Support Cargo lock file format version 4

[umweltinfo]

Since our last dependency update we are seeing errors like

[2024-11-28T09:23:18Z WARN  cargo_cyclonedx::generator] Failed to parse `Cargo.lock`: parse error: parse error: invalid Cargo.lock format version: `4`
    
    Hashes will not be included in the SBOM.

in our CI jobs to create SBOM.

[umweltinfo]

I am not sure, but I suspect that the cargo_metadata dependency needs to be updated? Though its CHANGELOG does not appear to mention format version 4, there is a new incompatible version 0.19 available.

[lfrancke]

Thanks for raising the issue. I totally missed that v4 is available.
I just did some quick research. It's been stabilized in Rust 1.78 (May 2024)
rust-lang/cargo#12852

Is this something you'd be willing to create a PR for?

[Shnatsel]

That issue is actually due to cargo-lock crate being too old, not cargo-metadata.

[Shnatsel]

Also edition 2024 is coming soon, but cargo-metadata v0.18.x is recent enough to handle that. So we don't have to upgrade cargo-metadata, which brought some rather disruptive changes in v0.19.

[Shnatsel]

@umweltinfo please try cargo install --git https://github.com/CycloneDX/cyclonedx-rust-cargo.git and let me know if the version from git works.

[umweltinfo]

Thanks for the quick fix which appears to work fine!

Note that the installation command needs to be

cargo install --git https://github.com/CycloneDX/cyclonedx-rust-cargo.git cargo-cyclonedx

to select the relevant binary.

Also note that the installation also logs the following warning

warning: profiles for the non root package will be ignored, specify profiles at the workspace root:
package:   /home/ubuntu/.cargo/git/checkouts/cyclonedx-rust-cargo-95925afc4f819a51/1b0b996/cargo-cyclonedx/Cargo.toml
workspace: /home/ubuntu/.cargo/git/checkouts/cyclonedx-rust-cargo-95925afc4f819a51/1b0b996/Cargo.toml

[Shnatsel]

Nice, thanks for confirming! I'll publish a release with the fix later today.

[Shnatsel]

v0.5.7 with the fix is up on crates.io