Comments (5)
@dmikusa-pivotal do you have a particular architecture in mind for this? Assuming we want to conform to the most recent SBOM RFC then we'd want to support both CycloneDX and SPDX.
CycloneDX has a rust cargo module: https://github.com/CycloneDX/cyclonedx-rust-cargo, which could be pre-built and provided by a new buildpack (probably called something like "cyclonedz-rust-cargo" and then the binary invoked in this buildpack. Alternatively I wonder if we could leverage #21 once implemented to install cyclonedx in this buildpack and skip the intermediate buildpack? I haven't fully thought through the implications of this second option, though.
from cargo.
I'm torn on this one.
On one hand, that tool looks nice. It's written by someone at OSWAP and seems to be actively maintained, at least at the moment. On the other hand, we still need a tool for SPDX (I didn't look to see if there's a reliably maintained tool that we could use for that). It's also more dependencies that we have to manage & install into the container.
On the other hand, I'm also thinking that this isn't too complicated of a problem to solve so the buildpack could implement it natively. Then we don't have to manage any dependencies/worry about how to install them into the container. It's also easier to test when you're not calling external commands.
Plus, getting the information from cargo isn't terribly difficult. We're already doing this for a couple of reasons, here's where we get the metadata, and we can use that plugin as an example for how to fetch the information from Cargo metadata.
Again, I haven't looked, but I'm hoping there are Go libraries for writing to SPDX and CycloneDX. That would make it all pretty easy to capture, write out the data, and ensure that we get compatible formatted files output.
@robdimsdale What are your thoughts? How are other language teams handling this?
from cargo.
If your RFC for Syft gets approved then I'd imagine we would want to explore that option? Although it looks like it doesn't yet support Rust, so we'd probably want to see if we can add Rust support to Syft.
from cargo.
Yes, Stephen shared that tool with me shortly after I wrote the note above. I definitely thing Syft is a strong contender. I didn't see support on their website, but when I ran the tool against some Rust apps it worked. There was also a PR that got merged a while back for Rust support, so I think it works they just don't mention it specifically, which is weird.
from cargo.
Oh, if it works then maybe it's just a matter of documenting that support on the README.
from cargo.
Related Issues (20)
- Add `/workspace/bin` to `$PATH` HOT 1
- Add default target for Tiny stack
- Cross compilation HOT 3
- Missing label io.buildpacks.builder.metadata HOT 1
- Should `--locked` be a default argument for the cargo build pack? HOT 3
- Support `cargo build` HOT 4
- Buildpack attempts to build lib members in a workspace HOT 2
- Allow specifying additional args to `cargo install`
- Support building a full workspace or multiple members in the workspace HOT 4
- Allow users to include a list of `cargo install`'d tools that will be available during build
- Condense build and detect into one executable
- Investigate if caching actually helps & how much HOT 2
- Cache CARGO_HOME HOT 3
- Document buildpack configuration in buildpack.toml
- Validate env used to run Cargo HOT 1
- Explore automatically detecting a command to execute
- Add integration tests HOT 1
- Do not allow the `target/` directory to end up in the launch image
- Detect fails with an error if no Cargo.lock or Cargo.toml HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from cargo.