Tom Fay comments

Results 25 comments of


                                            Tom Fay

Support writers without static lifetimes

> Could you update the CHANGELOG with an entry for this addition? > > Thank you for pinging me with the use case example and for persisting in asking about...

Use cargo SBOM precursor files, if available

Isn't that a case of cargo being more accurate than cargo metadata? Without a build.rs, a crate can have no build dependencies, regardless of what is declared in Cargo.toml.

Use cargo SBOM precursor files, if available

> Okay, I think I found an actual bug in Cargo: if I run `cargo +nightly build -Z sbom --release` and then `CARGO_BUILD_SBOM=true cargo +nightly build -Z sbom --release`, the...

Filtering against `cargo tree` under-includes dependencies, does not accurately reflect feature unification in a workspace

The cargo SBOM is correct for that test fixture *if* you build with `-p top_level_crate`. If you don't, then cargo passes all the workspace members over to the feature resolver,...

Filtering against `cargo tree` under-includes dependencies, does not accurately reflect feature unification in a workspace

Hmm... I don't think this is a cargo-auditable or cargo SBOM bug. Perhaps it's a cargo bug relating to workspace feature resolution but it's not a reporting bug. I think...