Enum DepSource 

pub enum DepSource {
    CratesIo,
    Git {
        url: String,
        rev: Option<String>,
    },
    Path,
    OtherRegistry {
        url: String,
    },
}

Where a vulnerable package resolves from — which registry, git remote, or local path. This is the identity a VEX subcomponent PURL must carry (spec §4.1): a crates.io dep is the bare pkg:cargo/<name>@<ver> PURL, but a git or alternate-registry dep needs a qualifier so a downstream scanner matches the exact artifact. Captured here so the PURL can be derived without re-reading the lockfile. Additive — defaults to CratesIo so a report written before this field existed keeps the crates.io assumption it shipped with.

Variants

CratesIo

The default crates.io registry — the overwhelmingly common case.

Git

A git dependency: the remote URL and the locked commit, when known.

Fields

url: String

The git remote URL (without the git+ scheme prefix or commit fragment).

rev: Option<String>

The locked commit hash (SourceId::precise), when the lock pins one.

Path

A local path dependency or workspace member — not a published artifact.

OtherRegistry

Another registry (alternate / sparse / local): its index URL.

Fields

url: String

The registry index URL.

Implementations

impl DepSource

pub fn is_crates_io(&self) -> bool

Whether this is the default crates.io source — used to omit the field from JSON in the common case, keeping schema_version: 1 output byte-identical.

Trait Implementations

impl Clone for DepSource

fn clone(&self) -> DepSource

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DepSource

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DepSource

fn default() -> DepSource

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for DepSource

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for DepSource

impl PartialEq for DepSource

fn eq(&self, other: &DepSource) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for DepSource

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for DepSource