I think cargo does too much. For example it has a bunch of meta information which could be extracted from the source code(i.e package documentation), the imports must be manually maintained in a config file(the Go way is to extract them from the source code automatically and snapshot the version). Shotly said I feel cargo is bloated, verbose and it wouldn't fit well with the Go philosophy(minimalist, convention over configuration). Why do you need both cargo.toml and cargo.lock? I also doubt Cargo would fix issues not fixed by the existing vendoring tools(e.g libraries that expose common types of different versions)