fix: rework name and version for virtual workspaces root node

Author: soul2zimate

src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java

@@ -60,6 +60,7 @@ public final class CargoProvider extends Provider {
   private static final ObjectMapper MAPPER =
       new ObjectMapper().configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
   private static final Logger log = LoggersFactory.getLogger(CargoProvider.class.getName());
+  private static final String VIRTUAL_VERSION = "1.0.0";
   private static final String PACKAGE_NAME = "package.name";
   private static final String PACKAGE_VERSION = "package.version";
   private static final String PACKAGE_VERSION_WORKSPACE = "package.version.workspace";
@@ -69,14 +70,18 @@ public final class CargoProvider extends Provider {
   private final String cargoExecutable;
 
   private void addDependencies(
-      Sbom sbom, PackageURL root, Set<String> ignoredDeps, AnalysisType analysisType) {
+      Sbom sbom,
+      PackageURL root,
+      Set<String> ignoredDeps,
+      AnalysisType analysisType,
+      ProjectInfo projectInfo) {
     try {
       CargoMetadata metadata = executeCargoMetadata();
       if (metadata != null && metadata.resolve() != null && metadata.resolve().nodes() != null) {
         // Build maps and find root once, reuse for better performance
         Map<String, CargoPackage> packageMap = buildPackageMap(metadata);
         Map<String, CargoNode> nodeMap = buildNodeMap(metadata);
-        CargoNode rootNode = findRootNodeForAnalysis(metadata, nodeMap);
+        CargoNode rootNode = findRootNodeForAnalysis(metadata, nodeMap, projectInfo);
 
         if (rootNode == null) {
           return;
@@ -228,21 +233,21 @@ private Map<String, CargoNode> buildNodeMap(CargoMetadata metadata) {
   }
 
   private CargoNode findRootNodeForAnalysis(
-      CargoMetadata metadata, Map<String, CargoNode> nodeMap) {
+      CargoMetadata metadata, Map<String, CargoNode> nodeMap, ProjectInfo projectInfo) {
     /* The package in the current working directory (if --manifest-path is not given).
     This is null if there is a virtual workspace. Otherwise, it is
     the Package ID of the package.
     */
     String rootId = metadata.resolve().root();
     // Handle workspace-only projects (no root package)
     if (rootId == null) {
-      return createRootNodeFromVirtualWorkspace(metadata, nodeMap);
+      return createRootNodeFromVirtualWorkspace(metadata, nodeMap, projectInfo);
     }
     return nodeMap.get(rootId);
   }
 
   private CargoNode createRootNodeFromVirtualWorkspace(
-      CargoMetadata metadata, Map<String, CargoNode> nodeMap) {
+      CargoMetadata metadata, Map<String, CargoNode> nodeMap, ProjectInfo projectInfo) {
     if (metadata.workspaceMembers() == null || metadata.workspaceMembers().isEmpty()) {
       log.warning("No workspace members found for workspace-only project");
       return null;
@@ -275,8 +280,8 @@ private CargoNode createRootNodeFromVirtualWorkspace(
     }
 
     // Create a virtual root node with combined dependencies
-    // Use the workspace name/version for the virtual root
-    String virtualRootId = "virtual-workspace-root";
+    // Use the actual workspace name/version from ProjectInfo
+    String virtualRootId = String.format("%s#%s", projectInfo.name(), projectInfo.version());
     return new CargoNode(virtualRootId, null, new ArrayList<>(depMap.values()));
   }
 
@@ -483,9 +488,9 @@ private Sbom createSbom(boolean includeTransitiveDependencies) throws IOExceptio
       Set<String> ignoredDeps = getIgnoredDependencies(tomlResult, cargoContent);
 
       if (includeTransitiveDependencies) {
-        addDependencies(sbom, root, ignoredDeps, AnalysisType.STACK);
+        addDependencies(sbom, root, ignoredDeps, AnalysisType.STACK, projectInfo);
       } else {
-        addDependencies(sbom, root, ignoredDeps, AnalysisType.COMPONENT);
+        addDependencies(sbom, root, ignoredDeps, AnalysisType.COMPONENT, projectInfo);
       }
       return sbom;
     } catch (Exception e) {
@@ -513,9 +518,10 @@ private ProjectInfo parseCargoToml(TomlParseResult result) throws IOException {
             "Parsed project info: name="
                 + packageName
                 + ", version="
-                + (packageVersion != null ? packageVersion : "0.0.0"));
+                + (packageVersion != null ? packageVersion : VIRTUAL_VERSION));
       }
-      return new ProjectInfo(packageName, packageVersion != null ? packageVersion : "0.0.0");
+      return new ProjectInfo(
+          packageName, packageVersion != null ? packageVersion : VIRTUAL_VERSION);
     }
     // Check for workspace section as fallback (when there's no [package] section)
     boolean hasWorkspace = result.contains("workspace");
@@ -527,9 +533,10 @@ private ProjectInfo parseCargoToml(TomlParseResult result) throws IOException {
             "Using workspace fallback: name="
                 + dirName
                 + ", version="
-                + (workspaceVersion != null ? workspaceVersion : "0.0.0"));
+                + (workspaceVersion != null ? workspaceVersion : VIRTUAL_VERSION));
       }
-      return new ProjectInfo(dirName, workspaceVersion != null ? workspaceVersion : "0.0.0");
+      return new ProjectInfo(
+          dirName, workspaceVersion != null ? workspaceVersion : VIRTUAL_VERSION);
     }
     throw new IOException("Invalid Cargo.toml: no [package] or [workspace] section found");
   }

src/test/java/io/github/guacsec/trustifyda/providers/CargoProviderCargoParsingTest.java

@@ -160,9 +160,9 @@ public void testPackageCargoTomlWithMissingVersion(@TempDir Path tempDir) throws
     var stackContent = provider.provideStack();
     String stackSbom = new String(stackContent.buffer);
 
-    // Should use default version "0.0.0"
+    // Should use default version "1.0.0"
     assertTrue(stackSbom.contains("no-version-project"));
-    assertTrue(stackSbom.contains("0.0.0"));
+    assertTrue(stackSbom.contains("1.0.0"));
   }
 
   @Test
@@ -188,7 +188,7 @@ public void testWorkspaceCargoTomlWithoutVersion(@TempDir Path tempDir) throws I
 
     // Should use directory name and default version
     assertTrue(stackSbom.contains(tempDir.getFileName().toString()));
-    assertTrue(stackSbom.contains("0.0.0"));
+    assertTrue(stackSbom.contains("1.0.0"));
   }
 
   @Test
@@ -351,7 +351,7 @@ public void testPackageWithWorkspaceCargoToml(@TempDir Path tempDir) throws IOEx
 
     // Should NOT contain default version (which would indicate workspace parsing)
     assertFalse(
-        componentContent.contains("0.0.0"),
+        componentContent.contains("1.0.0"),
         "Should not contain default version from workspace parsing");
   }
 
@@ -661,4 +661,63 @@ public void testDependencyKindsFilteringLogic() {
 
     assertTrue(true, "Logic documentation test - see console output for details");
   }
+
+  @Test
+  public void testVirtualRootUsesWorkspaceNameAndVersion(@TempDir Path tempDir) throws IOException {
+    // Create a workspace Cargo.toml with specific name (directory name) and version
+    Path cargoToml = tempDir.resolve("Cargo.toml");
+    String content =
+        """
+        [workspace]
+        members = ["member1", "member2"]
+
+        [workspace.package]
+        version = "2.5.0"
+        edition = "2021"
+        """;
+    Files.writeString(cargoToml, content);
+
+    CargoProvider provider = new CargoProvider(cargoToml);
+
+    // Test that virtual root doesn't use hardcoded name anymore
+    var stackContent = provider.provideStack();
+    String stackSbom = new String(stackContent.buffer);
+
+    // Verify workspace name comes from directory name
+    String expectedWorkspaceName = tempDir.getFileName().toString();
+    assertTrue(
+        stackSbom.contains(expectedWorkspaceName),
+        "SBOM should contain workspace directory name: " + expectedWorkspaceName);
+
+    // Verify workspace version comes from workspace.package.version
+    assertTrue(stackSbom.contains("2.5.0"), "SBOM should contain workspace version: 2.5.0");
+  }
+
+  @Test
+  public void testVirtualRootWithoutVersionUsesDefault(@TempDir Path tempDir) throws IOException {
+    // Create a workspace Cargo.toml without version
+    Path cargoToml = tempDir.resolve("Cargo.toml");
+    String content =
+        """
+        [workspace]
+        members = ["api", "core"]
+
+        [workspace.package]
+        edition = "2021"
+        """;
+    Files.writeString(cargoToml, content);
+
+    CargoProvider provider = new CargoProvider(cargoToml);
+
+    var stackContent = provider.provideStack();
+    String stackSbom = new String(stackContent.buffer);
+
+    // Should use directory name and default version
+    String expectedWorkspaceName = tempDir.getFileName().toString();
+    assertTrue(
+        stackSbom.contains(expectedWorkspaceName),
+        "SBOM should contain workspace directory name: " + expectedWorkspaceName);
+
+    assertTrue(stackSbom.contains("1.0.0"), "SBOM should contain default version: 1.0.0");
+  }
 }