Feature awareness?

[jadamcrain]

My use case is building FFI libraries that can distributed as C binary headers, but also embedded in Java Jars and Nuget pacakges.

A couple of questions:

1. Some of my customers want to exclude certain features from builds. Is this tool feature aware?
2. Can the tool exclude build-only dependencies? I've noticed that by default is includes them.
3. Is the purl standardized for Rust somewhere in the spec? What should the purl be for crates not distributed via crates.io?

[amy-keibler]

These are all good questions

1. Some of my customers want to exclude certain features from builds. Is this tool feature aware?

Not currently. In this issue, I outlined a few potential areas I want to investigate. It's one of my highest priority items after we complete the work to integrate the library with the cargo plugin.

2. Can the tool exclude build-only dependencies? I've noticed that by default is includes them.

Not currently. This somewhat falls under the first point, but it's probably worth having a separate GitHub issue to track it.

3. Is the purl standardized for Rust somewhere in the spec? What should the purl be for crates not distributed via crates.io?

The purl specification does not indicate a required type specific to Rust, beyond

type: the package "type" or package "protocol" such as maven, npm, nuget, gem, pypi, etc. Required.

We could interpret this to mean that cargo is the "protocol", which would cover third party repositories. This probably needs its own GitHub issue for tracking.

[jadamcrain]

Thanks for these detailed answers!

[lfrancke]

We should now exclude build only dependencies in main and #512 and #513 will help with selecting features and targets

[Shnatsel]

To clarify: only dev-dependencies are excluded. Build dependencies are included in the SBOM because unlike dev-dependencies they can influence the final binary.

[lfrancke]

Ah yes, sorry, my bad.

[jadamcrain]

Including build dependencies make sense! Thanks for the update.

[lfrancke]

So that should fix points 1 and 2 of your list. I don't think we have tackled purls for non crates things yet anywhere but I might have missed it as well.

[Shnatsel]

There is a tracking issue fir pURL from sources other than crates.io: #501

I am not aware of any standardization around that though.

[lfrancke]

Thanks. I believe we can close this issue now as everything has either been tackled or there are more specific issues.
Unless there are any objections I'll do so in a few days.