feat: include build and dev dependencies

cargo-sbom/src/graph.rs

@@ -50,12 +50,6 @@ pub fn build<'a>(metadata: &'a Metadata) -> Result<Graph<'a>, Error> {
 
       let to = graph.nodes[&dep.pkg];
       for kind in kinds {
-        // skip dev dependencies
-        if kind == DependencyKind::Development || kind == DependencyKind::Build
-        {
-          continue;
-        }
-
         graph.graph.add_edge(from, to, kind);
       }
     }

cargo-sbom/src/util/spdx/mod.rs

@@ -195,14 +195,40 @@ pub fn convert(
       edges.for_each(|e| {
         let source = &graph.graph[e.source()];
         let target = &graph.graph[e.target()];
-        relationships.insert(HashableSpdxItemRelationships(
-          serde_spdx::spdx::v_2_3::SpdxItemRelationshipsBuilder::default()
-            .spdx_element_id(generate_project_id(source))
-            .related_spdx_element(generate_project_id(target))
-            .relationship_type("DEPENDS_ON")
-            .build()
-            .unwrap(),
-        ));
+        let source_project_id = generate_project_id(source);
+        let target_project_id = generate_project_id(target);
+
+        let relationship = match e.weight() {
+          cargo_metadata::DependencyKind::Normal => Some(
+            serde_spdx::spdx::v_2_3::SpdxItemRelationshipsBuilder::default()
+              .spdx_element_id(source_project_id)
+              .related_spdx_element(target_project_id)
+              .relationship_type("DEPENDS_ON")
+              .build()
+              .unwrap(),
+          ),
+          cargo_metadata::DependencyKind::Build => Some(
+            serde_spdx::spdx::v_2_3::SpdxItemRelationshipsBuilder::default()
+              .spdx_element_id(target_project_id)
+              .related_spdx_element(source_project_id)
+              .relationship_type("BUILD_TOOL_OF")
+              .build()
+              .unwrap(),
+          ),
+          cargo_metadata::DependencyKind::Development => Some(
+            serde_spdx::spdx::v_2_3::SpdxItemRelationshipsBuilder::default()
+              .spdx_element_id(target_project_id)
+              .related_spdx_element(source_project_id)
+              .relationship_type("DEV_DEPENDENCY_OF")
+              .build()
+              .unwrap(),
+          ),
+          cargo_metadata::DependencyKind::Unknown => None,
+        };
+
+        if let Some(relationship) = relationship {
+          relationships.insert(HashableSpdxItemRelationships(relationship));
+        }
       });
     }
 

examples/cargo-binary/Cargo.toml

@@ -6,3 +6,6 @@ edition = "2021"
 
 [dependencies]
 clap = { version = "4.3.11", features = ["derive"] }
+
+[dev-dependencies]
+approx = "0.5.1"