Clarify package ID specifications in SBOMs are fully qualified#15731
Merged
weihanglo merged 2 commits intorust-lang:masterfrom Jul 5, 2025
Merged
Clarify package ID specifications in SBOMs are fully qualified#15731weihanglo merged 2 commits intorust-lang:masterfrom
weihanglo merged 2 commits intorust-lang:masterfrom
Conversation
Collaborator
bde57ce to
8feacfc
Compare
clarify fully qualified package ID usage in docs
8feacfc to
c74fadc
Compare
weihanglo
reviewed
Jul 5, 2025
src/doc/src/reference/pkgid-spec.md
Outdated
| if there are two versions of the `regex` package in the graph, then it can be | ||
| qualified with a version to make it unique, such as `regex@1.4.3`. | ||
|
|
||
| Fully qualified package ID specifications are output by Cargo in: |
Member
There was a problem hiding this comment.
I am a bit unsure whether we want an exhaustive list. Basically all outputs of package ID spec by Cargo should be fully qualified. Having a list here means we have one more thing needing to be in sync. Like, this doesn't mention the unstable --unit-graph output.
Contributor
Author
There was a problem hiding this comment.
Ok - I've replaced the list with that generalization.
rather than providing an exhaustive list
bors
added a commit
to rust-lang/rust
that referenced
this pull request
Jul 12, 2025
Update cargo 14 commits in 930b4f62cfcd1f0eabdb30a56d91bf6844b739bf..eabb4cd923deb73e714f7ad3f5234d68ca284dbe 2025-06-28 14:58:43 +0000 to 2025-07-09 22:07:55 +0000 - feat: Implementation and tests for `multiple-build-scripts` (rust-lang/cargo#15704) - perf: Speed up TOML parsing by upgrading toml (rust-lang/cargo#15736) - Mark cachelock tests that rely on interprocess blocking behaviour as unsupported on AIX. (rust-lang/cargo#15734) - feat(publish): Stabilize multi-package publishing (rust-lang/cargo#15636) - Update to Rust 2024 (rust-lang/cargo#15732) - Clarify package ID specifications in SBOMs are fully qualified (rust-lang/cargo#15731) - chore(deps): update cargo-semver-checks to v0.42.0 (rust-lang/cargo#15730) - test: Switch config tests to use snapshots (rust-lang/cargo#15729) - implement package feature unification (rust-lang/cargo#15684) - chore: Upgrade dependencies (rust-lang/cargo#15722) - Report valid file name when we can't find a build target for `name = "foo.rs"` (rust-lang/cargo#15707) - chore(release): Publish build-rs on release (rust-lang/cargo#15708) - Override `Cargo.lock` checksums when doing a dry-run `publish` (rust-lang/cargo#15711) - test(rustfix): Update for nightly (rust-lang/cargo#15717) r? ghost
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR try to resolve?
cargo-auditable 0.7.0 will use the unstable Cargo SBOM precursor files if a user configures Cargo to generate the SBOM files. cargo-auditable assumes that the package ID specifiers in Cargo SBOM files are fully qualified.
We'd like to enforce this assumption in Cargo so we can keep our package ID spec parsing simpler by not considering non-fully qualified package ID specs. This PR updates the cargo docs to state where fully qualified package ID specs are used, and also adds SBOMs to the existing
cargo pkgidtest that is currently enforcing consistency between the various usages of fully qualified package id specs.Previously raised at #t-cargo > sbom missing name, version, source @ 💬
How to test and review this PR?
Change doesn't affect current behaviour.