compiling git2 v0.4.4
   Compiling docopt v0.6.85
   Compiling env_logger v0.3.5
   Compiling git2-curl v0.5.0
   Compiling cargo v0.12.0
   Compiling cargo-vendor v0.1.2
error: linking with `cc` failed: exit code: 1
  |
  = note: "cc" "-m64" "-L" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/cargo_vendor.0.o" "-o" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/cargo_vendor" "-Wl,-dead_strip" "-nodefaultlibs" "-L" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps" "-L" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/build/libgit2-sys-7e806e051f3bd634/out/lib" "-L" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/build/libssh2-sys-f3e6ccc6379d9b0b/out/lib" "-L" "/usr/lib" "-L" "/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/build/miniz-sys-60c8d67696f63a43/out" "-L" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libcargo-79512f4b200efd2a.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libtoml-1a75b37a708f335b.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libterm-44dfa57762d62876.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libtar-8ec74efd965dea8d.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libxattr-5ed5a32b7c81881e.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libsemver-60d1aa0e68346373.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libnom-24d7a34b1cbfee73.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libglob-028bcc81f721b7f5.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libgit2-dbe5af82826f4a0e.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libbitflags-fdf4b7654a6da3e5.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libfs2-8e6e3f430ae191f6.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libflate2-d719035eaa7c6a88.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libfiletime-7100ae4a7fd471a6.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libdocopt-50d41646f88f269a.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libstrsim-b42a694875d9a3b0.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libregex-a99351f81f55a22d.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libregex_syntax-b3fc207b97c83ddf.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libthread_local-a3c0092e9fb6507d.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libthread_id-bcd46c79a620a618.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblazy_static-359f5533c970cd71.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libcrates_io-3690a7d0cad42c43.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/librustc_serialize-3561541d79c18212.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liburl-d2e26827701e4972.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libcurl-dca73271be8df6ed.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblog-bf16bb9a4912b11d.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libcrossbeam-2f53cae32cd2c9f1.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblibgit2_sys-807504203ddb27cc.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblibssh2_sys-b00038ecf999a6a7.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libopenssl_sys-a4f86492ba1e2f09.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libcurl_sys-3a18fbe355ab778b.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblibz_sys-3ed6726e0477f97a.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libaho_corasick-d1dfd931d7cac82f.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libmemchr-c555f740a543880f.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libnum_cpus-9256729e2e3ab66d.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libtempdir-c5a9975021308003.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/librand-49a08859d086fffe.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libutf8_ranges-5c6a6dacba3be7ce.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libidna-82ebdb343d6c1855.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libunicode_normalization-5de3a9c8fd8ddf4e.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libunicode_bidi-04ad1da5552425fd.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libmatches-5d5580ffd528031c.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/libminiz_sys-722889de4af2439c.rlib" "/private/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry/release/deps/liblibc-1417726cb94dbc83.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libstd-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libpanic_unwind-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libunwind-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/librand-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libcollections-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liballoc-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liballoc_jemalloc-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liblibc-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/librustc_unicode-411f48d3.rlib" "/Users/fitzgen/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libcore-411f48d3.rlib" "-l" "iconv" "-framework" "Security" "-framework" "CoreFoundation" "-l" "ssl" "-l" "crypto" "-l" "z" "-l" "curl" "-l" "z" "-l" "System" "-l" "pthread" "-l" "c" "-l" "m" "-l" "compiler-rt"
  = note: Undefined symbols for architecture x86_64:
  "_libiconv", referenced from:
      _git_path_iconv in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
  "_libiconv_open", referenced from:
      _git_path_direach in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
      _git_path_iconv_init_precompose in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
      _git_path_diriter_init in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
  "_libiconv_close", referenced from:
      _git_path_direach in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
      _git_path_iconv_clear in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
      _git_path_diriter_free in liblibgit2_sys-807504203ddb27cc.rlib(path.c.o)
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)


error: aborting due to previous error

error: failed to compile `cargo-vendor v0.1.2`, intermediate artifacts can be found at `/var/folders/14/l4lqpmvs5sncftp1c0ym243w0000gp/T/cargo-install.27gXBj9o9Kry`

Caused by:
  Could not compile `cargo-vendor`.

To learn more, run the command again with --verbose.

Support for vendoring on a single platform

Hi,

At Dropbox, we have a desktop client use case which requires cargo-vendor to vendor deps across all platforms (cargo-vendor is great here)

We also have a server use case in which we'd prefer to vendor deps just for linux (currently, we end up pulling in some windows-specific deps, some of which are quite large (eg 50MB of .a files here https://github.com/retep998/winapi-rs/tree/0.3/i686/lib)

Currently cargo-vendor will pull in optional windows dependencies even if we don't need them. I believe this happens in resolve_ws here https://github.com/rust-lang/cargo/blob/master/src/cargo/ops/resolve.rs#L16

It would be great to have an option to exclude windows-specific dependencies for cases where we know we're only building for linux.

Command-line flags not recognized

I ran cargo install cargo-vendor and then:

$ cargo -h vendor
error: Invalid arguments.

Usage:
    cargo <command> [<args>...]
    cargo [options]

and

$ cargo vendor -h
error: could not find `Cargo.lock`, must be run in a directory with Cargo.lock or use the `--sync` option

To learn more, run the command again with --verbose.

Am I holding it wrong? How do I print out the help - and then later actually use flags?

CRLF being replaced by LF causes checksum issues on OSX

Hi, I'm not sure if this is right place to raise this issue, but when I run cargo vendor and it downloads a bunch of source files, the downloaded files use CRLF instead of LF. Then git automatically replaces them with LF for OSX people, and so when people pull the files, they find that the checksums don't match. Is there some way to fix this issue? Thanks

Can't vendor two compatible crate versions from two projects

More info at -- https://bugzilla.mozilla.org/show_bug.cgi?id=1336528#c3

Provide tarball with vendored sources

With rust-lang/cargo#2857 being merged cargo vendor seems like a useful tool to implement a fetch task for build systems like Nix or Yocto.

However there seems to be a bootstraping issues. In order to fetch the dependencies of cargo vendor you already need cargo vendor.

One elegant solution would be to provide a source tarball that containes the vendored-sources directory of a release. This way cargo vendor could be built without needing the dependency fetch state and thus avoiding the bootstrap problem.

Fails on lz4-sys: "found too many packages: lz4-sys v1.0.1+1.7.3"

When updating to the current version of lz4-sys on crates.io, cargo vendor fails with:

[...]
 Downloading dtoa v0.2.2
 Downloading num-integer v0.1.32
 Downloading unicase v1.4.0
error: failed to sync

Caused by:
  found too many packages: lz4-sys v1.0.1+1.7.3

Please document how to install a prebuild binary

As the docs say, there is also a way to install the prebuild binaries as can be found here:
https://github.com/alexcrichton/cargo-vendor/releases

But not sure which command or options are necessary. Also simply copying the binary into .cargo/bin does not work, because cargo install --list will not list it.

Thanks.

cargo-installable?

Hi, thanks for the really useful crate. I installed it frome crates.io with cargo install cargo-vendor and it seemed to work fine, but the instructions suggest you should install directly from github. Is this instruction outdated or is there some good reason not to install from crates.io? A note would be helpful.

Support for path dependencies

I have some dependencies like this:

mydep = { path = "/some/path" }

cargo-vendor doesn't seem to include them in the vendor directory. Normally it's not needed except when using Docker.

the result between two cargo-vendor runs changed in few weeks

Not sure whether this is real problem.

My use case is to download all dependencies for e.g. cargo or rust build. After that I create GNU tar archive where I reset time to 1970 and force owner to root. This way I'm able to create unique archive with particular sha256 check sum. I can recreate the same archive even on different computer.

But I have find out the data can differ after few weeks or days. Which is causing problems. It seems that some crater versions were updated in between.

But not sure how it's possible. Original cargo or rust version lists still the same version dependencies.

To be more specific I'm preparing integration of Rust into Solaris where our build system is using sha256 check sum, it caches these archives and it needs to be reproducible.
(example: https://github.com/oracle/solaris-userland/blob/master/components/desktop/firefox/Makefile)

Failed to build/compile with nightly

Updating registry `https://github.com/rust-lang/crates.io-index`
 Downloading url v1.2.0
   Compiling strsim v0.3.0
   Compiling lazy_static v0.2.1
   Compiling winapi-build v0.1.1
   Compiling bitflags v0.1.1
   Compiling libc v0.2.14
   Compiling regex-syntax v0.3.4
   Compiling kernel32-sys v0.2.2
   Compiling advapi32-sys v0.1.2
   Compiling matches v0.1.2
   Compiling glob v0.2.11
   Compiling log v0.3.6
   Compiling memchr v0.1.11
   Compiling xattr v0.1.8
   Compiling aho-corasick v0.5.2
   Compiling rand v0.3.14
   Compiling num_cpus v0.2.13
   Compiling pkg-config v0.3.8
   Compiling winapi v0.2.8
   Compiling crossbeam v0.2.9
   Compiling openssl-sys v0.7.14
   Compiling tempdir v0.3.5
   Compiling unicode-normalization v0.1.2
   Compiling gcc v0.3.32
   Compiling nom v1.2.4
   Compiling utf8-ranges v0.1.3
   Compiling unicode-bidi v0.2.3
   Compiling semver v0.2.3
   Compiling cmake v0.1.17
   Compiling miniz-sys v0.1.7
   Compiling libz-sys v1.0.5
   Compiling curl-sys v0.1.34
   Compiling libssh2-sys v0.1.37
   Compiling libgit2-sys v0.4.4
   Compiling idna v0.1.0
   Compiling fs2 v0.2.5
   Compiling thread-id v2.0.0
   Compiling thread_local v0.2.6
   Compiling term v0.4.4
   Compiling regex v0.1.73
   Compiling flate2 v0.2.14
   Compiling filetime v0.1.10
   Compiling url v1.2.0
   Compiling tar v0.4.7
   Compiling rustc-serialize v0.3.19
   Compiling curl v0.2.19
   Compiling git2 v0.4.4
   Compiling uuid v0.1.18
   Compiling toml v0.1.30
   Compiling url v0.2.38
   Compiling env_logger v0.3.4
   Compiling docopt v0.6.82
   Compiling crates-io v0.2.0
   Compiling git2-curl v0.4.1
   Compiling cargo v0.11.0
   Compiling cargo-vendor v0.1.1
error: linking with `cc` failed: exit code: 1
note: "cc" "-m64" "-L" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/cargo_vendor.0.o" "-o" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/cargo_vendor" "-Wl,-dead_strip" "-nodefaultlibs" "-L" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps" "-L" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/build/libgit2-sys-b2a68819b9a94017/out/lib" "-L" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/build/libssh2-sys-c4765b00ae89bf13/out/lib" "-L" "/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/build/miniz-sys-60c8d67696f63a43/out" "-L" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libcargo-9f39e6dcf6f02c39.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libtoml-1a75b37a708f335b.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libtempdir-c5a9975021308003.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libtar-10e5f62353d41d19.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libxattr-16bf42e901af78bf.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libsemver-60d1aa0e68346373.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libnum_cpus-9256729e2e3ab66d.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libglob-028bcc81f721b7f5.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libgit2-dbe5af82826f4a0e.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblibgit2_sys-4240891edcea7aa6.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libbitflags-fdf4b7654a6da3e5.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libflate2-d719035eaa7c6a88.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libminiz_sys-722889de4af2439c.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libfiletime-7100ae4a7fd471a6.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libcrossbeam-95e5cb210400af41.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libcrates_io-2bcb266090a2cbcd.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liburl-7ed3313cfb59977c.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libuuid-13c4decae1c5ee4b.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/librand-49a08859d086fffe.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libcurl-0286b44e1d98c1ee.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libcurl_sys-55642974de419d95.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblog-bf16bb9a4912b11d.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libfs2-8e6e3f430ae191f6.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libdocopt-c2a0ac91deaa6c56.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/librustc_serialize-3561541d79c18212.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libregex-a1c323daba09617d.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libutf8_ranges-5c6a6dacba3be7ce.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libregex_syntax-b24da02611351433.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libaho_corasick-e528bf4fdf3954ff.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libmemchr-c555f740a543880f.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblazy_static-359f5533c970cd71.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblibssh2_sys-dc06faa4916a7285.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libopenssl_sys-1fd52a993b3834a7.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblibz_sys-4c0b4a70ced04023.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libnom-24d7a34b1cbfee73.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liburl-d2e26827701e4972.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libidna-82ebdb343d6c1855.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libunicode_bidi-04ad1da5552425fd.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libmatches-5d5580ffd528031c.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libthread_local-e5ce0d44bcaf00e6.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libthread_id-bcd46c79a620a618.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/liblibc-1f3392fe1afd1313.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libterm-44dfa57762d62876.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libunicode_normalization-5de3a9c8fd8ddf4e.rlib" "/private/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH/release/deps/libstrsim-6c9aaf530d99b06b.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libstd-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libpanic_unwind-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libunwind-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/librand-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libcollections-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liballoc-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liballoc_jemalloc-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/liblibc-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/librustc_unicode-c8005792.rlib" "/Users/chetanconikee/.multirust/toolchains/nightly-x86_64-apple-darwin/lib/rustlib/x86_64-apple-darwin/lib/libcore-c8005792.rlib" "-l" "iconv" "-framework" "Security" "-framework" "CoreFoundation" "-l" "curl" "-l" "ssl" "-l" "crypto" "-l" "z" "-l" "System" "-l" "pthread" "-l" "c" "-l" "m" "-l" "compiler-rt"
note: Undefined symbols for architecture x86_64:
  "_EVP_aes_256_ctr", referenced from:
      _libssh2_crypt_method_aes256_ctr in liblibssh2_sys-dc06faa4916a7285.rlib(crypt.c.o)
     (maybe you meant: __libssh2_EVP_aes_256_ctr)
  "_libiconv", referenced from:
      _git_path_iconv in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
  "_EVP_aes_192_ctr", referenced from:
      _libssh2_crypt_method_aes192_ctr in liblibssh2_sys-dc06faa4916a7285.rlib(crypt.c.o)
     (maybe you meant: __libssh2_EVP_aes_192_ctr)
  "_EVP_aes_128_ctr", referenced from:
      _libssh2_crypt_method_aes128_ctr in liblibssh2_sys-dc06faa4916a7285.rlib(crypt.c.o)
     (maybe you meant: __libssh2_EVP_aes_128_ctr)
  "_libiconv_open", referenced from:
      _git_path_direach in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
      _git_path_iconv_init_precompose in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
      _git_path_diriter_init in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
  "_libiconv_close", referenced from:
      _git_path_direach in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
      _git_path_iconv_clear in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
      _git_path_diriter_free in liblibgit2_sys-4240891edcea7aa6.rlib(path.c.o)
ld: symbol(s) not found for architecture x86_64
clang: error: linker command failed with exit code 1 (use -v to see invocation)

error: aborting due to previous error
error: failed to compile `cargo-vendor v0.1.1`, intermediate artifacts can be found at `/var/folders/f9/23439cns7gn9g81r46tp2g4w0000gn/T/cargo-install.ZZu42HxRx0yH`

Caused by:
  Could not compile `cargo-vendor`.

To learn more, run the command again with --verbose.

Attempting to vendor a git replacement for a crates.io crate results in error

What I'm trying to do is run cargo-vendor in Gecko, after adding some git crate replacements. Specifically, I'm taking the replacements indicated at servo/webrender@57d9165#diff-80398c5faae3c069e4e6aa2ed11b28c0R13 and putting them into toolkit/library/rust/Cargo.toml and toolkit/library/gtest/rust/Cargo.toml. Running cargo update on these works fine. However when I go to run mach vendor rust, it produces this:

Caused by:
  found duplicate version of package `serde v1.0.8` vendored from two sources:

	source 1: https://github.com/gankro/serde?branch=deserialize_from_enums3#01f8e598
	source 2: registry https://github.com/rust-lang/crates.io-index

Is this use-case intended to work? When I look in the Cargo.lock files, the sections for serde and serde_derive look like this:

[[package]]                                                                      
name = "serde"                                                                   
version = "1.0.8"                                                                
source = "git+https://github.com/gankro/serde?branch=deserialize_from_enums3#01f8e598705093a1f42e558099c6dcdfd96b9111"
dependencies = [                                                                 
 "serde_derive 1.0.8 (git+https://github.com/gankro/serde?branch=deserialize_from_enums3)",
]                                                                                
                                                                                 
[[package]]                                                                      
name = "serde"                                                                   
version = "1.0.8"                                                                
source = "registry+https://github.com/rust-lang/crates.io-index"                 
replace = "serde 1.0.8 (git+https://github.com/gankro/serde?branch=deserialize_from_enums3)"
                                                                                 
[[package]]                                                                      
name = "serde_derive"                                                            
version = "1.0.8"                                                                
source = "git+https://github.com/gankro/serde?branch=deserialize_from_enums3#01f8e598705093a1f42e558099c6dcdfd96b9111"
dependencies = [                                                                 
 "quote 0.3.15 (registry+https://github.com/rust-lang/crates.io-index)",         
 "serde_derive_internals 0.17.0 (git+https://github.com/gankro/serde?branch=deserialize_from_enums3)",
 "syn 0.11.11 (registry+https://github.com/rust-lang/crates.io-index)",          
]                                                                                
                                                                                 
[[package]]                                                                      
name = "serde_derive"                                                            
version = "1.0.8"                                                                
source = "registry+https://github.com/rust-lang/crates.io-index"                 
replace = "serde_derive 1.0.8 (git+https://github.com/gankro/serde?branch=deserialize_from_enums3)"

and I'm assuming that this is normal, but that cargo-vendor doesn't know how to deal with it? I'm running cargo-vendor v0.1.13, latest from crates.io

build fails on osx

On Mac Os high sierra
attempting to install fails with the following error:

> 
> error: failed to run custom build command for `libssh2-sys v0.2.6`
> process didn't exit successfully: `/Users/jonathangerber/src/rust/3ps/cargo-vendor/target/debug/build/libssh2-sys-8609a657562da192/build-script-build` (exit code: 101)
> --- stdout
> running: "cmake" "/Users/jonathangerber/.cargo/registry/src/github.com-1ecc6299db9ec823/libssh2-sys-0.2.6/libssh2" "-DCRYPTO_BACKEND=OpenSSL" "-DOPENSSL_INCLUDE_DIR=/usr/local/opt/openssl/include" "-DBUILD_SHARED_LIBS=OFF" "-DENABLE_ZLIB_COMPRESSION=ON" "-DCMAKE_INSTALL_LIBDIR=lib" "-DBUILD_EXAMPLES=OFF" "-DBUILD_TESTING=OFF" "-DCMAKE_INSTALL_PREFIX=/Users/jonathangerber/src/rust/3ps/cargo-vendor/target/debug/build/libssh2-sys-dad5a8f2797185f7/out" "-DCMAKE_C_FLAGS= -ffunction-sections -fdata-sections -fPIC -m64" "-DCMAKE_C_COMPILER=/usr/bin/cc" "-DCMAKE_CXX_FLAGS= -ffunction-sections -fdata-sections -fPIC -m64" "-DCMAKE_CXX_COMPILER=/usr/bin/c++" "-DCMAKE_BUILD_TYPE=Debug"
> -- 
> -- The following features have been enabled:
> 
>  * Compression , using zlib for compression
>  * diffie-hellman-group-exchange-sha1 , "new" diffie-hellman-group-exchange-sha1 method
> 
> -- The following REQUIRED packages have been found:
> 
>  * OpenSSL
>  * ZLIB
> 
> -- The following features have been disabled:
> 
>  * Shared library , creating libssh2 as a shared library (.so/.dll)
>  * "none" cipher
>  * "none" MAC
>  * Logging , Logging of execution with debug trace
> 
> -- Configuring done
> -- Generating done
> -- Build files have been written to: /Users/jonathangerber/.cargo/registry/src/github.com-1ecc6299db9ec823/libssh2-sys-0.2.6/libssh2
> running: "cmake" "--build" "." "--target" "install" "--config" "Debug" "--"
> 
> --- stderr
> fatal: Not a git repository (or any of the parent directories): .git
> poll use is disabled on this platform
> Error: could not load cache
> thread 'main' panicked at '
> command did not execute successfully, got: exit code: 1
> 
> build script failed, must exit now', /Users/jonathangerber/.cargo/registry/src/github.com-1ecc6299db9ec823/cmake-0.1.29/src/lib.rs:632:5
> note: Run with `RUST_BACKTRACE=1` for a backtrace.
> 
> warning: build failed, waiting for other jobs to finish...
> error: build failed
>

Only enough, I can actually cd into the directory and run the cmake --build command successfully.
I can also build the libssl2 crate on its own....

missing `registry =` line

In the README the output looks like:

[source.crates-io]
registry = 'https://github.com/rust-lang/crates.io-index'
replace-with = 'vendored-sources'

[source.vendored-sources]
directory = '/home/alex/code/cargo-vendor/vendor'

When running cargo vendor the registry = line is missing. What are the implications?

unused manifest key: source

Is cargo vendor plugin available in rust 1.20? Running cargo vendor downloads all the dependencies, which indicates it is, but after updating Cargo.toml cargo build outputs following warnings:
warning: unused manifest key: source
This fails during cargo build on the machine without network connection.
Can someone guide me how to set it up correctly please?

Can this be use to easily temporarily override just one dependency and fix it,

reverting to usual configuration after the fix goes upstream?

"Easily" means avoiding manually looking for the repository, checking it out, editing Cargo.toml to point to it and back.

.cargo-checksum.json stores backslash in filename on Windows

On Windows the content of ".cargo-checksum.json" looks like:

{"files":{
  ".cargo-ok":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  ".gitignore":"12cc0f91b51fedf41ae1670d1624ee1d78a284bdb101645b60a06a12de16c069",
  ".travis.yml":"6b96b2c6bfd7e1acef4b825a2813fc4277859eb9400a16800db8835c25e4087d",
  "Cargo.toml":"b3ccbfb0273b9c3eaaa9bc30eba9c0e1ee8079d672dd367d8bd7b7049fe24de7",
  "README.md":"9f048d969f9f8333cdcdb892744cd0816e4f2922c8817fa5e9e07f9472fe1050",
  "src\\app_unit.rs":"4927de20034ba6fc6454caa3e389dc2504f1b0bcad0a2427b52bef2f87b8f69c",
  "src\\lib.rs":"2df7d863c47d8b22f9af66caeafa87e6a206ee713a8aeaa55c5a80a42a92513b"
},"package":"5a0c3b5be4ed53affe3e1a162b2e7ef9979bcaac80daa9026e9d7988c41e0e83"}

that the paths use backslash, rather than slash.

It is undesired because we check in those files in Gecko's repo, and don't want the content to change depending on what platform cargo vendor is executed on.

[replace] sections

Using cargo vendor on packages with [replace] sections seems to fail with a warning about duplicate sources. Specifically I had that problem with rustup: NixOS/nixpkgs/issues/30742. I could work around that (rust-lang/rustup#1276), but there should probably be a general solution.

I made a naive attempt to solve this by only adding a pkg to the ids map, if it is not replaced. cargo vendor succeeds then, but cargo build says with the printed .cargo/config:

   error: checksum for `mio v0.6.11` could not be calculated, but a checksum is listed in the existing lock file

this could be indicative of a few possible situations:

    * the source `registry https://github.com/rust-lang/crates.io-index` supports checksums,

      but was replaced with one that doesn't
    * the lock file is corrupt

unable to verify that `mio v0.6.11` is the same as when the lockfile was generated

vendor error for some dependencies

I'm having trouble to vendor dependencies of the following project (https://github.com/jwilm/alacritty).
One problem I suspect this may fail is due to git repos dependencies specified in the Cargo.toml which I think I can workaround by tracking down the corresponding version in the crates.io.
Having said that for some other dependencies (afaik non-git ones) Cargo errors with the following message:

 Downloading unicode-normalization v0.1.2
error: failed to sync

Caused by:
  failed to download package from registry

I'm wondering if anybody could reproduce that too?

rustc 1.14.0 (e8a012324 2016-12-16)
cargo 0.15.0-nightly (298a012 2016-12-20)

Drop old versions from vendor/

Hey, I tried some of the new changes in 0.1.9 today and they're working great.

One request would be a mechanism to remove old versions as they aren't used. It's understandable that we wouldn't want this on-by-default in case there is one vendor directory being shared between different crates or workspaces.

However, in a one-workspace environment, there isn't a great way to do this short of rm -r vendor/ ; cargo vendor, which works but feels a bit strong of a hammer for the task.

No good way to update vendored crate

This is roughly my setup:

https://gist.github.com/LegNeato/793fdc3805ce67c6bd74828486fd1159

(many crates spread over the monorepo, using a shared vendor directory. A fairly common big-company scenario)

Note that this ALSO happens with a single crate in a more traditional setup.

Issue

When I first set it up it is all working and I check it in. Everything builds and works, even on CI w/o an internet connection as it uses the shared vendor directory.

👉 No bug yet

Now, imagine I want to add a feature to foo_crate and it requires a new dependency dep_crate. I add dep_crate to foo_crate's [dependencies] and.... 💣💥 .

👎 I can no longer cargo build, as dep_crate is not in the shared vendor directory.
👎 There is no way to fetch dep_crate, as .cargo/config makes all crates point to the shared vendor directory and there is no way to bypass it (and dep_crate is not there as it is new!).

So I end up having to do some hacks:

  # Blank the config so new deps will be downloaded from crates.io.
  mv ../../.cargo/config ../../.cargo/config.back;
  # Build to fetch from crates.io.
  cargo build;
  # Vendor newly downloaded deps to shared vendor dir.
  cargo vendor ../../third_party/rust/vendor
  # Restore the vendor config;
  mv ../../.cargo/config.back ../../.cargo/config;

There are lots of issues with this:

Blanking the config is very user-hostile, but it is needed to actually get the files local.
- Ideally there would be a way to ignore the config to pull the crates from the internet.
I always have to specify the vendor path, even if .cargo/config is in place.
- It seems silly that cargo knows to read from the shared vendor dir when using cargo build but doesn't know how to write to it using cargo vendor!
Requires a meta build system or at the very least a shell script to provide a nice developer experience.
- Cargo should have a nice experience without needing wrapper tools.

Suggestion

Running cargo vendor with no output path in a crate that has source.vendored-sources set bypasses reading from source.vendored-sources (downloads from crates.io) and writes updated crates to source.vendored-sources.

Different versions of same dependency

If using the same dependency, but multiple versions of it, cargo vendor only seems to build the index of one of them. For example the crate pnet has a dependency onto libc v0.1.12 whereas syntex_syntax (another dependency of pnet) needs libc v^0.2.2. This results (randomly) in one of the following errors:

cargo build
    Updating registry `file:///home/niobe/workspace/grnvs/vendor/index`
error: no matching package named `libc` found (required by `syntex_syntax`)
location searched: registry file:///home/niobe/workspace/grnvs/vendor/index
version required: ^0.2.2
versions found: 0.1.12

i.e.

cargo build
    Updating registry `file:///home/niobe/workspace/grnvs/vendor/index`
error: no matching package named `libc` found (required by `pnet`)
location searched: registry file:///home/niobe/workspace/grnvs/vendor/index
version required: = 0.1.12
versions found: 0.2.11

Vendoring only dependencies for a set list of targets / features

Currently, a cargo vendor downloads and vendors dependencies for all targets and features. Is there a way to specify that you only want to vendor for a specific target or list of features?

For example, a simple cargo build of the time crate produces this output:

➜  time git:(master) ✗ cargo clean
➜  time git:(master) ✗ cargo build
   Compiling libc v0.2.32
   Compiling time v0.1.38 (file:///usr/local/google/home/cramertj/src/time)
    Finished dev [unoptimized + debuginfo] target(s) in 1.35 secs

While cargo vendor pulls in many more dependencies:

➜  time git:(master) cargo vendor
 Downloading redox_syscall v0.1.31
 Downloading advapi32-sys v0.1.2
   Vendoring advapi32-sys v0.1.2 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/advapi32-sys-0.1.2) to vendor/advapi32-sys
   Vendoring kernel32-sys v0.2.2 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/kernel32-sys-0.2.2) to vendor/kernel32-sys
   Vendoring libc v0.2.32 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/libc-0.2.32) to vendor/libc
   Vendoring log v0.3.8 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/log-0.3.8) to vendor/log
   Vendoring redox_syscall v0.1.31 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/redox_syscall-0.1.31) to vendor/redox_syscall
   Vendoring rustc-serialize v0.3.24 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/rustc-serialize-0.3.24) to vendor/rustc-serialize
   Vendoring winapi v0.2.8 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/winapi-0.2.8) to vendor/winapi
   Vendoring winapi-build v0.1.1 (/usr/local/google/home/cramertj/.cargo/registry/src/github.com-1ecc6299db9ec823/winapi-build-0.1.1) to vendor/winapi-build
To use vendored sources, add this to your .cargo/config for this project:

[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "/usr/local/google/home/cramertj/src/time/vendor"

Many of these, such as redox_syscall, will never be used when building for a specific platform. Is it possible to omit them somehow by specifying the list of targets or features you want to support?

Build failure because of libgit-sys (Not a module `git_status_show_t`)

Trying to build cargo-vendor after a fresh clone, I get an error during compilation of libgit-sys. As git2 is already at version 0.4.3, but this crate still uses 0.3 (because of cargo (?) ), I thought I'd open this issue here.

If this issue should instead be opened in git2, then please tell me and I'll close it here and reopen it there.

cargo build --release
   Compiling winapi-build v0.1.1
   Compiling rustc-serialize v0.3.16
   Compiling regex-syntax v0.2.2
   Compiling glob v0.2.10
   Compiling advapi32-sys v0.1.2
   Compiling gcc v0.3.21
   Compiling kernel32-sys v0.1.4
   Compiling bitflags v0.1.1
   Compiling strsim v0.3.0
   Compiling cmake v0.1.12
   Compiling ws2_32-sys v0.2.1
   Compiling libc v0.2.4
   Compiling pkg-config v0.3.6
   Compiling winapi v0.2.5
   Compiling rand v0.3.12
   Compiling memchr v0.1.7
   Compiling matches v0.1.2
   Compiling libc v0.1.12
   Compiling libgit2-sys v0.3.8
   Compiling curl-sys v0.1.30
   Compiling libz-sys v1.0.0
   Compiling libssh2-sys v0.1.34
   Compiling log v0.3.4
   Compiling openssl-sys v0.7.4
   Compiling kernel32-sys v0.2.1
   Compiling crossbeam v0.1.6
   Compiling term v0.2.14
   Compiling num_cpus v0.2.10
   Compiling time v0.1.34
   Compiling filetime v0.1.9
   Compiling tar v0.3.2
   Compiling uuid v0.1.18
   Compiling url v0.2.38
   Compiling url v0.5.2
   Compiling toml v0.1.25
   Compiling aho-corasick v0.4.0
   Compiling miniz-sys v0.1.7
   Compiling regex v0.1.46
/home/niobe/.cargo/registry/src/github.com-88ac128001ac3a9a/libgit2-sys-0.3.8/lib.rs:537:9: 537:30 error: unresolved import `git_status_show_t::*`. Not a module `git_status_show_t` [E0432]
/home/niobe/.cargo/registry/src/github.com-88ac128001ac3a9a/libgit2-sys-0.3.8/lib.rs:537 pub use git_status_show_t::*;
                                                                                                 ^~~~~~~~~~~~~~~~~~~~~
/home/niobe/.cargo/registry/src/github.com-88ac128001ac3a9a/libgit2-sys-0.3.8/lib.rs:537:9: 537:30 help: run `rustc --explain E0432` to see a detailed explanation
error: aborting due to previous error
Build failed, waiting for other jobs to finish...
error: Could not compile `libgit2-sys`.

To learn more, run the command again with --verbose.

cargo install cargo-vendor fails with openssl error on Linux

Running cargo install cargo-vendor was working a week ago, but since then I had to reinstall my Linux machine, and for some reason it's failing now:

kats@kgupta-pc ~$ cargo install cargo-vendor
Updating registry https://github.com/rust-lang/crates.io-index
error: failed to compile cargo-vendor v0.1.2, intermediate artifacts can be found at /tmp/cargo-install.ft8ioYIvQxvz

Caused by:
native library openssl is being linked to by more than one version of the same package, but it can only be linked once; try updating or pinning your dependencies to ensure that this package only shows up once

openssl-sys v0.9.0
openssl-sys v0.7.17

I seem to be able to install cargo-vendor fine on OS X, so it might just be a problem with my Linux setup - but I'm not sure what could be going wrong. Any suggestions welcome.

Checksum issues when exporting to build machine

I place a relative path in my .cargo/config for the vendored sources, as an absolute path is not viable:

[source.crates-io]
registry = 'https://github.com/rust-lang/crates.io-index'
replace-with = 'vendored-sources'
[source.vendored-sources]
directory = 'vendor'

I push this whole thing to a build machine and I start getting checksum issues eg.

EXEC : error : the listed checksum of myproject\vendor\itertools\custom.css has changed:
expected: 03d2316d325a09f03f0fae54d24b64f784518a8249432edbd60e01436be900d5
actual: 76ef6e22fd3c348fe910edc65c2f3251b04d178acfbabcad78b2a636db5d258

None of the files have changed. I suspect that somehow the absolute path is included in this hash, which would make cargo vendor impossible to use across multiple machines.

This is Windows, if it makes a difference. Sorry if this is not a cargo-vendor issue but I only experience it when using that.