add cataloger for rust crates from Cargo.lock files

syft/cataloger/cataloger.go

@@ -14,6 +14,7 @@ import (
 	"github.com/anchore/syft/syft/cataloger/python"
 	"github.com/anchore/syft/syft/cataloger/rpmdb"
 	"github.com/anchore/syft/syft/cataloger/ruby"
+	"github.com/anchore/syft/syft/cataloger/rust"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/source"
 )
@@ -39,6 +40,7 @@ func ImageCatalogers() []Cataloger {
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModCataloger(),
+		rust.NewCargoLockCataloger(),
 	}
 }
 
@@ -54,5 +56,6 @@ func DirectoryCatalogers() []Cataloger {
 		java.NewJavaCataloger(),
 		apkdb.NewApkdbCataloger(),
 		golang.NewGoModCataloger(),
+		rust.NewCargoLockCataloger(),
 	}
 }

syft/cataloger/package_url_test.go

@@ -115,6 +115,14 @@ func TestPackageURL(t *testing.T) {
 			},
 			expected: "pkg:deb/name@v0.1.0",
 		},
+		{
+			pkg: pkg.Package{
+				Name:    "name",
+				Version: "v0.1.0",
+				Type:    pkg.RustPkg,
+			},
+			expected: "pkg:cargo/name@v0.1.0",
+		},
 	}
 
 	for _, test := range tests {

syft/cataloger/rust/cargo_metadata.go

@@ -0,0 +1,18 @@
+package rust
+
+import "github.com/anchore/syft/syft/pkg"
+
+type CargoMetadata struct {
+	Packages []CargoMetadataPackage `toml:"package"`
+}
+
+// Pkgs returns all of the packages referenced within the Cargo.lock metadata.
+func (m CargoMetadata) Pkgs() []pkg.Package {
+	pkgs := make([]pkg.Package, 0)
+
+	for _, p := range m.Packages {
+		pkgs = append(pkgs, p.Pkg())
+	}
+
+	return pkgs
+}

syft/cataloger/rust/cargo_metadata_package.go

@@ -0,0 +1,21 @@
+package rust
+
+import "github.com/anchore/syft/syft/pkg"
+
+type CargoMetadataPackage struct {
+	Name         string   `toml:"name"`
+	Version      string   `toml:"version"`
+	Source       string   `toml:"source"`
+	Checksum     string   `toml:"checksum"`
+	Dependencies []string `toml:"dependencies"`
+}
+
+// Pkg returns the standard `pkg.Package` representation of the package referenced within the Cargo.lock metadata.
+func (p CargoMetadataPackage) Pkg() pkg.Package {
+	return pkg.Package{
+		Name:     p.Name,
+		Version:  p.Version,
+		Language: pkg.Rust,
+		Type:     pkg.RustPkg,
+	}
+}

syft/cataloger/rust/cataloger.go

@@ -0,0 +1,17 @@
+/*
+Package rust provides a concrete Cataloger implementation for Cargo.lock files.
+*/
+package rust
+
+import (
+	"github.com/anchore/syft/syft/cataloger/common"
+)
+
+// NewCargoLockCataloger returns a new Rust Cargo lock file cataloger object.
+func NewCargoLockCataloger() *common.GenericCataloger {
+	globParsers := map[string]common.ParserFn{
+		"**/Cargo.lock": parseCargoLock,
+	}
+
+	return common.NewGenericCataloger(nil, globParsers, "rust-cataloger")
+}

syft/cataloger/rust/parse_cargo_lock.go

@@ -0,0 +1,29 @@
+package rust
+
+import (
+	"fmt"
+	"io"
+
+	"github.com/anchore/syft/syft/cataloger/common"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/pelletier/go-toml"
+)
+
+// integrity check
+var _ common.ParserFn = parseCargoLock
+
+// parseCargoLock is a parser function for Cargo.lock contents, returning all rust cargo crates discovered.
+func parseCargoLock(_ string, reader io.Reader) ([]pkg.Package, error) {
+	tree, err := toml.LoadReader(reader)
+	if err != nil {
+		return nil, fmt.Errorf("unable to load Cargo.lock for parsing: %v", err)
+	}
+
+	metadata := CargoMetadata{}
+	err = tree.Unmarshal(&metadata)
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse Cargo.lock: %v", err)
+	}
+
+	return metadata.Pkgs(), nil
+}

syft/cataloger/rust/parse_cargo_lock_test.go

@@ -0,0 +1,99 @@
+package rust
+
+import (
+	"os"
+	"testing"
+
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/go-test/deep"
+)
+
+func TestParseCargoLock(t *testing.T) {
+	expected := []pkg.Package{
+		{
+			Name:     "ansi_term",
+			Version:  "0.12.1",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "matches",
+			Version:  "0.1.8",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "memchr",
+			Version:  "2.3.3",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "natord",
+			Version:  "1.0.9",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "nom",
+			Version:  "4.2.3",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "unicode-bidi",
+			Version:  "0.3.4",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "version_check",
+			Version:  "0.1.5",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "winapi",
+			Version:  "0.3.9",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "winapi-i686-pc-windows-gnu",
+			Version:  "0.4.0",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+		{
+			Name:     "winapi-x86_64-pc-windows-gnu",
+			Version:  "0.4.0",
+			Language: pkg.Rust,
+			Type:     pkg.RustPkg,
+			Licenses: nil,
+		},
+	}
+
+	fixture, err := os.Open("test-fixtures/Cargo.lock")
+	if err != nil {
+		t.Fatalf("failed to open fixture: %+v", err)
+	}
+
+	actual, err := parseCargoLock(fixture.Name(), fixture)
+	if err != nil {
+		t.Error(err)
+	}
+
+	differences := deep.Equal(expected, actual)
+	if differences != nil {
+		t.Errorf("returned package list differed from expectation: %+v", differences)
+	}
+}

syft/pkg/language.go

@@ -11,6 +11,7 @@ const (
 	Python          Language = "python"
 	Ruby            Language = "ruby"
 	Go              Language = "go"
+	Rust            Language = "rust"
 )
 
 // AllLanguages is a set of all programming languages detected by syft.
@@ -20,6 +21,7 @@ var AllLanguages = []Language{
 	Python,
 	Ruby,
 	Go,
+	Rust,
 }
 
 // String returns the string representation of the language.

syft/pkg/metadata.go

@@ -13,4 +13,5 @@ const (
 	NpmPackageJSONMetadataType MetadataType = "NpmPackageJsonMetadata"
 	RpmdbMetadataType          MetadataType = "RpmdbMetadata"
 	PythonPackageMetadataType  MetadataType = "PythonPackageMetadata"
+	RustCrateMetadataType      MetadataType = "RustCrateMetadata"
 )

syft/pkg/type.go

@@ -17,6 +17,7 @@ const (
 	JavaPkg          Type = "java-archive"
 	JenkinsPluginPkg Type = "jenkins-plugin"
 	GoModulePkg      Type = "go-module"
+	RustPkg          Type = "rust-crate"
 )
 
 // AllPkgs represents all supported package types
@@ -30,6 +31,7 @@ var AllPkgs = []Type{
 	JavaPkg,
 	JenkinsPluginPkg,
 	GoModulePkg,
+	RustPkg,
 }
 
 // PackageURLType returns the PURL package type for the current package.
@@ -51,6 +53,8 @@ func (t Type) PackageURLType() string {
 		return packageurl.TypeRPM
 	case GoModulePkg:
 		return packageurl.TypeGolang
+	case RustPkg:
+		return "cargo"
 	default:
 		// TODO: should this be a "generic" purl type instead?
 		return ""

test/integration/pkg_cases_test.go

@@ -184,4 +184,14 @@ var commonTestCases = []testCase{
 			"github.com/bmatcuk/doublestar": "v1.3.1",
 		},
 	},
+	{
+		name:        "find rust crates",
+		pkgType:     pkg.RustPkg,
+		pkgLanguage: pkg.Rust,
+		pkgInfo: map[string]string{
+			"memchr":        "2.3.3",
+			"nom":           "4.2.3",
+			"version_check": "0.1.5",
+		},
+	},
 }