cargo

README

Cargo Parser

This directory contains the cargo project parser. It extracts information about a Rust project that handles its dependencies using cargo.

How Data Is Collected

Dependency data is read from three different sources: Reading the Cargo.toml config file, reading the Cargo.lock file and calling cargo to extract metadata.

The main chunk of information comes from running the cargo metadata subcommand and parsing its ouput. Data for the SBOM is augmented from the Cargo lockfile the main one being the computed crate hashes reused in the metadata.Packages containing dependency data.

Tests

The parser includes a full test suite. To run the parser's tests simply run:

 go test ./cargo/...

Integration tests are built by using a faked parser implementation. When adding functions to the implementation interface, regenerate the cargo fakes by running:

 go generate ./cargo/...

Known Issues

• Cargo metadata is currently hardcoded to Linux as the parsers project does not yet have awarness of the platform executing the parser (Issue #25)

Documentation

Index

• Constants
• type Config
• type LockFile
• type Metadata
  • func (md *Metadata) GetPackageByName(name string) *Package
• type Mod
  • func New() *Mod
  • func (m *Mod) GetMetadata() plugin.Metadata
  • func (m *Mod) GetRootModule(path string) (*meta.Package, error)
  • func (m *Mod) GetVersion() (string, error)
  • func (m *Mod) HasModulesInstalled(path string) error
  • func (m *Mod) IsValid(path string) bool
  • func (m *Mod) ListModulesWithDeps(path string, globalSettingFile string) ([]meta.Package, error)
  • func (m *Mod) ListUsedModules(path string) ([]meta.Package, error)
  • func (m *Mod) SetImplementation(impl cargoImplementation)
  • func (m *Mod) SetRootModule(path string) error
• type Package
• type PackageDependency

Constants

const (
	Cmd               = "cargo"
	VersionArg        = "--version"
	ModulesCmd        = "cargo metadata --format-version=1"
	RootModuleNameCmd = "cargo pkgid"
)

Types

type Config

type Config struct {
	Package         mainPackage
	RawDependencies map[string]interface{} `toml:"dependencies"`
	Dependencies    map[string]dependency  `toml:"omit"`
	Bin             []binaryData
}

type LockFile

type LockFile struct {
	Version  int
	Packages []lockedPackage `toml:"package"`
}

type Metadata

type Metadata struct {
	WorkspaceRoot   string    `json:"workspace_root"`
	Version         int64     `json:"version"`
	TargetDirectory string    `json:"target_directory"`
	Packages        []Package `json:"packages"`
}

func (*Metadata) GetPackageByName

func (md *Metadata) GetPackageByName(name string) *Package

type Mod

type Mod struct {
	// contains filtered or unexported fields
}

func New

func New() *Mod

func (*Mod) GetMetadata

func (m *Mod) GetMetadata() plugin.Metadata

func (*Mod) GetRootModule

func (m *Mod) GetRootModule(path string) (*meta.Package, error)

func (*Mod) GetVersion

func (m *Mod) GetVersion() (string, error)

func (*Mod) HasModulesInstalled

func (m *Mod) HasModulesInstalled(path string) error

func (*Mod) IsValid

func (m *Mod) IsValid(path string) bool

func (*Mod) ListModulesWithDeps

func (m *Mod) ListModulesWithDeps(path string, globalSettingFile string) ([]meta.Package, error)

func (*Mod) ListUsedModules

func (m *Mod) ListUsedModules(path string) ([]meta.Package, error)

ListUsedModules returns the firs tier dependencies of the module

func (*Mod) SetImplementation

func (m *Mod) SetImplementation(impl cargoImplementation)

func (*Mod) SetRootModule

func (m *Mod) SetRootModule(path string) error

type Package

type Package struct {
	Name         string              `json:"name"`
	Version      string              `json:"version"`
	ID           string              `json:"id"`
	Description  string              `json:"description"`
	Source       string              `json:"source"`
	Dependencies []PackageDependency `json:"dependencies"`
	ManifestPath string              `json:"manifest_path"`
	Authors      []string            `json:"authors"`
	Repository   string              `json:"repository"`
	Homepage     string              `json:"homepage"`
	License      string              `json:"license"`

	Checksum string `json:"-"` // This data bit gets read from the lockfile
}

type PackageDependency

type PackageDependency struct {
	Name                string        `json:"name"`
	Source              string        `json:"source"`
	Req                 string        `json:"req"`
	Kind                interface{}   `json:"kind"`
	Rename              interface{}   `json:"rename"`
	Optional            bool          `json:"optional"`
	UsesDefaultFeatures bool          `json:"uses_default_features"`
	Features            []interface{} `json:"features"`
	Target              interface{}   `json:"target"`
	Registry            interface{}   `json:"registry"`
}