Vendor dependencies

.cargo/config.toml

@@ -0,0 +1,6 @@
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+

.github/workflows/ci.yml

@@ -261,19 +261,6 @@ jobs:
     - name: Populate cache
       uses: ./.github/actions/cache
 
-    # Ensure that Cargo resolves the minimum possible syn version so that if we
-    # accidentally make a change which depends upon features added in more
-    # recent versions of syn, we'll catch it in CI.
-    #
-    # TODO(#1595): Debug why this step is still necessary after #1564 and maybe
-    # remove it.
-    - name: Pin syn dependency
-      run: |
-        set -eo pipefail
-        # Override the exising `syn` dependency with one which requires an exact
-        # version.
-        cargo add -p zerocopy-derive 'syn@=2.0.46'
-
     - name: Configure environment variables
       env:
         TOOLCHAIN: ${{ matrix.toolchain }}
@@ -460,6 +447,15 @@ jobs:
       run: |
         set -eo pipefail
 
+        # FIXME(#2906): We do this because `cargo vendor` doesn't currently
+        # support vendoring std's dependencies (required in order to build std
+        # from source, which Miri does). As a workaround, we simply temporarily
+        # remove the cargo config and bypass vendoring altogether. Eventually,
+        # we should get vendoring working for std's dependencies too.
+        #
+        # See also: https://github.com/rust-lang/wg-cargo-std-aware/issues/23
+        mv .cargo/config.toml .cargo/config.toml.bak
+
         # Work around https://github.com/rust-lang/miri/issues/3125
         [ "$TARGET" == "aarch64-unknown-linux-gnu" ] && cargo clean
 
@@ -479,6 +475,8 @@ jobs:
             --target $TARGET \
             $FEATURES
         done
+
+        mv .cargo/config.toml.bak .cargo/config.toml
       # Only nightly has a working Miri, so we skip installing on all other
       # toolchains.
       #
@@ -567,6 +565,18 @@ jobs:
           echo "ZC_SKIP_CARGO_SEMVER_CHECKS=1" >> $GITHUB_ENV
         fi
 
+    # FIXME(#2906): We do this because `cargo semver-checks` fetches the latest
+    # zerocopy from crates.io, but `.cargo/config.toml` causes that to resolve
+    # in our vendor directory, and we don't vendor zerocopy. Removing this file
+    # has the effect of causing the subsequent build to use crates.io rather
+    # than vendored dependencies, which is fine since we only run this on the
+    # stable toolchain. Eventually, we should update this job to use the
+    # `--baseline-rev` option to use a previous git commit as the baseline for
+    # checking compatibility (rather than the most recent published version),
+    # which will make this unnecessary.
+    - name: Remove Cargo config
+      run: rm .cargo/config.toml
+
     # Check semver compatibility with the most recently-published version on
     # crates.io. We do this in the matrix rather than in its own job so that it
     # gets run on different targets. Some of our API is target-specific (e.g.,
@@ -685,7 +695,19 @@ jobs:
             toolchain: ${{ env.ZC_TOOLCHAIN }}
             components: clippy, rust-src
       - name: Check big endian for aarch64_be-unknown-linux-gnu target
-        run: ./cargo.sh +nightly build --target=aarch64_be-unknown-linux-gnu -Zbuild-std --features simd
+        run: |
+          set -eo pipefail
+
+          # FIXME(#2906): We do this because `cargo vendor` doesn't currently
+          # support vendoring std's dependencies (required in order to build
+          # std from source, as we do here). As a workaround, we simply nuke
+          # the cargo config and bypass vendoring altogether. Eventually, we
+          # should get vendoring working for std's dependencies too.
+          #
+          # See also: https://github.com/rust-lang/wg-cargo-std-aware/issues/23
+          rm .cargo/config.toml
+
+          ./cargo.sh +nightly build --target=aarch64_be-unknown-linux-gnu -Zbuild-std --features simd
 
   # We can't use this as part of the build matrix because rustup doesn't support
   # the `avr-none` target.
@@ -716,6 +738,15 @@ jobs:
         with:
             toolchain: ${{ env.ZC_TOOLCHAIN }}
             components: clippy, rust-src
+      # FIXME(#2906): We do this because `cargo vendor` doesn't currently
+      # support vendoring std's dependencies (required in order to build std
+      # from source, as we do here). As a workaround, we simply nuke the cargo
+      # config and bypass vendoring altogether. Eventually, we should get
+      # vendoring working for std's dependencies too.
+      #
+      # See also: https://github.com/rust-lang/wg-cargo-std-aware/issues/23
+      - name: Remove Cargo config
+        run: rm .cargo/config.toml
       # NOTE: We cannot check tests because of a number of different issues (at
       # the time of writing):
       # - No `alloc::sync`
@@ -851,14 +882,6 @@ jobs:
             #
             # [1]  https://stackoverflow.com/a/42139535/836390
 
-            # See comment on "Pin syn dependency" job for why we do this. It needs
-            # to happen before the subsequent `cargo check`, so we don't
-            # background it.
-            #
-            # TODO(#1595): Debug why this step is still necessary after #1564 and
-            # maybe remove it.
-            cargo add -p zerocopy-derive 'syn@=2.0.46' &> /dev/null
-
             cargo check --workspace --tests                         &> /dev/null &
             # On our MSRV toolchain, updating the Cargo index takes a long time, so
             # it is worth specifically caching the MSRV index.
@@ -947,6 +970,8 @@ jobs:
           persist-credentials: false
       - uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0
         with:
+          # Only scan the .github directory to avoid scanning vendored dependencies
+          inputs: .github
           # We don't want to use GitHub Advanced Security because we want to
           # block the merge on zizmor failure, and the only way to do that
           # (without manually configuring a ruleset) is to fail the job, which

.gitignore

@@ -13,3 +13,8 @@ lcov.info
 
 # VSCode workspace files
 *.code-workspace
+
+# Unconditionally commit everything inside vendor directories (overrides
+# previous rules)
+!vendor/**
+!tools/vendor/**

.rgignore

@@ -0,0 +1,3 @@
+vendor/
+tools/vendor/
+

Cargo.toml

@@ -121,19 +121,11 @@ zerocopy-derive = { version = "=0.8.33", path = "zerocopy-derive", optional = tr
 zerocopy-derive = { version = "=0.8.33", path = "zerocopy-derive" }
 
 [dev-dependencies]
-# More recent versions of `either` have an MSRV higher than ours.
-either = "=1.13.0"
 # FIXME(#381) Remove this dependency once we have our own layout gadgets.
 elain = "0.3.0"
-# More recent versions of `glob` have an MSRV higher than ours.
-glob = "=0.3.2"
 itertools = "0.11"
-# More recent versions of `itoa` have an MSRV higher than ours.
-itoa = "=1.0.15"
 rand = { version = "0.8.5", default-features = false, features = ["small_rng"] }
 rustversion = "1.0"
-# More recent versions of `ryu` have an MSRV higher than ours.
-ryu = "=1.0.20"
 static_assertions = "1.1"
 testutil = { path = "testutil" }
 # Pinned to a specific version so that the version used for local development

Cargo.toml.std

@@ -0,0 +1,58 @@
+[package]
+name = "std-deps"
+version = "0.0.0"
+edition = "2021"
+publish = false
+
+# This manifest exists solely to force `cargo vendor` to vendor dependencies
+# required by `std` when building with `-Zbuild-std[=core]`. When running
+# `cargo vendor`, make sure to include this manifest using `--sync`.
+#
+# See: https://github.com/rust-lang/wg-cargo-std-aware/issues/23
+
+[workspace]
+
+[dependencies]
+# Dependencies from std/Cargo.toml and transitive deps from library/Cargo.lock
+addr2line = { version = "=0.25.1", default-features = false }
+adler2 = { version = "=2.0.1", default-features = false }
+cc = { version = "=1.2.0", default-features = false }
+cfg-if = { version = "=1.0.4", default-features = false }
+dlmalloc = { version = "=0.2.11", default-features = false }
+foldhash = { version = "=0.2.0", default-features = false }
+fortanix-sgx-abi = { version = "=0.6.1", default-features = false }
+getopts = { version = "=0.2.24", default-features = false }
+gimli = { version = "=0.32.3", default-features = false }
+hashbrown = { version = "=0.16.1", default-features = false }
+hermit-abi = { version = "=0.5.2", default-features = false }
+libc = { version = "=0.2.178", default-features = false }
+memchr = { version = "=2.7.6", default-features = false }
+miniz_oxide = { version = "=0.8.9", default-features = false }
+moto-rt = { version = "=0.16.0", default-features = false }
+object = { version = "=0.37.3", default-features = false }
+r-efi = { version = "=5.3.0", default-features = false }
+r-efi-alloc = { version = "=2.1.0", default-features = false }
+rand = { version = "=0.9.2", default-features = false }
+rand_core = { version = "=0.9.3", default-features = false }
+rand_xorshift = { version = "=0.4.0", default-features = false }
+rustc-demangle = "=0.1.26"
+rustc-literal-escaper = { version = "=0.0.7", default-features = false }
+shlex = { version = "=1.3.0", default-features = false }
+unwinding = { version = "=0.2.8", default-features = false }
+vex-sdk = { version = "=0.27.1", default-features = false }
+wasi-snapshot-preview1 = { package = "wasi", version = "=0.11.1+wasi-snapshot-preview1", default-features = false }
+wasi-p2 = { package = "wasi", version = "=0.14.4+wasi-0.2.4", default-features = false }
+windows-link = { version = "=0.2.1", default-features = false }
+windows-sys = { version = "=0.60.2", default-features = false }
+windows-targets = { version = "=0.53.5", default-features = false }
+wit-bindgen = { version = "=0.45.1", default-features = false }
+
+# Windows targets dependencies (transitive via windows-targets)
+windows_aarch64_gnullvm = { version = "=0.53.1", default-features = false }
+windows_aarch64_msvc = { version = "=0.53.1", default-features = false }
+windows_i686_gnu = { version = "=0.53.1", default-features = false }
+windows_i686_gnullvm = { version = "=0.53.1", default-features = false }
+windows_i686_msvc = { version = "=0.53.1", default-features = false }
+windows_x86_64_gnu = { version = "=0.53.1", default-features = false }
+windows_x86_64_gnullvm = { version = "=0.53.1", default-features = false }
+windows_x86_64_msvc = { version = "=0.53.1", default-features = false }

cargo.sh

@@ -10,6 +10,6 @@ set -eo pipefail
 
 # Build `cargo-zerocopy` without any RUSTFLAGS or CARGO_TARGET_DIR set in the
 # environment
-env -u RUSTFLAGS -u CARGO_TARGET_DIR cargo +stable build --manifest-path tools/Cargo.toml -p cargo-zerocopy -q
+env -u RUSTFLAGS -u CARGO_TARGET_DIR cargo +stable build --config tools/.cargo/config.toml --manifest-path tools/Cargo.toml -p cargo-zerocopy -q
 # Thin wrapper around the `cargo-zerocopy` binary in `tools/cargo-zerocopy`
 ./tools/target/debug/cargo-zerocopy $@

ci/check_fmt.sh

@@ -9,7 +9,7 @@
 # those terms.
 
 set -eo pipefail
-files=$(find . -iname '*.rs' -type f -not -path './target/*' -not -iname '*.expected.rs')
+files=$(find . -iname '*.rs' -type f -not -path './target/*' -not -iname '*.expected.rs' -not -path './vendor/*' -not -path './tools/vendor/*')
 # check that find succeeded
 if [[ -z $files ]]
 then

ci/check_readme.sh

@@ -15,5 +15,5 @@ set -eo pipefail
 # suppress all errors from it.
 cargo install -q cargo-readme --version 3.2.0
 
-diff <(cargo -q run --manifest-path tools/Cargo.toml -p generate-readme) README.md >&2
+diff <(cargo -q run --config tools/.cargo/config.toml --manifest-path tools/Cargo.toml -p generate-readme) README.md >&2
 exit $?

tools/.cargo/config.toml

@@ -0,0 +1,6 @@
+[source.crates-io]
+replace-with = "vendored-sources"
+
+[source.vendored-sources]
+directory = "vendor"
+

tools/vendor/aho-corasick/.cargo-checksum.json

@@ -0,0 +1 @@
+{"files":{".cargo_vcs_info.json":"ace303bf25937bf488919e5461f3994d1b88a19a40465ec8342c63af89cbebf7",".github/FUNDING.yml":"0c65f392d32a8639ba7986bbb42ca124505b462122382f314c89d84c95dd27f1",".github/workflows/ci.yml":"0605d9327a4633916dc789008d5686c692656bb3e1ee57f821f8537e9ad7d7b4",".vim/coc-settings.json":"8237c8f41db352b0d83f1bb10a60bc2f60f56f3234afbf696b4075c8d4d62d9b","COPYING":"01c266bced4a434da0051174d6bee16a4c82cf634e2679b6155d40d75012390f","Cargo.lock":"395d3e76f284190cef50c807ab2f00b9a5d388fde7a7bf88b73b02ed9fd346d1","Cargo.toml":"9384d7c725c5c2ebc8adc602081e7cbce8b214693e9e27edef1c40f33e925810","Cargo.toml.orig":"05304eb8b8821d48c0c4d2e991b9ed0f1a0b68cb70afb8881b81c4c317969663","DESIGN.md":"59c960e1b73b1d7fb41e4df6c0c1b1fcf44dd2ebc8a349597a7d0595f8cb5130","LICENSE-MIT":"0f96a83840e146e43c0ec96a22ec1f392e0680e6c1226e6f3ba87e0740af850f","README.md":"afc4d559a98cf190029af0bf320fc0022725e349cd2a303aac860254e28f3c53","UNLICENSE":"7e12e5df4bae12cb21581ba157ced20e1986a0508dd10d0e8a4ab9a4cf94e85c","rustfmt.toml":"1ca600239a27401c4a43f363cf3f38183a212affc1f31bff3ae93234bbaec228","src/ahocorasick.rs":"c699c07df70be45c666e128509ad571a7649d2073e4ae16ac1efd6793c9c6890","src/automaton.rs":"22258a3e118672413119f8f543a9b912cce954e63524575c0ebfdf9011f9c2dd","src/dfa.rs":"197075923eb9d760a552f4e8652310fd4f657736613a9b1444ae05ef5d525da3","src/lib.rs":"66dea84d227f269b2f14ecc8109a97e96245b56c22eef0e8ce03b2343b8d6e66","src/macros.rs":"c6c52ae05b24433cffaca7b78b3645d797862c5d5feffddf9f54909095ed6e05","src/nfa/contiguous.rs":"f435c131ce84927e5600109722d006533ea21442dddaf18e03286d8caed82389","src/nfa/mod.rs":"ee7b3109774d14bbad5239c16bb980dd6b8185ec136d94fbaf2f0dc27d5ffa15","src/nfa/noncontiguous.rs":"de94f02b04efd8744fb096759a8897c22012b0e0ca3ace161fd87c71befefe04","src/packed/api.rs":"2197077ff7d7c731ae03a72bed0ae52d89fee56c5564be076313c9a573ce5013","src/packed/ext.rs":"66be06fde8558429da23a290584d4b9fae665bf64c2578db4fe5f5f3ee864869","src/packed/mod.rs":"0020cd6f07ba5c8955923a9516d7f758864260eda53a6b6f629131c45ddeec62","src/packed/pattern.rs":"0e4bca57d4b941495d31fc8246ad32904eed0cd89e3cda732ad35f4deeba3bef","src/packed/rabinkarp.rs":"403146eb1d838a84601d171393542340513cd1ee7ff750f2372161dd47746586","src/packed/teddy/README.md":"3a43194b64e221543d885176aba3beb1224a927385a20eca842daf6b0ea2f342","src/packed/teddy/builder.rs":"08ec116a4a842a2bb1221d296a2515ef3672c54906bed588fb733364c07855d3","src/packed/teddy/generic.rs":"ea252ab05b32cea7dd9d71e332071d243db7dd0362e049252a27e5881ba2bf39","src/packed/teddy/mod.rs":"17d741f7e2fb9dbac5ba7d1bd4542cf1e35e9f146ace728e23fe6bbed20028b2","src/packed/tests.rs":"8e2f56eb3890ed3876ecb47d3121996e416563127b6430110d7b516df3f83b4b","src/packed/vector.rs":"70c325cfa6f7c5c4c9a6af7b133b75a29e65990a7fe0b9a4c4ce3c3d5a0fe587","src/tests.rs":"c68192ab97b6161d0d6ee96fefd80cc7d14e4486ddcd8d1f82b5c92432c24ed5","src/transducer.rs":"02daa33a5d6dac41dcfd67f51df7c0d4a91c5131c781fb54c4de3520c585a6e1","src/util/alphabet.rs":"6dc22658a38deddc0279892035b18870d4585069e35ba7c7e649a24509acfbcc","src/util/buffer.rs":"f9e37f662c46c6ecd734458dedbe76c3bb0e84a93b6b0117c0d4ad3042413891","src/util/byte_frequencies.rs":"2fb85b381c038c1e44ce94294531cdcd339dca48b1e61f41455666e802cbbc9e","src/util/debug.rs":"ab301ad59aa912529cb97233a54a05914dd3cb2ec43e6fec7334170b97ac5998","src/util/error.rs":"ecccd60e7406305023efcc6adcc826eeeb083ab8f7fbfe3d97469438cd4c4e5c","src/util/int.rs":"e264e6abebf5622b59f6500210773db36048371c4e509c930263334095959a52","src/util/mod.rs":"7ab28d11323ecdbd982087f32eb8bceeee84f1a2583f3aae27039c36d58cf12c","src/util/prefilter.rs":"183e32aa9951d9957f89062e4a6ae7235df7060722a3c91995a3d36db5a98111","src/util/primitives.rs":"f89f3fa1d8db4e37de9ca767c6d05e346404837cade6d063bba68972fafa610b","src/util/remapper.rs":"9f12d911583a325c11806eeceb46d0dfec863cfcfa241aed84d31af73da746e5","src/util/search.rs":"6af803e08b8b8c8a33db100623f1621b0d741616524ce40893d8316897f27ffe","src/util/special.rs":"7d2f9cb9dd9771f59816e829b2d96b1239996f32939ba98764e121696c52b146"},"package":"ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"}

tools/vendor/aho-corasick/.cargo_vcs_info.json

@@ -0,0 +1,6 @@
+{
+  "git": {
+    "sha1": "17f8b32e3b7c845ef3c5429b823804f552f14ec9"
+  },
+  "path_in_vcs": ""
+}

tools/vendor/aho-corasick/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: [BurntSushi]