proc-macro dependencies are recorded as runtime deps, not build deps

[Shnatsel]

This can be reproduced by building cargo-auditable itself using cargo auditable build, and then extracting the audit data. The proc-macro2 dependency will be recorded as a runtime dependency, not a build dependency.

This happens because cargo metadata that we rely on to retrieve information about the build reports these dependencies as runtime rather than build-time.

There is nothing we can do about this on stable short of parsing the output of cargo tree, and I'm not sure I'm willing to go to such lengths.

On nightly, -Z sbom accurately reports proc macros and we don't run into that issue at all.

[bjorn3]

Does cargo metadata not show which packages are proc-macros?

[Shnatsel]

Ah, it doesn't show that in the dependency tree under resolve but if you look up the respective node in packages then there are indications of a crate being a proc macro:

Good point, thank you!