Automic VaultAutomic Vault

brew

Install cargo-about with Homebrew, Nix, pacman

Cargo plugin to generate list of all licenses for a crate. Version 0.9.1 via Homebrew; verified 2026-06-30.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install cargo-about

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#cargo-about

nixpkgs package indexes · pkgs/by-name/ca/cargo-about/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S cargo-about

Arch Linux sync databases · cargo-about · source: geo.mirror.pkgbuild.com

overview

Package summary

Cargo plugin to generate list of all licenses for a crate

Commands and aliases

  • cargo-about

history

Project history and usage

cargo-about is an Embark Studios Cargo plugin for generating license listings for the full dependency graph of a Rust crate. It sits at the intersection of Cargo metadata, SPDX license data, and release compliance work.

Project history

Embark Studios created the public cargo-about repository in November 2019 and released it as one of its open-source Rust tools. The README states that Embark uses and likes the tool internally, while warning that it is not legal advice.

The project provides both a command-line Cargo subcommand and an mdBook manual. Its normal workflow is to initialize an about.toml and template, then generate a license output such as an HTML notice file from dependency metadata.

Adoption history

cargo-about's adoption follows Rust projects that need repeatable license disclosure for dependency-heavy applications. The supplied package-manager facts list Homebrew, Nix, and Arch Linux packages, and the upstream README documents installation from crates.io and Arch Linux.

The project also benefited from Embark's wider open-source Rust toolchain presence. Its repository topics include SPDX, license-checking, Cargo plugin, and Rust, which describe the niche it occupies among Cargo subcommands.

How it is used

The documented starting workflow is `cargo about init`, which creates about.toml and about.hbs in a Cargo project, followed by `cargo about generate about.hbs` to produce license information.

The official book documents commands and configuration for generating, clarifying, and working around license metadata issues, making cargo-about more of a compliance-report generator than a general dependency-audit scanner.

Why package nerds care

cargo-about matters because open-source license obligations are one of the least glamorous but most important parts of shipping packaged software. Rust's transitive dependency graphs can be large, and cargo-about turns that graph into a reproducible artifact for release notes, installers, game bundles, and product distributions.

For package nerds, its importance is also cultural: it is a Cargo subcommand that treats package metadata as operational data, using Cargo manifests and SPDX license identifiers to make dependency compliance automatable.

Timeline

  • 2019: cargo-about repository created on GitHub.
  • 2019: GitHub releases show an initial 0.0.1 release in November.
  • 2026: Repository metadata shows continued maintenance, Rust implementation, and licensing/SPDX topics.

Related projects

  • cargo-about is related to Cargo itself, SPDX license data, crates.io package metadata, and docs.rs API documentation.
  • It overlaps culturally with cargo-deny and cargo-audit: all three turn Cargo dependency metadata into release or security decisions, but cargo-about focuses on license listings rather than vulnerability or policy enforcement.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
<manifest_root>/about.toml

executables

Installed executables

CommandKindExposureNote
cargo-aboutcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.9.1
manager updated2026-06-30
local dataok
upstreamcurrent
latest detected0.9.1

https://github.com/EmbarkStudios/cargo-about

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:cargo-about
Version0.9.1
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/cargo-about
Homepagehttps://github.com/EmbarkStudios/cargo-about
Repositoryhttps://github.com/EmbarkStudios/cargo-about
Upstream docshttps://embarkstudios.github.io/cargo-about
LicenseApache-2.0 OR MIT
Source archivehttps://github.com/EmbarkStudios/cargo-about/archive/refs/tags/0.9.1.tar.gz
Last updated2026-06-30T12:38:26Z
Pulseupdated
Build dependenciesrust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecargo-about
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cargo-about

nix profile install nixpkgs#cargo-about
  • normalized package name match
  • Matched by: Cargo About
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ca/cargo-about/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
pacman95%

cargo-about 0.8.4-2

Cargo plugin to generate list of all licenses for a crate

https://github.com/EmbarkStudios/cargo-about

sudo pacman -S cargo-about
  • License: Apache-2.0 AND MIT
  • Architecture: x86_64
  • 3 dependencies
  • normalized package name match
  • Matched by: Cargo About
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: cargo-about from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • rustBuild dependency declared by Homebrew.
  • cargo-instrumentsPackage names and metadata indicate a similar tool family. Shared terms: cargo, crate, generate.
  • cargo-releasePackage names and metadata indicate a similar tool family. Shared terms: about, cargo, crate.
  • cargo-all-featuresPackage names and metadata indicate a similar tool family. Shared terms: all, cargo.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment