Assume the following Cargo.toml : <div class="high

Using a git patch on a dependecy removes it from the SBOM about cyclonedx-rust-cargo HOT 2 CLOSED

cyclonedx commented on June 6, 2024

Using a git patch on a dependecy removes it from the SBOM

from cyclonedx-rust-cargo.

Comments (2)

ctron commented on June 6, 2024

When using the --all switch, the dependency shows up. So I assume it is some issue when doing the lookup from dependency to package:

cyclonedx-rust-cargo/cargo-cyclonedx/src/generator.rs

Lines 386 to 388 in 19ba261

 if let Some(package_id) = package_ids 

 .package_ids() 

 .find(|id| dependency.matches_id(*id))

from cyclonedx-rust-cargo.

ctron commented on June 6, 2024

I looks like this is due to the fact that that Dependency::matches_id also expects the "source id" to match, which however changes from registry `crates-io` to https://github.com/marshallpierce/rust-base64#d7fb31c4

from cyclonedx-rust-cargo.

Related Issues (20)

Provide an easy way to map an artifact to a SBOM
Present `cargo metadata` output to the user even when there are no errors
Use a license id or name instead of an expression if there is only one license
Support `license-file`
`--output-prefix` conflicts with `--output-pattern` (and is not really a prefix)
Extend metadata via user input HOT 3
Replace qualifier with optional namespace for local packages HOT 1
CycloneDx 1.4 requires "dependsOn" but it is not mandatory in the spec.
`cyclonedx-bom` is unsuitable for `cargo auditable` use case
Hashes for packages from registries with parameters in the URL may not be recorded
`cargo cyclonedx`: make CycloneDX version configurable
`--output-pattern` flag is confusing HOT 1
Switch from `packageurl` to `purl` crate
Support spec version 1.5 HOT 4
The type of external references shouldn't be "open"
Refactor `.new_unchecked()` on enums into `impl From<&str>`
Do round trip tests
Split `specs` module for XML and JSON
Avoid null fields
`cyclonedx_bom::models::tool::Tool` misses `external_references` introduced in v1.4 HOT 1

Using a git patch on a dependecy removes it from the SBOM about cyclonedx-rust-cargo HOT 2 CLOSED

Comments (2)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	if let Some(package_id) = package_ids
	.package_ids()
	.find(\|id\| dependency.matches_id(*id))