Why cargo build acts different when directly use a package from GitHub or import through other package?

help
1

Recently, I've been working with verus-analyzer — a tool similar to rust-analyzer, but designed for parsing Verus code. As part of this work, I imported the ide-assists package from the project.

However, I immediately encountered a compilation error when running:

cargo build
    Updating git repository `https://github.com/verus-lang/verusfmt.git`
error: failed to get `verusfmt` as a dependency of package `ide-assists v0.0.0 (/Users/marsmac/dev/ruzykaller/PromeX-Verus/verus-analyzer/crates/ide-assists)`
    ... which satisfies path dependency `ide-assists` (locked to 0.0.0) of package `ide v0.0.0 (/Users/marsmac/dev/ruzykaller/PromeX-Verus/verus-analyzer/crates/ide)`
    ... which satisfies path dependency `ide` (locked to 0.0.0) of package `PromeX-Verus v0.1.0 (/Users/marsmac/dev/ruzykaller/PromeX-Verus)`

Caused by:
  failed to load source for dependency `verusfmt`

Caused by:
  Unable to update https://github.com/verus-lang/verusfmt.git?branch=optional-updater

Caused by:
  failed to find branch `optional-updater`

Caused by:
  cannot locate remote-tracking branch 'origin/optional-updater'; class=Reference (4); code=NotFound (-3)

The problem stems from a dependency in Cargo.toml, which references a non-existent branch:

verusfmt = { git = "https://github.com/verus-lang/verusfmt.git", branch = "optional-updater", default-features = false }

However, when I build the package directly, it compiles successfully. According to the build log, it pulls the latest commit from the main branch of verusfmt:

Compiling verusfmt v0.5.0 (https://github.com/verus-lang/verusfmt.git?branch=optional-updater#9ea9c5a5)

I'm wondering why this difference happens.

2

A PoC to reproduce this:

Cargo.toml for va_test

[package]
name = "va_test"
version = "0.1.0"
edition = "2024"

[dependencies]
test2 = { path = "./inner" }

The Cargo.toml for inner

[package]
name = "inner"
version = "0.1.0"
edition = "2024"

[dependencies]
verusfmt = { git = "https://github.com/verus-lang/verusfmt.git", branch = "optional-updater", default-features = false }

And the Cargo.lock for inner:

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "inner"
version = "0.1.0"

[[package]]
name = "verusfmt"
version = "0.5.0"
source = "git+https://github.com/verus-lang/verusfmt.git?branch=optional-updater#9ea9c5a52a96f7004487ccac63d137dac6161809"
dependencies = [
 "clap",
 "fs-err",
 "miette",
 "pest",
 "pest_derive",
 "pretty",
 "regex",
 "similar",
 "tempfile",
 "thiserror",
 "tracing",
 "tracing-subscriber",
]
3

If you build directly the Cargo.lock from verus-analyzer is used which pins a specific commit without regards of if that commit exists on the specified branch, if you use it as dependency, cargo will ignore the Cargo.locl of verus-analyzer and create a separate Cargo.lock for your project and in the process try to lookup the branch that no longer exists.

2 Likes