PLSysSec / PLSysSec/cargo-scan
Identify crates using SemVer and crates.io
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 47
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
In audit files:
-
For crates which appear on https://crates.io/, we should identify the crate using the crate name and semantic version (e.g. syn v2.0.70), and the source code hash as provided by crates.io.
-
For crates which are local, we should identify the crate using the path to the crate as well as the source code hash. It may be possible to add some kind of public identifier in some cases (e.g. a repository link) if the audit needs to be shared.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how audit files are generated and how dependency metadata is currently recorded. Check what crates.io exposes for crate names, semantic versions, and source hashes, then compare that with the metadata available for local crates. Done means audit files identify registry crates by name, version, and hash, while local crates include their path and hash.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100