{"id":20617796,"url":"https://github.com/cyclonedx/cyclonedx-rust-cargo","last_synced_at":"2025-05-15T10:01:32.192Z","repository":{"id":36988640,"uuid":"187911394","full_name":"CycloneDX/cyclonedx-rust-cargo","owner":"CycloneDX","description":"Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects","archived":false,"fork":false,"pushed_at":"2025-04-03T03:04:20.000Z","size":2650,"stargazers_count":128,"open_issues_count":41,"forks_count":50,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-05-10T01:37:53.322Z","etag":null,"topics":["bill-of-materials","bom","cargo","cargo-plugin","cyclonedx","mbom","obom","owasp","package-url","purl","rust","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"latest_commit_sha":null,"homepage":"https://cyclonedx.org/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CycloneDX.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"custom":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"]}},"created_at":"2019-05-21T20:48:15.000Z","updated_at":"2025-05-04T17:32:47.000Z","dependencies_parsed_at":"2024-02-29T02:27:23.252Z","dependency_job_id":"c4b12713-e00e-4022-9179-d95cc51d4d61","html_url":"https://github.com/CycloneDX/cyclonedx-rust-cargo","commit_stats":{"total_commits":981,"total_committers":36,"mean_commits":27.25,"dds":0.6972477064220184,"last_synced_commit":"c4c3ba9717e70eeb95c674cc31d9260bad4b3ee8"},"previous_names":[],"tags_count":35,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-rust-cargo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-rust-cargo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-rust-cargo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CycloneDX%2Fcyclonedx-rust-cargo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CycloneDX","download_url":"https://codeload.github.com/CycloneDX/cyclonedx-rust-cargo/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254319715,"owners_count":22051072,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bill-of-materials","bom","cargo","cargo-plugin","cyclonedx","mbom","obom","owasp","package-url","purl","rust","saasbom","sbom","sbom-generator","software-bill-of-materials","spdx","vex"],"created_at":"2024-11-16T12:05:59.727Z","updated_at":"2025-05-15T10:01:31.153Z","avatar_url":"https://github.com/CycloneDX.png","language":"Rust","funding_links":["https://owasp.org/donate/?reponame=www-project-cyclonedx\u0026title=OWASP+CycloneDX"],"categories":[],"sub_categories":[],"readme":"[![Build Status](https://github.com/CycloneDX/cyclonedx-rust-cargo/workflows/Rust%20CI/badge.svg)](https://github.com/CycloneDX/cyclonedx-rust-cargo/actions?workflow=Rust+CI)\n[![Crates.io](https://img.shields.io/crates/v/cyclonedx-bom.svg)](https://crates.io/crates/cyclonedx-bom)\n[![License](https://img.shields.io/badge/license-Apache%202.0-brightgreen.svg)][License]\n[![Website](https://img.shields.io/badge/https://-cyclonedx.org-blue.svg)](https://cyclonedx.org/)\n[![Slack Invite](https://img.shields.io/badge/Slack-Join-blue?logo=slack\u0026labelColor=393939)](https://cyclonedx.org/slack/invite)\n[![Group Discussion](https://img.shields.io/badge/discussion-groups.io-blue.svg)](https://groups.io/g/CycloneDX)\n[![Twitter](https://img.shields.io/twitter/url/http/shields.io.svg?style=social\u0026label=Follow)](https://twitter.com/CycloneDX_Spec)\n\n# CycloneDX Rust (Cargo) Plugin\n\nThe CycloneDX module for Rust (Cargo) creates a valid CycloneDX Software Bill of Materials (SBOM) containing an\naggregate of all project dependencies.\nOWASP CycloneDX is a full-stack Bill of Materials (BOM) standard providing advanced supply chain capabilities for cyber risk reduction.\n\n## Structure\n\nThis repository contains two separate projects:\n\n- [`cyclonedx-bom`](./cyclonedx-bom/README.md) is a Rust library to read and write CycloneDX SBOMs to and from Rust structs.\n- [`cargo-cyclonedx`](./cargo-cyclonedx/README.md) is a Rust application, which generates CycloneDX SBOMs for Cargo based Rust projects (it uses `cyclonedx-bom` for that purpose).\n\n## Usage\n\nExecute `cargo-cyclonedx` from within a Rust project directory containing Cargo.toml.\n\n### Installing\n\n```bash\ncargo install cargo-cyclonedx\n```\n\n### Executing binary\n\n```bash\n~/.cargo/bin/cargo-cyclonedx cyclonedx\n```\n\n### Executing from cargo\n\n```bash\ncargo cyclonedx\n```\n\n## Security considerations\n\n`cargo-cyclonedx` calls into Cargo internally to get information about a Rust project. Like nearly any other build system,\nCargo [may run arbitrary code](https://shnatsel.medium.com/do-not-run-any-cargo-commands-on-untrusted-projects-4c31c89a78d6)\nwhen invoked on an untrusted project, so `cargo-cyclonedx` should not be called on untrusted projects either.\n\nSome of the other tools for generating CycloneDX SBOMs do not invoke Cargo and only parse the `Cargo.lock` file.\nHowever, the only way to generate the `Cargo.lock` file for them to scan is to invoke Cargo, so this issue is currently unavoidable for any tool that describes a Cargo project.\n\n## Contributing\n\nContributions are welcome.\nSee our [`CONTRIBUTING.md`](CONTRIBUTING.md) for details.\n\n### Bug Bounty\n\nWe are running a [Bug Bounty](https://yeswehack.com/programs/cyclonedx-rust-cargo-bounty-program) program financed by the [Bug Resilience Program](https://www.sovereigntechfund.de/programs/bug-resilience/faq) of the [Sovereign Tech Fund](https://www.sovereigntechfund.de/). Thank you very much!\n\n## Copyright \u0026 License\n\nCycloneDX Rust Cargo is Copyright (c) OWASP Foundation. All Rights Reserved.\n\nPermission to modify and redistribute is granted under the terms of the Apache 2.0 license. See the [LICENSE] file for the full license.\n\n[License]: https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-rust-cargo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcyclonedx%2Fcyclonedx-rust-cargo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcyclonedx%2Fcyclonedx-rust-cargo/lists"}