cargo-deny

Cargo-deny Tool Analysis

Overview

Cargo-deny is a Rust tool that checks Cargo dependencies for license compliance, security advisories, banned crates, and duplicate dependencies. It runs as a cargo subcommand and produces JSON output for structured analysis.

Core Tool Capabilities

  • Runs via cargo deny check against workspace or package
  • Four check categories: advisories, licenses, bans, sources
  • JSON output format (--format json) with per-issue diagnostics
  • Configured via deny.toml in project root

Lintro Implementation Analysis

Preserved Features

  • Executes cargo deny check --format json
  • Parses JSON diagnostic output into structured issues
  • Discovers Cargo root from provided paths
  • Respects project-level deny.toml configuration

Defaults and Notes

  • Requires Cargo.toml to run; otherwise returns success with message
  • Times out after configurable default (60s)
  • Cannot auto-fix issues (read-only security/compliance tool)
  • Runs all check categories by default (advisories, licenses, bans, sources)

Enhancements

  • Normalized ToolResult with issue counts
  • Integrates with unified runner and timeout handling
  • Structured issue parsing with severity, category, and advisory IDs

Usage Comparison

Core cargo-deny

cargo deny check --format json
cargo deny check advisories
cargo deny check licenses

Lintro Wrapper

tool = CargoDenyPlugin()
result = tool.check(["path/to/project"], {})

Configuration Strategy

  • Minimum version: 0.14.0
  • Uses system cargo deny; install via cargo install cargo-deny
  • File patterns: Cargo.toml, deny.toml
  • Timeout configurable via tool options (default: 60s)

Limited/Missing Features

  • No pass-through for selecting specific check categories
  • No support for --exclude or --features flags
  • Cannot auto-fix; issues must be resolved manually

Recommendations

  • Consider pass-through for category selection (e.g., advisories-only mode)
  • Consider supporting --exclude for specific advisory IDs