3 ms·

> Rust projects starting from scratch could consider vendoring their dependencies rather than pulling from crates.io. But support for vendored dependency in Car

by xpe 3y ago

> Rust projects starting from scratch could consider vendoring their dependencies rather than pulling from crates.io. But support for vendored dependency in Cargo is weak/bad. You run into all sorts of nightmares especially when using workspaces. Could you point us to some relevant discussions (GitHub, etc) so some of us can weigh in and possibly contribute to this pain point?

anonymoushn 3y ago
One case that can cause you trouble is that if you have a workspace that contains two different programs with deps that specify incompatible versions of another dep, you can't build either :)
cmrdporcupine 3y ago
No, sorry, because these are things that have happened at work, in my paid job, not my hobby, and I have higher priority things to do than help Cargo clean up its mess right now. I'd have to go dig back through chat logs and tickets. But basically: vendored (git submodule in this case) project that was workspaced, added as a dep inside a workspace... Blew up badly with general workspace complaints. And doesn't help that at work we have to accommodate working with older toolchain versions because we ship a hardware product with that requirement.
- xpe 3y ago
  Thanks; I get it. I was thinking maybe the open source community has discussed this in some detail. I'm not actively involved in any such discussions, but I did a quick look and found that "Documentation for cargo vendor use cases" [1] is a decent starting point to jump in. In that thread a user named 'rimutaka' has a comment titled "cargo vendor-related questions asked by the community" [2] of related conversations. [1]: https://github.com/rust-lang/cargo/issues/7520 https://github.com/rust-lang/cargo/issues/7520 [2]: https://github.com/rust-lang/cargo/issues/7520#issuecomment-1979895905 https://github.com/rust-lang/cargo/issues/7520#issuecomment-...
  - deleted 3y ago
    [deleted]
- sevagh 3y ago
  >makes statement >is asked to clarify >"I'm too busy!"
  - cmrdporcupine 3y ago
    Makes statement as a minor subpoint to my main point about crates.io and dep explosion. But sure, flame away, you're adding a lot to the conversation /s

by xpe 3y ago

anonymoushn 3y ago

One case that can cause you trouble is that if you have a workspace that contains two different programs with deps that specify incompatible versions of another dep, you can't build either :)

cmrdporcupine 3y ago

No, sorry, because these are things that have happened at work, in my paid job, not my hobby, and I have higher priority things to do than help Cargo clean up its mess right now. I'd have to go dig back through chat logs and tickets. But basically: vendored (git submodule in this case) project that was workspaced, added as a dep inside a workspace... Blew up badly with general workspace complaints. And doesn't help that at work we have to accommodate working with older toolchain versions because we ship a hardware product with that requirement.

xpe 3y ago
Thanks; I get it. I was thinking maybe the open source community has discussed this in some detail. I'm not actively involved in any such discussions, but I did a quick look and found that "Documentation for cargo vendor use cases" [1] is a decent starting point to jump in. In that thread a user named 'rimutaka' has a comment titled "cargo vendor-related questions asked by the community" [2] of related conversations. [1]: https://github.com/rust-lang/cargo/issues/7520 https://github.com/rust-lang/cargo/issues/7520 [2]: https://github.com/rust-lang/cargo/issues/7520#issuecomment-1979895905 https://github.com/rust-lang/cargo/issues/7520#issuecomment-...
- deleted 3y ago
  [deleted]
sevagh 3y ago
>makes statement >is asked to clarify >"I'm too busy!"
- cmrdporcupine 3y ago
  Makes statement as a minor subpoint to my main point about crates.io and dep explosion. But sure, flame away, you're adding a lot to the conversation /s