cargo-auditable 0.7.5

Make production Rust binaries auditable
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110

use std::ffi::OsString;

use serde::{Deserialize, Serialize};

#[derive(Debug, Serialize, Deserialize)]
/// Includes only the cargo arguments we care about
pub struct CargoArgs {
    pub offline: bool,
    pub locked: bool,
    pub frozen: bool,
    pub config: Vec<String>,
}

impl CargoArgs {
    /// Extracts Cargo flags from the arguments to the current process
    pub fn from_args() -> CargoArgs {
        // we .skip(3) to get over `cargo auditable build` and to the start of the flags
        let raw_args: Vec<OsString> = std::env::args_os().skip(3).collect();
        Self::from_args_vec(raw_args)
    }

    /// Split into its own function for unit testing
    fn from_args_vec(mut raw_args: Vec<OsString>) -> CargoArgs {
        // if there is a -- in the invocation somewhere, only parse up to it
        if let Some(position) = raw_args.iter().position(|s| s == "--") {
            raw_args.truncate(position);
        }
        let mut parser = pico_args::Arguments::from_vec(raw_args);

        CargoArgs {
            config: parser.values_from_str("--config").unwrap(),
            offline: parser.contains("--offline"),
            locked: parser.contains("--locked"),
            frozen: parser.contains("--frozen"),
        }
    }

    /// Recovers `SerializedCargoArgs` from an environment variable (if it was exported earlier)
    pub fn from_env() -> Result<Self, std::env::VarError> {
        let json_args = std::env::var("CARGO_AUDITABLE_ORIG_ARGS")?;
        // We unwrap here because we've serialized these args ourselves and they should roundtrip cleanly.
        // Deserialization would only fail if someone tampered with them in transit.
        Ok(serde_json::from_str(&json_args).unwrap())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn basic_parsing() {
        let input = [
            "cargo",
            "auditable",
            "build",
            "--locked",
            "--config",
            "net.git-fetch-with-cli=true",
            "--offline",
        ];
        let raw_args = input.iter().map(OsString::from).collect();
        let args = CargoArgs::from_args_vec(raw_args);
        assert!(args.locked);
        assert!(args.offline);
        assert!(!args.frozen);
        assert_eq!(args.config, vec!["net.git-fetch-with-cli=true"]);
    }

    #[test]
    fn with_unrelated_flags() {
        let input = [
            "cargo",
            "auditable",
            "build",
            "--locked",
            "--target",
            "x86_64-unknown-linux-gnu",
            "--release",
            "--config",
            "net.git-fetch-with-cli=true",
            "--offline",
            "--ignore-rust-version",
        ];
        let raw_args = input.iter().map(OsString::from).collect();
        let args = CargoArgs::from_args_vec(raw_args);
        assert!(args.locked);
        assert!(args.offline);
        assert!(!args.frozen);
        assert_eq!(args.config, vec!["net.git-fetch-with-cli=true"]);
    }

    #[test]
    fn double_dash_to_ignore_args() {
        let input = [
            "cargo",
            "auditable",
            "run",
            "--release",
            "--config",
            "net.git-fetch-with-cli=true",
            "--",
            "--offline",
        ];
        let raw_args = input.iter().map(OsString::from).collect();
        let args = CargoArgs::from_args_vec(raw_args);
        assert!(!args.offline);
        assert_eq!(args.config, vec!["net.git-fetch-with-cli=true"]);
    }
}