How to vendor only parts of a project (in my case only the CLI part of gitbutler)?

[kastl-ars]

Hi all,

I found that gitbutler now has a CLI, which I wanted to package.
https://blog.gitbutler.com/but-cli

I prepared a package that pulls the gitbutler repository and vendors the dependencies.

<services>
  <service name="obs_scm" mode="manual">
    <param name="url">https://github.com/gitbutlerapp/gitbutler.git</param>
    <param name="scm">git</param>
    <param name="exclude">.git</param>
    <param name="revision">refs/tags/release/0.19.1</param>
    <param name="match-tag">release/*</param>
    <param name="versionformat">@PARENT_TAG@</param>
    <param name="versionrewrite-pattern">release/(.*)</param>
    <param name="changesgenerate">disable</param>
    <param name="filename">gitbutler-cli</param>
  </service>
  <service name="set_version" mode="manual">
  </service>
  <service name="cargo_vendor" mode="manual">
    <param name="update">false</param>
    <param name="respect-lockfile">true</param>
    <param name="srcdir">gitbutler</param>
  </service>
  <service name="tar" mode="buildtime"/>
  <service name="recompress" mode="buildtime">
    <param name="file">*.tar</param>
    <param name="compression">gz</param>
  </service>
</services>

Unfortunately it seems it is vendoring all dependencies, not just the ones needed for the CLI. And fails due to some duplicate things.

I tried to specify the correct Cargo.toml via the cargotoml parameter, but apparently this is to specify an additional file if it was not found automatically.

Can I tell the service to only vendor the files I explicitly tell it to vendor?

Kind Regards,
Johannes

[Firstyear]

https://github.com/openSUSE-Rust/obs-service-cargo?tab=readme-ov-file#filter

<param name="filter">true</param>

This is experimental and may have issues however.

Unfortunately it seems it is vendoring all dependencies, not just the ones needed for the CLI. And fails due to some duplicate things.

Additionally, ensure you have "versioned-dirs' true.

[kastl-ars]

Thanks for the quick reply, William. Unfortunately this does not help, it still fails due to the duplicate thingy:

Gathering metadata for platforms
error: failed to sync

Caused by:
  found duplicate version of package `file-id v0.2.3` vendored from two sources:

        source 1: registry `crates-io`
        source 2: https://github.com/notify-rs/notify?rev=978fe719b066a8ce76b9a9d346546b1569eecfb6#978fe719
error: Failed to execute cargo vendor: ExitStatus(unix_wait_status(25856))

And it still looks as though it is vendoring all of the Cargo.toml files it finds.

https://build.opensuse.org/package/show/home:ojkastl_buildservice:Branch_devel_tools_scm/gitbutler-cli

[Firstyear]

It's because whatever the upstream is, they have a git version of the dep, and a crates version. So you probably need to work out "why " that is, because that's not really gonna work anyway vendoring aside.

[uncomfyhalomacro]

I'll take a look at this. It seems I haven't checked the issue tracker in a long while.

[uncomfyhalomacro]

Hmm looking at the repository, it seems that each subproject is dependent on the workspace's virtual manifest. This means, when we run cargo fetch or cargo vendor, dependencies for the whole workspace are pulled. This gives us at least a 300+mb tar archive. I guess one way to make the vendored deps worthwhile is to package both the Tauri-based GUI app and the CLI.

[uncomfyhalomacro]

it seems that each subproject is dependent on the workspace's virtual manifest

On another topic, this one is something I am looking forward to open an issue as a bug to the upstream cargo because afaict, vendoring within a workspace package and not the whole workspace can sometimes have these dependencies conflict that don't make sense. It's still something I am going to document. In the meantime, if a Rust package follows a workspace configuration, only vendor that manifest (the clue is the location of the Cargo.lock if it exists or if the Cargo.toml has a [workspace] key).

[uncomfyhalomacro]

@kastl-ars you can check now https://build.opensuse.org/package/show/home:uncomfyhalomacro/gitbutler-cli to see how I build it. That 300MB tarball for dependencies is kind of cough cough not my ideal outcome. But it is what it is. Another issue is the license. It seems the license is https://fsl.software/. Not sure what it means, seems source-only and not really an open-source license.

Open Source does not protect against harmful free-riding.

Understandable.

[uncomfyhalomacro]

Thanks for the quick reply, William. Unfortunately this does not help, it still fails due to the duplicate thingy:

Gathering metadata for platforms
error: failed to sync

Caused by:
  found duplicate version of package `file-id v0.2.3` vendored from two sources:

        source 1: registry `crates-io`
        source 2: https://github.com/notify-rs/notify?rev=978fe719b066a8ce76b9a9d346546b1569eecfb6#978fe719
error: Failed to execute cargo vendor: ExitStatus(unix_wait_status(25856))

And it still looks as though it is vendoring all of the Cargo.toml files it finds.

https://build.opensuse.org/package/show/home:ojkastl_buildservice:Branch_devel_tools_scm/gitbutler-cli

Also, this is the reason why I also created the registry method. Seems it does happen to other packages. Vendoring Rust projects that use workspaces or have multiple subprojects as monorepos have this kind of behaviour where they cannot resolve to which dependency versions or allow duplicates (but with multiple versions). I tried cargo vendor at the top-most directory and confirmed said behaviour

 uncomfy in <home:uncomfyhalomacro/gitbutler-cli/gitbutler-release-0.19.3> [pts/5] @ sentient-slate 19:56 Feb 24 2026 (Tuesday)
 % cargo vendor                                
error: failed to sync

Caused by:
  found duplicate version of package `file-id v0.2.3` vendored from two sources:

  	source 1: registry `crates-io`
  	source 2: https://github.com/notify-rs/notify?rev=978fe719b066a8ce76b9a9d346546b1569eecfb6#978fe719