Vendoring Dependencies

You will bundle local copies of dependencies to ensure reproducible builds in air-gapped environments.

In this lesson, you will learn how to achieve hermetic builds by embedding local copies of your dependencies directly into your project repository to guarantee reproducibility in air-gapped or restricted environments.

The Problem with Remote Resolution

Normally, Cargo resolves dependencies by fetching source code from crates.io at build time. In mission-critical, secure, or air-gapped systems—such as embedded hardware in a shielded facility—the build machine cannot reach the public registry. If your dependency tree changes or a crate is yanked, your CI/CD pipeline breaks. Vendoring solves this by bringing the "internet" inside your version control.

How Vendoring Works

To vendor dependencies, you instruct Cargo to download all transitive dependencies into a local directory within your workspace. You then configure your project to use these local files instead of querying the remote registry.

The process is managed via the cargo vendor command:

Populate the vendor directory: Run this in your workspace root:
```
cargo vendor vendor/
```
This command creates a vendor/ folder containing the source code for every crate in your dependency graph.
Configure Cargo: Cargo needs to know it should look in vendor/ instead of the network. Create (or update) a .cargo/config.toml file in your project:
```
[source.crates-io]
replace-with = "vendored-sources"

[source.vendored-sources]
directory = "vendor"
```

Ensuring Reproducibility

By checking the vendor/ directory and the .cargo/config.toml into your version control system, you ensure that anyone who clones the repository has the exact same source code for every dependency. Because the paths are relative and local, the build is fully deterministic and independent of the state of the crates.io registry.

When updating dependencies, you simply update your Cargo.toml, re-run cargo vendor, and commit the changes to the vendor/ directory. This creates an audit trail of every dependency change, providing both security and build stability.

Key Takeaway: Vendoring creates a self-contained, reproducible build artifact by mirroring the entire dependency tree locally and remapping Cargo’s source resolution to these local files.