{"id":31934066,"url":"https://github.com/komar007/cargo-lock-fetch","last_synced_at":"2025-10-14T06:20:32.511Z","repository":{"id":306481197,"uuid":"1026352839","full_name":"komar007/cargo-lock-fetch","owner":"komar007","description":"cargo fetch and cargo vendor with just Cargo.lock","archived":false,"fork":false,"pushed_at":"2025-08-04T18:58:36.000Z","size":86,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-09-03T11:10:59.906Z","etag":null,"topics":["cargo","cargolock","cli","crate","crates","lockfile","registry","rust","rust-crate"],"latest_commit_sha":null,"homepage":"https://crates.io/crates/cargo-lock-fetch","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/komar007.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE-APACHE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-07-25T18:29:14.000Z","updated_at":"2025-08-29T15:53:43.000Z","dependencies_parsed_at":"2025-07-26T01:07:20.610Z","dependency_job_id":"a1fa658e-30ab-4219-8f95-f9774ef949e6","html_url":"https://github.com/komar007/cargo-lock-fetch","commit_stats":null,"previous_names":["komar007/cargo-lock-fetch"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/komar007/cargo-lock-fetch","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komar007%2Fcargo-lock-fetch","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komar007%2Fcargo-lock-fetch/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komar007%2Fcargo-lock-fetch/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komar007%2Fcargo-lock-fetch/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/komar007","download_url":"https://codeload.github.com/komar007/cargo-lock-fetch/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/komar007%2Fcargo-lock-fetch/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279006459,"owners_count":26084107,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-11T02:00:06.511Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cargo","cargolock","cli","crate","crates","lockfile","registry","rust","rust-crate"],"created_at":"2025-10-14T06:20:28.642Z","updated_at":"2025-10-14T06:20:32.502Z","avatar_url":"https://github.com/komar007.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# `cargo-lock-fetch` - cargo fetch and vendor with just Cargo.lock\n\n![Crates.io License](https://img.shields.io/crates/l/cargo-lock-fetch)\n[![Crates.io Version](https://img.shields.io/crates/v/cargo-lock-fetch)](https://crates.io/crates/cargo-lock-fetch/)\n[![Docker Image Version](https://img.shields.io/docker/v/komar007/cargo-lock-fetch?logo=docker\u0026label=hub)](https://hub.docker.com/r/komar007/cargo-lock-fetch)\n![GitHub branch check runs](https://img.shields.io/github/check-runs/komar007/cargo-lock-fetch/main)\n![Crates.io MSRV](https://img.shields.io/crates/msrv/cargo-lock-fetch)\n\nThis [cargo](https://doc.rust-lang.org/cargo/) plugin fetches and optionally vendors crates based\nonly on `Cargo.lock`.\n\nIt is particularly useful when building rarely changing docker layers containing just project\ndependencies without copying/mounting all `Cargo.toml` files of a multi-crate workspace.\n\n\u003c!--toc:start--\u003e\n- [Installation](#installation)\n- [Usage](#usage)\n- [SemVer compatibility](#semver-compatibility)\n- [Example: primary use case](#example-primary-use-case)\n- [How it works](#how-it-works)\n\u003c!--toc:end--\u003e\n\n## Installation\n\n`cargo-lock-fetch` is mainly intended to be used with containers. Docker users can copy it from the\nbinary docker distribution:\n\n``` dockerfile\nCOPY --from=komar007/cargo-lock-fetch \\\n    /cargo-lock-fetch /usr/local/cargo/bin\n```\n\nIt's also possible to build from source:\n\n``` sh\ncargo install cargo-lock-fetch\n```\n\nor install a binary release from github:\n\n``` sh\ncargo binstall cargo-lock-fetch # requires cargo-binstall\n```\n\n\u003e [!IMPORTANT]\n\u003e For reproducible builds, avoid omitting version requirements when specifying dependencies. See\n\u003e [SemVer compatibility](#semver-compatibility) for semver guarantees. For `cargo`\n\u003e `install`/`binstall` use `cargo-lock-fetch@0.x.y`, for docker images, use specific tag:\n\u003e `komar007/cargo-lock-fetch:0.x.y`.\n\n## Usage\n\nTo fetch dependencies to cargo’s registry cache:\n\n``` sh\ncargo lock-fetch --lockfile-path path/to/Cargo.lock\n```\n\nTo additionally vendor the dependencies (like `cargo vendor`):\n\n``` sh\ncargo lock-fetch --lockfile-path path/to/Cargo.lock --vendor vendor_dir/\n```\n\nThere is no need to run `cargo lock-fetch` from any specific directory.\n\n## SemVer compatibility\n\nThis tool follows the [cargo](https://doc.rust-lang.org/cargo/reference/semver.html) /\n[semver](https://semver.org/) guidelines with respect to its CLI interface. At the current\n`0.x.y` stage, changes of `x` (MINOR) indicate breaking changes. `cargo-lock-fetch` is close to\ndeclaring a public interface which will be indicated by reaching version `1.0.0`. From this moment,\nbreaking changes to the CLI interface will be indicated by MAJOR version increments.\n\n## Example: primary use case\n\nThe following example is the reason this plugin was written.\n\nAssuming the `Dockerfile` is in the root directory of a cargo project, a minimal setup that caches\nproject dependencies in a docker layer and rebuilds it only on `Cargo.lock` changes would look like\nthis:\n\n```dockerfile\nFROM rust:1.88.0-alpine3.22 AS builder\n\n# Tools layer\nRUN apk update \\\n \u0026\u0026 apk add --no-cache musl-dev \\\n \u0026\u0026 cargo install cargo-lock-fetch\n\nWORKDIR /app\n\n# Dependencies layer: fetch all dependencies, but only rebuild layer\n# when Cargo.lock changes.\n#\n# This is for demonstration only - using cargo-lock-fetch starts to\n# matter only when multiple Cargo.toml files are used because the\n# project consists of many crates. It eliminates the need to specify\n# each and every Cargo.toml file to be copied into the build context.\nCOPY Cargo.lock .\nRUN cargo lock-fetch\n\n# Sources layer: the build runs offline here. This layer rebuilds when\n# any file changes, but dependencies are cached in the previous layer.\nCOPY . .\nRUN cargo build --frozen --release\n\nFROM scratch\n\nCOPY --from=builder /app/target/release/app /app\nCMD [ \"/app\" ]\n```\n\nThe example can be tested with `docker compose build` in `examples/fetch-deps-to-layer`.\n\n## How it works\n\nIn order to use `cargo` to fetch the crates, `cargo-lock-fetch` creates a cargo package and adds the\ndependencies found in the input `Cargo.lock` file to its `Cargo.toml,` and then calls `cargo fetch`\nand optionally `cargo vendor`.\n\nBecause a single `Cargo.toml` file cannot contain multiple versions of the same crate as\ndependencies, and this situation is perfectly correct for cargo packages if the versions are pulled\nin indirectly by different dependencies, `cargo-lock-fetch` distributes the list of dependencies\nbetween sub-crates using an approach based on greedy vertex coloring, which is optimal for cluster\ngraphs (there is an edge between 2 dependencies iff they are different versions of the same crate).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkomar007%2Fcargo-lock-fetch","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkomar007%2Fcargo-lock-fetch","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkomar007%2Fcargo-lock-fetch/lists"}