Documentation
¶
Overview ¶
Package rust implements the Rust/Cargo ecosystem.Ecosystem, backed by omnibump's RustAnalyzer.
Index ¶
- type Ecosystem
- func (e *Ecosystem) Analyze(ctx context.Context, files map[string][]byte) (*ecosystem.ModuleDeps, error)
- func (e *Ecosystem) BumpCoords(_ context.Context, bumps []scan.SecurityBump, _ *ecosystem.ModuleDeps) map[string]scan.SecurityBump
- func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, ...) ([]string, []ecosystem.HeldBump)
- func (e *Ecosystem) ManifestFiles() (required, optional []string)
- func (e *Ecosystem) Name() string
- func (e *Ecosystem) ScanPackages(_ context.Context, deps *ecosystem.ModuleDeps) []scan.Package
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Ecosystem ¶
type Ecosystem struct {
// contains filtered or unexported fields
}
Ecosystem implements ecosystem.Ecosystem for Rust/Cargo projects. omnibump's RustAnalyzer has no checkout-free AnalyzeRemote, so Analyze materializes the fetched Cargo.lock into a real temp directory (via ecosystem.WriteTempFiles) and calls the local Analyze against it.
func (*Ecosystem) BumpCoords ¶
func (e *Ecosystem) BumpCoords(_ context.Context, bumps []scan.SecurityBump, _ *ecosystem.ModuleDeps) map[string]scan.SecurityBump
BumpCoords maps each OSV bump to its rendered-grammar coordinate. For Rust the two coincide: OSV names crates exactly as Cargo.lock does, and the rendered grammar is "crate@version", so the coordinate is the crate name.
func (*Ecosystem) FilterBumps ¶
func (e *Ecosystem) FilterBumps(_ context.Context, existing []string, bumps []scan.SecurityBump, deps *ecosystem.ModuleDeps) ([]string, []ecosystem.HeldBump)
FilterBumps keeps a candidate bump only when the crate is present in this modroot's Cargo.lock and the candidate version is newer than the highest locked version. An existing entry above an advisory's fix is kept (never lowered). A fix is held back, never written, when the crate is locked at several versions (one entry cannot say which to move) or when it is not a Cargo-compatible upgrade of the locked version (a different major, or for 0.x a different minor: 0.12 -> 0.14 is a breaking change under Cargo's caret rules, which Cargo.toml requirements - not fetched here - would refuse). Omnibump's own per-line constraint resolution is not replicated.
func (*Ecosystem) ManifestFiles ¶
ManifestFiles returns Cargo.lock only: omnibump's RustAnalyzer.Analyze reads Cargo.lock exclusively and never consults Cargo.toml.
Source Files