Struct NativeContext 

pub struct NativeContext<'a> {
    pub started_at: String,
    pub ended_at: String,
    pub analyzer_version: Option<String>,
    pub exit_status: i32,
    pub source: &'a SourceIdentity,
    pub rules_digest: Option<String>,
    pub advisory_db: Option<AdvisoryDb>,
    pub worktree: Option<&'a Path>,
    pub snippets: &'a dyn SnippetSource,
}

Everything an adapter may need that is not in the analyzer’s own output.

Native analyzer output is missing things the evidence chain requires — no mainstream analyzer stamps its report with the wall-clock window it ran in, and cargo audit does not even record its own version. Rather than let an adapter invent them, the caller supplies what it actually knows, and an adapter that has nothing better says so (UNKNOWN_VERSION).

Fields

started_at: String

When the run started, RFC 3339 UTC. A subprocess run measures it; an ingest of a report file uses the file’s modification time, which is the only timestamp evidence a bare report carries.

ended_at: String

When the run ended, RFC 3339 UTC.

analyzer_version: Option<String>

The analyzer’s version, where the caller learned it out of band (a subprocess run asks the binary). None leaves the adapter to use whatever the report itself carries.

exit_status: i32

The analyzer’s process exit status, where the caller observed it.

source: &'a SourceIdentity

The source identity the run was against. Some identity recipes need it — cargo-audit keys findings by lockfile blob, so a finding stays distinct when the lockfile changes underneath the same advisory.

rules_digest: Option<String>

Digest of the rule set the analyzer ran with, where one applies.

advisory_db: Option<AdvisoryDb>

The pinned advisory database the caller provisioned, where one applies.

A fallback, not an override: an adapter prefers what the analyzer’s own report says about the database it consulted, and uses this only when the report says nothing. cargo audit says nothing whenever it is pointed at a database with --db, which is every pinned run — so without this, the reproducible configuration would be the one with no staleness evidence.

worktree: Option<&'a Path>

The checkout the report describes, where the caller knows it.

Only an adapter whose analyzer reports absolute paths needs this, and osv-scanner is that adapter: it returns a full filesystem path for every manifest even when it is told to scan .. Without the worktree there is nothing to relativise against, so an absolute path would be stored verbatim — user-identifying data in a persisted finding key, and a key that differs between two machines running the identical scan.

None is the honest answer for a report about a tree this checkout does not have; an adapter must then say the location is unknown rather than guess at one.

snippets: &'a dyn SnippetSource

Where to read the source a finding points at, for identity recipes that include a snippet hash.

It is here rather than inside an adapter because the caller knows which checkout the report describes, and because both execution paths must read the same one — that is what makes a subprocess run and an ingest of its output produce identical finding keys.

Implementations

impl NativeContext<'_>

pub fn version_or(&self, from_report: Option<&str>) -> String

The version to record: what the caller learned, else what the report carried, else UNKNOWN_VERSION.

Never empty — crate::IngestRunner refuses a report that cannot say what version produced it, and “unknown” is a truthful answer where an empty string is a missing one.

Trait Implementations

impl<'a> Clone for NativeContext<'a>

fn clone(&self) -> NativeContext<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for NativeContext<'_>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.