Rust：使用 cargo deny 检查项目依赖

Pomelo_刘金2024-06-11 12:38

cargo deny 不是Rust工具链中的官方工具，而是由Embark Studios开发的一个第三方工具。它专门用于帮助Rust开发者检查项目依赖项的安全性、许可证合规性、多版本依赖管理等。

何时使用 cargo deny

cargo deny 特别适合在以下情况下使用：

  1. 安全性检查 ：如果你希望确保项目中的所有依赖项都没有已知的安全漏洞，可以使用cargo deny进行扫描。它会检查RustSec数据库中的漏洞报告，并与项目中的依赖项进行比对。
  2. 许可证合规性 ：当你需要确保项目中使用的所有依赖项都符合特定的许可证要求时，cargo deny 可以帮助你检测和报告不符合要求的许可证。
  3. 多版本依赖管理 ：如果你的项目可能因为使用多个版本的同一依赖项而导致二进制膨胀或冲突，cargo deny 能帮助你识别和管理这些情况。
  4. 未维护的依赖项 ：在项目中使用未维护的依赖项可能会带来潜在风险。cargo deny 可以检测并警告这些未维护的依赖项，帮助你决定是否需要替换或更新这些依赖项。

实现方式:

  • cargo deny 使用RustSec数据库和其他社区维护的数据库来检查依赖项的安全性和许可证问题。
  • 通过解析项目的Cargo.lock文件，获取所有依赖项及其版本信息。
  • 对比依赖项信息和数据库中的已知问题，生成报告并根据配置的规则进行相应处理。

cargo deny 与cargo clippy 的区别

cargo deny

  • 功能 : cargo deny 主要用于检查项目依赖项的安全性、许可证合规性、未维护的依赖项以及多个版本的依赖项冲突。

  • 主要检查内容:

    • 安全性漏洞: 检查依赖项是否存在已知的安全漏洞。
    • 许可证合规性: 检查依赖项的许可证是否符合项目的合规要求。
    • 未维护的依赖项: 检查依赖项是否仍在维护中。
    • 多版本依赖项: 检查项目中是否存在多个版本的同一依赖项，并提供解决方案。

  • 实现方式:

    • cargo deny 使用RustSec数据库和其他社区维护的数据库来检查依赖项的安全性和许可证问题。
    • 通过解析项目的Cargo.lock文件，获取所有依赖项及其版本信息。
    • 对比依赖项信息和数据库中的已知问题，生成报告并根据配置的规则进行相应处理。

cargo clippy

  • 功能 : cargo clippy 是Rust的一个代码静态分析工具，主要用于发现和报告代码中的潜在问题、性能问题和不一致的代码风格。

  • 主要检查内容:

    • 代码质量: 检查代码中的潜在错误和不良实践。
    • 性能问题: 检查代码中可能导致性能下降的部分。
    • 代码风格: 确保代码符合Rust的惯用风格和最佳实践。

  • 实现方式:

    • cargo clippy 是基于Rust编译器的插件，直接分析源代码。
    • 通过内置的规则和lint检查器，分析代码的结构和逻辑。
    • 生成报告，指出代码中的问题并提供修复建议。

实现功能的区别

  • cargo deny:

    • 依赖项安全性和合规性检查工具。
    • 通过解析依赖项元数据和社区数据库进行检查。
    • 适用于项目依赖管理，确保依赖项的安全和合规。

  • cargo clippy:

    • 代码静态分析工具。
    • 直接分析源代码。
    • 适用于代码质量和性能优化，确保代码符合最佳实践。

使用示例

以下是一些使用cargo deny的具体示例：

  1. 安装 cargo deny

    sh 复制代码 
    cargo install cargo-deny

  2. 初始化配置文件

    sh 复制代码 
    cargo deny init

  3. 运行检查

    sh 复制代码 
    cargo deny check

配置示例

deny.toml 的配置示例如下：

toml 复制代码 
[advisories]
vulnerability = "deny"
unmaintained = "warn"
yanked = "warn"

[licenses]
unlicensed = "allow"
allow = ["MIT", "Apache-2.0"]
deny = ["GPL-3.0"]

[bans]
multiple-versions = "warn"

参考资料

一个更详细的配置页

toml 复制代码 
# This template contains all of the possible sections and their default values

# Note that all fields that take a lint level have these possible values:
# * deny - An error will be produced and the check will fail
# * warn - A warning will be produced, but the check will not fail
# * allow - No warning or error will be produced, though in some cases a note
# will be

# The values provided in this template are the default values that will be used
# when any section or field is not specified in your own configuration

# If 1 or more target triples (and optionally, target_features) are specified,
# only the specified targets will be checked when running `cargo deny check`.
# This means, if a particular package is only ever used as a target specific
# dependency, such as, for example, the `nix` crate only being used via the
# `target_family = "unix"` configuration, that only having windows targets in
# this list would mean the nix crate, as well as any of its exclusive
# dependencies not shared by any other crates, would be ignored, as the target
# list here is effectively saying which targets you are building for.
targets = [
  # The triple can be any string, but only the target triples built in to
  # rustc (as of 1.40) can be checked against actual config expressions
  #{ triple = "x86_64-unknown-linux-musl" },
  # You can also specify which target_features you promise are enabled for a
  # particular target. target_features are currently not validated against
  # the actual valid features supported by the target architecture.
  #{ triple = "wasm32-unknown-unknown", features = ["atomics"] },
]

# This section is considered when running `cargo deny check advisories`
# More documentation for the advisories section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
[advisories]
# The path where the advisory database is cloned/fetched into
db-path = "~/.cargo/advisory-db"
# The url(s) of the advisory databases to use
db-urls = ["https://github.com/rustsec/advisory-db"]
# The lint level for security vulnerabilities
vulnerability = "deny"
# The lint level for unmaintained crates
unmaintained = "warn"
# The lint level for crates that have been yanked from their source registry
yanked = "warn"
# The lint level for crates with security notices. Note that as of
# 2019-12-17 there are no security notice advisories in
# https://github.com/rustsec/advisory-db
notice = "warn"
# A list of advisory IDs to ignore. Note that ignored advisories will still
# output a note when they are encountered.
ignore = [
  #"RUSTSEC-0000-0000",
]
# Threshold for security vulnerabilities, any vulnerability with a CVSS score
# lower than the range specified will be ignored. Note that ignored advisories
# will still output a note when they are encountered.
# * None - CVSS Score 0.0
# * Low - CVSS Score 0.1 - 3.9
# * Medium - CVSS Score 4.0 - 6.9
# * High - CVSS Score 7.0 - 8.9
# * Critical - CVSS Score 9.0 - 10.0
#severity-threshold =

# This section is considered when running `cargo deny check licenses`
# More documentation for the licenses section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
[licenses]
# The lint level for crates which do not have a detectable license
unlicensed = "allow"
# List of explicitly allowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.7 short identifier (+ optional exception)].
allow = [
  "MIT",
  "Apache-2.0",
  "Unicode-DFS-2016",
  "MPL-2.0",
  "BSD-2-Clause",
  "BSD-3-Clause",
  "ISC",
  "CC0-1.0",
]
# List of explicitly disallowed licenses
# See https://spdx.org/licenses/ for list of possible licenses
# [possible values: any SPDX 3.7 short identifier (+ optional exception)].
deny = [
  #"Nokia",
]
# Lint level for licenses considered copyleft
copyleft = "warn"
# Blanket approval or denial for OSI-approved or FSF Free/Libre licenses
# * both - The license will be approved if it is both OSI-approved *AND* FSF
# * either - The license will be approved if it is either OSI-approved *OR* FSF
# * osi-only - The license will be approved if is OSI-approved *AND NOT* FSF
# * fsf-only - The license will be approved if is FSF *AND NOT* OSI-approved
# * neither - This predicate is ignored and the default lint level is used
allow-osi-fsf-free = "neither"
# Lint level used when no other predicates are matched
# 1. License isn't in the allow or deny lists
# 2. License isn't copyleft
# 3. License isn't OSI/FSF, or allow-osi-fsf-free = "neither"
default = "deny"
# The confidence threshold for detecting a license from license text.
# The higher the value, the more closely the license text must be to the
# canonical license text of a valid SPDX license file.
# [possible values: any between 0.0 and 1.0].
confidence-threshold = 0.8
# Allow 1 or more licenses on a per-crate basis, so that particular licenses
# aren't accepted for every possible crate as with the normal allow list
exceptions = [
  # Each entry is the crate and version constraint, and its specific allow
  # list
  #{ allow = ["Zlib"], name = "adler32", version = "*" },
]

# Some crates don't have (easily) machine readable licensing information,
# adding a clarification entry for it allows you to manually specify the
# licensing information
#[[licenses.clarify]]
# The name of the crate the clarification applies to
#name = "ring"
# The optional version constraint for the crate
#version = "*"
# The SPDX expression for the license requirements of the crate
#expression = "MIT AND ISC AND OpenSSL"
# One or more files in the crate's source used as the "source of truth" for
# the license expression. If the contents match, the clarification will be used
# when running the license check, otherwise the clarification will be ignored
# and the crate will be checked normally, which may produce warnings or errors
# depending on the rest of your configuration
#license-files = [
# Each entry is a crate relative path, and the (opaque) hash of its contents
#{ path = "LICENSE", hash = 0xbd0eed23 }
#]

[licenses.private]
# If true, ignores workspace crates that aren't published, or are only
# published to private registries
ignore = false
# One or more private registries that you might publish crates to, if a crate
# is only published to private registries, and ignore is true, the crate will
# not have its license(s) checked
registries = [
  #"https://sekretz.com/registry
]

# This section is considered when running `cargo deny check bans`.
# More documentation about the 'bans' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
[bans]
# Lint level for when multiple versions of the same crate are detected
multiple-versions = "warn"
# Lint level for when a crate version requirement is `*`
wildcards = "allow"
# The graph highlighting used when creating dotgraphs for crates
# with multiple versions
# * lowest-version - The path to the lowest versioned duplicate is highlighted
# * simplest-path - The path to the version with the fewest edges is highlighted
# * all - Both lowest-version and simplest-path are used
highlight = "all"
# List of crates that are allowed. Use with care!
allow = [
  #{ name = "ansi_term", version = "=0.11.0" },
]
# List of crates to deny
deny = [
  # Each entry the name of a crate and a version range. If version is
  # not specified, all versions will be matched.
  #{ name = "ansi_term", version = "=0.11.0" },
  #
  # Wrapper crates can optionally be specified to allow the crate when it
  # is a direct dependency of the otherwise banned crate
  #{ name = "ansi_term", version = "=0.11.0", wrappers = [] },
]
# Certain crates/versions that will be skipped when doing duplicate detection.
skip = [
  #{ name = "ansi_term", version = "=0.11.0" },
]
# Similarly to `skip` allows you to skip certain crates during duplicate
# detection. Unlike skip, it also includes the entire tree of transitive
# dependencies starting at the specified crate, up to a certain depth, which is
# by default infinite
skip-tree = [
  #{ name = "ansi_term", version = "=0.11.0", depth = 20 },
]

# This section is considered when running `cargo deny check sources`.
# More documentation about the 'sources' section can be found here:
# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
[sources]
# Lint level for what to happen when a crate from a crate registry that is not
# in the allow list is encountered
unknown-registry = "warn"
# Lint level for what to happen when a crate from a git repository that is not
# in the allow list is encountered
unknown-git = "warn"
# List of URLs for allowed crate registries. Defaults to the crates.io index
# if not specified. If it is specified but empty, no registries are allowed.
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
# List of URLs for allowed Git repositories
allow-git = []

[sources.allow-org]
# 1 or more github.com organizations to allow git sources for
github = []
# 1 or more gitlab.com organizations to allow git sources for
gitlab = []
# 1 or more bitbucket.org organizations to allow git sources for
bitbucket = []

Pomelo_刘金。转载请注明原文链接。感谢！

相关推荐
盒马盒马9 分钟前
Rust：变量、常量与数据类型
开发语言·rust
傻啦嘿哟16 分钟前
Rust爬虫实战：用reqwest+select打造高效网页抓取工具
开发语言·爬虫·rust
咸甜适中14 小时前
rust语言 (1.88) egui (0.32.1) 学习笔记（逐行注释）（十四）垂直滚动条
笔记·学习·rust·egui
张志鹏PHP全栈18 小时前
Rust第四天，Rust中常见编程概念
后端·rust
咸甜适中1 天前
rust语言 (1.88) egui (0.32.1) 学习笔记（逐行注释）（十五）网格布局
笔记·学习·rust·egui
susnm2 天前
最后的最后
rust·全栈
bruce541103 天前
深入理解 Rust Axum：两种依赖注入模式的实践与对比（二）
rust
该用户已不存在4 天前
这几款Rust工具，开发体验直线上升
前端·后端·rust
m0_480502646 天前
Rust 入门 生命周期-next2 (十九)
开发语言·后端·rust
寻月隐君6 天前
Rust Web 开发实战：使用 SQLx 连接 PostgreSQL 数据库
后端·rust·github
热门推荐
01Cursor 快速入门指南：从安装到核心功能02UV安装并设置国内源03【2025.08.06最新版】Android Studio下载、安装及配置记录（自动下载sdk）04如何在Windows/Linux系统上安装adb052025最新国内服务器可用docker源仓库地址大全（2025年8月更新）06【踩坑笔记】50系显卡适配的 PyTorch 安装0720个国内外主流AI绘画工具大汇总（最新免费可用~）08KGG转MP3工具|非KGM文件|解密音频09Claude Code VSCode集成开发指南：AI编程助手完整配置10UnityHub Validation Failed下载编辑器错误，添加模块报错的解决方案