Fixes #4581: Failure to scan cargo #4582

omsuneri · 2025-10-10T12:23:24Z

Issue :
Fixes #4581

Changes made :
cargo.py
added proper null check before accessing .path on parent resource
added fallback to use os.path.dirname(resource.path) when no parent exists
npm.py
code was calling .parent() twice instead of reusing the result

after making changes i passed the same cargo.toml file in the scancode and the error is resolved.
before changes result.json:

{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "v32.4.1-16-g93a2d69943",
      "options": {
        "input": [
          "Cargo.toml"
        ],
        "--json-pp": "original_resultm.json",
        "--package": true
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2025-10-10T120320.176700",
      "end_timestamp": "2025-10-10T120353.633673",
      "output_format_version": "4.1.0",
      "duration": 33.4572548866272,
      "message": null,
      "errors": [
        "Path: Cargo.toml"
      ],
      "warnings": [],
      "extra_data": {
        "system_environment": {
          "operating_system": "mac",
          "cpu_architecture": "64",
          "platform": "macOS-26.0.1-x86_64-i386-64bit",
          "platform_version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:39 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T8103",
          "python_version": "3.12.4 (v3.12.4:8e8a4baf65, Jun  6 2024, 17:33:18) [Clang 13.0.0 (clang-1300.0.29.30)]"
        },
        "spdx_license_list_version": "3.27",
        "files_count": 1
      }
    }
  ],
  "packages": [],
  "dependencies": [],
  "files": [
    {
      "path": "Cargo.toml",
      "type": "file",
      "package_data": [
        {
          "type": "cargo",
          "namespace": null,
          "name": "constant_time_eq",
          "version": "0.4.2",
          "qualifiers": {},
          "subpath": null,
          "primary_language": "Rust",
          "description": "Compares two equal-sized byte strings in constant time.",
          "release_date": null,
          "parties": [
            {
              "type": "person",
              "role": "author",
              "name": "Cesar Eduardo Barros",
              "email": "[email protected]",
              "url": null
            }
          ],
          "keywords": [
            "constant_time",
            "cryptography",
            "no-std"
          ],
          "homepage_url": null,
          "download_url": null,
          "size": null,
          "sha1": null,
          "md5": null,
          "sha256": null,
          "sha512": null,
          "bug_tracking_url": null,
          "code_view_url": null,
          "vcs_url": "https://github.com/cesarb/constant_time_eq",
          "copyright": null,
          "holder": null,
          "declared_license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
          "declared_license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "license_detections": [
            {
              "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
              "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
              "matches": [
                {
                  "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
                  "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
                  "from_file": "Cargo.toml",
                  "start_line": 1,
                  "end_line": 1,
                  "matcher": "1-spdx-id",
                  "score": 100.0,
                  "matched_length": 10,
                  "match_coverage": 100.0,
                  "rule_relevance": 100,
                  "rule_identifier": "spdx-license-identifier-cc0_1_0_or_mit_0_or_apache_2_0-f44a2ec174eb034bd3c662f728664281e507b20d",
                  "rule_url": null,
                  "matched_text": "CC0-1.0 OR MIT-0 OR Apache-2.0"
                }
              ],
              "identifier": "cc0_1_0_or_mit_0_or_apache_2_0-3f14dd48-7cd8-cf28-d4e1-3b0174a587ee"
            }
          ],
          "other_license_expression": null,
          "other_license_expression_spdx": null,
          "other_license_detections": [],
          "extracted_license_statement": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "notice_text": null,
          "source_packages": [],
          "file_references": [],
          "is_private": false,
          "is_virtual": false,
          "extra_data": {
            "documentation_url": "https://docs.rs/constant_time_eq",
            "rust_version": "1.85.0",
            "rust_edition": "2024"
          },
          "dependencies": [
            {
              "purl": "pkg:cargo/criterion",
              "extracted_requirement": "0.5.1",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {
                "version": "0.5.1",
                "features": [
                  "cargo_bench_support",
                  "html_reports"
                ]
              }
            },
            {
              "purl": "pkg:cargo/count_instructions",
              "extracted_requirement": "0.2.0",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {}
            }
          ],
          "repository_homepage_url": "https://crates.io/crates/constant_time_eq",
          "repository_download_url": "https://crates.io/api/v1/crates/constant_time_eq/0.4.2/download",
          "api_data_url": "https://crates.io/api/v1/crates/constant_time_eq",
          "datasource_id": "cargo_toml",
          "purl": "pkg:cargo/[email protected]"
        }
      ],
      "for_packages": [],
      "scan_errors": [
        "get_package_and_deps: Failed to assemble PackageData: PackageData(type='cargo', namespace=None, name='constant_time_eq', version='0.4.2', datasource_id='cargo_toml'):\nTraceback (most recent call last):\n  File \"/Users/omsuneri/scancode-toolkit/src/packagedcode/plugin_package.py\", line 428, in get_package_and_deps\n    for item in items:\n  File \"/Users/omsuneri/scancode-toolkit/src/packagedcode/cargo.py\", line 62, in assemble\n    workspace_root_path = resource.parent(codebase).path\n                          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAttributeError: 'bool' object has no attribute 'path'\n"
      ]
    }
  ]
}

after changes result.json:

{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "v32.4.1-18-g02a38c1abc",
      "options": {
        "input": [
          "Cargo.toml"
        ],
        "--json-pp": "original_resultm1.json",
        "--package": true
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2025-10-10T120813.765667",
      "end_timestamp": "2025-10-10T120835.711878",
      "output_format_version": "4.1.0",
      "duration": 21.946434020996094,
      "message": null,
      "errors": [],
      "warnings": [],
      "extra_data": {
        "system_environment": {
          "operating_system": "mac",
          "cpu_architecture": "64",
          "platform": "macOS-26.0.1-x86_64-i386-64bit",
          "platform_version": "Darwin Kernel Version 25.0.0: Wed Sep 17 21:41:39 PDT 2025; root:xnu-12377.1.9~141/RELEASE_ARM64_T8103",
          "python_version": "3.12.4 (v3.12.4:8e8a4baf65, Jun  6 2024, 17:33:18) [Clang 13.0.0 (clang-1300.0.29.30)]"
        },
        "spdx_license_list_version": "3.27",
        "files_count": 1
      }
    }
  ],
  "packages": [],
  "dependencies": [],
  "files": [
    {
      "path": "Cargo.toml",
      "type": "file",
      "package_data": [
        {
          "type": "cargo",
          "namespace": null,
          "name": "constant_time_eq",
          "version": "0.4.2",
          "qualifiers": {},
          "subpath": null,
          "primary_language": "Rust",
          "description": "Compares two equal-sized byte strings in constant time.",
          "release_date": null,
          "parties": [
            {
              "type": "person",
              "role": "author",
              "name": "Cesar Eduardo Barros",
              "email": "[email protected]",
              "url": null
            }
          ],
          "keywords": [
            "constant_time",
            "cryptography",
            "no-std"
          ],
          "homepage_url": null,
          "download_url": null,
          "size": null,
          "sha1": null,
          "md5": null,
          "sha256": null,
          "sha512": null,
          "bug_tracking_url": null,
          "code_view_url": null,
          "vcs_url": "https://github.com/cesarb/constant_time_eq",
          "copyright": null,
          "holder": null,
          "declared_license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
          "declared_license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "license_detections": [
            {
              "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
              "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
              "matches": [
                {
                  "license_expression": "cc0-1.0 OR mit-0 OR apache-2.0",
                  "license_expression_spdx": "CC0-1.0 OR MIT-0 OR Apache-2.0",
                  "from_file": "Cargo.toml",
                  "start_line": 1,
                  "end_line": 1,
                  "matcher": "1-spdx-id",
                  "score": 100.0,
                  "matched_length": 10,
                  "match_coverage": 100.0,
                  "rule_relevance": 100,
                  "rule_identifier": "spdx-license-identifier-cc0_1_0_or_mit_0_or_apache_2_0-f44a2ec174eb034bd3c662f728664281e507b20d",
                  "rule_url": null,
                  "matched_text": "CC0-1.0 OR MIT-0 OR Apache-2.0"
                }
              ],
              "identifier": "cc0_1_0_or_mit_0_or_apache_2_0-3f14dd48-7cd8-cf28-d4e1-3b0174a587ee"
            }
          ],
          "other_license_expression": null,
          "other_license_expression_spdx": null,
          "other_license_detections": [],
          "extracted_license_statement": "CC0-1.0 OR MIT-0 OR Apache-2.0",
          "notice_text": null,
          "source_packages": [],
          "file_references": [],
          "is_private": false,
          "is_virtual": false,
          "extra_data": {
            "documentation_url": "https://docs.rs/constant_time_eq",
            "rust_version": "1.85.0",
            "rust_edition": "2024"
          },
          "dependencies": [
            {
              "purl": "pkg:cargo/criterion",
              "extracted_requirement": "0.5.1",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {
                "version": "0.5.1",
                "features": [
                  "cargo_bench_support",
                  "html_reports"
                ]
              }
            },
            {
              "purl": "pkg:cargo/count_instructions",
              "extracted_requirement": "0.2.0",
              "scope": "dev-dependencies",
              "is_runtime": false,
              "is_optional": false,
              "is_pinned": false,
              "is_direct": true,
              "resolved_package": {},
              "extra_data": {}
            }
          ],
          "repository_homepage_url": "https://crates.io/crates/constant_time_eq",
          "repository_download_url": "https://crates.io/api/v1/crates/constant_time_eq/0.4.2/download",
          "api_data_url": "https://crates.io/api/v1/crates/constant_time_eq",
          "datasource_id": "cargo_toml",
          "purl": "pkg:cargo/[email protected]"
        }
      ],
      "for_packages": [],
      "scan_errors": []
    }
  ]
}

omsuneri · 2025-10-10T12:24:36Z

@AyanSinhaMahapatra review this please !!

AyanSinhaMahapatra · 2025-10-15T15:25:56Z

@omsuneri can you add a small test for #4581 with a single (stripped as much as possible) cargo manifest to show this doesn't fail anymore and check against future failures?

omsuneri · 2025-10-15T15:28:49Z

@AyanSinhaMahapatra sure I ll add the required test in the test suite !!

omsuneri · 2025-10-15T20:46:25Z

@AyanSinhaMahapatra i added the test please review !!

here i used the same cargo.toml file this https://raw.githubusercontent.com/cesarb/constant_time_eq/refs/heads/main/Cargo.toml mentioned in the issue
please request iof any further chnages are required

AyanSinhaMahapatra

@omsuneri please update your tests to actually check that the failure in #4581 is not happening again

Could you also merge latest develop as there were fixes for some failing tests.

tests/packagedcode/test_cargo.py

AyanSinhaMahapatra · 2025-10-24T08:42:44Z

tests/packagedcode/data/cargo/cargo_toml/single-file-scan/Cargo.toml

+[dev-dependencies]
+criterion = { version = "0.5.1", features = ["cargo_bench_support", "html_reports"] }
+count_instructions = "0.2.0"
+


Could you shorten this test file by getting rid of everything below the dev-dependencies as we ignore this anyway as they are not useful info? We keep test files as small as possible to reduce repo size

@AyanSinhaMahapatra yaa actually i followed the same cargo.toml which is in the issue also before adding i looked in other cargo.toml and there is features and everything so i just added this one without any type of annotation
will be making this shorter !!

omsuneri · 2025-10-25T05:43:36Z

@omsuneri please update your tests to actually check that the failure in #4581 is not happening again

Could you also merge latest develop as there were fixes for some failing tests.

sure i m just about to test the latest changes !!

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri · 2025-10-28T18:01:33Z

@AyanSinhaMahapatra please review i had refactored the test and shortened the cargo.toml along with the full package scan cargo.toml.expected
and request if any further changes are required !!

tests/packagedcode/data/cargo/cargo_toml/single-file-scan/Cargo.toml.expected

Signed-off-by: Om Santosh Suneri <[email protected]>

AyanSinhaMahapatra requested changes Oct 24, 2025

View reviewed changes

omsuneri force-pushed the resolving-4581 branch from b755a2f to 9c3b77f Compare October 24, 2025 10:27

omsuneri added 4 commits October 28, 2025 22:55

fix: prevent 'NoneType' error when scanning single Cargo.toml files

210c91e

Signed-off-by: Om Santosh Suneri <[email protected]>

fix: use cached parent resource instead of redundant parent() call

84034f9

Signed-off-by: Om Santosh Suneri <[email protected]>

Add regression test for single Cargo.toml file scan

ee7f8e4

Signed-off-by: Om Santosh Suneri <[email protected]>

refactor: remove unnecessary portion of test file Cargo.toml

b09b68b

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri force-pushed the resolving-4581 branch from 9c3b77f to b09b68b Compare October 28, 2025 17:29

refactor: test with a full --package scan

5249967

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri requested a review from AyanSinhaMahapatra October 28, 2025 18:22

AyanSinhaMahapatra reviewed Oct 28, 2025

View reviewed changes

tests/packagedcode/data/cargo/cargo_toml/single-file-scan/Cargo.toml.expected Outdated Show resolved Hide resolved

refactor: removing header from the cargo.toml.expected

58e2e2b

Signed-off-by: Om Santosh Suneri <[email protected]>

omsuneri force-pushed the resolving-4581 branch from 3679f02 to 58e2e2b Compare October 28, 2025 19:17

omsuneri requested a review from AyanSinhaMahapatra October 28, 2025 19:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Uh oh!

Fixes #4581: Failure to scan cargo #4582

Fixes #4581: Failure to scan cargo #4582

omsuneri commented Oct 10, 2025

Uh oh!

omsuneri commented Oct 10, 2025

Uh oh!

AyanSinhaMahapatra commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

AyanSinhaMahapatra left a comment •

edited

Loading

Uh oh!

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Uh oh!

omsuneri Oct 25, 2025

Uh oh!

omsuneri commented Oct 25, 2025

Uh oh!

omsuneri commented Oct 28, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Fixes #4581: Failure to scan cargo #4582

Are you sure you want to change the base?

Fixes #4581: Failure to scan cargo #4582

Conversation

omsuneri commented Oct 10, 2025

Uh oh!

omsuneri commented Oct 10, 2025

Uh oh!

AyanSinhaMahapatra commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

omsuneri commented Oct 15, 2025

Uh oh!

AyanSinhaMahapatra left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AyanSinhaMahapatra Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

omsuneri Oct 25, 2025

Choose a reason for hiding this comment

Uh oh!

omsuneri commented Oct 25, 2025

Uh oh!

omsuneri commented Oct 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AyanSinhaMahapatra left a comment •

edited

Loading

omsuneri commented Oct 28, 2025 •

edited

Loading