cargo-auditable

{
  "aliases": [],
  "alternatives": [],
  "build_dependencies": [
    "rust"
  ],
  "categories": [],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "Make production Rust binaries auditable",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:36:07+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "cargo-auditable",
  "github_default_branch": "master",
  "github_last_commit_at": "2026-05-28T16:16:45Z",
  "github_readme_excerpt": "## cargo-auditable\n\nKnow the exact crate versions used to build your Rust executable. Audit binaries for known bugs or security vulnerabilities in production, at scale, with zero bookkeeping.\n\nThis works by embedding data about the dependency tree in JSON format into a dedicated linker section of the compiled executable.\n\nLinux, Windows and Mac OS are officially supported. [WebAssembly](https://en.wikipedia.org/wiki/WebAssembly) is also supported starting with v0.6.3. All other ELF targets should work, but are not tested on CI.\n\nThe end goal is to get Cargo itself to encode this information in binaries. There is an RFC for an implementation within Cargo, for which this project paves the way: https://github.com/rust-lang/rfcs/pull/2801\n\n## Usage\n\n```bash\n# Install the tools\ncargo install cargo-auditable cargo-audit\n# Build your project with dependency lists embedded in the binaries\ncargo auditable build --release\n# Scan the binary for vulnerabilities\ncargo audit bin target/release/your-project\n```\n\n`cargo auditable` works with any Cargo command. All arguments are passed to `cargo` as-is.\n\n### On nightly Rust\n\nOn nightly we can take advantage of Cargo\u0027s [native SBOM precursor](https://doc.rust-lang.org/cargo/reference/unstable.html#sbom) to record dependencies more accurately:\n\n```bash\nCARGO_BUILD_SBOM=true cargo +nightly auditable build -Z sbom --release\n```\n\nDue to [a bug in Cargo](https://github.com/rust-lang/cargo/issues/15695) you may have to `touch src/*` or `cargo clean` first if you also used `cargo auditable` without `-Z sbom` in the same project.\n\n### Through other tools\n\nIf you\u0027re not calling `cargo` directly and cannot change how it\u0027s invoked, you can use `cargo auditable` as a drop-in replacement for `cargo`. See [here](REPLACING_CARGO.md) for details.\n\n### For Github releases\n\n[`cargo dist`](https://github.com/axodotdev/cargo-dist) has opt-in support for `cargo auditable`, see [here](https://axodotdev.github.io/cargo-dist/book/supplychain-security/index.",
  "github_repo": "rust-secure-code/cargo-auditable",
  "github_stars": 828,
  "github_topics": [
    "cargo-plugin",
    "cargo-subcommand",
    "rust",
    "rust-lang",
    "sbom",
    "security-audit",
    "security-automation",
    "security-tools"
  ],
  "homepage": "https://github.com/rust-secure-code/cargo-auditable",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 53,
  "installs_365d": 605,
  "installs_90d": 174,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "Apache-2.0 OR MIT",
  "llm_generated_at": null,
  "llm_model": null,
  "name": "cargo-auditable",
  "oldnames": [],
  "one_liner": null,
  "optional_dependencies": [],
  "rank_30d": 4562,
  "rank_365d": 4711,
  "rank_90d": 4429,
  "raw_hash": "418e3c55ea6d0776",
  "recommended_dependencies": [],
  "revision": 0,
  "ruby_source_path": "Formula/c/cargo-auditable.rb",
  "tap": "homebrew/core",
  "test_dependencies": [
    "rustup"
  ],
  "uses_from_macos": [],
  "version_head": "HEAD",
  "version_stable": "0.7.5",
  "versioned_formulae": [],
  "why_use_this": null
}