Vendored, Offline Builds
Goal: build or install quantum-sign without hitting the network, with all dependencies bundled locally.
Quick start
- From the repo root, run:
- scripts/vendor.sh
- CARGO_HOME="$PWD/.cargo-vendored" cargo build --locked
- CARGO_HOME="$PWD/.cargo-vendored" cargo test --locked
- CARGO_HOME="$PWD/.cargo-vendored" cargo install --path . --locked
What this does
- scripts/vendor.sh creates a vendor/ directory and writes .cargo-vendored/config.toml that:
- points crates-io to the local [source.vendored-sources]
- sets [net] offline = true to ensure no network is used
- By setting CARGO_HOME to .cargo-vendored, cargo picks up the offline config for the current build.
Release artifacts
- If you want to publish a single tarball that includes all sources and dependencies:
- Run scripts/vendor.sh
- Create an archive of the repository including the vendor/ directory
- Consumers can then extract the archive and run with CARGO_HOME set as above
Notes
- Using cargo normally (cargo build / cargo install quantum-sign) already fetches dependencies automatically; vendoring is only needed for offline or hermetic builds.
- Bundling third-party crates directly into one monolithic crate is discouraged: it complicates licensing, auditing, and updates. Vendoring preserves upstream crates (and their licenses) while enabling offline builds.