Skip to content

Rust#

What licenseal reads in a Cargo project. The rules that hold for every ecosystem are under How a scan works.

  • Registry: crates.io
  • Manifests: Cargo.toml ([dependencies], [dev-dependencies], [build-dependencies], [target.<cfg>.*], [workspace.dependencies] via workspace = true references)
  • Lockfiles: Cargo.lock

What is read#

With a Cargo.lock, the locked graph is reported as it is.

Dev dependencies#

[dev-dependencies] are dev dependencies. [build-dependencies] are production.

Off-registry dependencies#

These are reported as off-registry dependencies:

  • a git = … dependency;
  • a path = … the scan does not read;
  • a crate that a [patch] or [replace] entry points at either.

Not evaluated#

  • Without a Cargo.lock, the optional (feature-gated) dependencies of the crates the registry walk visits.
  • A path crate that Cargo.lock reaches only through another path crate the scan does not read is not reported.
  • Cargo's .cargo/config.toml is not read: see What is not read.

See also#