supply_chain

supply_chain is a test helper for snapshotting the output of cargo-supply-chain. It makes changes to the publishers in a Rust project's dependency graph visible during testing and code review.

Installation

Install cargo-supply-chain:

cargo install cargo-supply-chain

Add supply_chain as a development dependency:

cargo add --dev supply_chain

Usage

Add a test that specifies where the snapshot should be stored:

#[test]
fn supply_chain() {
    supply_chain::check("tests/supply_chain.json");
}

Create or update the snapshot by running the test with BLESS set:

BLESS=1 cargo test supply_chain

Commit the generated snapshot. Subsequent test runs compare the current report with the committed snapshot:

cargo test supply_chain

If the report changes, inspect the diff. If the change is expected, rerun the test with BLESS=1 and commit the updated snapshot.

Behavior

For each check, supply_chain:

1. Runs cargo supply-chain update --cache-max-age=0s.
2. Runs cargo supply-chain json --no-dev.
3. Removes all avatar fields from the JSON report and pretty-prints it.
4. Compares the report with the stored snapshot, or updates the snapshot when BLESS is set to a value other than 0.

The exit status of the update command is ignored, but the report command must succeed.

This crate provides a reviewable signal when a dependency's supply-chain metadata changes. It does not determine whether a dependency or publisher is trustworthy.

License

Licensed under either of the following, at your option:

• Apache License, Version 2.0
• MIT License