Repository: mozilla/cargo-vet
Pull request #470 (2023-05-09 16:18:33)

Add --store-path to CLI to specify supply-chain directory.
Our use case for this is the following:

* We want to import and build 3rd party Rust binaries -- such as `cargo-vet` itself.
* We want to apply our own auditing criteria, not necessarily what is use by the upstream maintainers.
* We want to leave the imported code untouched -- simply mirror the upstream repo, and not fork or maintain patches.

Without the ability to override the path to the supply-chain directory, we would have to fork or patch Config.toml to set `[package.metadata.vet]`.

As a side note, the behavior of `cargo vet` with respect to the current working directory differs from that of `cargo vendor`. `cargo vendor --manifest-path blah/Cargo.toml` uses a vendor directory in the current working directory, while `cargo vet init --manifest-path blah/Cargo.toml` creates a supply-chain directory in the same directory as the manifest.


Patch:
diff --git a/src/cli.rs b/src/cli.rs
index 30843f4..f831889 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -33,6 +33,11 @@ pub struct Cli {
     #[clap(help_heading = "GLOBAL OPTIONS", global = true)]
     pub manifest_path: Option<PathBuf>,
 
+    /// Path to the supply-chain directory
+    #[clap(long, name = "STORE_PATH", parse(from_os_str))]
+    #[clap(help_heading = "GLOBAL OPTIONS", global = true)]
+    pub store_path: Option<PathBuf>,
+
     /// Don't use --all-features
     ///
     /// We default to passing --all-features to `cargo metadata`
diff --git a/src/main.rs b/src/main.rs
index 7b09f7e..08a800d 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -419,6 +419,13 @@ fn real_main() -> Result<(), miette::Report> {
         })
         .transpose()?;
 
+    let cli_metacfg = cli.store_path.as_ref().map(|path| MetaConfigInstance {
+        version: Some(1),
+        store: Some(StoreInfo {
+            path: Some(path.clone()),
+        }),
+    });
+
     if workspace_metacfg.is_some() && package_metacfg.is_some() {
         // ERRORS: immediate fatal diagnostic
         return Err(miette!("Both a workspace and a package defined [metadata.vet]! We don't know what that means, if you do, let us know!"));
@@ -431,6 +438,9 @@ fn real_main() -> Result<(), miette::Report> {
     if let Some(metacfg) = package_metacfg {
         metacfgs.push(metacfg);
     }
+    if let Some(metacfg) = cli_metacfg {
+        metacfgs.push(metacfg);
+    }
     let metacfg = MetaConfig(metacfgs);
 
     info!("Final Metadata Config: ");


Test patch:
diff --git a/tests/snapshots/test_cli__long-help.snap b/tests/snapshots/test_cli__long-help.snap
index 03a4999..9d3c396 100644
--- a/tests/snapshots/test_cli__long-help.snap
+++ b/tests/snapshots/test_cli__long-help.snap
@@ -24,6 +24,9 @@ GLOBAL OPTIONS:
         --manifest-path <PATH>
             Path to Cargo.toml
 
+        --store-path <STORE_PATH>
+            Path to the supply-chain directory
+
         --no-all-features
             Don't use --all-features
             
diff --git a/tests/snapshots/test_cli__markdown-help.snap b/tests/snapshots/test_cli__markdown-help.snap
index 115a6c3..68fb75d 100644
--- a/tests/snapshots/test_cli__markdown-help.snap
+++ b/tests/snapshots/test_cli__markdown-help.snap
@@ -33,6 +33,9 @@ Print version information
 #### `--manifest-path <PATH>`
 Path to Cargo.toml
 
+#### `--store-path <STORE_PATH>`
+Path to the supply-chain directory
+
 #### `--no-all-features`
 Don't use --all-features
 
diff --git a/tests/snapshots/test_cli__short-help.snap b/tests/snapshots/test_cli__short-help.snap
index dbd63cc..e9d200a 100644
--- a/tests/snapshots/test_cli__short-help.snap
+++ b/tests/snapshots/test_cli__short-help.snap
@@ -18,6 +18,9 @@ GLOBAL OPTIONS:
         --manifest-path <PATH>
             Path to Cargo.toml
 
+        --store-path <STORE_PATH>
+            Path to the supply-chain directory
+
         --no-all-features
             Don't use --all-features