0e6eca4085
* feat(native): read embedded cargo-auditable Rust dependency lists * fix(native): trim PE section padding and compute dependency cycles iteratively * fix(native): ignore SHT_NOBITS sections and validate dependency edges linearly * fix(native): bound compiler path scanning and retained hashes * fix(rust): pass package arrays as named parameterized test cases * fix(rust): admit graph expansion and preserve resource units * fix(rust): reject malformed packages, false cycles, and hidden compiler paths Fail the first malformed cargo-auditable package before Zod collects an issue per field. Require cyclic dependency indices to match the cycles in package dependencies. Keep read-only ELF ranges when a section name does not fit the bounded name window, so a rustc path in that range is still reported. * fix(ci): repair integrated checks and Hopper test baseline * fix(go): verify Mach-O sections against segments --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com> Co-authored-by: Cursor Agent <cursoragent@cursor.com>
3.1 KiB
Rust binary dependency metadata
inspect_rust_binary / inspect-rust-binary answers which crate names,
versions, sources, and dependency edges are embedded by cargo-auditable in one
selected local executable or library. It reads the file without running it and
requires no Rust installation, active binary target, Hopper, Ghidra, or IDA.
rea inspect-rust-binary /absolute/path/to/application --json
The CLI resolves relative paths against the caller's working directory. MCP requires an absolute filesystem path and preserves that exact selection:
{
"name": "inspect_rust_binary",
"arguments": { "path": "/artifacts/application" }
}
Observations
The inline Evidence result contains the artifact path, SHA-256, byte length,
container format, architecture, word size, and byte order. When a .dep-v0
section is present, auditable_metadata contains:
section_name,.dep-v0for ELF and PE or__DATA,.dep-v0for thin Mach-O;file_offsetandsection_bytes, the exact file range of the compressed section;compressed_bytesanduncompressed_bytes;format_version, the embedded integer, ornullwhen the field is omitted;packages, in the section's original order, withname,version,source,kind,dependencies, androot;root_package_index, the single package markedroot, ornullwhen none is marked;dependency_edges, pairs of package indices in package-then-dependency order;cyclic_dependency_indices, sorted unique indices that participate in a cycle.
An omitted kind stays null. The embedded format treats that omission as
runtime, and that default is not stored in the section. An omitted dependency
list is an empty array. An omitted root flag is false.
rustc_commit is present only when a /rustc/<40-hex>/ path is found in
read-only data. Its evidence_kind is inferred. The hash is not a claim that
that compiler produced the binary. Several distinct hashes leave a single
commit unknown.
Limits and failures
The selected file is limited to 256 MiB. A dependency section is limited to 1 MiB compressed. Inflated JSON is limited to the smaller of 8 MiB and 64 times the compressed size. The complete report is limited to 8 MiB. Empty sections, truncated or trailing zlib bytes, invalid JSON, unknown fields, dependency indices outside the package list, more than one root package, and compressed dependency sections are typed failures. A cycle is reported and is not walked.
A missing section returns success with auditable_metadata: null and a
limitation. Absence of .dep-v0 does not mean the binary has no dependencies.
Embedded names and versions are file content. They do not authenticate the
packages or the compiler.
Universal Mach-O containers are unsupported. Select a thin slice first. ELF, PE, and thin Mach-O are the supported containers.
Package and dependency counts are checked against the minimum required JSON
representation before graph allocation or schema cloning. Oversized graphs
report the output byte budget; the compiler-path capacity reports
maximum_rustc_hashes in hashes, independently of byte limits.