Merge pull request rustsec#860 from graydon/improve-tree-command

Various improvements to the "cargo-lock tree" subcommand

Author: Shnatsel

cargo-lock/src/bin/cargo-lock/main.rs

@@ -7,13 +7,15 @@ use cargo_lock::{
     dependency::graph::EdgeDirection,
     dependency::Tree,
     package::{self},
-    Dependency, Lockfile, ResolveVersion,
+    Dependency, Lockfile, Package, ResolveVersion, Version,
 };
 use gumdrop::Options;
+use petgraph::graph::NodeIndex;
 use std::{
     env, fs, io,
     path::{Path, PathBuf},
     process::exit,
+    str::FromStr,
 };
 
 /// `cargo lock` subcommands
@@ -126,12 +128,66 @@ impl TranslateCmd {
 #[derive(Debug, Options)]
 struct TreeCmd {
     /// Input `Cargo.lock` file
-    #[options(short = "f", help = "input Cargo.lock file to translate")]
+    #[options(
+        short = "f",
+        long = "file",
+        help = "input Cargo.lock file to translate"
+    )]
     file: Option<PathBuf>,
 
-    /// Dependencies names to draw a tree for
-    #[options(free, help = "dependency names to draw trees for")]
-    dependencies: Vec<package::Name>,
+    /// Show exact package identities (checksums or specific source versions) when available
+    #[options(
+        short = "x",
+        long = "exact",
+        help = "show exact package identies (checksums or specific source versions) when available"
+    )]
+    exact: bool,
+
+    // Show inverse dependencies rather than forward dependencies
+    #[options(
+        short = "i",
+        long = "invert",
+        help = "show inverse dependencies _on_ a package, rather than forward dependencies _of_ a package"
+    )]
+    inverse: bool,
+
+    /// Dependencies names or hashes to draw a tree for
+    #[options(free, help = "dependency names or hashes to draw trees for")]
+    dependencies: Vec<String>,
+}
+
+fn package_matches_name(pkg: &Package, name: &str) -> bool {
+    pkg.name.as_str() == name
+}
+
+fn package_matches_ver(pkg: &Package, ver: &str) -> bool {
+    // Try interpreting ver as a semver string.
+    if let Ok(v) = Version::from_str(ver) {
+        return pkg.version == v;
+    }
+    // Try comparing ver to hashes in either the package checksum or the source
+    // precise field
+    if let Some(cksum) = &pkg.checksum {
+        if cksum.to_string() == ver {
+            return true;
+        }
+    }
+    if let Some(src) = &pkg.source {
+        if let Some(precise) = src.precise() {
+            if precise == ver {
+                return true;
+            }
+        }
+    }
+    false
+}
+
+fn package_matches(pkg: &Package, spec: &str) -> bool {
+    if let Some((name, ver)) = spec.split_once('@') {
+        package_matches_name(pkg, name) && package_matches_ver(pkg, ver)
+    } else {
+        package_matches_name(pkg, spec) || package_matches_ver(pkg, spec)
+    }
 }
 
 impl TreeCmd {
@@ -144,43 +200,40 @@ impl TreeCmd {
             exit(1);
         });
 
-        if self.dependencies.is_empty() {
-            self.dependency_tree(&tree);
+        let indices: Vec<NodeIndex> = if self.dependencies.is_empty() {
+            tree.roots().to_vec()
         } else {
-            self.inverse_dependency_tree(&lockfile, &tree);
-        }
-    }
-
-    /// Show forward dependency tree for detected root dependencies
-    fn dependency_tree(&self, tree: &Tree) {
-        for (i, index) in tree.roots().iter().enumerate() {
-            if i > 0 {
-                println!();
-            }
-
-            tree.render(&mut io::stdout(), *index, EdgeDirection::Outgoing)
-                .unwrap();
-        }
+            self.dependencies
+                .iter()
+                .map(|dep| {
+                    let package = lockfile
+                        .packages
+                        .iter()
+                        .find(|pkg| package_matches(pkg, dep))
+                        .unwrap_or_else(|| {
+                            eprintln!("*** error: invalid dependency name: `{}`", dep);
+                            exit(1);
+                        });
+                    tree.nodes()[&package.into()]
+                })
+                .collect()
+        };
+
+        self.dependency_tree(&tree, &indices);
     }
 
-    /// Show inverse dependency tree for the provided dependencies
-    fn inverse_dependency_tree(&self, lockfile: &Lockfile, tree: &Tree) {
-        for (i, dep) in self.dependencies.iter().enumerate() {
+    /// Show dependency tree for the provided dependencies
+    fn dependency_tree(&self, tree: &Tree, indices: &[NodeIndex]) {
+        for (i, index) in indices.iter().enumerate() {
             if i > 0 {
                 println!();
             }
-
-            let package = lockfile
-                .packages
-                .iter()
-                .find(|pkg| pkg.name == *dep)
-                .unwrap_or_else(|| {
-                    eprintln!("*** error: invalid dependency name: `{}`", dep);
-                    exit(1);
-                });
-
-            let index = tree.nodes()[&package.into()];
-            tree.render(&mut io::stdout(), index, EdgeDirection::Incoming)
+            let direction = if self.inverse {
+                EdgeDirection::Incoming
+            } else {
+                EdgeDirection::Outgoing
+            };
+            tree.render(&mut io::stdout(), *index, direction, self.exact)
                 .unwrap();
         }
     }

cargo-lock/src/dependency/tree.rs

@@ -55,8 +55,9 @@ impl Tree {
         w: &mut impl io::Write,
         node_index: NodeIndex,
         direction: EdgeDirection,
+        exact: bool,
     ) -> io::Result<()> {
-        self.render_with_symbols(w, node_index, direction, &Symbols::default())
+        self.render_with_symbols(w, node_index, direction, &Symbols::default(), exact)
     }
 
     /// Render the dependency graph for the given [`NodeIndex`] using the
@@ -67,8 +68,9 @@ impl Tree {
         node_index: NodeIndex,
         direction: EdgeDirection,
         symbols: &Symbols,
+        exact: bool,
     ) -> io::Result<()> {
-        Presenter::new(&self.graph, symbols).print_node(w, node_index, direction)
+        Presenter::new(&self.graph, symbols).print_node(w, node_index, direction, exact)
     }
 
     /// Get the indexes of the root packages in the workspace
@@ -139,6 +141,7 @@ impl<'g, 's> Presenter<'g, 's> {
         w: &mut impl io::Write,
         node_index: NodeIndex,
         direction: EdgeDirection,
+        exact: bool,
     ) -> io::Result<()> {
         let package = &self.graph[node_index];
         let new = self.visited.insert(node_index);
@@ -158,7 +161,18 @@ impl<'g, 's> Presenter<'g, 's> {
             write!(w, "{0}{1}{1} ", c, self.symbols.right)?;
         }
 
-        writeln!(w, "{} {}", &package.name, &package.version)?;
+        if exact {
+            let spec = if let Some(checksum) = &package.checksum {
+                format!("checksum:{}", checksum)
+            } else if let Some(src) = &package.source {
+                src.to_string()
+            } else {
+                "inexact".to_string()
+            };
+            writeln!(w, "{} {} {}", &package.name, &package.version, spec)?;
+        } else {
+            writeln!(w, "{} {}", &package.name, &package.version)?;
+        }
 
         if !new {
             return Ok(());
@@ -176,7 +190,7 @@ impl<'g, 's> Presenter<'g, 's> {
 
         for (i, dependency) in dependencies.iter().enumerate() {
             self.levels_continue.push(i < (dependencies.len() - 1));
-            self.print_node(w, *dependency, direction)?;
+            self.print_node(w, *dependency, direction, exact)?;
             self.levels_continue.pop();
         }