jerrycan 0.6.1

The AI-native Rust backend platform: framework, CLI, and MCP server. https://jerrycan.cc
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

//! CycloneDX 1.5 SBOM from `cargo metadata` — no cargo-cyclonedx dependency.

use serde_json::Value;

/// Build a CycloneDX 1.5 BOM from parsed `cargo metadata`. `root_name`/`root_version`
/// identify the app under analysis (becomes metadata.component, excluded from components).
pub fn document(metadata: &Value, root_name: &str, root_version: &str) -> Value {
    let empty = vec![];
    let packages = metadata["packages"].as_array().unwrap_or(&empty);
    let mut components = Vec::new();
    for pkg in packages {
        let name = pkg["name"].as_str().unwrap_or("");
        let version = pkg["version"].as_str().unwrap_or("");
        if name == root_name && version == root_version {
            continue; // the root is metadata.component, not a dependency
        }
        let mut component = serde_json::json!({
            "type": "library",
            "name": name,
            "version": version,
            "purl": format!("pkg:cargo/{name}@{version}"),
        });
        if let Some(license) = pkg["license"].as_str() {
            component["licenses"] = serde_json::json!([{ "expression": license }]);
        }
        components.push(component);
    }
    components.sort_by(|a, b| a["name"].as_str().cmp(&b["name"].as_str()));
    serde_json::json!({
        "bomFormat": "CycloneDX",
        "specVersion": "1.5",
        "version": 1,
        "metadata": {
            "component": { "type": "application", "name": root_name, "version": root_version }
        },
        "components": components,
    })
}

/// Run `cargo metadata` for an app and produce the pretty SBOM JSON. The root
/// version is derived from the `root_name` package's own metadata entry (so it
/// tracks the real app version rather than a hardcoded literal); `0.0.0` is the
/// fallback when that package isn't present.
pub fn generate(app_root: &std::path::Path, root_name: &str) -> Result<String, String> {
    let output = std::process::Command::new("cargo")
        .current_dir(app_root)
        .args(["metadata", "--format-version", "1"])
        .output()
        .map_err(|e| format!("cargo metadata failed to run: {e}"))?;
    if !output.status.success() {
        return Err(format!(
            "cargo metadata failed: {}",
            String::from_utf8_lossy(&output.stderr)
        ));
    }
    let metadata: Value =
        serde_json::from_slice(&output.stdout).map_err(|e| format!("cargo metadata parse: {e}"))?;
    let root_version = root_version(&metadata, root_name);
    let doc = document(&metadata, root_name, &root_version);
    let mut s = serde_json::to_string_pretty(&doc).map_err(|e| e.to_string())?;
    s.push('\n');
    Ok(s)
}

/// The version of the root package as cargo sees it, or `0.0.0` if absent.
fn root_version(metadata: &Value, root_name: &str) -> String {
    metadata["packages"]
        .as_array()
        .and_then(|pkgs| pkgs.iter().find(|p| p["name"].as_str() == Some(root_name)))
        .and_then(|p| p["version"].as_str())
        .unwrap_or("0.0.0")
        .to_string()
}

#[cfg(test)]
mod tests {
    use super::*;

    // A trimmed `cargo metadata` shape: packages with name/version/license/source.
    const META: &str = r#"{
        "packages": [
            { "name": "app", "version": "0.1.0", "license": "MIT OR Apache-2.0", "source": null },
            { "name": "serde", "version": "1.0.0", "license": "MIT OR Apache-2.0", "source": "registry+https://github.com/rust-lang/crates.io-index" },
            { "name": "tokio", "version": "1.40.0", "license": "MIT", "source": "registry+https://github.com/rust-lang/crates.io-index" }
        ]
    }"#;

    #[test]
    fn cyclonedx_shape_and_components() {
        let doc = document(&serde_json::from_str(META).unwrap(), "app", "0.1.0");
        assert_eq!(doc["bomFormat"], "CycloneDX");
        assert_eq!(doc["specVersion"], "1.5");
        assert_eq!(doc["metadata"]["component"]["name"], "app");
        let comps = doc["components"].as_array().unwrap();
        // The root package is the metadata.component, not a dependency component.
        assert!(
            comps.iter().all(|c| c["name"] != "app"),
            "root excluded from components"
        );
        assert!(
            comps
                .iter()
                .any(|c| c["name"] == "serde" && c["version"] == "1.0.0")
        );
        let serde = comps.iter().find(|c| c["name"] == "serde").unwrap();
        assert_eq!(serde["type"], "library");
        assert!(
            serde["purl"]
                .as_str()
                .unwrap()
                .starts_with("pkg:cargo/serde@1.0.0")
        );
        assert_eq!(serde["licenses"][0]["expression"], "MIT OR Apache-2.0");
    }

    #[test]
    fn root_version_is_derived_from_the_app_package() {
        let meta: Value = serde_json::from_str(META).unwrap();
        assert_eq!(root_version(&meta, "app"), "0.1.0");
        // missing root package → conservative fallback, never a panic.
        assert_eq!(root_version(&meta, "missing"), "0.0.0");
    }

    #[test]
    fn registryless_packages_are_still_listed() {
        // local path deps (source null) are components too, minus a registry purl.
        let doc = document(&serde_json::from_str(META).unwrap(), "app", "0.1.0");
        // only "app" is source-null and it's the root, so all listed components have purls:
        for c in doc["components"].as_array().unwrap() {
            assert!(c["purl"].is_string());
        }
    }
}