From 003c810599f36c66086fbe0611786a6075620f1f Mon Sep 17 00:00:00 2001
From: Samuel Moelius <samuel.moelius@trailofbits.com>
Date: Thu, 27 Aug 2026 05:34:08 -0400
Subject: [PATCH 1/2] Update supply_chain.json

---
 tests/supply_chain.json | 24 ++++++------------------
 1 file changed, 6 insertions(+), 18 deletions(-)

diff --git a/tests/supply_chain.json b/tests/supply_chain.json
index 6b23264..0973b9b 100644
--- a/tests/supply_chain.json
+++ b/tests/supply_chain.json
@@ -17,17 +17,17 @@
       }
     ],
     "bitflags": [
-      {
-        "id": 51,
-        "kind": "team",
-        "login": "github:rust-lang-nursery:libs",
-        "name": "libs"
-      },
       {
         "id": 3204,
         "kind": "user",
         "login": "KodrAus",
         "name": "Ashley Mannix"
+      },
+      {
+        "id": 55123,
+        "kind": "user",
+        "login": "rust-lang-owner",
+        "name": null
       }
     ],
     "cfg-if": [
@@ -125,12 +125,6 @@
       }
     ],
     "home": [
-      {
-        "id": 6202,
-        "kind": "user",
-        "login": "ehuss",
-        "name": "Eric Huss"
-      },
       {
         "id": 11164,
         "kind": "user",
@@ -453,12 +447,6 @@
       }
     ],
     "toml": [
-      {
-        "id": 6202,
-        "kind": "user",
-        "login": "ehuss",
-        "name": "Eric Huss"
-      },
       {
         "id": 6743,
         "kind": "user",

From b2f492b5373109d12bc1eb2e06b3ab985d49fe17 Mon Sep 17 00:00:00 2001
From: Samuel Moelius <samuel.moelius@trailofbits.com>
Date: Thu, 27 Aug 2026 05:42:44 -0400
Subject: [PATCH 2/2] Use `supply_chain` package

---
 Cargo.lock              | 13 ++++++++-
 Cargo.toml              |  2 +-
 tests/integration/ci.rs | 63 ++---------------------------------------
 3 files changed, 15 insertions(+), 63 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 31bff3e..9dc0aef 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -110,8 +110,8 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "similar-asserts",
  "snapbox",
+ "supply_chain",
  "tempfile",
  "toml",
  "xdg",
@@ -541,6 +541,17 @@ dependencies = [
  "anstream",
 ]
 
+[[package]]
+name = "supply_chain"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e18c7619d13ca46c62abd2cc31786f4b86d264bfbf2c96ec8d043e5c0af469b"
+dependencies = [
+ "anyhow",
+ "serde_json",
+ "similar-asserts",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.117"
diff --git a/Cargo.toml b/Cargo.toml
index 2d30b46..3d7168f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,8 +21,8 @@ assert_cmd = "2.2"
 cargo_metadata = "0.23"
 serde = "1.0"
 serde_json = "1.0"
-similar-asserts = "2.0"
 snapbox = "1.2"
+supply_chain = "0.1"
 
 [lints.clippy]
 pedantic = { level = "warn", priority = -1 }
diff --git a/tests/integration/ci.rs b/tests/integration/ci.rs
index 4fb9703..a5b6194 100644
--- a/tests/integration/ci.rs
+++ b/tests/integration/ci.rs
@@ -2,14 +2,7 @@ use crate::util;
 use assert_cmd::assert::OutputAssertExt;
 use cargo_metadata::MetadataCommand;
 use regex::Regex;
-use similar_asserts::SimpleDiff;
-use std::{
-    env::var,
-    fs::{read_to_string, write},
-    path::Path,
-    process::{Command, ExitStatus},
-    str::FromStr,
-};
+use std::{fs::read_to_string, path::Path, process::Command};
 
 #[test]
 fn clippy() {
@@ -100,57 +93,5 @@ fn readme_reference_links_are_used() {
 
 #[test]
 fn supply_chain() {
-    let mut command = Command::new("cargo");
-    command.args(["supply-chain", "update", "--cache-max-age=0s"]);
-    let _: ExitStatus = command.status().unwrap();
-
-    let mut command = Command::new("cargo");
-    command.args(["supply-chain", "json", "--no-dev"]);
-    let assert = command.assert().success();
-
-    let stdout_actual = std::str::from_utf8(&assert.get_output().stdout).unwrap();
-    let mut value = serde_json::Value::from_str(stdout_actual).unwrap();
-    remove_avatars(&mut value);
-    let stdout_normalized = serde_json::to_string_pretty(&value).unwrap();
-
-    let path_buf = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/supply_chain.json");
-
-    if enabled("BLESS") {
-        write(path_buf, stdout_normalized).unwrap();
-    } else {
-        let stdout_expected = read_to_string(&path_buf).unwrap();
-
-        assert!(
-            stdout_expected == stdout_normalized,
-            "{}",
-            SimpleDiff::from_str(&stdout_expected, &stdout_normalized, "left", "right")
-        );
-    }
-}
-
-fn remove_avatars(value: &mut serde_json::Value) {
-    match value {
-        serde_json::Value::Null
-        | serde_json::Value::Bool(_)
-        | serde_json::Value::Number(_)
-        | serde_json::Value::String(_) => {}
-        serde_json::Value::Array(array) => {
-            for value in array {
-                remove_avatars(value);
-            }
-        }
-        serde_json::Value::Object(object) => {
-            object.retain(|key, value| {
-                if key == "avatar" {
-                    return false;
-                }
-                remove_avatars(value);
-                true
-            });
-        }
-    }
-}
-
-fn enabled(key: &str) -> bool {
-    var(key).is_ok_and(|value| value != "0")
+    supply_chain::check("tests/supply_chain.json");
 }