select first discovered SBOM file

Author: tofay

cargo-auditable/src/collect_audit_data.rs

@@ -13,14 +13,11 @@ pub fn compressed_dependency_list(rustc_args: &RustcArgs, target_triple: &str) -
 
     // If cargo has created precursor SBOM files, use them instead of `cargo metadata`.
     let version_info = if sbom_path.as_ref().map(|p| !p.is_empty()).unwrap_or(false) {
-        let sbom_paths = std::env::split_paths(&sbom_path.unwrap()).collect::<Vec<_>>();
-        // Cargo may create multiple SBOM precursor files.
-        // We can't control per-binary (or cdylib) dependency information, just grab the first non-rlib SBOM we find.
-        let sbom_path = sbom_paths
-            .iter()
-            .find(|p| !p.ends_with(".rlib.cargo-sbom.json"))
-            .unwrap_or_else(|| &sbom_paths[0]);
-        let sbom_data: Vec<u8> = std::fs::read(sbom_path)
+        // Cargo creates an SBOM file for each output file (rlib, bin, cdylib, etc),
+        // but the SBOM file is identical for each output file in a given rustc crate compilation,
+        // so we can just use the first SBOM we find.
+        let sbom_path = std::env::split_paths(&sbom_path.unwrap()).next().unwrap();
+        let sbom_data: Vec<u8> = std::fs::read(&sbom_path)
             .unwrap_or_else(|_| panic!("Failed to read SBOM file at {}", sbom_path.display()));
         let sbom_precursor: sbom_precursor::SbomPrecursor = serde_json::from_slice(&sbom_data)
             .unwrap_or_else(|_| panic!("Failed to parse SBOM file at {}", sbom_path.display()));

cargo-auditable/src/sbom_precursor.rs

@@ -23,7 +23,7 @@ impl From<SbomPrecursor> for VersionInfo {
         // cargo sbom data format has more nodes than the auditable info format - if a crate is both a build
         // and runtime dependency it will appear twice in the `crates` array.
         // The `VersionInfo` format lists each package only once, with a single `kind` field
-        // (Runtime having precence over other kinds).
+        // (Runtime having precedence over other kinds).
 
         // Firstly, we deduplicate the (name, version) pairs and create a mapping from the
         // original indices in the cargo sbom array to the new index in the auditable info package array.