feat: add Rust crates support

[sidsri14]

Summary

• add crates.io package download and source scanning through the public crates.io API
• add Cargo.lock verification for crates.io registry dependencies, including multiple locked versions
• recognize Rust source and comments, with focused Rust coverage in five applicable YARA rules
• expose guarddog crates scan and guarddog crates verify, and update the README and generated rules matrix

This follows the existing ecosystem scanner patterns while keeping Rust-specific package metadata heuristics outside the initial support layer.

Closes #758

Validation

• make test (467 passed, 2 skipped; 86% aggregate coverage)
• make lint
• mypy --install-types --non-interactive guarddog
• black --check guarddog scripts tests/core/test_cargo_project_scanner.py tests/core/test_crates_package_scanner.py tests/core/test_rust_sourcecode.py
• regenerated RULES.md twice and verified identical SHA-256 output
• completed a live crates.io scan of serde 1.0.228 through the new CLI path

[sobregosodd]

Hey @sidsri14 , this looks pretty good and straightforward, is it ready for review?

[Copilot]

Pull request overview

Adds first-class Rust crates (crates.io) ecosystem support to GuardDog, aligning with existing ecosystem scanners by enabling remote crate downloads, Cargo.lock parsing for dependency verification, and Rust-aware source scanning via updated YARA rule coverage.

Changes:

• Introduces crates.io package scanning (CratesPackageScanner) and Cargo.lock project scanning (CargoLockScanner) wired into the ecosystem registry and CLI.
• Extends language detection/comment parsing for Rust and broadens five YARA rules to include *.rs plus Rust-specific match patterns.
• Updates documentation and generated rules matrix, and adds focused tests for Rust source scanning, crates downloads, and Cargo.lock parsing/CLI presence.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/core/test_rust_sourcecode.py	Adds a regression test ensuring Rust source triggers applicable YARA rules under the crates ecosystem.
tests/core/test_crates_package_scanner.py	Adds unit tests for crates.io API lookup, version selection, and archive fetching headers.
tests/core/test_cargo_project_scanner.py	Adds tests for parsing crates.io-only dependencies (including multiple locked versions) and for CLI group availability.
scripts/generate-rules-docs.py	Teaches docs generation to associate .rs with the crates ecosystem.
RULES.md	Regenerates the rules matrix to include crates.io column and rule applicability updates.
README.md	Documents Rust/crates support and adds example CLI usage for guarddog crates scan/verify.
guarddog/scanners/crates_package_scanner.py	Implements crates.io API metadata fetch and crate archive download/extract workflow.
guarddog/scanners/cargo_project_scanner.py	Implements Cargo.lock parsing and discovery to drive dependency verification for crates.
guarddog/scanners/init.py	Registers new package/project scanners for ECOSYSTEM.CRATES.
guarddog/ecosystems.py	Adds CRATES ecosystem and RUST language plus friendly-name mapping.
guarddog/cli.py	Updates CLI help text; crates subcommand becomes available via dynamic ecosystem registration.
guarddog/analyzer/sourcecode/threat-runtime-environment-read.yar	Adds *.rs inclusion and Rust env-var access detection.
guarddog/analyzer/sourcecode/threat-process-cryptomining.yar	Adds *.rs inclusion for cryptomining indicators.
guarddog/analyzer/sourcecode/threat-network-exfiltration.yar	Adds *.rs inclusion for exfiltration indicators.
guarddog/analyzer/sourcecode/capability-process-spawn.yar	Adds *.rs inclusion and Rust Command::new(...) detection.
guarddog/analyzer/sourcecode/capability-network-outbound.yar	Adds *.rs inclusion and Rust socket/reqwest patterns.
guarddog/analyzer/metadata/init.py	Explicitly disables metadata detectors for crates (empty set) for now.
guarddog/analyzer/analyzer.py	Adds Rust file extension detection and comment syntax handling.

Comments suppressed due to low confidence (1)

guarddog/analyzer/analyzer.py:137

• Rust supports nested /* ... */ comments, but the current heuristic (comparing the last "/" vs "/") can incorrectly report "not in comment" when inside an outer block comment after an inner comment closes. This can lead to YARA matches being treated as code when they are still inside a comment. Consider a depth-based check for Rust block comments.

                # Search backwards for first /* or */
                last_open = window.rfind("/*")
                last_close = window.rfind("*/")

                # If we find an opening comment and it comes after the last closing,

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sidsri14]

Yes, this is ready for maintainer review now. I merged the latest v3, resolved the generated RULES.md conflict, addressed the path-sanitization review, and added a regression test. Locally, the 11 focused crates/Rust tests, Black, Flake8, and mypy all pass; CI is rerunning on the updated branch.