Rust Ecosystem

StellaOps implementation

src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Rust/RustLanguageAnalyzer.cs coordinates collection via Internal/RustAnalyzerCollector.cs.
Collector ingests Cargo.lock, cargo fingerprint caches, and compiled binaries, merging data into three record sets: crate (authoritative), heuristic (fingerprints), and fallback (hashed binaries).
License metadata is sourced through RustLicenseScanner; binaries retain SHA256 hashes and usage indicators derived from EntryTrace.
Results are deduplicated and sorted to guarantee deterministic replay; each record includes evidence pointing to lockfile paths or binary locations.

pkg/fanal/analyzer/language/rust/cargo/cargo.go parses Cargo.lock/TOML to classify direct, workspace, and transitive dependencies, removing dev dependencies where possible.
pkg/fanal/analyzer/language/rust/binary/binary.go inspects ELF binaries, returning nil when crate metadata is missing; no hashed fallback component is emitted.
License attribution relies on Cargo metadata; runtime usage is not tracked.

The plugin dispatcher in src/lib/plugins/index.ts does not list a Rust/Cargo plugin, so Rust projects are currently unsupported by the Snyk CLI.[s1]
Users must resort to other tooling or Snyk SaaS capabilities outside the CLI for Rust coverage.

Syft provides Rust packages for Grype’s matchers (grype/pkg/syft_provider.go).
The Rust matcher consumes syftPkg.RustPkg and matches via ecosystem/CPE lookups (grype/matcher/rust/matcher.go); there is no fallback for binaries without Cargo metadata.
Runtime usage, fingerprinting, or hashed binary fallbacks are not emitted.

Fallback strategy: StellaOps preserves components for binaries lacking metadata; Trivy and Grype drop or ignore binaries without Cargo linkage, while Snyk lacks Rust support entirely.
Evidence breadth: StellaOps aggregates lockfile, fingerprint, and binary evidence into a deterministic record; Trivy and Grype primarily consume Cargo descriptors, and Snyk provides no CLI coverage.
Usage insight: StellaOps propagates EntryTrace usage flags; Trivy and Grype outputs are inventory-only; Snyk has no runtime data due to lack of support.