🚀 Motivation

The SBOM generator was not capturing metadata such as file location and transtivity information for Rust dependencies, making it difficult to identify where direct dependencies are declared in Cargo.toml files.

📚 Documentation

📝 Summary

This PR implements a Cargo.toml matcher for the Rust ecosystem to enrich package data with location evidence. At a high level the matcher takes in the dependencies we parse from the Cargo.lock file, and matches it against the user defined Cargo.toml file to try and resolve metadata for these dependencies (see this doc for details on these two files).

The new matcher:

• Parses the Cargo.toml file to give us the different dependencies defined (regular, build, dev, workspace)
• Processes these different dependency sections by trying to match it against the raw toml file to get dependency location data

🧪 Testing

• New tests were added for new logic.
• Existing tests were updated for new logic, and not only so that they pass!
• Benchmark results prove that performance is the same or better.

🚧 Staging validation

• Deployed and monitored using Datadog dashboards.
• Proof that it works as expected, including profiling or UX screenshots.

🆘 Recovery

Notes for on-call - select only one:

• The change can be rolled back.
• Do not roll back. Why?: