Add Workspace Support for Cargo

[zahidblackduck]

JIRA Ticket

IDETECT-4919

Description

This merge request aims to add cargo workspace support in the cargo detectors.
Previously, the cargo detectors parsed only the manifest in the project root directory, which caused:

• Incomplete SBOMs due to not including workspace dependencies.
• Orphaned dependencies grouped under "Additional_components".

The current implementation now resolves workspace by default. We can exclude / include workspace or disable the workspace support altogether by specified detect properties.
Detect now identifies cargo workspaces declared via [workspace] table in the root Cargo.toml. Added properties to add support for workspace enable/disable and include/exclude workspace members.

New Properties

1. Properties to include workspace
   detect.cargo.included.workspaces=<comma separated list of workspace(s) to include>

2. Properties to exclude workspace
   detect.cargo.excluded.workspaces=<comma separated list of workspace(s) to exclude>

3. Enable / Disable workspace
   detect.cargo.ignore.all.workspaces=<true for ignore all workspaces, false is default>

[devmehtabd]

Do we want to parse the exclude array which can be present in the toml file along with members?

Consider this,
[workspace]
members = [packages/*]
exclude = [packages/foo]

From your logic, foo will be included, so the question is do we want to exclude it or let users do that via property? Or the build commands would take care of that for us?

[zahidblackduck]

You are right. As, Cargo Lockfile Detector is dependent on the manual parsing of Cargo.toml workspace table, it should take care of exclude section. The exclude section should be respected. Thanks for pointing this out. Updated the code accordingly.

[devmehtabd]

Instead of this method, did you try using ExcludedIncludedWildcardFilter class, I think this will simplify things on your end.

[zahidblackduck]

Thanks for the suggestion Dev. I considered using ExcludedIncludedWildcardFilter, but the cargo tree command has specific flag requirements that don't align well with a simple filter-based approach:

The challenge is that cargo tree has strict rules about flag combinations:

1. --workspace flag must be present when using --exclude (enforced by cargo CLI)
2. --package flags can work alone when no exclusions are specified
3. The command structure changes based on which filters are active

Example scenarios:

# When there is no workspace filter, we must add --workspace flag (default workspace support)
cargo tree --workspace

# When only inclusions filter is present, we need to use --package flags without the --workspace
cargo tree --package grep --package ignore

# When only exclusions filter is present, we must add --workspace (cargo requirement)
cargo tree --workspace --exclude grep-regex

# When both inclusions and exclusions flag present, we must add --workspace + both flag types
cargo tree --workspace --package grep --exclude grep-regex

ExcludedIncludedWildcardFilter filter class cannot tell us whether to add --workspace or when to skip it, which is critical for generating valid cargo commands.

That's why addWorkspaceFlags() explicitly checks for inclusions/exclusions and constructs the command accordingly rather than delegating to a filter.

The getEffectiveInclusions(...) method has been dropped altogether though. While exploring the possibility of introducting ExcludedIncludedWildcardFilter in the code, it was found that this method is not required at all, and the cargo tree <additional-flags> command can be constructed in much simpler way.

[cpottsbd]

Tiny tweak suggestion:

• (IDETECT-4919) Added Cargo workspace support in Cargo detectors. [detect_product_short] now identifies [workspace] in the root Cargo.toml and resolves dependencies across all members using the shared Cargo.lock. The "Additional_components" section has been removed from SBOMs for completeness.

[cpottsbd]

Minor rewording suggestion:

• Control over which workspace members are included or excluded during scanning is made possible by the new detect.cargo.included.workspaces and detect.cargo.excluded.workspaces properties for Cargo Detector. See Cargo for details.

[cpottsbd]

When set to true (default: false), the new detect.cargo.ignore.all.workspaces property allows you to completely disable workspace support. See Cargo for more information.