CARGO-VENDOR(1)

📦 version 1.82.0, in ubuntu jammy, ubuntu noble

🌸 NAME 🌸

okay bestie, meet cargo-vendor — she's a cargo subcommand and her whole job is literally vendoring all your dependencies locally. that's it. that's the gig. 💅

(this page lives in the General Commands Manual, section 1, iykyk ✨)

🦋 SYNOPSIS 🦋

cargo vendor [options] [path]

🎀 DESCRIPTION 🎀

so what does she actually do? this cargo subcommand will vendor all your crates.io and git dependencies for a project into the directory you point at with <path>. once the command finishes, that vendor directory — the one you named with <path> — is gonna contain all the remote sources from the dependencies you specified. ✨

and if you've got extra manifests beyond the default one? you can hand those over too, with the -s option. no cap.

after cargo vendor finishes doing her thing, the configuration you need in order to actually use those vendored sources gets printed to stdout. so you're gonna need to add it, or redirect it, into your Cargo configuration file — which is usually .cargo/config.toml, locally, for the current package. don't skip this part bestie, it's giving "step 2 of a 2-step tutorial" 💖

now here's the important vibe check: Cargo treats vendored sources as read-only, exactly like it does with registry and git sources. so if you're intending to modify a crate that came from a remote source, the move is to use [patch] or a path dependency pointing at a local copy of that crate. do that and Cargo will handle the crate correctly on incremental rebuilds, because she knows it's no longer a read-only dependency. slay. 👑

✨ OPTIONS ✨

💖 Vendor Options 💖

  • -s manifest, --sync manifest — point at an extra Cargo.toml manifest for workspaces that should also be vendored and synced into the output. you can specify this multiple times, go wild.
  • --no-delete — don't delete the "vendor" directory when vendoring. instead, keep all the existing contents of the vendor directory. nothing gets yeeted. 🫶
  • --respect-source-config — normally [source] config in .cargo/config.toml is ignored by default. this flag makes Cargo actually read it and use it when downloading crates from crates.io, for example.
  • --versioned-dirs — normally versions are only added to disambiguate multiple versions of the same package. this option makes all directories in the "vendor" directory versioned, which makes it easier to track the history of vendored packages over time, and can help with the performance of re-vendoring when only a subset of the packages have changed. it's giving "organized queen" 💅

🌸 Manifest Options 🌸

  • --manifest-path path — path to the Cargo.toml file. by default, Cargo searches for the Cargo.toml file in the current directory or any parent directory. she's a detective. 🔍
  • --locked — asserts that the exact same dependencies and versions are used as when the existing Cargo.lock file was originally generated. Cargo will exit with an error when either of these scenarios arises:
    • The lock file is missing. 😭
    • Cargo attempted to change the lock file due to a different dependency resolution. 💀

it may be used in environments where deterministic builds are desired, such as in CI pipelines.

  • --offline — prevents Cargo from accessing the network for any reason. without this flag, Cargo will stop with an error if she needs to access the network and the network is not available. with this flag, Cargo will attempt to proceed without the network if possible.
beware bestie, this may result in different dependency resolution than online mode. Cargo will restrict herself to crates that are downloaded locally, even if there might be a newer version as indicated in the local copy of the index. see the cargo-fetch(1) command to download dependencies before going offline. 🧚

may also be specified with the net.offline config value: https://doc.rust-lang.org/cargo/reference/config.html

  • --frozen — equivalent to specifying both --locked and --offline. two-for-one combo, we love a bundle. 🎀
  • --lockfile-path PATH — changes the path of the lockfile from the default (<workspace_root>/Cargo.lock) to PATH. PATH must end with Cargo.lock (e.g. --lockfile-path /tmp/temporary-lockfile/Cargo.lock). note that providing --lockfile-path will ignore the existing lockfile at the default path, and instead will either use the lockfile from PATH, or write a new lockfile into the provided PATH if it doesn't exist. this flag can be used to run most commands in read-only directories, writing the lockfile into the provided PATH.
this option is only available on the nightly channel — https://doc.rust-lang.org/book/appendix-07-nightly-rust.html — and requires the -Z unstable-options flag to enable (see #14421: https://github.com/rust-lang/cargo/issues/14421). ✨

🦋 Display Options 🦋

  • -v, --verbose — use verbose output. may be specified twice for "very verbose" output, which includes extra output such as dependency warnings and build script output. may also be specified with the term.verbose config value: https://doc.rust-lang.org/cargo/reference/config.html
  • -q, --quiet — do not print cargo log messages. may also be specified with the term.quiet config value: https://doc.rust-lang.org/cargo/reference/config.html. shhh. 🤫
  • --color when — control when colored output is used. valid values:
    • auto (default): automatically detect if color support is available on the terminal. 🌈
    • always: always display colors. ✨
    • never: never display colors. 🚫

may also be specified with the term.color config value: https://doc.rust-lang.org/cargo/reference/config.html

👑 Common Options 👑

  • +toolchain — if Cargo has been installed with rustup, and the first argument to cargo begins with +, it will be interpreted as a rustup toolchain name (such as +stable or +nightly). see the rustup documentation for more information about how toolchain overrides work: https://rust-lang.github.io/rustup/overrides.html
  • --config KEY=VALUE or PATH — overrides a Cargo configuration value. the argument should be in TOML syntax of KEY=VALUE, or provided as a path to an extra configuration file. this flag may be specified multiple times. see the command-line overrides section for more information: https://doc.rust-lang.org/cargo/reference/config.html#command-line-overrides
  • -C PATH — changes the current working directory before executing any specified operations. this affects things like where cargo looks by default for the project manifest (Cargo.toml), as well as the directories searched for discovering .cargo/config.toml, for example. this option must appear before the command name, for example cargo -C path/to/my-project build. order matters bestie!!
this option is only available on the nightly channel — https://doc.rust-lang.org/book/appendix-07-nightly-rust.html — and requires the -Z unstable-options flag to enable (see #10098: https://github.com/rust-lang/cargo/issues/10098). 💀
  • -h, --help — prints help information. the classic. 🫶
  • -Z flag — unstable (nightly-only) flags to Cargo. run cargo -Z help for details.

🌈 ENVIRONMENT 🌈

see the reference for details on environment variables that Cargo reads: https://doc.rust-lang.org/cargo/reference/environment-variables.html

⭐ EXIT STATUS ⭐

  • 0: Cargo succeeded. 🎉 we ate.
  • 101: Cargo failed to complete. 😭 it's not giving.

🍓 EXAMPLES 🍓

  1. Vendor all dependencies into a local "vendor" folder
cargo vendor
  1. Vendor all dependencies into a local "third-party/vendor" folder
cargo vendor third-party/vendor
  1. Vendor the current workspace as well as another to "vendor"
cargo vendor -s ../path/to/Cargo.toml
  1. Vendor and redirect the necessary vendor configs to a config file.
cargo vendor > path/to/my/cargo/config.toml

💜 SEE ALSO 💜

and that's the whole page bestie, no cap — this was CARGO-VENDOR(1) from the General Commands Manual, the one and only, and she's out here being iconic. go vendor something, you've got this. 💖✨🎀🦋🌸

📦 where this page comes from