cargo-vendor-filterer 0.5.3

`cargo vendor`, but with filtering for platforms and more
cargo-vendor-filterer-0.5.3 is not a library.

cargo vendor, but with filtering

The core cargo vendor tool is useful to save all dependencies. However, it doesn't offer any filtering; today cargo includes all platforms, but some projects only care about Linux for example.

More information: https://github.com/rust-lang/cargo/issues/7058

Generating a vendor/ directory with filtering

Here's a basic example which filters out all crates that don't target Linux; for example this will drop out crates like winapi-x86_64-pc-windows-gnu and core-foundation that are Windows or MacOS only.

$ cargo vendor-filterer --platform=x86_64-unknown-linux-gnu

You can also declaratively specify the desired vendor configuration via the Cargo metadata key package.metadata.vendor-filter:

[package.metadata.vendor-filter]
platforms = ["x86_64-unknown-linux-gnu"]
all-features = true
exclude-crate-paths = [ { name = "curl-sys", exclude = "curl" },
                        { name = "libz-sys", exclude = "src/zlib" },
                        { name = "libz-sys", exclude = "src/zlib-ng" },
                      ]

Available options for for package.metadata.vendor-filter in Cargo.toml

  • platforms: List of rustc target triples; this is the same values accepted by e.g. cargo metadata --filter-platform. You can specify multiple values, however at the moment wildcards are not supported.
  • all-features: Enable all features of the current crate when vendoring.
  • exclude-crate-paths: Remove files and directories from target crates. A key use case for this is removing the vendored copy of C libraries embedded in crates like libz-sys, when you only want to support dynamically linking.

All of these options have corresponding CLI flags; see cargo vendor-filterer --help.

Generating reproducible vendor tarballs

You can also provide --format=tar.zstd to output a reproducible tar archive compressed via zstd; the default filename will be vendor.tar.zstd. Similarly there is --format=tar.gz for gzip, and --format=tar to output an uncompressed tar archive, which you can compress however you like.

This option requires:

  • An external GNU tar program
  • An external gzip or zstd program (for --format=tar.gz and --format=tar.zstd respectively)
  • SOURCE_DATE_EPOCH set in the environment, or an external git and the working directory must be a git repository

This uses the suggested code from https://reproducible-builds.org/docs/archives/ to output a reproducible archive; in other words, another process/tool can also perform a git clone of your project and regenerate the vendor tarball to verify it.