microsoft / microsoft/component-detection

Investigate if cargo dependencies of type 'build' should be considered dev dependencies

Open
#1,366 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

detector:rust
Dominant language
C#
Stars
553
Forks
135
Avg merge
20h 58m
Merged PRs (30d)
6

Description

Today the detector when is inspecting the `kind` property of the dependency is only flagging it as dev dependency if `kind=dev` (see [here](https://github.com/microsoft/component-detection/blob/255e01115700899c5d5ea2cc82d1c3a40e68d315/src/Microsoft.ComponentDetection.Detectors/rust/RustCliDetector.cs#L243)), but other value that `kind` can have is `build`. These are dependencies used by the build script and probably should not be considered as dependencies of the final artifact.

- https://stackoverflow.com/questions/72861807/what-are-build-dependencies
- https://doc.rust-lang.org/cargo/reference/build-scripts.html

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in src/Microsoft.ComponentDetection.Detectors/rust/RustCliDetector.cs around line 243, then read the linked Cargo build-script documentation to understand how `kind=build` dependencies differ from `kind=dev`. Done means establishing the expected classification for build dependencies and documenting or implementing that behavior in the Rust detector.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
devtools
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.