Dfetch¶
Vendor dependencies without the pain.
Dfetch copies source code directly into your project — no Git submodules, no SVN externals, no hidden external links. Dependencies live as plain, readable files inside your own repository. You stay in full control of every line.
How it works
1
Install
Download or pip install dfetch
2
Configure
Add projects to dfetch.yaml
3
Fetch
dfetch update
See it in action
What makes Dfetch different
Works with Git and SVN — even mixed in the same project. The only dependency manager that bridges both without compromise.
C, C++, Python, Go, Rust, Java — dfetch doesn’t care. No build-system assumptions. Bring your own toolchain.
Designed for long-lived embedded and industrial products. Reproducible builds from source — no registry, no CDN, no service required.
One project entry in dfetch.yaml. One command. Dfetch copies exactly what you
specified, pins the version in .dfetch_data.yaml, and keeps everything inside your repository.
manifest:
version: '0.0'
remotes:
- name: github
url-base: https://github.com/
projects:
- name: ext/cunit # (1)
remote: github
repo-path: org/cunit
tag: v3.2.7 # (2)
src: src/ # (3)
(1) name: — destination path in your repo
(2) tag: — exact version to fetch
(3) src: — subfolder to copy from upstream
your-project/
├─ dfetch.yaml
└─ ext/
└─ cunit/ # (a)
├─ .dfetch_data.yaml
├─ LICENSE # (b)
└─ CUnit.h # (c)
(a) folder created at the path given by name:
(b) license always retained, even with src:
(c) contents of src: placed directly here
Why teams choose Dfetch
VCS-agnostic
Works seamlessly with Git and SVN — even mixed within the same project. Pin by tag, branch, revision, or exact commit hash. Adapt to your team’s workflow, not the other way around.
Fully self-contained
Every dependency is stored inside your repository as plain source code. No external links means simpler audits, offline builds, and hassle-free deployments that stay reproducible forever.
Fetch only what you need
Point Dfetch at a single subfolder inside a larger repo using the src: attribute.
Pull in just the files you need — no bloat, no noise, and license files are always retained.
Zero lock-in
Your vendored code stays as plain source files. Switch tools any time — no proprietary formats, no migration work. Dfetch respects that your source code belongs to you.
Check which dependencies have available updates and pull them in when you are ready. Dfetch puts you in control of every change — no surprise breakages, no forced upgrades.
Supply-chain ready out of the box
Generate a machine-readable Software Bill of Materials to track every vendored dependency — ready for audits, compliance checks, and vulnerability scans.
Infers and reports the license for every dependency automatically. Stay legally compliant — even when fetching a single subfolder from a larger repository.
Export to Jenkins JSON, SARIF, Code Climate, DependencyTrack formats. Plug into your existing security toolchain with zero extra work.
Dfetch has mature patch stack support. dfetch diff captures each local change as a numbered
.patch file. Declare them in your manifest — they are re-applied in order on every
dfetch update, even as upstream evolves. Fuzzy matching keeps patches applying cleanly
even when surrounding lines shift.
When a fix is ready to share, dfetch format-patch produces a contributor-ready unified diff
for direct PR submission. Drop the patch once it lands upstream — no forks, no divergence.
Built for modern CI/CD
Dfetch plugs right into your automation pipeline, allowing you to push dependency status to your existing tools automatically.
dfetch import automatically converts Git submodules and SVN externals into a dfetch manifest.
No manual work, no lost history — start benefiting from dfetch’s workflow immediately.
Get started in seconds
Generated: 22 Mar 2026 at 17:19
