Rust pipeline

[chinyeungli]

Issues

• Closes: t-rust: Design and implement Scancode.io pipeline for a single Rust package #1767

Changes

• Added the dedicated pipeline for Rust
  • It takes a single PURL as an input (cargo type)
  • Downloads the crate sources
  • Run scans and determine if there's any license mismatch between "declared licenses" and "detected licenses"
  • Builds the crate source in a container and determines which files are actually used based on the generated .d files.
    • If the build succeeds, the source files are placed under codebase/from/ and the built artifacts under codebase/to/.
  • Identifies the project's source repo and compare if there's any differences between the source repo and source crates

Samples:

I used pkg:cargo/rand@0.7.2 as a sample.

The source crate files are put under the codebase/from

and the built files are put under codebase/to

If there is a license mismatch issue, a small red alert sign will be put next to the PURL

A comparison summary and issue info are put under the extra_data tab

(The logic behind detected_codebase_license is to collect all license expressions detected in the codebase, deduplicate them, and join them using AND. In the sample, the entire codebase is under (mit OR apache-2.0) and contains one apache‑2.0 license file and one mit license file. Therefore, the final detected_codebase_license becomes (mit OR apache-2.0) AND apache-2.0 AND mit)

Checklist

• I have read the contributing guidelines
• I have linked an existing issue above
• I have added unit tests covering the new code
• I have reviewed and understood every line of this PR