diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index adbb4648..2f497eb2 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -42,6 +42,7 @@ The OpenAPI specification is located in the [`trustify-da-api-spec`](https://git which will provide data that we can send to the _Backend_ using _analysis.js_. See the [Adding a Provider](#adding-a-provider) section. * [java_maven.js](src/providers/java_maven.js) is the provider for the _Java_ _Maven_ ecosystem. + * [rust_cargo.js](src/providers/rust_cargo.js) is the provider for the _Rust_ _Cargo_ ecosystem. #### Types diff --git a/README.md b/README.md index a01da90b..4457b361 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ let imageAnalysisWithArch = await client.imageAnalysis(['httpd:2.4.49^^amd64']) The client automatically detects your project's license with intelligent fallback:

License Detection

@@ -203,7 +204,7 @@ $ trustify-da-javascript-client license /path/to/package.json The client automatically detects your project's license with intelligent fallback:

@@ -366,6 +381,7 @@ let options = { 'TRUSTIFY_DA_PYTHON_PATH' : '/path/to/python', 'TRUSTIFY_DA_PIP_PATH' : '/path/to/pip', 'TRUSTIFY_DA_GRADLE_PATH' : '/path/to/gradle', + 'TRUSTIFY_DA_CARGO_PATH' : '/path/to/cargo', // Configure proxy for all requests 'TRUSTIFY_DA_PROXY_URL': 'http://proxy.example.com:8080' } @@ -411,7 +427,7 @@ The proxy URL should be in the format: `http://host:port` or `https://host:port`

License resolution and dependency license compliance

-The client can resolve the project license from the manifest (e.g. package.json license, pom.xml <licenses>) and from a LICENSE or LICENSE.md file in the project, and report when they differ. For component analysis, you can optionally run a license check: the client fetches dependency licenses from the backend (by purl) and reports dependencies whose licenses are incompatible with the project license. See License resolution and compliance for design and behavior. To disable the check on component analysis, set TRUSTIFY_DA_LICENSE_CHECK=false or pass licenseCheck: false in the options. +The client can resolve the project license from the manifest (e.g. package.json license, pom.xml <licenses>, Cargo.toml license) and from a LICENSE or LICENSE.md file in the project, and report when they differ. For component analysis, you can optionally run a license check: the client fetches dependency licenses from the backend (by purl) and reports dependencies whose licenses are incompatible with the project license. See License resolution and compliance for design and behavior. To disable the check on component analysis, set TRUSTIFY_DA_LICENSE_CHECK=false or pass licenseCheck: false in the options.

Customizing Executables

@@ -487,6 +503,11 @@ following keys for setting custom paths for the said executables. gradle TRUSTIFY_DA_PREFER_GRADLEW + +Rust Cargo +cargo +TRUSTIFY_DA_CARGO_PATH + #### Match Manifest Versions Feature diff --git a/docs/license-resolution-and-compliance.md b/docs/license-resolution-and-compliance.md index 479f018c..a4a5493c 100644 --- a/docs/license-resolution-and-compliance.md +++ b/docs/license-resolution-and-compliance.md @@ -20,6 +20,7 @@ The client looks for your project’s license with **automatic fallback**: 1. **Primary: Manifest file** — Reads the license field from: - `package.json`: `license` field - `pom.xml`: `` element + - `Cargo.toml`: `license` field under `[package]` or `[workspace.package]` - `build.gradle` / `build.gradle.kts`: No standard license field (falls back to LICENSE file) - `go.mod`: No standard license field (falls back to LICENSE file) - `requirements.txt`: No standard license field (falls back to LICENSE file) @@ -27,7 +28,7 @@ The client looks for your project’s license with **automatic fallback**: 2. **Fallback: LICENSE file** — If no license is found in the manifest, searches for `LICENSE`, `LICENSE.md`, or `LICENSE.txt` in the same directory as your manifest **How the fallback works:** -- **Ecosystems with manifest license support** (Maven, JavaScript): Uses manifest license if present, otherwise falls back to LICENSE file +- **Ecosystems with manifest license support** (Maven, JavaScript, Rust Cargo): Uses manifest license if present, otherwise falls back to LICENSE file - **Ecosystems without manifest license support** (Gradle, Go, Python): Automatically reads from LICENSE file - **SPDX detection**: Common licenses (Apache-2.0, MIT, GPL-2.0/3.0, LGPL-2.1/3.0, AGPL-3.0, BSD-2-Clause/3-Clause) are automatically detected from LICENSE file content @@ -167,5 +168,5 @@ Project license information is automatically included in generated SBOMs (Cyclon **LICENSE file fallback in SBOMs:** - **All ecosystems** now include license information in the SBOM when available - **Gradle, Go, Python projects**: Even though these ecosystems don’t have manifest license fields, the SBOM will include the license from your LICENSE file -- **Maven, JavaScript projects**: The SBOM uses the manifest license, or falls back to LICENSE file if not specified in manifest +- **Maven, JavaScript, Rust Cargo projects**: The SBOM uses the manifest license, or falls back to LICENSE file if not specified in manifest - If neither manifest nor LICENSE file contains a license, the SBOM root component will have no `licenses` field diff --git a/package-lock.json b/package-lock.json index 64468568..9b3cef0d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -18,6 +18,7 @@ "https-proxy-agent": "^7.0.6", "node-fetch": "^3.3.2", "packageurl-js": "~1.0.2", + "smol-toml": "^1.6.0", "tree-sitter-requirements": "github:Strum355/tree-sitter-requirements#d0261ee76b84253997fe70d7d397e78c006c3801", "web-tree-sitter": "^0.26.6", "yargs": "^18.0.0" @@ -6878,6 +6879,18 @@ "npm": ">= 3.0.0" } }, + "node_modules/smol-toml": { + "version": "1.6.0", + "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.6.0.tgz", + "integrity": "sha512-4zemZi0HvTnYwLfrpk/CF9LOd9Lt87kAt50GnqhMpyF9U3poDAP2+iukq2bZsO/ufegbYehBkqINbsWxj4l4cw==", + "license": "BSD-3-Clause", + "engines": { + "node": ">= 18" + }, + "funding": { + "url": "https://github.com/sponsors/cyyynthia" + } + }, "node_modules/smtp-address-parser": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/smtp-address-parser/-/smtp-address-parser-1.1.0.tgz", diff --git a/package.json b/package.json index 92b6e144..31d072fd 100644 --- a/package.json +++ b/package.json @@ -56,6 +56,7 @@ "https-proxy-agent": "^7.0.6", "node-fetch": "^3.3.2", "packageurl-js": "~1.0.2", + "smol-toml": "^1.6.0", "tree-sitter-requirements": "github:Strum355/tree-sitter-requirements#d0261ee76b84253997fe70d7d397e78c006c3801", "web-tree-sitter": "^0.26.6", "yargs": "^18.0.0" diff --git a/src/index.js b/src/index.js index 436dcc88..3dfdf976 100644 --- a/src/index.js +++ b/src/index.js @@ -15,6 +15,7 @@ export default { componentAnalysis, stackAnalysis, imageAnalysis, validateToken /** * @typedef {{ + * TRUSTIFY_DA_CARGO_PATH?: string | undefined, * TRUSTIFY_DA_DOCKER_PATH?: string | undefined, * TRUSTIFY_DA_GO_MVS_LOGIC_ENABLED?: string | undefined, * TRUSTIFY_DA_GO_PATH?: string | undefined, diff --git a/src/provider.js b/src/provider.js index 57652599..4bfa8b52 100644 --- a/src/provider.js +++ b/src/provider.js @@ -8,6 +8,7 @@ import Javascript_npm from './providers/javascript_npm.js'; import Javascript_pnpm from './providers/javascript_pnpm.js'; import Javascript_yarn from './providers/javascript_yarn.js'; import pythonPipProvider from './providers/python_pip.js' +import rustCargoProvider from './providers/rust_cargo.js' /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */ /** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string): void, provideComponent: function(string, {}): Provided | Promise, provideStack: function(string, {}): Provided | Promise, readLicenseFromManifest: function(string): string | null}} Provider */ @@ -24,7 +25,8 @@ export const availableProviders = [ new Javascript_pnpm(), new Javascript_yarn(), golangGomodulesProvider, - pythonPipProvider] + pythonPipProvider, + rustCargoProvider] /** * Match a provider by manifest type only (no lock file check). Used for license reading. diff --git a/src/providers/rust_cargo.js b/src/providers/rust_cargo.js new file mode 100644 index 00000000..bbe52c10 --- /dev/null +++ b/src/providers/rust_cargo.js @@ -0,0 +1,644 @@ +import fs from 'node:fs' +import path from 'node:path' + +import { PackageURL } from 'packageurl-js' +import { parse as parseToml } from 'smol-toml' + +import { getLicense } from '../license/license_utils.js' +import Sbom from '../sbom.js' +import { getCustomPath, invokeCommand } from '../tools.js' + +export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest } + +/** @typedef {import('../provider').Provider} */ + +/** @typedef {import('../provider').Provided} Provided */ + +/** + * @type {string} ecosystem identifier for cargo/crates packages + * @private + */ +const ecosystem = 'cargo' + +/** + * Ignore markers recognised in Cargo.toml comments. + * Supports both the legacy `exhortignore` marker and the new `trustify-da-ignore` marker. + * @type {string[]} + * @private + */ +const IGNORE_MARKERS = ['exhortignore', 'trustify-da-ignore'] + +/** + * Checks whether a line contains any of the recognised ignore markers. + * @param {string} line - the line to check + * @returns {boolean} true if the line contains at least one ignore marker + * @private + */ +function hasIgnoreMarker(line) { + return IGNORE_MARKERS.some(marker => line.includes(marker)) +} + +/** + * Checks whether a dependency name is in the ignored set, accounting for + * Cargo's underscore/hyphen equivalence + * @param {string} name - the dependency name to check + * @param {Set} ignoredDeps - set of ignored dependency names + * @returns {boolean} true if the dependency should be ignored + * @private + */ +function isDepIgnored(name, ignoredDeps) { + if (ignoredDeps.has(name)) {return true} + let normalized = name.replace(/_/g, '-') + if (normalized !== name && ignoredDeps.has(normalized)) {return true} + normalized = name.replace(/-/g, '_') + if (normalized !== name && ignoredDeps.has(normalized)) {return true} + return false +} + +/** + * Enum-like constants for Cargo project types. + * @private + */ +const CrateType = { + SINGLE_CRATE: 'SINGLE_CRATE', + WORKSPACE_VIRTUAL: 'WORKSPACE_VIRTUAL', + WORKSPACE_WITH_ROOT_CRATE: 'WORKSPACE_WITH_ROOT_CRATE' +} + +/** + * @param {string} manifestName - the subject manifest name-type + * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type + */ +function isSupported(manifestName) { + return 'Cargo.toml' === manifestName +} + +/** + * Read project license from Cargo.toml, with fallback to LICENSE file. + * Supports the `license` field under `[package]` (single crate / workspace + * with root) and under `[workspace.package]` (virtual workspaces). + * @param {string} manifestPath - path to Cargo.toml + * @returns {string|null} SPDX identifier or null + */ +function readLicenseFromManifest(manifestPath) { + let fromManifest = null + try { + let content = fs.readFileSync(manifestPath, 'utf-8') + let parsed = parseToml(content) + + fromManifest = parsed.package?.license + || parsed.workspace?.package?.license + || null + } catch (_) { + // leave fromManifest as null + } + return getLicense(fromManifest, manifestPath) +} + +/** + * Validates that Cargo.lock exists in the manifest directory or in a parent + * workspace root directory. In Cargo workspaces the lock file always lives at + * the workspace root, so when a member crate's Cargo.toml is provided we walk + * up the directory tree looking for Cargo.lock (stopping when we find a + * Cargo.toml that contains a [workspace] section, or when we reach the + * filesystem root). + * @param {string} manifestDir - the directory where the manifest lies + * @returns {boolean} true if Cargo.lock is found + */ +function validateLockFile(manifestDir) { + let dir = path.resolve(manifestDir) + let parent = dir + + do { + dir = parent + + if (fs.existsSync(path.join(dir, 'Cargo.lock'))) { + return true + } + + // If this directory has a Cargo.toml with [workspace], the lock file + // should have been here — stop searching. + let cargoToml = path.join(dir, 'Cargo.toml') + if (fs.existsSync(cargoToml)) { + try { + let content = fs.readFileSync(cargoToml, 'utf-8') + if (/\[workspace\]/.test(content)) { + return false + } + } catch (_) { + // ignore read errors, keep searching + } + } + + parent = path.dirname(dir) + } while (parent !== dir) + + return false +} + +/** + * Provide content and content type for Cargo stack analysis. + * @param {string} manifest - the manifest path + * @param {{}} [opts={}] - optional various options to pass along the application + * @returns {Provided} + */ +function provideStack(manifest, opts = {}) { + return { + ecosystem, + content: getSBOM(manifest, opts, true), + contentType: 'application/vnd.cyclonedx+json' + } +} + +/** + * Provide content and content type for Cargo component analysis. + * @param {string} manifest - path to Cargo.toml for component report + * @param {{}} [opts={}] - optional various options to pass along the application + * @returns {Provided} + */ +function provideComponent(manifest, opts = {}) { + return { + ecosystem, + content: getSBOM(manifest, opts, false), + contentType: 'application/vnd.cyclonedx+json' + } +} + +/** + * Create SBOM json string for a Cargo project. + * @param {string} manifest - path to Cargo.toml + * @param {{}} [opts={}] - optional various options to pass along the application + * @param {boolean} includeTransitive - whether the sbom should contain transitive dependencies + * @returns {string} the SBOM json content + * @private + */ +function getSBOM(manifest, opts = {}, includeTransitive) { + let cargoBin = getCustomPath('cargo', opts) + verifyCargoAccessible(cargoBin) + + let manifestDir = path.dirname(manifest) + let metadata = executeCargoMetadata(cargoBin, manifestDir) + let ignoredDeps = getIgnoredDeps(manifest, metadata) + let crateType = detectCrateType(metadata) + let license = readLicenseFromManifest(manifest) + + let sbom + if (crateType === CrateType.WORKSPACE_VIRTUAL) { + sbom = handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license) + } else { + sbom = handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license) + } + + return sbom +} + +/** + * Verifies that the cargo binary is accessible. + * @param {string} cargoBin - path to cargo binary + * @throws {Error} if cargo is not accessible + * @private + */ +function verifyCargoAccessible(cargoBin) { + try { + invokeCommand(cargoBin, ['--version']) + } catch (error) { + if (error.code === 'ENOENT') { + throw new Error(`cargo binary is not accessible at "${cargoBin}"`) + } + throw new Error('failed to check for cargo binary', { cause: error }) + } +} + +/** + * Executes `cargo metadata` and returns the parsed JSON. + * @param {string} cargoBin - path to cargo binary + * @param {string} manifestDir - directory containing Cargo.toml + * @returns {object} parsed cargo metadata JSON + * @throws {Error} if cargo metadata fails + * @private + */ +function executeCargoMetadata(cargoBin, manifestDir) { + try { + let output = invokeCommand(cargoBin, ['metadata', '--format-version', '1'], { cwd: manifestDir }) + return JSON.parse(output.toString().trim()) + } catch (error) { + throw new Error('failed to execute cargo metadata', { cause: error }) + } +} + +/** + * Detects the type of Cargo project from metadata. + * @param {object} metadata - parsed cargo metadata + * @returns {string} one of CrateType values + * @private + */ +function detectCrateType(metadata) { + let rootPackageId = metadata.resolve?.root + let workspaceMembers = metadata.workspace_members || [] + + if (!rootPackageId && workspaceMembers.length > 0) { + return CrateType.WORKSPACE_VIRTUAL + } + + if (rootPackageId && workspaceMembers.length > 1) { + return CrateType.WORKSPACE_WITH_ROOT_CRATE + } + + return CrateType.SINGLE_CRATE +} + +/** + * Handles SBOM generation for single crate and workspace-with-root-crate projects. + * For workspace-with-root-crate, workspace members are only included if they + * appear in the root crate's dependency graph from cargo metadata. We don't + * automatically add all members as dependencies since most workspace members + * (examples, tools, benchmarks) depend ON the root crate, not the other way around. + * @param {object} metadata - parsed cargo metadata + * @param {Set} ignoredDeps - set of ignored dependency names + * @param {boolean} includeTransitive - whether to include transitive dependencies + * @param {{}} opts - options + * @param {string|null} license - SPDX license identifier for the root component + * @returns {string} SBOM json string + * @private + */ +function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, license) { + let rootPackageId = metadata.resolve.root + let rootPackage = findPackageById(metadata, rootPackageId) + let rootPurl = toPurl(rootPackage.name, rootPackage.version) + + let sbom = new Sbom() + sbom.addRoot(rootPurl, license) + + let resolveNode = findResolveNode(metadata, rootPackageId) + if (!resolveNode) { + return sbom.getAsJsonString(opts) + } + + if (includeTransitive) { + addTransitiveDeps(sbom, metadata, rootPackageId, ignoredDeps, new Set(), rootPurl) + } else { + addDirectDeps(sbom, metadata, rootPackageId, rootPurl, ignoredDeps) + } + + return sbom.getAsJsonString(opts) +} + +/** + * Handles SBOM generation for virtual workspace projects. + * + * For stack analysis (includeTransitive=true): + * Iterates all workspace members and walks their full dependency trees. + * + * For component analysis (includeTransitive=false): + * Only includes dependencies explicitly listed in [workspace.dependencies] + * of the root Cargo.toml. If that section is absent the SBOM contains only + * the synthetic workspace root with no dependencies — this matches the Java + * client behaviour where CA "just analyzes direct dependencies defined in + * Cargo.toml". + * + * @param {string} manifest - path to the root Cargo.toml + * @param {object} metadata - parsed cargo metadata + * @param {Set} ignoredDeps - set of ignored dependency names + * @param {boolean} includeTransitive - whether to include transitive dependencies + * @param {{}} opts - options + * @param {string|null} license - SPDX license identifier for the root component + * @returns {string} SBOM json string + * @private + */ +function handleVirtualWorkspace(manifest, metadata, ignoredDeps, includeTransitive, opts, license) { + let workspaceRoot = metadata.workspace_root + let rootName = path.basename(workspaceRoot) + let workspaceVersion = getWorkspaceVersion(metadata) + let rootPurl = toPurl(rootName, workspaceVersion) + + let sbom = new Sbom() + sbom.addRoot(rootPurl, license) + + if (includeTransitive) { + // Stack analysis: walk all members and their full dependency trees + let workspaceMembers = metadata.workspace_members || [] + + for (let memberId of workspaceMembers) { + let memberPackage = findPackageById(metadata, memberId) + if (!memberPackage) {continue} + + let memberPurl = memberPackage.source == null + ? toPathDepPurl(memberPackage.name, memberPackage.version) + : toPurl(memberPackage.name, memberPackage.version) + + sbom.addDependency(rootPurl, memberPurl) + addTransitiveDeps(sbom, metadata, memberId, ignoredDeps, new Set(), memberPurl) + } + } else { + // Component analysis: only [workspace.dependencies] from root Cargo.toml + let workspaceDeps = getWorkspaceDepsFromManifest(manifest) + + for (let depName of workspaceDeps) { + if (isDepIgnored(depName, ignoredDeps)) {continue} + + let pkg = metadata.packages.find(p => p.name === depName) + if (!pkg) { + let altName = depName.replace(/-/g, '_') + pkg = metadata.packages.find(p => p.name === altName) + } + if (!pkg) {continue} + + let depPurl = pkg.source == null + ? toPathDepPurl(pkg.name, pkg.version) + : toPurl(pkg.name, pkg.version) + + sbom.addDependency(rootPurl, depPurl) + } + } + + return sbom.getAsJsonString(opts) +} + +/** + * Recursively adds transitive dependencies to the SBOM. + * Path dependencies (source == null) are included with a + * {@code repository_url=local} qualifier so the backend can skip + * vulnerability checks while still showing them in the dependency tree. + * @param {Sbom} sbom - the SBOM to add dependencies to + * @param {object} metadata - parsed cargo metadata + * @param {string} packageId - the package ID to resolve dependencies for + * @param {Set} ignoredDeps - set of ignored dependency names + * @param {Set} visited - set of already-visited package IDs to prevent cycles + * @param {PackageURL} [startingPurl] - purl to use for the starting package, + * so callers can ensure it matches the purl already added to the SBOM + * @private + */ +function addTransitiveDeps(sbom, metadata, packageId, ignoredDeps, visited, startingPurl) { + if (visited.has(packageId)) {return} + visited.add(packageId) + + let resolveNode = findResolveNode(metadata, packageId) + if (!resolveNode) {return} + + let sourcePackage = findPackageById(metadata, packageId) + if (!sourcePackage) {return} + + let sourcePurl = startingPurl || (sourcePackage.source == null + ? toPathDepPurl(sourcePackage.name, sourcePackage.version) + : toPurl(sourcePackage.name, sourcePackage.version)) + + let runtimeDeps = filterRuntimeDeps(resolveNode) + + for (let depId of runtimeDeps) { + let depPackage = findPackageById(metadata, depId) + if (!depPackage) {continue} + if (isDepIgnored(depPackage.name, ignoredDeps)) {continue} + + let depPurl = depPackage.source == null + ? toPathDepPurl(depPackage.name, depPackage.version) + : toPurl(depPackage.name, depPackage.version) + + sbom.addDependency(sourcePurl, depPurl) + addTransitiveDeps(sbom, metadata, depId, ignoredDeps, visited) + } +} + +/** + * Adds only direct (non-transitive) dependencies to the SBOM. + * Path dependencies are included with a {@code repository_url=local} qualifier. + * @param {Sbom} sbom - the SBOM to add dependencies to + * @param {object} metadata - parsed cargo metadata + * @param {string} packageId - the package ID to resolve dependencies for + * @param {PackageURL} parentPurl - the parent purl to attach dependencies to + * @param {Set} ignoredDeps - set of ignored dependency names + * @private + */ +function addDirectDeps(sbom, metadata, packageId, parentPurl, ignoredDeps) { + let resolveNode = findResolveNode(metadata, packageId) + if (!resolveNode) {return} + + let runtimeDeps = filterRuntimeDeps(resolveNode) + + for (let depId of runtimeDeps) { + let depPackage = findPackageById(metadata, depId) + if (!depPackage) {continue} + if (isDepIgnored(depPackage.name, ignoredDeps)) {continue} + + let depPurl = depPackage.source == null + ? toPathDepPurl(depPackage.name, depPackage.version) + : toPurl(depPackage.name, depPackage.version) + + sbom.addDependency(parentPurl, depPurl) + } +} + +/** + * Filters the deps of a resolve node to only include runtime (normal) dependencies. + * @param {object} resolveNode - a node from metadata.resolve.nodes + * @returns {string[]} array of package IDs for runtime dependencies + * @private + */ +function filterRuntimeDeps(resolveNode) { + if (!resolveNode.deps) {return []} + + return resolveNode.deps + .filter(dep => { + if (!dep.dep_kinds || dep.dep_kinds.length === 0) {return true} + return dep.dep_kinds.some(dk => dk.kind == null || dk.kind === 'normal') + }) + .map(dep => dep.pkg) +} + +/** + * Finds a package in the metadata by its ID. + * @param {object} metadata - parsed cargo metadata + * @param {string} packageId - the package ID to find + * @returns {object|undefined} the found package or undefined + * @private + */ +function findPackageById(metadata, packageId) { + return metadata.packages.find(pkg => pkg.id === packageId) +} + +/** + * Finds a resolve node by package ID. + * @param {object} metadata - parsed cargo metadata + * @param {string} packageId - the package ID to find + * @returns {object|undefined} the found resolve node or undefined + * @private + */ +function findResolveNode(metadata, packageId) { + return metadata.resolve.nodes.find(node => node.id === packageId) +} + +/** + * Parses the root Cargo.toml and returns the dependency names listed in the + * [workspace.dependencies] section. Returns an empty array when the section + * does not exist. + * @param {string} manifest - path to the root Cargo.toml + * @returns {string[]} list of dependency names + * @private + */ +function getWorkspaceDepsFromManifest(manifest) { + let content = fs.readFileSync(manifest, 'utf-8') + let parsed = parseToml(content) + return Object.keys(parsed.workspace?.dependencies || {}) +} + +/** + * Extracts the workspace version from metadata if defined. + * @param {object} metadata - parsed cargo metadata + * @returns {string} the workspace version or a placeholder + * @private + */ +function getWorkspaceVersion(metadata) { + let workspaceRoot = metadata.workspace_root + let cargoTomlPath = path.join(workspaceRoot, 'Cargo.toml') + try { + let content = fs.readFileSync(cargoTomlPath, 'utf-8') + let parsed = parseToml(content) + return parsed.workspace?.package?.version || '0.0.0' + } catch (_) { + return '0.0.0' + } +} + +/** + * Parses Cargo.toml for dependencies annotated with an ignore marker. + * Supports both `exhortignore` and `trustify-da-ignore` markers. + * Supports inline deps, table-based deps, and workspace-level dependency sections. + * Uses cargo metadata to discover workspace members (which already handles glob + * expansion and exclude filtering) instead of parsing workspace member paths ourselves. + * @param {string} manifest - path to Cargo.toml + * @param {object} metadata - parsed cargo metadata + * @returns {Set} set of dependency names to ignore + * @private + */ +function getIgnoredDeps(manifest, metadata) { + let ignored = new Set() + + scanManifestForIgnored(manifest, ignored) + + // Scan workspace member manifests using metadata + let manifestDir = path.dirname(manifest) + let workspaceRoot = metadata.workspace_root + let workspaceMembers = metadata.workspace_members || [] + + for (let memberId of workspaceMembers) { + let memberRelDir = getMemberRelativeDir(memberId, workspaceRoot) + if (memberRelDir == null) {continue} + + let memberManifest = path.join(manifestDir, memberRelDir, 'Cargo.toml') + if (path.resolve(memberManifest) === path.resolve(manifest)) {continue} + + if (fs.existsSync(memberManifest)) { + scanManifestForIgnored(memberManifest, ignored) + } + } + + return ignored +} + +/** + * Extracts a workspace member's directory path relative to the workspace root + * from its cargo package ID. Workspace member IDs use the `path+file://` scheme, + * e.g. `path+file:///workspace/root/crates/member#0.1.0`. + * @param {string} packageId - the cargo package ID + * @param {string} workspaceRoot - the workspace root path from cargo metadata + * @returns {string|null} relative directory path, or null if it cannot be determined + * @private + */ +function getMemberRelativeDir(packageId, workspaceRoot) { + let pathMatch = packageId.match(/path\+file:\/\/(.+?)#/) + if (!pathMatch) {return null} + + let pkgPath = pathMatch[1] + if (!pkgPath.startsWith(workspaceRoot)) {return null} + + let relPath = pkgPath.substring(workspaceRoot.length) + if (relPath.startsWith('/')) {relPath = relPath.substring(1)} + + return relPath || null +} + +/** + * Scans a single Cargo.toml for ignored dependencies and adds them to the set. + * @param {string} manifest - path to Cargo.toml + * @param {Set} ignored - the set to add ignored dependency names to + * @private + */ +function scanManifestForIgnored(manifest, ignored) { + let content = fs.readFileSync(manifest, 'utf-8') + let lines = content.split(/\r?\n/) + + let currentSection = '' + let currentDepName = null + + for (let line of lines) { + let trimmed = line.trim() + + let sectionMatch = trimmed.match(/^\[([^\]]+)\]\s*(?:#.*)?$/) + if (sectionMatch) { + currentSection = sectionMatch[1] + currentDepName = null + + let tableDep = currentSection.match(/^(?:dependencies|dev-dependencies|build-dependencies|workspace\.dependencies)\.(.+)$/) + if (tableDep) { + currentDepName = tableDep[1] + // If the section header line itself carries an ignore marker, + // immediately add the dep + if (hasIgnoreMarker(line)) { + ignored.add(currentDepName) + } + } + continue + } + + let isIgnored = hasIgnoreMarker(line) + + if (isIgnored && isInDependencySection(currentSection)) { + let inlineMatch = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=/) + if (inlineMatch) { + ignored.add(inlineMatch[1]) + continue + } + } + + if (isIgnored && currentDepName) { + ignored.add(currentDepName) + continue + } + } +} + +/** + * Checks if a section name is a dependency section. + * @param {string} section - the TOML section name + * @returns {boolean} + * @private + */ +function isInDependencySection(section) { + return section === 'dependencies' || + section === 'dev-dependencies' || + section === 'build-dependencies' || + section === 'workspace.dependencies' +} + +/** + * Creates a PackageURL for a Cargo/crates.io package. + * @param {string} name - the crate name + * @param {string} version - the crate version + * @returns {PackageURL} the package URL + * @private + */ +function toPurl(name, version) { + return new PackageURL(ecosystem, undefined, name, version, undefined, undefined) +} + +/** + * Creates a PackageURL for a local path dependency, marked with a + * {@code repository_url=local} qualifier so the backend can distinguish + * it from registry packages and skip vulnerability checks. + * @param {string} name - the crate name + * @param {string} version - the crate version + * @returns {PackageURL} the package URL with local qualifier + * @private + */ +function toPathDepPurl(name, version) { + return new PackageURL(ecosystem, undefined, name, version, { repository_url: 'local' }, undefined) +} diff --git a/test/provider.test.js b/test/provider.test.js index 40a87af7..87e383b7 100644 --- a/test/provider.test.js +++ b/test/provider.test.js @@ -124,6 +124,12 @@ suite('testing the matchForLicense utility function', () => { expect(provider.isSupported('requirements.txt')).to.be.true; }); + test('should match Rust Cargo provider for Cargo.toml', () => { + const provider = matchForLicense('/some/path/Cargo.toml', availableProviders); + expect(provider).to.exist; + expect(provider.isSupported('Cargo.toml')).to.be.true; + }); + test('all matched providers should have readLicenseFromManifest method', () => { const manifests = [ 'pom.xml', @@ -131,7 +137,8 @@ suite('testing the matchForLicense utility function', () => { 'build.gradle.kts', 'package.json', 'go.mod', - 'requirements.txt' + 'requirements.txt', + 'Cargo.toml' ]; manifests.forEach(manifest => { diff --git a/test/providers/license.test.js b/test/providers/license.test.js index a3c99071..9a075c69 100644 --- a/test/providers/license.test.js +++ b/test/providers/license.test.js @@ -10,6 +10,7 @@ import Javascript_npm from '../../src/providers/javascript_npm.js' import Javascript_pnpm from '../../src/providers/javascript_pnpm.js' import Javascript_yarn from '../../src/providers/javascript_yarn.js' import pythonPipProvider from '../../src/providers/python_pip.js' +import rustCargoProvider from '../../src/providers/rust_cargo.js' import { normalizeLicensesResponse } from '../../src/license/licenses_api.js' suite('normalizeLicensesResponse', () => { @@ -160,6 +161,31 @@ suite('testing readLicenseFromManifest with existing test manifests', () => { }); }); + suite('Rust Cargo provider', () => { + test('should read ISC license from [package] section', () => { + const cargoPath = path.resolve('test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.toml'); + const license = rustCargoProvider.readLicenseFromManifest(cargoPath); + expect(license).to.equal('ISC'); + }); + + test('should read ISC license from [workspace.package] section', () => { + const cargoPath = path.resolve('test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.toml'); + const license = rustCargoProvider.readLicenseFromManifest(cargoPath); + expect(license).to.equal('ISC'); + }); + + test('should return null when license not present', () => { + const cargoPath = path.resolve('test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml'); + const license = rustCargoProvider.readLicenseFromManifest(cargoPath); + expect(license).to.be.null; + }); + + test('should return null for non-existent file', () => { + const license = rustCargoProvider.readLicenseFromManifest('/fake/path/Cargo.toml'); + expect(license).to.be.null; + }); + }); + suite('All providers have readLicenseFromManifest method', () => { const allProviders = [ { name: 'Java Maven', instance: new Java_maven() }, @@ -169,7 +195,8 @@ suite('testing readLicenseFromManifest with existing test manifests', () => { { name: 'JavaScript pnpm', instance: new Javascript_pnpm() }, { name: 'JavaScript yarn', instance: new Javascript_yarn() }, { name: 'Golang', instance: golangGomodulesProvider }, - { name: 'Python', instance: pythonPipProvider } + { name: 'Python', instance: pythonPipProvider }, + { name: 'Rust Cargo', instance: rustCargoProvider } ]; allProviders.forEach(({ name, instance }) => { diff --git a/test/providers/provider_manifests/cargo/with_lock_file/Cargo.lock b/test/providers/provider_manifests/cargo/with_lock_file/Cargo.lock new file mode 100644 index 00000000..fdffa2a0 --- /dev/null +++ b/test/providers/provider_manifests/cargo/with_lock_file/Cargo.lock @@ -0,0 +1 @@ +# placeholder diff --git a/test/providers/provider_manifests/cargo/with_lock_file/Cargo.toml b/test/providers/provider_manifests/cargo/with_lock_file/Cargo.toml new file mode 100644 index 00000000..d8aaeee2 --- /dev/null +++ b/test/providers/provider_manifests/cargo/with_lock_file/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0" diff --git a/test/providers/provider_manifests/cargo/without_lock_file/Cargo.toml b/test/providers/provider_manifests/cargo/without_lock_file/Cargo.toml new file mode 100644 index 00000000..d8aaeee2 --- /dev/null +++ b/test/providers/provider_manifests/cargo/without_lock_file/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0" diff --git a/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.lock b/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.lock new file mode 100644 index 00000000..51b227f7 --- /dev/null +++ b/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.lock @@ -0,0 +1,7 @@ +# This file is automatically @generated by Cargo. +# It is not intended for manual editing. +version = 3 + +[[package]] +name = "member1" +version = "1.0.0" diff --git a/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.toml b/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.toml new file mode 100644 index 00000000..598f5c61 --- /dev/null +++ b/test/providers/provider_manifests/cargo/workspace_member_with_lock/Cargo.toml @@ -0,0 +1,6 @@ +[workspace] +members = ["member1"] + +[workspace.package] +version = "1.0.0" +edition = "2021" diff --git a/test/providers/provider_manifests/cargo/workspace_member_with_lock/member1/Cargo.toml b/test/providers/provider_manifests/cargo/workspace_member_with_lock/member1/Cargo.toml new file mode 100644 index 00000000..9fd83a80 --- /dev/null +++ b/test/providers/provider_manifests/cargo/workspace_member_with_lock/member1/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "member1" +version = "1.0.0" +edition = "2021" + +[dependencies] +serde = "1.0" diff --git a/test/providers/provider_manifests/cargo/workspace_member_without_lock/Cargo.toml b/test/providers/provider_manifests/cargo/workspace_member_without_lock/Cargo.toml new file mode 100644 index 00000000..4478f8d4 --- /dev/null +++ b/test/providers/provider_manifests/cargo/workspace_member_without_lock/Cargo.toml @@ -0,0 +1,2 @@ +[workspace] +members = ["member1"] diff --git a/test/providers/provider_manifests/cargo/workspace_member_without_lock/member1/Cargo.toml b/test/providers/provider_manifests/cargo/workspace_member_without_lock/member1/Cargo.toml new file mode 100644 index 00000000..9fd83a80 --- /dev/null +++ b/test/providers/provider_manifests/cargo/workspace_member_without_lock/member1/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "member1" +version = "1.0.0" +edition = "2021" + +[dependencies] +serde = "1.0" diff --git a/test/providers/rust_cargo.test.js b/test/providers/rust_cargo.test.js new file mode 100644 index 00000000..dda73448 --- /dev/null +++ b/test/providers/rust_cargo.test.js @@ -0,0 +1,523 @@ +import fs from 'fs' +import path from 'path' + +import { expect } from 'chai' +import esmock from 'esmock' +import { useFakeTimers } from 'sinon' + +import { availableProviders, match } from '../../src/provider.js' +import rustCargo from '../../src/providers/rust_cargo.js' + +let clock + +/** + * Creates a mocked rust_cargo provider that uses a pre-built cargo_metadata.json + * instead of actually invoking the `cargo` binary. + * @param {string} testDir - the test directory containing cargo_metadata.json and Cargo.toml + * @returns {Promise} the mocked provider module + */ +async function createMockProvider(testDir) { + const metadataPath = path.join(testDir, 'cargo_metadata.json') + const metadataJson = fs.readFileSync(metadataPath, 'utf-8') + + return esmock('../../src/providers/rust_cargo.js', { + '../../src/tools.js': { + getCustomPath: () => 'cargo', + invokeCommand: (bin, args) => { + if (args.includes('--version')) { + return 'cargo 1.75.0 (1d8b05cdd 2023-11-20)' + } + if (args.includes('metadata')) { + return metadataJson + } + return '' + } + } + }) +} + +/** + * Asserts that the provider output for a given analysis type matches the expected SBOM file. + * @param {string} testDir - the test fixture directory + * @param {'stack'|'component'} analysisType - 'stack' or 'component' + */ +async function assertSbomMatchesExpected(testDir, analysisType) { + let expectedSbom = fs.readFileSync(`${testDir}/expected_sbom_${analysisType}_analysis.json`).toString() + expectedSbom = JSON.stringify(JSON.parse(expectedSbom), null, 4) + + let provider = await createMockProvider(testDir) + let manifest = `${testDir}/Cargo.toml` + let providedData = analysisType === 'stack' + ? provider.provideStack(manifest) + : provider.provideComponent(manifest) + + expect(providedData.ecosystem).equal('cargo') + expect(providedData.contentType).equal('application/vnd.cyclonedx+json') + expect(JSON.stringify(JSON.parse(providedData.content), null, 4).trim()).to.deep.equal(expectedSbom.trim()) +} + +/** + * Creates a mock provider and returns the parsed SBOM for a given analysis type. + * @param {string} testDir - the test fixture directory + * @param {'stack'|'component'} analysisType - 'stack' or 'component' + * @returns {Promise} the parsed SBOM object + */ +async function getParsedSbom(testDir, analysisType) { + let provider = await createMockProvider(testDir) + let manifest = `${testDir}/Cargo.toml` + let providedData = analysisType === 'stack' + ? provider.provideStack(manifest) + : provider.provideComponent(manifest) + return JSON.parse(providedData.content) +} + +suite('testing the rust-cargo data provider', () => { + [ + { name: 'Cargo.toml', expected: true }, + { name: 'package.json', expected: false }, + { name: 'pom.xml', expected: false }, + { name: 'go.mod', expected: false }, + { name: 'cargo.toml', expected: false }, + ].forEach(testCase => { + test(`verify isSupported returns ${testCase.expected} for ${testCase.name}`, () => + expect(rustCargo.isSupported(testCase.name)).to.equal(testCase.expected) + ) + }); + + test('verify validateLockFile returns true when Cargo.lock exists', () => { + expect(rustCargo.validateLockFile('test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore')).to.equal(true) + }) + + test('verify validateLockFile returns true for member crate when Cargo.lock is at workspace root', () => { + expect(rustCargo.validateLockFile('test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-a')).to.equal(true) + }) + + test('verify validateLockFile returns false when Cargo.lock does not exist anywhere', () => { + expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/without_lock_file')).to.equal(false) + }) + + test('verify match function finds Cargo provider with lock file', () => { + let provider = match('test/providers/provider_manifests/cargo/with_lock_file/Cargo.toml', availableProviders) + expect(provider).to.not.be.null + expect(provider.isSupported('Cargo.toml')).to.be.true + }) + + test('verify match function throws when Cargo.lock is missing', () => { + expect(() => match('test/providers/provider_manifests/cargo/without_lock_file/Cargo.toml', availableProviders)) + .to.throw('Cargo.toml requires a lock file') + }) + + test('verify workspace member crate finds Cargo.lock at workspace root', () => { + let provider = match('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1/Cargo.toml', availableProviders) + expect(provider).to.not.be.null + expect(provider.isSupported('Cargo.toml')).to.be.true + }) + + test('verify workspace member crate throws when workspace root has no Cargo.lock', () => { + expect(() => match('test/providers/provider_manifests/cargo/workspace_member_without_lock/member1/Cargo.toml', availableProviders)) + .to.throw('Cargo.toml requires a lock file') + }) + + test('verify validateLockFile returns true for workspace member when Cargo.lock is at workspace root', () => { + expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_with_lock/member1')).to.equal(true) + }) + + test('verify validateLockFile returns false for workspace member when workspace root has no Cargo.lock', () => { + expect(rustCargo.validateLockFile('test/providers/provider_manifests/cargo/workspace_member_without_lock/member1')).to.equal(false) + }) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing the rust-cargo single crate without ignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore' + + test('verify Cargo.toml sbom provided for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify Cargo.toml sbom provided for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing the rust-cargo single crate with ignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore' + + test('verify Cargo.toml sbom provided for stack analysis with ignored deps', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify Cargo.toml sbom provided for component analysis with ignored deps', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing the rust-cargo virtual workspace', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace' + + test('verify Cargo.toml sbom provided for stack analysis with virtual workspace', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify Cargo.toml sbom provided for component analysis with virtual workspace', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing the rust-cargo workspace with root package', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_workspace_with_root' + + test('verify Cargo.toml sbom provided for stack analysis with workspace root package', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify Cargo.toml sbom provided for component analysis with workspace root package', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo dependency filtering', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore' + + test('verify dev dependencies are excluded from stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + // tempfile is a dev dependency and should not appear in the SBOM + expect(sbom.components.find(c => c.name === 'tempfile')).to.be.undefined + + // serde and tokio (normal deps) should be present + expect(sbom.components.find(c => c.name === 'serde')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + }).timeout(10000) + + test('verify dev dependencies are excluded from component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'tempfile')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo error handling', () => { + test('verify error when cargo binary is not accessible', async () => { + let provider = await esmock('../../src/providers/rust_cargo.js', { + '../../src/tools.js': { + getCustomPath: () => '/nonexistent/cargo', + invokeCommand: () => { + let err = new Error('spawn /nonexistent/cargo ENOENT') + err.code = 'ENOENT' + throw err + } + } + }) + + expect(() => provider.provideStack('test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml')) + .to.throw('cargo binary is not accessible at "/nonexistent/cargo"') + }).timeout(10000) + + test('verify error when cargo metadata fails (e.g. invalid Cargo.toml)', async () => { + let provider = await esmock('../../src/providers/rust_cargo.js', { + '../../src/tools.js': { + getCustomPath: () => 'cargo', + invokeCommand: (bin, args) => { + if (args.includes('--version')) { + return 'cargo 1.75.0 (1d8b05cdd 2023-11-20)' + } + if (args.includes('metadata')) { + throw new Error('error: failed to parse manifest at `/fake/Cargo.toml`\n\nCaused by:\n missing field `name`') + } + return '' + } + } + }) + + expect(() => provider.provideStack('test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml')) + .to.throw('failed to execute cargo metadata') + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo ignore with underscore/hyphen normalization', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore' + + test('verify hyphenated ignore name matches underscored crate in stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + // Cargo.toml uses "serde-derive" (hyphen) but metadata reports "serde_derive" (underscore) + expect(sbom.components.find(c => c.name === 'serde_derive')).to.be.undefined + + // serde and tokio should still be present + expect(sbom.components.find(c => c.name === 'serde')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + }).timeout(10000) + + test('verify hyphenated ignore name matches underscored crate in component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'serde_derive')).to.be.undefined + expect(sbom.components.find(c => c.name === 'serde')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo ignore annotations with trustify-da-ignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore' + + test('verify trustify-da-ignore dependency is excluded from stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + // serde is annotated with trustify-da-ignore and should not appear + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'serde_derive')).to.be.undefined + + // tokio should still be present + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + }).timeout(10000) + + test('verify trustify-da-ignore dependency is excluded from component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo ignore annotations with exhortignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore' + + test('verify exhortignore dependency is excluded from stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + // serde is annotated with exhortignore and should not appear + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'serde_derive')).to.be.undefined + + // tokio should still be present + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + }).timeout(10000) + + test('verify exhortignore dependency is excluded from component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo virtual workspace ignore with trustify-da-ignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify serde is excluded and tokio is present in stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.not.be.undefined + }).timeout(10000) + + test('verify component analysis has no member deps (no [workspace.dependencies])', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + // No [workspace.dependencies] → CA returns only the synthetic root + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo virtual workspace ignore with exhortignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify serde is excluded and tokio is present in stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.not.be.undefined + }).timeout(10000) + + test('verify component analysis has no member deps (no [workspace.dependencies])', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + // No [workspace.dependencies] → CA returns only the synthetic root + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo workspace with root ignore with trustify-da-ignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify serde is excluded and sub-crate not in graph in stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + // sub-crate is a workspace member but NOT in the root's dependency graph + expect(sbom.components.find(c => c.name === 'sub-crate')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.be.undefined + }).timeout(10000) + + test('verify serde is excluded and sub-crate not in graph in component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'sub-crate')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo virtual workspace with glob member patterns', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify serde is excluded via glob-resolved member ignore', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.not.be.undefined + }).timeout(10000) + + test('verify component analysis has no member deps (no [workspace.dependencies])', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + // No [workspace.dependencies] → CA returns only the synthetic root + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-a')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo virtual workspace with [workspace.dependencies]', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify CA includes only [workspace.dependencies] entries', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + // serde and tokio are in [workspace.dependencies] → should be present + expect(sbom.components.find(c => c.name === 'serde')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + + // crate-a and crate-b are workspace members, not in [workspace.dependencies] + expect(sbom.components.find(c => c.name === 'crate-a')).to.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.be.undefined + + // pin-project-lite is transitive, should not appear in CA + expect(sbom.components.find(c => c.name === 'pin-project-lite')).to.be.undefined + }).timeout(10000) + + test('verify SA includes full member trees', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'crate-a')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'crate-b')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'serde')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.not.be.undefined + expect(sbom.components.find(c => c.name === 'pin-project-lite')).to.not.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo workspace with root ignore with exhortignore', () => { + const testDir = 'test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore' + + test('verify sbom matches expected for stack analysis', async () => { + await assertSbomMatchesExpected(testDir, 'stack') + }).timeout(10000) + + test('verify sbom matches expected for component analysis', async () => { + await assertSbomMatchesExpected(testDir, 'component') + }).timeout(10000) + + test('verify serde is excluded and sub-crate not in graph in stack analysis', async () => { + let sbom = await getParsedSbom(testDir, 'stack') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + // sub-crate is a workspace member but NOT in the root's dependency graph + expect(sbom.components.find(c => c.name === 'sub-crate')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.be.undefined + }).timeout(10000) + + test('verify serde is excluded and sub-crate not in graph in component analysis', async () => { + let sbom = await getParsedSbom(testDir, 'component') + + expect(sbom.components.find(c => c.name === 'serde')).to.be.undefined + expect(sbom.components.find(c => c.name === 'sub-crate')).to.be.undefined + expect(sbom.components.find(c => c.name === 'tokio')).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); + +suite('testing rust-cargo license detection', () => { + const singleCrateLicenseDir = 'test/providers/tst_manifests/cargo/cargo_single_crate_with_license' + const virtualWorkspaceLicenseDir = 'test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license' + + // readLicenseFromManifest unit tests are in license.test.js (shared across all providers) + + test('verify license is included in SBOM for single crate (stack analysis)', async () => { + await assertSbomMatchesExpected(singleCrateLicenseDir, 'stack') + }).timeout(10000) + + test('verify license is included in SBOM for single crate (component analysis)', async () => { + await assertSbomMatchesExpected(singleCrateLicenseDir, 'component') + }).timeout(10000) + + test('verify license is included in SBOM for virtual workspace (stack analysis)', async () => { + await assertSbomMatchesExpected(virtualWorkspaceLicenseDir, 'stack') + }).timeout(10000) + + test('verify license is included in SBOM for virtual workspace (component analysis)', async () => { + await assertSbomMatchesExpected(virtualWorkspaceLicenseDir, 'component') + }).timeout(10000) + + test('verify license field present in single crate SBOM metadata component', async () => { + let sbom = await getParsedSbom(singleCrateLicenseDir, 'stack') + expect(sbom.metadata.component.licenses).to.deep.equal([{ license: { id: 'ISC' } }]) + }).timeout(10000) + + test('verify license field present in virtual workspace SBOM metadata component', async () => { + let sbom = await getParsedSbom(virtualWorkspaceLicenseDir, 'stack') + expect(sbom.metadata.component.licenses).to.deep.equal([{ license: { id: 'ISC' } }]) + }).timeout(10000) + + test('verify no license field in SBOM when manifest has no license', async () => { + let sbom = await getParsedSbom('test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore', 'stack') + expect(sbom.metadata.component.licenses).to.be.undefined + }).timeout(10000) +}).beforeAll(() => clock = useFakeTimers(new Date('2023-08-07T00:00:00.000Z'))).afterAll(() => clock.restore()); diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml new file mode 100644 index 00000000..c3206cfc --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/Cargo.toml @@ -0,0 +1,11 @@ +[package] +name = "my-test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" +tokio = { version = "1.35.0", features = ["full"] } + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/cargo_metadata.json new file mode 100644 index 00000000..1239801d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/cargo_metadata.json @@ -0,0 +1,110 @@ +{ + "packages": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tokio", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "serde_derive", "kind": null } + ] + }, + { + "name": "serde_derive", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/my-test-crate#0.1.0" + ], + "workspace_root": "/fake/path/my-test-crate", + "resolve": { + "root": "path+file:///fake/path/my-test-crate#0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..4fc7de2c --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_component_analysis.json @@ -0,0 +1,55 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..3773710d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_no_ignore/expected_sbom_stack_analysis.json @@ -0,0 +1,81 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "serde_derive", + "version": "1.0.193", + "purl": "pkg:cargo/serde_derive@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde_derive@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [ + "pkg:cargo/serde_derive@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde_derive@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.toml new file mode 100644 index 00000000..4799e2c4 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/Cargo.toml @@ -0,0 +1,11 @@ +[package] +name = "my-test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" # exhortignore +tokio = { version = "1.35.0", features = ["full"] } + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/cargo_metadata.json new file mode 100644 index 00000000..1239801d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/cargo_metadata.json @@ -0,0 +1,110 @@ +{ + "packages": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tokio", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "serde_derive", "kind": null } + ] + }, + { + "name": "serde_derive", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/my-test-crate#0.1.0" + ], + "workspace_root": "/fake/path/my-test-crate", + "resolve": { + "root": "path+file:///fake/path/my-test-crate#0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..1511cb4d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_component_analysis.json @@ -0,0 +1,43 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..289b00a7 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_exhortignore/expected_sbom_stack_analysis.json @@ -0,0 +1,56 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.lock new file mode 100644 index 00000000..fdffa2a0 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.lock @@ -0,0 +1 @@ +# placeholder diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.toml new file mode 100644 index 00000000..a9c8050e --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/Cargo.toml @@ -0,0 +1,14 @@ +[package] +name = "my-test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" +tokio = { version = "1.35.0", features = ["full"] } + +[dependencies.serde-derive] # trustify-da-ignore +version = "1.0.193" + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/cargo_metadata.json new file mode 100644 index 00000000..476e04d5 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_hyphen_ignore/cargo_metadata.json @@ -0,0 +1,108 @@ +{ + "packages": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "serde_derive", "kind": null }, + { "name": "tokio", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "serde_derive", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/my-test-crate#0.1.0" + ], + "workspace_root": "/fake/path/my-test-crate", + "resolve": { + "root": "path+file:///fake/path/my-test-crate#0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.toml new file mode 100644 index 00000000..54b20ca8 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/Cargo.toml @@ -0,0 +1,11 @@ +[package] +name = "my-test-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" # trustify-da-ignore +tokio = { version = "1.35.0", features = ["full"] } + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/cargo_metadata.json new file mode 100644 index 00000000..1239801d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/cargo_metadata.json @@ -0,0 +1,110 @@ +{ + "packages": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tokio", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "serde_derive", "kind": null } + ] + }, + { + "name": "serde_derive", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/my-test-crate#0.1.0" + ], + "workspace_root": "/fake/path/my-test-crate", + "resolve": { + "root": "path+file:///fake/path/my-test-crate#0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..1511cb4d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_component_analysis.json @@ -0,0 +1,43 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..289b00a7 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_ignore/expected_sbom_stack_analysis.json @@ -0,0 +1,56 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.toml new file mode 100644 index 00000000..a82de102 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/Cargo.toml @@ -0,0 +1,12 @@ +[package] +name = "my-test-crate" +version = "0.1.0" +edition = "2021" +license = "ISC" + +[dependencies] +serde = "1.0.193" +tokio = { version = "1.35.0", features = ["full"] } + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/cargo_metadata.json new file mode 100644 index 00000000..1239801d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/cargo_metadata.json @@ -0,0 +1,110 @@ +{ + "packages": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tokio", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "serde_derive", "kind": null } + ] + }, + { + "name": "serde_derive", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/my-test-crate#0.1.0" + ], + "workspace_root": "/fake/path/my-test-crate", + "resolve": { + "root": "path+file:///fake/path/my-test-crate#0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/my-test-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde_derive@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_component_analysis.json new file mode 100644 index 00000000..c4453ccc --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_component_analysis.json @@ -0,0 +1,69 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..13faea24 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_single_crate_with_license/expected_sbom_stack_analysis.json @@ -0,0 +1,95 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + } + }, + "components": [ + { + "name": "my-test-crate", + "version": "0.1.0", + "purl": "pkg:cargo/my-test-crate@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-test-crate@0.1.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "serde_derive", + "version": "1.0.193", + "purl": "pkg:cargo/serde_derive@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde_derive@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-test-crate@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [ + "pkg:cargo/serde_derive@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde_derive@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.toml new file mode 100644 index 00000000..76c52381 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/Cargo.toml @@ -0,0 +1,6 @@ +[workspace] +members = [ + "crate-a", + "crate-b", +] +resolver = "2" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/cargo_metadata.json new file mode 100644 index 00000000..7e520d60 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-a/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-a/Cargo.toml new file mode 100644 index 00000000..4c79e6eb --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-a/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-a" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-b/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-b/Cargo.toml new file mode 100644 index 00000000..8974ad47 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/crate-b/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-b" +version = "0.2.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_component_analysis.json new file mode 100644 index 00000000..78d8b1a6 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..06639d2f --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace/expected_sbom_stack_analysis.json @@ -0,0 +1,94 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace@0.0.0" + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/serde@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.lock new file mode 100644 index 00000000..fdffa2a0 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.lock @@ -0,0 +1 @@ +# placeholder diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.toml new file mode 100644 index 00000000..a7cff588 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/Cargo.toml @@ -0,0 +1,5 @@ +[workspace] +members = [ + "crates/*", +] +resolver = "2" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/cargo_metadata.json new file mode 100644 index 00000000..4a07cedb --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace_glob_members", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace_glob_members/crates/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-a/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-a/Cargo.toml new file mode 100644 index 00000000..226e8c62 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-a/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-a" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" # trustify-da-ignore diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-b/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-b/Cargo.toml new file mode 100644 index 00000000..8974ad47 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/crates/crate-b/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-b" +version = "0.2.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_component_analysis.json new file mode 100644 index 00000000..8fa1c7a5 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_glob_members", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_glob_members", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..3da42dad --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_glob_members/expected_sbom_stack_analysis.json @@ -0,0 +1,81 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_glob_members", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_glob_members", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0" + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_glob_members@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.toml new file mode 100644 index 00000000..76c52381 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/Cargo.toml @@ -0,0 +1,6 @@ +[workspace] +members = [ + "crate-a", + "crate-b", +] +resolver = "2" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/cargo_metadata.json new file mode 100644 index 00000000..71d02678 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace_with_exhortignore", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_exhortignore/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-a/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-a/Cargo.toml new file mode 100644 index 00000000..aad0c0e0 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-a/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-a" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" # exhortignore diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-b/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-b/Cargo.toml new file mode 100644 index 00000000..8974ad47 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/crate-b/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-b" +version = "0.2.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..e61b9b94 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_exhortignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_exhortignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..4b88eb4f --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_exhortignore/expected_sbom_stack_analysis.json @@ -0,0 +1,81 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_exhortignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_exhortignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0" + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_exhortignore@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.toml new file mode 100644 index 00000000..76c52381 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/Cargo.toml @@ -0,0 +1,6 @@ +[workspace] +members = [ + "crate-a", + "crate-b", +] +resolver = "2" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/cargo_metadata.json new file mode 100644 index 00000000..25957c60 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace_with_ignore", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_ignore/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-a/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-a/Cargo.toml new file mode 100644 index 00000000..226e8c62 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-a/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-a" +version = "0.1.0" +edition = "2021" + +[dependencies] +serde = "1.0.193" # trustify-da-ignore diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-b/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-b/Cargo.toml new file mode 100644 index 00000000..8974ad47 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/crate-b/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "crate-b" +version = "0.2.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..79032065 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_ignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_ignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..46b781e8 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_ignore/expected_sbom_stack_analysis.json @@ -0,0 +1,81 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_ignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_ignore", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0" + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_ignore@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.lock new file mode 100644 index 00000000..fdffa2a0 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.lock @@ -0,0 +1 @@ +# placeholder diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.toml new file mode 100644 index 00000000..d1e1beca --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/Cargo.toml @@ -0,0 +1,13 @@ +[workspace] +members = [ + "crate-a", + "crate-b", +] +resolver = "2" + +[workspace.package] +license = "ISC" + +[workspace.dependencies] +serde = "1.0.193" +tokio = "1.35.0" diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/cargo_metadata.json new file mode 100644 index 00000000..9a4b6ea8 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace_with_license", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_license/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_component_analysis.json new file mode 100644 index 00000000..b7d93e02 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_component_analysis.json @@ -0,0 +1,69 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_license", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_license", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..cd248f0d --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_license/expected_sbom_stack_analysis.json @@ -0,0 +1,108 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_license", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_license", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "licenses": [ + { + "license": { + "id": "ISC" + } + } + ] + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_license@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/serde@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.lock new file mode 100644 index 00000000..fdffa2a0 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.lock @@ -0,0 +1 @@ +# placeholder diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.toml new file mode 100644 index 00000000..144ece21 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/Cargo.toml @@ -0,0 +1,10 @@ +[workspace] +members = [ + "crate-a", + "crate-b", +] +resolver = "2" + +[workspace.dependencies] +serde = "1.0.193" +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/cargo_metadata.json new file mode 100644 index 00000000..5adcdd56 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/cargo_metadata.json @@ -0,0 +1,90 @@ +{ + "packages": [ + { + "name": "crate-a", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-a#0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null } + ] + }, + { + "name": "crate-b", + "version": "0.2.0", + "id": "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-b#0.2.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-a#0.1.0", + "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-b#0.2.0" + ], + "workspace_root": "/fake/path/cargo_virtual_workspace_with_workspace_deps", + "resolve": { + "root": null, + "nodes": [ + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-a#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_virtual_workspace_with_workspace_deps/crate-b#0.2.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_component_analysis.json new file mode 100644 index 00000000..86799afa --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_component_analysis.json @@ -0,0 +1,55 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_workspace_deps", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_workspace_deps", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193", + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..21bb6607 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_virtual_workspace_with_workspace_deps/expected_sbom_stack_analysis.json @@ -0,0 +1,94 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "cargo_virtual_workspace_with_workspace_deps", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0" + } + }, + "components": [ + { + "name": "cargo_virtual_workspace_with_workspace_deps", + "version": "0.0.0", + "purl": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "type": "application", + "bom-ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0" + }, + { + "name": "crate-a", + "version": "0.1.0", + "purl": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-a@0.1.0?repository_url=local" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + }, + { + "name": "crate-b", + "version": "0.2.0", + "purl": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "type": "library", + "bom-ref": "pkg:cargo/crate-b@0.2.0?repository_url=local" + }, + { + "name": "tokio", + "version": "1.35.0", + "purl": "pkg:cargo/tokio@1.35.0", + "type": "library", + "bom-ref": "pkg:cargo/tokio@1.35.0" + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "purl": "pkg:cargo/pin-project-lite@0.2.13", + "type": "library", + "bom-ref": "pkg:cargo/pin-project-lite@0.2.13" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/cargo_virtual_workspace_with_workspace_deps@0.0.0", + "dependsOn": [ + "pkg:cargo/crate-a@0.1.0?repository_url=local", + "pkg:cargo/crate-b@0.2.0?repository_url=local" + ] + }, + { + "ref": "pkg:cargo/crate-a@0.1.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/serde@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + }, + { + "ref": "pkg:cargo/crate-b@0.2.0?repository_url=local", + "dependsOn": [ + "pkg:cargo/tokio@1.35.0" + ] + }, + { + "ref": "pkg:cargo/tokio@1.35.0", + "dependsOn": [ + "pkg:cargo/pin-project-lite@0.2.13" + ] + }, + { + "ref": "pkg:cargo/pin-project-lite@0.2.13", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.toml new file mode 100644 index 00000000..b740cbb4 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/Cargo.toml @@ -0,0 +1,16 @@ +[package] +name = "my-workspace-root" +version = "0.1.0" +edition = "2021" + +[workspace] +members = [ + "sub-crate", +] +resolver = "2" + +[dependencies] +serde = "1.0.193" + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/cargo_metadata.json new file mode 100644 index 00000000..ccd5d651 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/cargo_metadata.json @@ -0,0 +1,106 @@ +{ + "packages": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "sub-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0" + ], + "workspace_root": "/fake/path/cargo_workspace_with_root", + "resolve": { + "root": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_component_analysis.json new file mode 100644 index 00000000..b6fd4381 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_component_analysis.json @@ -0,0 +1,43 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-workspace-root@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..b6fd4381 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/expected_sbom_stack_analysis.json @@ -0,0 +1,43 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + }, + { + "name": "serde", + "version": "1.0.193", + "purl": "pkg:cargo/serde@1.0.193", + "type": "library", + "bom-ref": "pkg:cargo/serde@1.0.193" + } + ], + "dependencies": [ + { + "ref": "pkg:cargo/my-workspace-root@0.1.0", + "dependsOn": [ + "pkg:cargo/serde@1.0.193" + ] + }, + { + "ref": "pkg:cargo/serde@1.0.193", + "dependsOn": [] + } + ] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root/sub-crate/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/sub-crate/Cargo.toml new file mode 100644 index 00000000..2ffba0bf --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root/sub-crate/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "sub-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.toml new file mode 100644 index 00000000..d206dacc --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/Cargo.toml @@ -0,0 +1,16 @@ +[package] +name = "my-workspace-root" +version = "0.1.0" +edition = "2021" + +[workspace] +members = [ + "sub-crate", +] +resolver = "2" + +[dependencies] +serde = "1.0.193" # exhortignore + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/cargo_metadata.json new file mode 100644 index 00000000..ccd5d651 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/cargo_metadata.json @@ -0,0 +1,106 @@ +{ + "packages": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "sub-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0" + ], + "workspace_root": "/fake/path/cargo_workspace_with_root", + "resolve": { + "root": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..d28a4508 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..d28a4508 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/expected_sbom_stack_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/sub-crate/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/sub-crate/Cargo.toml new file mode 100644 index 00000000..2ffba0bf --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_exhortignore/sub-crate/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "sub-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] } diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.lock b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.lock new file mode 100644 index 00000000..1fcedc5a --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.lock @@ -0,0 +1,2 @@ +# This file is a placeholder for lock file validation. +# The actual dependency resolution is done by `cargo metadata`. diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.toml new file mode 100644 index 00000000..b744b480 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/Cargo.toml @@ -0,0 +1,16 @@ +[package] +name = "my-workspace-root" +version = "0.1.0" +edition = "2021" + +[workspace] +members = [ + "sub-crate", +] +resolver = "2" + +[dependencies] +serde = "1.0.193" # trustify-da-ignore + +[dev-dependencies] +tempfile = "3.8.0" diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/cargo_metadata.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/cargo_metadata.json new file mode 100644 index 00000000..ccd5d651 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/cargo_metadata.json @@ -0,0 +1,106 @@ +{ + "packages": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "source": null, + "dependencies": [ + { "name": "serde", "kind": null }, + { "name": "tempfile", "kind": "dev" } + ] + }, + { + "name": "sub-crate", + "version": "0.1.0", + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "source": null, + "dependencies": [ + { "name": "tokio", "kind": null } + ] + }, + { + "name": "serde", + "version": "1.0.193", + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tokio", + "version": "1.35.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [ + { "name": "pin-project-lite", "kind": null } + ] + }, + { + "name": "pin-project-lite", + "version": "0.2.13", + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + }, + { + "name": "tempfile", + "version": "3.8.0", + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "source": "registry+https://github.com/rust-lang/crates.io-index", + "dependencies": [] + } + ], + "workspace_members": [ + "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0" + ], + "workspace_root": "/fake/path/cargo_workspace_with_root", + "resolve": { + "root": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "nodes": [ + { + "id": "path+file:///fake/path/cargo_workspace_with_root#my-workspace-root@0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "dep_kinds": [{ "kind": null, "target": null }] + }, + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "dep_kinds": [{ "kind": "dev", "target": null }] + } + ] + }, + { + "id": "path+file:///fake/path/cargo_workspace_with_root/sub-crate#0.1.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#serde@1.0.193", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tokio@1.35.0", + "deps": [ + { + "pkg": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "dep_kinds": [{ "kind": null, "target": null }] + } + ] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#pin-project-lite@0.2.13", + "deps": [] + }, + { + "id": "registry+https://github.com/rust-lang/crates.io-index#tempfile@3.8.0", + "deps": [] + } + ] + } +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_component_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_component_analysis.json new file mode 100644 index 00000000..d28a4508 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_component_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_stack_analysis.json b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_stack_analysis.json new file mode 100644 index 00000000..d28a4508 --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/expected_sbom_stack_analysis.json @@ -0,0 +1,25 @@ +{ + "bomFormat": "CycloneDX", + "specVersion": "1.4", + "version": 1, + "metadata": { + "timestamp": "2023-08-07T00:00:00.000Z", + "component": { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + }, + "components": [ + { + "name": "my-workspace-root", + "version": "0.1.0", + "purl": "pkg:cargo/my-workspace-root@0.1.0", + "type": "application", + "bom-ref": "pkg:cargo/my-workspace-root@0.1.0" + } + ], + "dependencies": [] +} diff --git a/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/sub-crate/Cargo.toml b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/sub-crate/Cargo.toml new file mode 100644 index 00000000..2ffba0bf --- /dev/null +++ b/test/providers/tst_manifests/cargo/cargo_workspace_with_root_ignore/sub-crate/Cargo.toml @@ -0,0 +1,7 @@ +[package] +name = "sub-crate" +version = "0.1.0" +edition = "2021" + +[dependencies] +tokio = { version = "1.35.0", features = ["full"] }