search

rust-secure-code / cargo-auditable

Make production Rust binaries auditable
Apache License 2.0
628 stars 26 forks source link

Remove dependency on cargo-lock #160

Closed Shnatsel closed 1 month ago

Shnatsel commented 1 month ago

Removes the disabled-by-default and not very useful conversion to Cargo.lock format. It is supplanted by conversion to CycloneDX anyway.

This simplifies the release process for cargo audit considerably, removing the cyclic dependency on this repository.

I'm not sure I have bumped the versions correctly across the board - some crates depending on auditable-serde may require a bump as well.

Supersedes https://github.com/rust-secure-code/cargo-auditable/pull/159

Shnatsel commented 1 month ago

Published to crates.io

tarcieri commented 1 month ago

@Shnatsel what should be done about this? https://github.com/rustsec/rustsec/blob/465967c/cargo-audit/src/binary_deps.rs#L32

Shnatsel commented 1 month ago

Ooh dammit. I forgot about that. That's actually required for cargo-audit to ingest this data.

The implementation of conversion from this format to cargo-lock format (the one I deleted from this repo) will have to be moved into the rustsec repo. We still need the conversion, but at least that will break the cyclic dependency.

Unfortunately I won't be able to help with it today. It is a very hot day here, my brain is fried.

tarcieri commented 1 month ago

Aha, ok