cxx has invalid cxxbridge-cmd dependency

[pprkut]

I'm trying to vendor the sources for https://github.com/zed-industries/zed with cargo-vendor-filterer 0.5.16.

This is the configuration I'm adding to Config.toml:

[workspace.metadata.vendor-filter]
platforms = ["x86_64-unknown-linux-gnu", "i686-unknown-linux-gnu"]
all-features = true

I don't see any errors during the vendoring, but when I then try to build it using the vendored sources I get:

error: failed to load source for dependency `cpal`

Caused by:
  Unable to update https://github.com/zed-industries/cpal?rev=fd8bc2fd39f1f5fdee5a0690656caff9a26d9d50#fd8bc2fd

Caused by:
  failed to update replaced source https://github.com/zed-industries/cpal?rev=fd8bc2fd39f1f5fdee5a0690656caff9a26d9d50#fd8bc2fd

Caused by:
  failed to parse manifest at `/usr/src/tmp/zed-0.168.2/vendor/cxxbridge-cmd/Cargo.toml`

Caused by:
  no targets specified in the manifest
  either src/lib.rs, src/main.rs, a [lib] section, or [[bin]] section must be present

Checking back at the vendoring, I do see that cxxbridge-cmd is one of the dependencies getting replaced with stubs:

Replacing unreferenced package with stub: cxxbridge-cmd

[cgwalters]

Wow, zed is a huge project. Only looking at this briefly:

$ cargo tree -i cxxbridge-cmd --target all --depth 2
cxxbridge-cmd v1.0.134
[build-dependencies]
└── cxx v1.0.134
    ├── libwebrtc v0.3.7 (https://github.com/zed-industries/livekit-rust-sdks?rev=060964da10574cd9bf06463a53bf6e0769c5c45e#060964da)
    └── webrtc-sys v0.3.5 (https://github.com/zed-industries/livekit-rust-sdks?rev=060964da10574cd9bf06463a53bf6e0769c5c45e#060964da)

There must be something special in the dependency chain here (maybe platform conditionals)?

[cgwalters]

OK I've narrowed this down to dtolnay/cxx#1409

And cargo update cxx -p 1.0.131 fixes this for me.

Now...I haven't done a full analysis here but clearly something is going wrong with build-dependencies here.

[cgwalters]

cargo metadata --format-version 1 does not include cxxbridge-cmd in the package list here. There's other things that are listed in build-dependencies that are vendored...but what I'm unsure of yet is whether those packages are not actually strongly referenced by something else.

OK yeah, take version_check - AFAICS that's only referenced in build-dependencies, it is emitted into the full package list. But I don't see what's different about this case, modulo some weird bug in cargo?

We could probably work around this by traversing all the dependencies, or a brutal hack would be a generic --retain [crate] option ?

OK wait, I think I may have figured it out. If I try adding this to rpm-ostree's Cargo.toml to try to see if I can replicate:

[build-dependencies]
cxxbridge-cmd = "1.0.130"

What I get is:

$ cargo metadata --format-version 1
warning: rpmostree-rust v0.1.0 (/var/home/walters/src/github/coreos/rpm-ostree) ignoring invalid dependency `cxxbridge-cmd` which is missing a lib target

[cgwalters]

➡ dtolnay/cxx#1420