Pre-RFC: Cargo SBOM

Shnatsel · November 19, 2023, 10:26pm

There is a number of issues in cargo auditable that stem from limitations of various parts of cargo for SBOM use cases:

github.com/rust-secure-code/cargo-auditable

Can't build recent `gitoxide` versions

opened 08:53AM - 09 Jul 23 UTC

jcgruenhage

https://github.com/Byron/gitoxide doesn't successfully build with cargo-auditabl…e anymore. It fails in https://github.com/rust-secure-code/cargo-auditable/blob/9fa7fb3988b4d2414397b9550a3f3fd1aa1bc8f2/cargo-auditable/src/collect_audit_data.rs#L77-L80. I'm not sure if gitoxide or cargo-auditable is to blame here, and the error message isn't all that helpful to me either: ``` thread 'main' panicked at 'cargo metadata failure: error: Package `gix-features v0.31.0 (/home/jcgruenhage/dev/github.com/Byron/gitoxide/gix-features)` does not have feature `prodash`. It has an optional dependency with that name, but that dependency uses the "dep:" syntax in the features table, so it does not have an implicit feature with that name. ', cargo-auditable/src/collect_audit_data.rs:77:9 ``` That reads to me as if something tried to enable a prodash feature on gix-features, but I couldn't find such a thing. For context, afaict, v0.23.0 is the last version that builds. Anything newer than that runs into the above issue. I ran into this while trying to update the version of gitoxide we ship on Void Linux.

github.com/rust-secure-code/cargo-auditable

cargo metadata tries to collect dev dependencies

opened 08:25PM - 19 Nov 23 UTC

alexanderkjall

I modified the Debian cargo buildsystem to use auditable (finally) But ran into …an issue that is maybe a bit philosophical in how it should be solved. This is the error message from a test run trying to compile [lsd](https://crates.io/crates/lsd): ``` thread 'main' panicked at 'cargo metadata failure: error: no matching package named `assert_cmd` found location searched: registry `crates-io` required by package `lsd v0.23.1 (/<<PKGBUILDDIR>>)` ', src/collect_audit_data.rs:77:9 stack backtrace: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace. error: could not compile `lsd` ``` `assert_cmd` is a dev-dependencies to lsd, and the Debian build system doesn't inject those in the environment when running the `cargo install` command. That is hard to change, as that would introduce a large number of dependency loops. Is it important to collect dev-dependencies, or could cargo metadata be instructed to not look for those maybe (This I haven't researched yet)?

This last one is preventing adoption of cargo auditable by Debian, so it is a pretty big deal.

Topic		Replies	Views
Build.rs use cases and stories sought! cargo	47	3632	June 5, 2019
[Pre-RFC] Lang-Level License Management tools and infrastructure	53	2840	May 13, 2020
Perfecting Rust Packaging - The Plan	51	20223	March 25, 2019
[pre-pre-rfc?] Solving Crate Trust cargo	33	6774	March 25, 2019
[Idea] Cargo Global Binary Cache cargo	32	6523	March 31, 2019

Pre-RFC: Cargo SBOM

Related topics