bug: `cargo vendor` creates files with `Modify:" date "1970-01-01 00:00:01.000000000 +0000"

[georglauterbach]

Problem

When running cargo vendor <DIR> --respect-source-config, some of the vendored files have an extremely bizarre Modify: date. I do not think the --respect-source-config flag matters here, but I wanted to provide it for completeness' sake.

Click to expand...

$ cargo +1.88.0 vendor ../tmp/archival_tmp/cargo_vendor1.88 --respect-source-config
...
$ cargo +1.91.0 vendor ../tmp/archival_tmp/cargo_vendor1.91 --respect-source-config
...

$ stat ../tmp/archival_tmp/cargo_vendor1.88/base64-0.21.7/Cargo.toml
  File: ../tmp/archival_tmp/cargo_vendor1.88/base64-0.21.7/Cargo.toml
  Size: 1795            Blocks: 8          IO Block: 4096   regular file
Device: 252,1   Inode: 57028918    Links: 1
Access: (0644/-rw-r--r--)  Uid: (402526/    user)   Gid: ( 1000/    user)
Access: 2025-11-11 15:40:04.355309785 +0000
Modify: 2025-11-11 15:39:47.654342761 +0000
Change: 2025-11-11 15:39:47.654342761 +0000
 Birth: 2025-11-11 15:39:47.654342761 +0000
$ stat ../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/Cargo.toml
  File: ../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/Cargo.toml
  Size: 1795            Blocks: 8          IO Block: 4096   regular file
Device: 252,1   Inode: 57054795    Links: 1
Access: (0644/-rw-r--r--)  Uid: (402526/    user)   Gid: ( 1000/    user)
Access: 2025-11-11 15:48:56.973293266 +0000
Modify: 1970-01-01 00:00:01.000000000 +0000
Change: 2025-11-11 15:48:56.971293264 +0000
 Birth: 2025-11-11 15:48:56.971293264 +0000

$ command find ../tmp/archival_tmp/cargo_vendor1.91 -type f -not -newermt "2000-01-01" -print | rg base64
../tmp/archival_tmp/cargo_vendor1.91/base64/Cargo.toml
../tmp/archival_tmp/cargo_vendor1.91/base64/.cargo_vcs_info.json
../tmp/archival_tmp/cargo_vendor1.91/base64/Cargo.lock
../tmp/archival_tmp/cargo_vendor1.91/base64ct/Cargo.toml
../tmp/archival_tmp/cargo_vendor1.91/base64ct/.cargo_vcs_info.json
../tmp/archival_tmp/cargo_vendor1.91/base64ct/Cargo.lock
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/Cargo.toml
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/.cargo_vcs_info.json
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/Cargo.lock
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/Cargo.toml
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/.cargo_vcs_info.json
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/Cargo.lock
$ command find ../tmp/archival_tmp/cargo_vendor1.91 -type f -newermt "2000-01-01" -print | rg base64
../tmp/archival_tmp/cargo_vendor1.91/base64/examples/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/LICENSE-MIT
../tmp/archival_tmp/cargo_vendor1.91/base64/benches/benchmarks.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/.circleci/config.yml
../tmp/archival_tmp/cargo_vendor1.91/base64/LICENSE-APACHE
../tmp/archival_tmp/cargo_vendor1.91/base64/RELEASE-NOTES.md
../tmp/archival_tmp/cargo_vendor1.91/base64/clippy.toml
../tmp/archival_tmp/cargo_vendor1.91/base64/.github/ISSUE_TEMPLATE/general-purpose-issue.md
../tmp/archival_tmp/cargo_vendor1.91/base64/README.md
../tmp/archival_tmp/cargo_vendor1.91/base64/Cargo.toml.orig
../tmp/archival_tmp/cargo_vendor1.91/base64/src/lib.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/read/decoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/read/decoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/read/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/prelude.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/display.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/general_purpose/decode_suffix.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/general_purpose/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/general_purpose/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/naive.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/engine/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/alphabet.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/write/encoder_string_writer.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/write/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/write/encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/write/encoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/src/chunked_encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/icon_CLion.svg
../tmp/archival_tmp/cargo_vendor1.91/base64/tests/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/tests/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64/.cargo-checksum.json
../tmp/archival_tmp/cargo_vendor1.91/rustls-pki-types/src/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/LICENSE-MIT
../tmp/archival_tmp/cargo_vendor1.91/base64ct/benches/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/LICENSE-APACHE
../tmp/archival_tmp/cargo_vendor1.91/base64ct/CHANGELOG.md
../tmp/archival_tmp/cargo_vendor1.91/base64ct/README.md
../tmp/archival_tmp/cargo_vendor1.91/base64ct/Cargo.toml.orig
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/encoding.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/errors.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/line_ending.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet/shacrypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet/crypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet/standard.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet/bcrypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet/url.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/lib.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/decoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/test_vectors.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/alphabet.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/src/encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/proptests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/shacrypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/proptests.proptest-regressions
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/crypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/standard.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/common/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/bcrypt.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/tests/url.rs
../tmp/archival_tmp/cargo_vendor1.91/base64ct/.cargo-checksum.json
../tmp/archival_tmp/cargo_vendor1.91/serde_with/src/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/serde_with/tests/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/.travis.yml
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/examples/make_tables.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/examples/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/LICENSE-MIT
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/benches/benchmarks.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/LICENSE-APACHE
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/RELEASE-NOTES.md
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/README.md
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/Cargo.toml.orig
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/lib.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/read/decoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/read/decoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/read/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/display.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/tables.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/write/encoder_string_writer.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/write/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/write/encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/write/encoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/src/chunked_encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/icon_CLion.svg
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/tests/helpers.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/tests/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/tests/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/tests/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.13.1/.cargo-checksum.json
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/examples/base64.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/LICENSE-MIT
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/benches/benchmarks.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/.circleci/config.yml
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/LICENSE-APACHE
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/RELEASE-NOTES.md
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/clippy.toml
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/.github/ISSUE_TEMPLATE/general-purpose-issue.md
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/README.md
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/Cargo.toml.orig
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/lib.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/read/decoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/read/decoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/read/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/prelude.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/display.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/general_purpose/decode_suffix.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/general_purpose/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/general_purpose/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/naive.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/engine/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/alphabet.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/write/encoder_string_writer.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/write/mod.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/write/encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/write/encoder_tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/decode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/src/chunked_encoder.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/icon_CLion.svg
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/tests/encode.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/tests/tests.rs
../tmp/archival_tmp/cargo_vendor1.91/base64-0.21.7/.cargo-checksum.json

This does not only happen for the files shown in the example above, but also for other files from other crates.

Steps

1. Vendor with 1.88 and 1.91:

   cargo +1.88.0 vendor cargo_vendor1.88 --respect-source-config
   cargo +1.91.0 vendor cargo_vendor1.91 --respect-source-config

2. Check with GNU find

   command find cargo_vendor1.88 -type f -not -newermt "2000-01-01" -print | rg base64
   command find cargo_vendor1.91 -type f -not -newermt "2000-01-01" -print | rg base64

Possible Solution(s)

No response

Notes

I am using a custom source config as I work in a company network with a mirrored crates.io.

Version

cargo 1.91.0 (ea2d97820 2025-10-10)
release: 1.91.0
commit-hash: ea2d97820c16195b0ca3fadb4319fe512c199a43
commit-date: 2025-10-10
host: x86_64-unknown-linux-gnu
libgit2: 1.9.1 (sys:0.20.2 vendored)
libcurl: 8.15.0-DEV (sys:0.4.83+curl-8.15.0 vendored ssl:OpenSSL/3.5.2)
ssl: OpenSSL 3.5.2 5 Aug 2025
os: Ubuntu 24.4.0 (noble) [64-bit]

[epage]

Is there a problem you observed because cargo vendor set those mtimes?

[georglauterbach]

Is there a problem you observed because cargo vendor set those mtimes?

Yes. You cannot ZIP the folder because ZIP does not support files older than 1980:

  File "/usr/lib/python3.12/zipfile/__init__.py", line 398, in __init__
    raise ValueError('ZIP does not support timestamps before 1980')
ValueError: ZIP does not support timestamps before 1980

Besides, it's quite weird anyway, isn't it?

[weihanglo]

Probably a mix of alexcrichton/tar-rs#349 and #15514? (The latter is shipped in 1.89 btw)

[weihanglo]

And this #9512, which fixed by alexcrichton/tar-rs#250 by setting the mtime to 1973, and later alexcrichton/tar-rs#262 set to 2006.

Mind sharing the package version that has old mtime, @georglauterbach?

[georglauterbach]

Mind sharing the package version that has old mtime, @georglauterbach?

Gladly, but what do you mean by "package" here? Many dependencies exhibit this behavior, but I guess this is not what you mean by package.. base64 0.13.1 exhibits the behavior, but many others do too.

[weihanglo]

Thanks. Just poked this a bit more. Looks like it was the generated file that didn't use the deterministic tar header during packaging.

cargo-platform@0.1.2 (predated alexcrichton/tar-rs#250)

$ tar -tvf  ~/.cargo/registry/cache/index.crates.io-1949cf8c6b5b557f/cargo-platform-0.1.2.crate
-rw-r--r-- 0/0              74 1970-01-01 00:00 cargo-platform-0.1.2/.cargo_vcs_info.json
-rw-r--r-- 0/0            1564 1970-01-01 00:00 cargo-platform-0.1.2/Cargo.lock
-rw-r--r-- 0/0             879 1970-01-01 00:00 cargo-platform-0.1.2/Cargo.toml
-rw-r--r-- 0/0             420 1973-11-29 21:33 cargo-platform-0.1.2/Cargo.toml.orig
-rw-r--r-- 0/0           10860 1973-11-29 21:33 cargo-platform-0.1.2/LICENSE-APACHE
-rw-r--r-- 0/0            1023 1973-11-29 21:33 cargo-platform-0.1.2/LICENSE-MIT
-rw-r--r-- 0/0            1530 1973-11-29 21:33 cargo-platform-0.1.2/examples/matches.rs
-rw-r--r-- 0/0            9724 1973-11-29 21:33 cargo-platform-0.1.2/src/cfg.rs
-rw-r--r-- 0/0            1809 1973-11-29 21:33 cargo-platform-0.1.2/src/error.rs
-rw-r--r-- 0/0            5048 1973-11-29 21:33 cargo-platform-0.1.2/src/lib.rs
-rw-r--r-- 0/0            7596 1973-11-29 21:33 cargo-platform-0.1.2/tests/test_cfg.rs

cargo-platform@0.3.1 (released early this year, way after alexcrichton/tar-rs#262)

$ tar -tvf  ~/.cargo/registry/cache/index.crates.io-1949cf8c6b5b557f/cargo-platform-0.3.1.crate
-rw-r--r-- 0/0             115 1970-01-01 00:00 cargo-platform-0.3.1/.cargo_vcs_info.json
-rw-r--r-- 0/0            1573 1970-01-01 00:00 cargo-platform-0.3.1/Cargo.lock
-rw-r--r-- 0/0            1483 1970-01-01 00:00 cargo-platform-0.3.1/Cargo.toml
-rw-r--r-- 0/0             361 2006-07-24 01:21 cargo-platform-0.3.1/Cargo.toml.orig
-rw-r--r-- 0/0           10860 2006-07-24 01:21 cargo-platform-0.3.1/LICENSE-APACHE
-rw-r--r-- 0/0            1023 2006-07-24 01:21 cargo-platform-0.3.1/LICENSE-MIT
-rw-r--r-- 0/0             133 2006-07-24 01:21 cargo-platform-0.3.1/README.md
-rw-r--r-- 0/0            1575 2006-07-24 01:21 cargo-platform-0.3.1/examples/matches.rs
-rw-r--r-- 0/0           13263 2006-07-24 01:21 cargo-platform-0.3.1/src/cfg.rs
-rw-r--r-- 0/0            1817 2006-07-24 01:21 cargo-platform-0.3.1/src/error.rs
-rw-r--r-- 0/0            6816 2006-07-24 01:21 cargo-platform-0.3.1/src/lib.rs
-rw-r--r-- 0/0            8752 2006-07-24 01:21 cargo-platform-0.3.1/tests/test_cfg.rs

So it looks like we might want to have two fixes:

• During packaging, generated files in tarball should have the same deterministic mtime.
• To mitigate old already-uploaded tarballs, during unpacking Cargo should set mtime no earlier than 2006-07-24 (the deterministic mtime in tar).

[georglauterbach]

Sounds good!