Publishing crates with their dependencies

help
1

Greetings,

A newbie Cargo user here.

A question about publishing and re-using cargo crates with dependencies and dev dependencies.

We have a scenario where:

  • we would like to build a package with dependencies from crates.io (which are proxied via a remote repo in Artifactory)
  • we would like to then publish it to a local repository. (all dependencies included)
  • we would then like to use the package as a dependency in order to build another package but without needing to access the internet again.

What we tested:

  • In order to make sure that Cargo does not try to reach crates, apart from setting a [registry.] entry in config.toml to the local registry, we also set the [source.crates-io] to replace-with = "" to point to the same local registry.
    Note: Maybe I am doing something wrong, but when the [source.crates-io] entry is removed, if cargo cannot resolve dependencies from a local repository it will still try to reach crates. This is expected I suppose?

Anyway, when the only registry entry in config.toml is the local registry, neither cargo build nor cargo install are able to resolve the dependencies.

After a bit of digging, snippet taken from a .json metadata file:

    "deps": [
        {
            "name": "name",
            "versionReq": "^0.13.0",
            "features": [],
            "optional": true,
            "defaultFeatures": false,
            "kind": "normal",
            "registry": "https://github.com/rust-lang/crates.io-index"
		}

It would seem that because the package was initially built with dependencies from crates.io Cargo will always try to resolve them from there.

So, finally, the question is if it is possible to package a crate with all of its dependencies in a local registry without needing to reach crates ? (after the initial build to get them all of course)

I have seen some suggestions to try cargo vendor and to publish all dependencies manually, but I wanted to see if there are other options.

Thank you for any feedback and sorry for a long winded explanation.

2

Are you using cargo local-registry to manage the local repo?

3

Hello.

Thank you for the suggestion I came across the package but I did not try it yet.

From the package info I can see how it should be used:

cargo local-registry --sync path/to/Cargo.lock path/to/registry

Though, as the result should be in a local cargo repository in Artifactory, can local-registry point to the said local repository?
Could the path/to/registry be used to publish it there?
Or maybe with the --registry option? Similar to how cargo publish can choose a registry

Edit:
Forgot to mention 2 important notes:

  1. We are using sparse-indexing
  2. We need to account for transitive dependencies that any dependency might have.
4

This topic was automatically closed 90 days after the last reply. We invite you to open a new topic if you have further questions or comments.