Fixes #4581: Failure to scan cargo #4582

omsuneri · 2025-10-10T12:23:24Z

Issue :
Fixes #4581

Changes made :
cargo.py
added proper null check before accessing .path on parent resource
added fallback to use os.path.dirname(resource.path) when no parent exists
npm.py
code was calling .parent() twice instead of reusing the result

after making changes i passed the same cargo.toml file in the scancode and the error is resolved.
before changes result.json:

{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "v32.4.1-16-g93a2d69943",
      "options": {
        "input": [
          "Cargo.toml"
        ],
        "--json-pp": "original_resultm.json",
        "--package": true
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2025-10-10T120320.176700",
      "end_timestamp": "2025-10-10T120353.633673",
      "output_format_version": "4.1.0",
      "duration": 33.4572548866272,
      "message": null,
      "errors": [
        "Path: Cargo.toml"
      ],
      "warnings": [],
      "extra_data": {
        "system_environment": {
          "operating_system": "mac",
          "cpu_architecture": "64",
          "platform": "macOS-26.0.1-x86_64-i386-64bit",
          "platform_version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:39 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T8103",
          "python_version": "3.12.4 (v3.12.4:8e8a4baf65, Jun  6 2024, 17:33:18) [Clang 13.0.0 (clang-1300.0.29.30)]"
        },
        "spdx_license_list_version": "3.27",
        "files_count": 1
      }
    }
  ],
  "packages": [],
  "dependencies": [],
  "files": [
    {
      "path": "Cargo.toml",
      "type": "file",
      "package_data": [
        {
          "type": "cargo",
          "namespace": null,
          "name": "constant_time_eq",
          "version": "0.4.2",
          "qualifiers": {},
          "subpath": null,
          "primary_language": "Rust",
          "description": "Compares two equal-sized byte strings in constant time.",
          "release_date": null,
          "parties": [
            {
              "type": "person",
              "role": "author",
              "name": "Cesar Eduardo Barros",
              "email": "[email protected]",
              "url": null
            }
          ],
          "keywords": [
            "constant_time",
            "cryptography",
            "no-std"
          ],
          "homepage_url": null,
          "download_url": null,
          "size": null,
          "sha1": null,
          "md5": null,
          "sha256": null,
          "sha512": null,
          "bug_tracking_url": null,
          "code_view_url": null,
          "vcs_url": "https://github.com/cesarb/constant_time_eq",
          "copyright": null,
          "holder": null,
          "declared_license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
          "declared_license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "license_detections": [
            {
              "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
              "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
              "matches": [
                {
                  "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
                  "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
                  "from_file": "Cargo.toml",
                  "start_line": 1,
                  "end_line": 1,
                  "matcher": "1-spdx-id",
                  "score": 100.0,
                  "matched_length": 10,
                  "match_coverage": 100.0,
                  "rule_relevance": 100,
                  "rule_identifier": "spdx-license-identifier-cc0_1_0_or_mit_0_or_apache_2_0-f44a2ec174eb034bd3c662f728664281e507b20d",
                  "rule_url": null,
                  "matched_text": "CC0-1.0 OR MIT-0 OR Apache-2.0"
                }
              ],
              "identifier": "cc0_1_0_or_mit_0_or_apache_2_0-3f14dd48-7cd8-cf28-d4e1-3b0174a587ee"
            }
          ],
          "other_license_expression": null,
          "other_license_expression_spdx": null,
          "other_license_detections": [],
          "extracted_license_statement": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "notice_text": null,
          "source_packages": [],
          "file_references": [],
          "is_private": false,
          "is_virtual": false,
          "extra_data": {
            "documentation_url": "https://docs.rs/constant_time_eq",
            "rust_version": "1.85.0",
            "rust_edition": "2024"
          },
          "dependencies": [
            {
              "purl": "pkg:cargo/criterion",
              "extracted_requirement": "0.5.1",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {
                "version": "0.5.1",
                "features": [
                  "cargo_bench_support",
                  "html_reports"
                ]
              }
            },
            {
              "purl": "pkg:cargo/count_instructions",
              "extracted_requirement": "0.2.0",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {}
            }
          ],
          "repository_homepage_url": "https://crates.io/crates/constant_time_eq",
          "repository_download_url": "https://crates.io/api/v1/crates/constant_time_eq/0.4.2/download",
          "api_data_url": "https://crates.io/api/v1/crates/constant_time_eq",
          "datasource_id": "cargo_toml",
          "purl": "pkg:cargo/[email protected]"
        }
      ],
      "for_packages": [],
      "scan_errors": [
        "get_package_and_deps: Failed to assemble PackageData: PackageData(type='cargo', namespace=None, name='constant_time_eq', version='0.4.2', datasource_id='cargo_toml'):\nTraceback (most recent call last):\n  File \"/Users/omsuneri/scancode-toolkit/src/packagedcode/plugin_package.py\", line 428, in get_package_and_deps\n    for item in items:\n  File \"/Users/omsuneri/scancode-toolkit/src/packagedcode/cargo.py\", line 62, in assemble\n    workspace_root_path = resource.parent(codebase).path\n                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'bool' object has no attribute 'path'\n"
      ]
    }
  ]
}

after changes result.json:

{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "v32.4.1-18-g02a38c1abc",
      "options": {
        "input": [
          "Cargo.toml"
        ],
        "--json-pp": "original_resultm1.json",
        "--package": true
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2025-10-10T120813.765667",
      "end_timestamp": "2025-10-10T120835.711878",
      "output_format_version": "4.1.0",
      "duration": 21.946434020996094,
      "message": null,
      "errors": [],
      "warnings": [],
      "extra_data": {
        "system_environment": {
          "operating_system": "mac",
          "cpu_architecture": "64",
          "platform": "macOS-26.0.1-x86_64-i386-64bit",
          "platform_version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:39 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T8103",
          "python_version": "3.12.4 (v3.12.4:8e8a4baf65, Jun  6 2024, 17:33:18) [Clang 13.0.0 (clang-1300.0.29.30)]"
        },
        "spdx_license_list_version": "3.27",
        "files_count": 1
      }
    }
  ],
  "packages": [],
  "dependencies": [],
  "files": [
    {
      "path": "Cargo.toml",
      "type": "file",
      "package_data": [
        {
          "type": "cargo",
          "namespace": null,
          "name": "constant_time_eq",
          "version": "0.4.2",
          "qualifiers": {},
          "subpath": null,
          "primary_language": "Rust",
          "description": "Compares two equal-sized byte strings in constant time.",
          "release_date": null,
          "parties": [
            {
              "type": "person",
              "role": "author",
              "name": "Cesar Eduardo Barros",
              "email": "[email protected]",
              "url": null
            }
          ],
          "keywords": [
            "constant_time",
            "cryptography",
            "no-std"
          ],
          "homepage_url": null,
          "download_url": null,
          "size": null,
          "sha1": null,
          "md5": null,
          "sha256": null,
          "sha512": null,
          "bug_tracking_url": null,
          "code_view_url": null,
          "vcs_url": "https://github.com/cesarb/constant_time_eq",
          "copyright": null,
          "holder": null,
          "declared_license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
          "declared_license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "license_detections": [
            {
              "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
              "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
              "matches": [
                {
                  "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
                  "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
                  "from_file": "Cargo.toml",
                  "start_line": 1,
                  "end_line": 1,
                  "matcher": "1-spdx-id",
                  "score": 100.0,
                  "matched_length": 10,
                  "match_coverage": 100.0,
                  "rule_relevance": 100,
                  "rule_identifier": "spdx-license-identifier-cc0_1_0_or_mit_0_or_apache_2_0-f44a2ec174eb034bd3c662f728664281e507b20d",
                  "rule_url": null,
                  "matched_text": "CC0-1.0 OR MIT-0 OR Apache-2.0"
                }
              ],
              "identifier": "cc0_1_0_or_mit_0_or_apache_2_0-3f14dd48-7cd8-cf28-d4e1-3b0174a587ee"
            }
          ],
          "other_license_expression": null,
          "other_license_expression_spdx": null,
          "other_license_detections": [],
          "extracted_license_statement": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "notice_text": null,
          "source_packages": [],
          "file_references": [],
          "is_private": false,
          "is_virtual": false,
          "extra_data": {
            "documentation_url": "https://docs.rs/constant_time_eq",
            "rust_version": "1.85.0",
            "rust_edition": "2024"
          },
          "dependencies": [
            {
              "purl": "pkg:cargo/criterion",
              "extracted_requirement": "0.5.1",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {
                "version": "0.5.1",
                "features": [
                  "cargo_bench_support",
                  "html_reports"
                ]
              }
            },
            {
              "purl": "pkg:cargo/count_instructions",
              "extracted_requirement": "0.2.0",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {}
            }
          ],
          "repository_homepage_url": "https://crates.io/crates/constant_time_eq",
          "repository_download_url": "https://crates.io/api/v1/crates/constant_time_eq/0.4.2/download",
          "api_data_url": "https://crates.io/api/v1/crates/constant_time_eq",
          "datasource_id": "cargo_toml",
          "purl": "pkg:cargo/[email protected]"
        }
      ],
      "for_packages": [],
      "scan_errors": []
    }
  ]
}

omsuneri · 2025-10-10T12:24:36Z

@AyanSinhaMahapatra review this please !!

AyanSinhaMahapatra · 2025-10-15T15:25:56Z

@omsuneri can you add a small test for #4581 with a single (stripped as much as possible) cargo manifest to show this doesn't fail anymore and check against future failures?

omsuneri · 2025-10-15T15:28:49Z

@AyanSinhaMahapatra sure I ll add the required test in the test suite !!

omsuneri · 2025-10-15T20:46:25Z

@AyanSinhaMahapatra i added the test please review !!

here i used the same cargo.toml file this https://raw.githubusercontent.com/cesarb/constant_time_eq/refs/heads/main/Cargo.toml mentioned in the issue
please request iof any further chnages are required

AyanSinhaMahapatra

@omsuneri please update your tests to actually check that the failure in #4581 is not happening again

Could you also merge latest develop as there were fixes for some failing tests.

AyanSinhaMahapatra · 2025-10-24T08:41:07Z

tests/packagedcode/test_cargo.py

        packages_data = cargo.CargoTomlHandler.parse(test_file)
        self.check_packages_data(packages_data, expected_loc, regen=REGEN_TEST_FIXTURES)

+    def test_parse_cargo_toml_single_file_no_crash(self):


@omsuneri the fixes you applied in #4582 are inthe assemble function for cargo, but you are only testing cargo.CargoTomlHandler.parse for a single cargo file which was not what was failing before. You need to add a test which was failing before your changes and passes with your fixes. It is best practice to write the test before you add the fixes anyway.

Create a test with a full --package scan like the test_scan_works_on_cargo_workspace_tauri test below, as assembly functions are called in the package plugin along with the package parsers. See https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/packagedcode/plugin_package.py for more details.

AyanSinhaMahapatra · 2025-10-24T08:42:44Z

tests/packagedcode/data/cargo/cargo_toml/single-file-scan/Cargo.toml

+[dev-dependencies]
+criterion = { version = "0.5.1", features = ["cargo_bench_support", "html_reports"] }
+count_instructions = "0.2.0"
+


Could you shorten this test file by getting rid of everything below the dev-dependencies as we ignore this anyway as they are not useful info? We keep test files as small as possible to reduce repo size

@AyanSinhaMahapatra yaa actually i followed the same cargo.toml which is in the issue also before adding i looked in other cargo.toml and there is features and everything so i just added this one without any type of annotation
will be making this shorter !!

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri · 2025-10-25T05:43:36Z

@omsuneri please update your tests to actually check that the failure in #4581 is not happening again

Could you also merge latest develop as there were fixes for some failing tests.

sure i m just about to test the latest changes !!

AyanSinhaMahapatra requested changes Oct 24, 2025

View reviewed changes

omsuneri added 3 commits October 24, 2025 15:56

fix: prevent 'NoneType' error when scanning single Cargo.toml files

3cf1394

Signed-off-by: Om Santosh Suneri <[email protected]>

fix: use cached parent resource instead of redundant parent() call

aaea989

Signed-off-by: Om Santosh Suneri <[email protected]>

Add regression test for single Cargo.toml file scan

9c3b77f

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri force-pushed the resolving-4581 branch from b755a2f to 9c3b77f Compare October 24, 2025 10:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Fixes #4581: Failure to scan cargo #4582

Fixes #4581: Failure to scan cargo #4582

Uh oh!

omsuneri commented Oct 10, 2025

Uh oh!

omsuneri commented Oct 10, 2025

Uh oh!

AyanSinhaMahapatra commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

AyanSinhaMahapatra left a comment •

edited

Loading

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Uh oh!

omsuneri Oct 25, 2025

Uh oh!

omsuneri commented Oct 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Fixes #4581: Failure to scan cargo #4582

Are you sure you want to change the base?

Fixes #4581: Failure to scan cargo #4582

Uh oh!

Conversation

omsuneri commented Oct 10, 2025

Uh oh!

omsuneri commented Oct 10, 2025

Uh oh!

AyanSinhaMahapatra commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

AyanSinhaMahapatra left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

omsuneri Oct 25, 2025

Choose a reason for hiding this comment

Uh oh!

omsuneri commented Oct 25, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AyanSinhaMahapatra left a comment •

edited

Loading