EmbarkStudios / cargo-deny

❌ Cargo plugin for linting your dependencies 🦀
http://embark.rs
Apache License 2.0
1.63k stars 81 forks source link

Improve error output when license hash does not match #577

Open tgross35 opened 7 months ago

tgross35 commented 7 months ago

Is your feature request related to a problem? Please describe.

I tried changing the hash = ... value for a dependency and was expecting to see a simple message about a hash mismatch. Instead, I get a couple errors that don't mention it:

error[unlicensed]: ring = 0.17.6 is unlicensed
  ┌─ ring 0.17.6 (registry+https://github.com/rust-lang/crates.io-index):2:9
  │
2 │ name = "ring"
  │         ^^^^ a valid license expression could not be retrieved for the crate
3 │ version = "0.17.6"
4 │ license = ""
  │            - license expression was not specified
5 │ license-files = [
6 │     { path = "/Users/me/.cargo/registry/src/index.crates.io-6f17d22bba15001f/ring-0.17.6/LICENSE", hash = 0xbd0eed23, score = 0.67, license = "OpenSSL" },
  │                                                                                                                                    ---- low confidence in the license text
  │
  = ring v0.17.6
    ├── rustls v0.21.9
    │   └── ureq v2.9.1
    │       ├── clevis v0.4.3
    │       │   └── keymgt-clevis v0.1.0
    │       └── keymgt-clevis v0.1.0 (*)
    ├── rustls-webpki v0.101.7
    │   ├── rustls v0.21.9 (*)
    │   └── ureq v2.9.1 (*)
    └── sct v0.7.1
        └── rustls v0.21.9 (*)

warning[license-exception-not-encountered]: license exception was not encountered
   ┌─ /Users/me/Documents/projects/mdb/mariadb-server/rust/deny.toml:32:35
   │
32 │     { allow = ["OpenSSL"], name = "ring", version = "*" },
   │                                   ^^^^^^ unmatched license exception

licenses FAILED

It seems like if the hash is incorrect it falls back to other methods?

Describe the solution you'd like

It may still be OK to fall back to other methods, but a notice would help. Maybe something like:

hash mismatch: 0xbd0eed23 was specified but 0x1234abcd was calculated.
    falling back to other predicates

This is also nice because you can copy and paste the new hash if you are OK with the new file.