Module crossref 

Cross-referencing dependency findings across analyzers.

cargo-audit and osv-scanner both read Cargo.lock, and OSV.dev ingests the RustSec database — so the same Rust advisory arrives twice, under finding:cargo-audit:… and finding:osv-scanner:…. ADR-0018 v1.1 decides what to do about it: keep both findings and cross-reference them at the reporting layer. This module is that reporting layer’s join.

Nothing here filters, merges, or renumbers

A Correspondence is a view over findings, not a replacement for them. Every finding stays in its own layer, keyed as its own analyzer named it, and every layer is still replaced wholesale per analyzer. The count of findings is unchanged by anything in this file, which is the specific failure ADR-0018 names: “never a merged super-finding, and never a count that silently halves”. A duplicate pair reads as one advisory confirmed by two analyzers, with both Correspondence::keys still addressable — so a reader who fixes the advisory watches both disappear.

The join needs no invention

Both upstreams publish the identifiers already. OSV keys a RustSec-derived record by the RUSTSEC id itself (RUSTSEC-2020-0071 resolves, carrying aliases: ["CVE-2020-26235", "GHSA-wcg3-cvx6-7396"]), and cargo-audit’s adapter stores the advisory’s aliases and related verbatim in meta. So two findings correspond when their identifier sets intersect — the RUSTSEC id where both name it, any shared CVE or GHSA id otherwise. That is a deterministic join over published identifiers: no similarity matching, no heuristic, and nothing that needs a confidence score.

Why the package must match too

Identifier intersection alone over-merges. A single CVE is regularly assigned to several packages, and joining on it alone would fuse advisories about different crates into one row. Correspondence therefore also requires the same package at the same version, which both adapters record in meta.package and meta.version. A finding without those — every SAST finding — is not on the dependency axis and does not take part at all.

“Present in one, absent in the other” is a real state

The two analyzers pin their databases independently and are prefetched at different times, so they will legitimately disagree for a window, and there are advisory kinds only one of them can ever carry (cargo-audit learns yanked from the registry index, which is not an advisory and is not in OSV at all). A Correspondence reported by one analyzer is therefore a normal result, not a defect: Correspondence::confirmed_by answers how many said so, and the caller renders that rather than treating a single source as a discrepancy.

@rto:0012 @rto:0018

Structs

Correspondence

One advisory, and every finding that reported it.

Report

One analyzer’s report of an advisory.

Functions

cross_reference

Cross-reference the dependency findings across layers.