Commits on Nov 26, 2024

1. Explore location to generate SBOM precursor files …

   Similar to the generation of `depinfo` files, a function is called to
   generated SBOM precursor file named `output_sbom`. It takes the
   `BuildRunner` & the current `Unit`. The `sbom` flag can be specified as
   a cargo build option, but it's currently not configured fully. To
   test the generation the flag is set to `true`.
   
   * use SBOM types to serialize data
   
   Output source, profile & dependencies
   
   Trying to fetch all dependencies
   
   This ignores dependencies for custom build scripts. The output should be
   similar to what `cargo tree` reports.
   
   Output package dependencies
   
   This is similar to what the `cargo metadata` command outputs.
   
   Extract logic to fetch sbom output files
   
   This extracts the logic to get the list of SBOM output file paths into
   its own function in `BuildRunner` for a given Unit.
   
   Add test file to check sbom output
   
   * add test to check project with bin & lib
   * extract sbom config into helper function
   
   Add build type to dependency
   
   Add test to read JSON
   
   Still needs to check output.
   
   Guard sbom logic behind unstable feature
   
   Add test with custom build script
   
   Integrate review feedback
   
   * disable `sbom` config when `-Zsbom` is not passed as unstable option
   * refactor tests
   * add test
   
   Expand end-to-end tests
   
   This expands the tests to reflect end-to-end tests by comparing the
   generated JSON output files with expected strings.
   
   * add test helper to compare actual & expected JSON content
   * refactor setup of packages in test
   
   Add 'sbom' section to unstable features doc
   
   Append SBOM file suffix instead of replacing
   
   Instead of replacing the file extension, the `.cargo-sbom.json` suffix
   is appended to the output file. This is to keep existing file extensions
   in place.
   
   * refactor logic to set `sbom` property from build config
   * expand build script related test to check JSON output
   
   Integrate review feedback
   
   * use `PackageIdSpec` instead of only `PackageId` in SBOM output
   * change `version` of a dependency to `Option<Version>`
   * output `Vec<CrateType>` instead of only the first found crate type
   * output rustc workspace wrapper
   * update 'warning' string in test using `[WARNING]`
   * use `serde_json::to_writer` to serialize SBOM
   * set sbom suffix in tests explicitely, instead of using `with_extension`
   
   Output additional fields to JSON
   
   In case a unit's profile differs from the profile information on root
   level, it's added to the package information to the JSON output.
   
   The verbose output for `rustc -vV` is also written to the `rustc` field
   in the SBOM.
   
   * rename `fetch_packages` to `collect_packages`
   * update JSON in tests to include profile information
   
   Add test to check multiple crate types
   
   Add test to check artifact name conflict
   
   Use SbomProfile to wrap Profile type
   
   This adds the `SbomProfile` to convert the existing `Profile` into, to
   expose relevant fields. For now it removes the `strip` field, while
   serializing all other fields. It should keep the output consistent, even
   when fields in the `Profile` change, e.g. new field added.
   
   Document package profile
   
   * only export `profile` field in case it differs from root profile
   
   Add test to check different features
   
   The added test uses a crate with multiple features. The main crate uses
   the dependency in the normal build & the custom build script with
   different features.
   
   Refactor storing of package dependencies
   
   All dependencies for a package are indices into the `packages` list now.
   This sets the correct association between a dependency & its associated
   package.
   
   * remove `SbomDependency` struct
   
   Refactor tests to use snapbox

   

   justahero authored and arlosi committed Nov 26, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 848cc32
   • Browse repository at this point

   Copy the full SHA

   848cc32 View commit details

   Browse the repository at this point in the history