add support for extra sbom information in Cargo.toml

The schema for Cargo.toml allows arbitrary extra data to be stored under the `[package.metadata]` table. It is convention to create a subtable under this (e.g. `[package.metadata.cyclonedx]`), and then to read/write data in this table for your custom use-case.

This PR uses the `[package.metadata]` table to store more SBOM information for a crate. In particular, it adds support for the `modified` field on components (which is what my project needs). I could add support for other fields as required. The name of the subtable is customizable from a CLI argument, and by default is empty, meaning no attempt is made to access the data.

I also made a small change to a test to write a main function in a `main.rs` file. It's not essential to the patch and I can remove it if requested.

Author: richard-uk1

cargo-cyclonedx/src/cli.rs

@@ -108,6 +108,10 @@ Defaults to the host target, as printed by 'rustc -vV'"
     /// Do not include build-time dependencies in the SBOM
     #[clap(long = "no-build-deps")]
     pub no_build_deps: bool,
+
+    /// Look for extra SBOM information in this subtable of `[package.metadata]`
+    #[clap(long = "metadata-section-name")]
+    pub package_metadata_subtable: Option<String>,
 }
 
 impl Args {
@@ -193,6 +197,7 @@ impl Args {
             describe,
             spec_version,
             only_normal_deps,
+            package_metadata_subtable: self.package_metadata_subtable.clone(),
         })
     }
 }

cargo-cyclonedx/src/config.rs

@@ -34,6 +34,9 @@ pub struct SbomConfig {
     pub describe: Option<Describe>,
     pub spec_version: Option<SpecVersion>,
     pub only_normal_deps: Option<bool>,
+    /// An extra section under `[package.metadata]` for data that is not stored
+    /// in Cargo.toml
+    pub package_metadata_subtable: Option<String>,
 }
 
 impl SbomConfig {
@@ -60,6 +63,10 @@ impl SbomConfig {
             describe: other.describe.or(self.describe),
             spec_version: other.spec_version.or(self.spec_version),
             only_normal_deps: other.only_normal_deps.or(self.only_normal_deps),
+            package_metadata_subtable: other
+                .package_metadata_subtable
+                .clone()
+                .or_else(|| self.package_metadata_subtable.clone()),
         }
     }
 

cargo-cyclonedx/src/generator.rs

@@ -259,6 +259,8 @@ impl SbomGenerator {
             component.author = Some(NormalizedString::new(&package.authors.join(", ")));
         }
 
+        self.add_metadata_subtable(package, &mut component);
+
         component
     }
 
@@ -513,6 +515,29 @@ impl SbomGenerator {
         }
     }
 
+    fn add_metadata_subtable(&self, package: &Package, component: &mut Component) {
+        let Some(table_name) = self.config.package_metadata_subtable.as_ref() else {
+            // No `[package.metadata]` subtable, so don't try to add any more
+            // information
+            return;
+        };
+
+        let Some(table) = package.metadata.get(table_name) else {
+            log::warn!("could not find metadata table called {table_name}");
+            return;
+        };
+        if let Some(modified) = table.get("modified") {
+            if let Some(modified) = modified.as_bool() {
+                component.modified = Some(modified);
+            } else {
+                log::warn!("`modified` field in `{table_name}` table was not a boolean, ignoring");
+            }
+        }
+        // TODO support for other fields not covered by the Cargo.toml format could be added here.
+        // TODO serde could be used to parse this table into a struct to reduce need for manual
+        // deserialization.
+    }
+
     fn create_metadata(
         &self,
         package: &Package,

cargo-cyclonedx/src/main.rs

@@ -247,4 +247,40 @@ mod tests {
             != NormalizedString::new("runtime_dep_of_build_dep")
             || c.scope == Some(Scope::Excluded)));
     }
+
+    #[test]
+    fn parse_toml_with_metadata_table() {
+        use crate::cli;
+        use crate::generate_sboms;
+        use clap::Parser;
+        use cyclonedx_bom::models::component::Scope;
+        use std::path::PathBuf;
+
+        let mut test_cargo_toml = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+        test_cargo_toml.push("tests/fixtures/build_then_runtime_dep/Cargo.toml");
+
+        let path_arg = &format!("--manifest-path={}", test_cargo_toml.display());
+        let args = [
+            "cyclonedx",
+            path_arg,
+            "--no-build-deps",
+            "--metadata-section-name=cyclonedx",
+        ];
+        let args_parsed = cli::Args::parse_from(args.iter());
+
+        let sboms = generate_sboms(&args_parsed).unwrap();
+
+        let components = sboms[0].bom.components.as_ref().unwrap();
+        assert!(components
+            .0
+            .iter()
+            .all(|f| f.scope == Some(Scope::Required)));
+        assert!(components.0.iter().all(|f| {
+            if f.name == "top_level_crate".into() {
+                f.modified == Some(true)
+            } else {
+                f.modified == None
+            }
+        }));
+    }
 }

cargo-cyclonedx/tests/cli.rs

@@ -135,7 +135,7 @@ fn find_content_in_stderr() -> Result<(), Box<dyn std::error::Error>> {
 
 fn make_temp_rust_project() -> Result<assert_fs::TempDir, assert_fs::fixture::FixtureError> {
     let tmp_dir = assert_fs::TempDir::new()?;
-    tmp_dir.child("src/main.rs").touch()?;
+    tmp_dir.child("src/main.rs").write_str("fn main() {}")?;
 
     tmp_dir
         .child("Cargo.toml")

cargo-cyclonedx/tests/fixtures/build_then_runtime_dep/top_level_crate/Cargo.toml

@@ -6,4 +6,7 @@ edition = "2021"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [build-dependencies]
-build_dep = {path = "../build_dep"}
+build_dep = {path = "../build_dep"}
+
+[package.metadata.cyclonedx]
+modified = true