@@ -185,8 +185,6 @@ function getSBOM(manifest, opts = {}, includeTransitive) {
185185 let sbom
186186 if ( crateType === CrateType . WORKSPACE_VIRTUAL ) {
187187 sbom = handleVirtualWorkspace ( manifest , metadata , ignoredDeps , includeTransitive , opts , license )
188- } else if ( crateType === CrateType . WORKSPACE_WITH_ROOT_CRATE ) {
189- sbom = handleWorkspaceWithRoot ( metadata , ignoredDeps , includeTransitive , opts , license )
190188 } else {
191189 sbom = handleSingleCrate ( metadata , ignoredDeps , includeTransitive , opts , license )
192190 }
@@ -250,7 +248,11 @@ function detectCrateType(metadata) {
250248}
251249
252250/**
253- * Handles SBOM generation for single crate projects (no workspace members beyond the root).
251+ * Handles SBOM generation for single crate and workspace-with-root-crate projects.
252+ * For workspace-with-root-crate, workspace members are only included if they
253+ * appear in the root crate's dependency graph from cargo metadata. We don't
254+ * automatically add all members as dependencies since most workspace members
255+ * (examples, tools, benchmarks) depend ON the root crate, not the other way around.
254256 * @param {object } metadata - parsed cargo metadata
255257 * @param {Set<string> } ignoredDeps - set of ignored dependency names
256258 * @param {boolean } includeTransitive - whether to include transitive dependencies
@@ -281,44 +283,6 @@ function handleSingleCrate(metadata, ignoredDeps, includeTransitive, opts, licen
281283 return sbom . getAsJsonString ( opts )
282284}
283285
284- /**
285- * Handles SBOM generation for workspace-with-root-crate projects.
286- * Processes root crate dependencies — this naturally includes any workspace
287- * members that are actual dependencies via the cargo dependency graph.
288- * Workspace members are only included if they appear in the root crate's
289- * dependency graph from cargo metadata. We don't automatically add all
290- * members as dependencies since most workspace members (examples, tools,
291- * benchmarks) depend ON the root crate, not the other way around.
292- * @param {object } metadata - parsed cargo metadata
293- * @param {Set<string> } ignoredDeps - set of ignored dependency names
294- * @param {boolean } includeTransitive - whether to include transitive dependencies
295- * @param {{} } opts - options
296- * @param {string|null } license - SPDX license identifier for the root component
297- * @returns {string } SBOM json string
298- * @private
299- */
300- function handleWorkspaceWithRoot ( metadata , ignoredDeps , includeTransitive , opts , license ) {
301- let rootPackageId = metadata . resolve . root
302- let rootPackage = findPackageById ( metadata , rootPackageId )
303- let rootPurl = toPurl ( rootPackage . name , rootPackage . version )
304-
305- let sbom = new Sbom ( )
306- sbom . addRoot ( rootPurl , license )
307-
308- let resolveNode = findResolveNode ( metadata , rootPackageId )
309- if ( ! resolveNode ) {
310- return sbom . getAsJsonString ( opts )
311- }
312-
313- if ( includeTransitive ) {
314- addTransitiveDeps ( sbom , metadata , rootPackageId , ignoredDeps , new Set ( ) )
315- } else {
316- addDirectDeps ( sbom , metadata , rootPackageId , rootPurl , ignoredDeps )
317- }
318-
319- return sbom . getAsJsonString ( opts )
320- }
321-
322286/**
323287 * Handles SBOM generation for virtual workspace projects.
324288 *
0 commit comments