Enum Occurrence 

pub enum Occurrence {
    InRepo {
        repo: RepoId,
        package: String,
        installed: Version,
        patched: Vec<VersionReq>,
        dependency_kind: DependencyKind,
        dependency_path: Vec<String>,
        active: Option<bool>,
        source: DepSource,
    },
    Toolchain {
        channel: String,
        installed: Option<Version>,
        patched: Vec<VersionReq>,
    },
}

A single location/version where an advisory applies.

The advisory groups occurrences, but the verdict is per-occurrence: the same crate at different versions across repos may differ (one patched, one not). A toolchain advisory (rustsec::Collection::Rust) has no repo to pin, so it is a distinct variant rather than a sentinel repo.

Serializes internally-tagged on kind ("in_repo" / "toolchain"), with the variant’s fields inlined alongside.

Variants

InRepo

Fields

repo: RepoId

Stable id from fleet.toml.

package: String

installed: Version

patched: Vec<VersionReq>

Versions that fix the advisory; empty means “no fix available”.

dependency_kind: DependencyKind

dependency_path: Vec<String>

A shortest chain of package names from a root crate down to this package (["my-app", "jiff", "defmt", …]) — the answer to “who pulls this in”. There may be other paths; this is one representative. Empty when the dependency graph could not be computed. Additive field — omitted from JSON when empty, so schema_version: 1 is unaffected.

active: Option<bool>

Whether this package is actually compiled in the host’s default build (feature-resolved). None unless --resolve-features ran; Some(false) flags a Cargo.lock-only optional dep that is never built. Additive — omitted from JSON when None.

source: DepSource

Where this package resolves from (registry / git / path), for the VEX subcomponent PURL (§4.1). Additive — omitted from JSON for the common crates.io case, so schema_version: 1 output is unaffected.

Toolchain

Fields

channel: String

e.g. "stable 1.xx" — there is no repo to pin a toolchain advisory to.

installed: Option<Version>

patched: Vec<VersionReq>

Implementations

impl Occurrence

pub fn is_vulnerable(&self) -> bool

The per-occurrence verdict: is the installed version actually vulnerable? An occurrence is vulnerable when its installed version is covered by none of the advisory’s patched requirements. This is computed per occurrence precisely because the same advisory can apply to different versions across the fleet — one already patched, one not.

Fail-closed: an empty patched set (no fix published) or an unknown installed version counts as vulnerable.

use fleetreach_core::{DependencyKind, Occurrence, RepoId};
use fleetreach_core::semver::{Version, VersionReq};

let at = |major, minor, patch| Occurrence::InRepo {
    repo: RepoId("app".into()),
    package: "foo".into(),
    installed: Version::new(major, minor, patch),
    patched: vec![VersionReq::parse(">=1.2.0").unwrap()],
    dependency_kind: DependencyKind::Transitive,
    dependency_path: vec![],
    active: None,
    source: Default::default(),
};
assert!(at(1, 1, 9).is_vulnerable());  // below the fix
assert!(!at(1, 2, 0).is_vulnerable()); // at the fix

Trait Implementations

impl Clone for Occurrence

fn clone(&self) -> Occurrence

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Occurrence

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for Occurrence

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for Occurrence

fn eq(&self, other: &Occurrence) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for Occurrence

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for Occurrence