Skip to main content

Adapter

rto_exec::adapter

Trait Adapter 

Source 
pub trait Adapter: Sync + Debug {
    // Required methods
    fn analyzer(&self) -> &'static str;
    fn summary(&self) -> &'static str;
    fn languages(&self) -> &'static [&'static str];
    fn asset_ids(&self) -> &'static [&'static str];
    fn host_programs(&self) -> &'static [&'static str];
    fn command(&self, assets: &AssetPaths<'_>) -> Invocation;
    fn normalize(
        &self,
        native: &[u8],
        ctx: &NativeContext<'_>,
    ) -> Result<NormalizedReport, ExecError>;
}
Expand description

One analyzer’s native output format and invocation.

Required Methods§

Source

fn analyzer(&self) -> &'static str

The analyzer id — the value that appears in every layer key and finding key this adapter produces.

Source

fn summary(&self) -> &'static str

A one-line description of what it looks for, for roteiro security status and --help.

Source

fn languages(&self) -> &'static [&'static str]

The languages this adapter produces findings for, as the coverage matrix in ADR-0018 states them. Reported by the CLI so the claim is inspectable rather than only documented.

Source

fn asset_ids(&self) -> &'static [&'static str]

Which pinned assets the analyzer needs before it can run offline (see crate::assets). An empty slice means it needs none.

Source

fn host_programs(&self) -> &'static [&'static str]

Which programs must be on PATH for this analyzer to run on this host, in the order a reader would install them.

The counterpart of Adapter::asset_ids, and the reason both exist: asset ids are what Roteiro provisions, and these are what it deliberately never installs (ADR-0014). roteiro security status reports the two separately because their remedies differ — prefetch for the first, an install the host owner performs for the second — and collapsing them into one word is issue #464.

§Why this is declared and not read off Adapter::command

Because Invocation::program is not always the thing to look for. cargo-audit’s program is cargo, and cargo audit dispatches to a separate cargo-audit binary on PATH — so probing Invocation::program would find cargo on any Rust developer’s machine and report ready in precisely the commonest failure, cargo installed and cargo-audit not. That is the defect #464 is about, reintroduced one level down. An adapter therefore states its own requirement.

Empty means the analyzer needs nothing on PATH.

Source

fn command(&self, assets: &AssetPaths<'_>) -> Invocation

The argv that makes the analyzer emit the native format Adapter::normalize parses, with egress configured off.

assets maps an id from Adapter::asset_ids to the verified local path it was provisioned to.

Source

fn normalize( &self, native: &[u8], ctx: &NativeContext<'_>, ) -> Result<NormalizedReport, ExecError>

Parse native output into a normalized report.

§Errors

Returns ExecError::MalformedReport when the bytes are not this analyzer’s format, or ExecError::Json when they are not JSON at all. A partially-parsed report is never returned: either the whole thing converts or the run fails.

Dyn Compatibility§

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors§