Skip to content

Is there a good way to visualise rust-audit-info json? (Also additional dependencies may be present) #182

@xnox

Description

@xnox

It is difficult to resolve the dependencies IDs, is there anything that would substitute names for the digits? or at least augument the json with digits?

Is there anything that can generate graph (mermaid or graphviz) from the json?

Also what is the difference between no kind specified, and kind "build"? Are the kind "build" crates linked into the final binary?

I am trying to understand why "ring" crate got into this binary, and if it really is present in the binary and used, or not.

ztunnel.json.txt.gz

gzip -d ztunnel.json.txt
cat ztunnel.json | jq | grep name | less -N

Look at the numbers:

 30       "name": "boring-rustls-provider",
233       "name": "ring",
240       "name": "rustls",
244       "name": "rustls-webpki",
329       "name": "ztunnel",

Mentally subtract one, as less -N is 1-indexed, and dependencies appear to be 0-indexed

 29       "name": "boring-rustls-provider",
232       "name": "ring",
239       "name": "rustls",
243       "name": "rustls-webpki",
328       "name": "ztunnel",

Now try to trace edges

cat ztunnel.json | jq | grep -e name -e 29, -e 232 -e 239 -e 243 -e 328

Abriviated:

      "name": "boring",
      "name": "boring-additions",
      "name": "boring-rustls-provider",
        239,
        243,
      "name": "boring-sys",
      "name": "boring-sys-additions",
      "name": "hyper",
      "name": "hyper-rustls",
        239,
      "name": "hyper-util",
      "name": "rcgen",
        232,
      "name": "rustls",
        243,
      "name": "rustls-native-certs",
      "name": "rustls-pemfile",
      "name": "rustls-pki-types",
      "name": "rustls-webpki",
        232,
      "name": "ryu",
      "name": "tokio",
      "name": "tokio-macros",
      "name": "tokio-rustls",
        239,
      "name": "tokio-stream",
      "name": "tokio-util",
      "name": "x509-parser",
        232,
      "name": "ztunnel",
        29,
        239,

Does this mean that ztunnel depends on boring-rustls-provider (29) & rustls (239)?
And boring-rustls-provider (29) depends on both rustls (239) and rustls-webpki (243)?
And finally "rustls-webpki" depends on ring (232)?

Did I parse this right?

It would have helped a lot if rust-audit-info could translate this to humans by replacing integer references with names; and also allow to show graph without kind build; or just the kind build.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions