Analyzer confuses Cargo dependency hosted in repo for a source artifact

[bennati]

When running the analyzer (revision 2b230b8) on a Cargo project, a dependency which is hosted in a git repo is identified as source artifact. The analyzer result contains the following:

"source_artifact" : {
          "url" : "https://repo.com/lib.git",
          "hash" : {
            "value" : "123abc",
            "algorithm" : "SHA-1"
          }
        },
        "vcs" : {
          "type" : "Git",
          "url" : "https://repo.com/lib.git",
          "revision" : "",
          "path" : ""
        },

Attached are the analyzer results generated by a minimal reproducible example, as well as the source code of the minimal project and library. sources.zip analyzer-result.json

[sschuberth]

@bennati, can you please try again with the current main of ORT, as recently several Cargo improvements were merged?

[bennati]

Hi @sschuberth I tested again and the issue is still there

[sschuberth]

I had some problems reproducing the issue with your provided data, something was missing IIRC. Could you set up an example repository that works out of the box?