{"id":"fb3d33a0e49f0e79","repo":"rust-lang/cargo","slug":"venedored-manifests-must-have-packages","errorCode":null,"errorMessage":"venedored manifests must have packages","messagePattern":"venedored manifests must have packages","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/ops/cargo_vendor.rs","lineNumber":541,"sourceCode":"        me.manifest_path(),\n        me.manifest().is_embedded(),\n        gctx,\n        &mut warnings,\n        &mut errors,\n    )?;\n    let new_pkg = Package::new(manifest, me.manifest_path());\n    Ok(new_pkg)\n}\n\nfn prepare_toml_for_vendor(\n    mut me: cargo_util_schemas::manifest::TomlManifest,\n    packaged_files: &[PathBuf],\n    gctx: &GlobalContext,\n) -> CargoResult<cargo_util_schemas::manifest::TomlManifest> {\n    let package = me\n        .package\n        .as_mut()\n        .expect(\"venedored manifests must have packages\");\n    // Validates if build script file is included in package. If not, warn and ignore.\n    if let Some(custom_build_scripts) = package.normalized_build().expect(\"previously normalized\") {\n        let mut included_scripts = Vec::new();\n        for script in custom_build_scripts {\n            let path = paths::normalize_path(Path::new(script));\n            let included = packaged_files.contains(&path);\n            if included {\n                let path = path\n                    .into_os_string()\n                    .into_string()\n                    .map_err(|_err| anyhow::format_err!(\"non-UTF8 `package.build`\"))?;\n                let path = crate::workspace::parser::normalize_path_string_sep(path);\n                included_scripts.push(path);\n            } else {\n                gctx.shell().warn(format!(\n                    \"ignoring `package.build` entry `{}` as it is not included in the published package\",\n                    path.display()\n                ))?;","sourceCodeStart":523,"sourceCodeEnd":559,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/ops/cargo_vendor.rs#L523-L559","documentation":"Invariant in `prepare_toml_for_vendor`: `me.package.as_mut().expect(\"venedored manifests must have packages\")` (note the source typo \"venedored\"). Cargo assumes every vendored crate manifest has a `[package]` section. A manifest without `[package]` (a virtual/workspace-only manifest) panics here.","triggerScenarios":"Running `cargo vendor` when one of the resolved dependency manifests is a virtual manifest (only `[workspace]`, no `[package]`), or when a published `.crate` tarball's `Cargo.toml` is missing `[package]` due to corruption or a malformed registry entry.","commonSituations":"A dependency published incorrectly without `[package]`; a git dependency whose root `Cargo.toml` is a virtual manifest; a corrupted local registry / vendored cache; a `[patch]` pointing at a workspace root rather than a member crate.","solutions":["Identify the offending crate: run `cargo vendor -v` and look for the last manifest processed before the panic.","If it's a git dependency, point `[patch]`/`path` at the specific workspace member with `[package]`, not the virtual root.","Re-fetch the registry index / clear `~/.cargo/registry/cache` in case of a corrupt tarball.","Report upstream if a published `.crate` legitimately lacks `[package]`."],"exampleFix":"// before\nlet package = me.package.as_mut().expect(\"venedored manifests must have packages\");\n\n// after\nlet package = me.package.as_mut()\n    .ok_or_else(|| anyhow::format_err!(\n        \"vendored manifest at {:?} is missing [package]; cannot vendor a virtual manifest\",\n        me.manifest_path))?;","handlingStrategy":"validation","validationCode":"// Before vendoring, confirm each dependency manifest has [package].\nfor dep_manifest in resolved_manifests {\n    if dep_manifest.package.is_none() {\n        return Err(anyhow!(\"cannot vendor {}: missing [package]\", dep_manifest.manifest_path));\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Point `[patch]`/git deps at the member crate with `[package]`, not a virtual workspace root.","Audit published `.crate` tarballs for `[package]` before indexing a private registry.","Run `cargo fetch` then inspect manifests before `cargo vendor`."],"tags":["cargo","panic","invariant","cargo-vendor","manifest","package","rust"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}