Automic VaultAutomic Vault

brew

Install cargo-bundle with Homebrew, Nix

Wrap rust executables in OS-specific app bundles. Version 0.11.0 via Homebrew; verified 2026-05-31.

install

Additional install commands

macOS

Homebrewverified · 100%
brew install cargo-bundle

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#cargo-bundle

nixpkgs package indexes · pkgs/by-name/ca/cargo-bundle/package.nix · source: api.github.com

overview

Package summary

Wrap rust executables in OS-specific app bundles

Commands and aliases

  • cargo-bundle

history

Project history and usage

cargo-bundle is a Cargo subcommand for wrapping Rust GUI executables into operating-system application bundles and installer formats.

Project history

The cargo-bundle repository was created in January 2016 and the first crates.io release followed in March 2016. The README positions it as a tool for generating macOS app bundles, iOS bundles, Debian packages, and experimental Windows MSI installers from Cargo-built executables.

Its design centers on a `[package.metadata.bundle]` section in Cargo.toml. That metadata describes user-facing application attributes such as name, identifier, icon, version, resources, copyright, category, descriptions, Debian dependencies, macOS frameworks, and URL schemes.

Adoption history

cargo-bundle occupies a narrower niche than compiler or profiling Cargo plugins: desktop and GUI Rust applications. Crates.io reports more than 150,000 downloads, and the input records Homebrew and Nix packaging.

The project remained useful because early Rust desktop applications needed a Cargo-native way to bridge from a compiled binary to platform packaging conventions without adopting a full application framework.

How it is used

Users install it with `cargo install cargo-bundle`, add `[package.metadata.bundle]` to Cargo.toml, and run `cargo bundle` from the package directory. The command supports familiar Cargo selectors and build controls such as `--bin`, `--example`, `--release`, `--profile`, `--target`, and feature flags.

The README documents output formats including deb, ios, msi, wxsmsi, osx, rpm, and appimage, while also warning that the project status is early alpha and that the metadata format is not guaranteed stable.

Why package nerds care

cargo-bundle is historically interesting because it embeds desktop packaging metadata inside Cargo.toml rather than treating app bundling as an entirely external release step. It shows how Rust package metadata became a place for downstream packaging intent, not just dependency resolution.

For package maintainers, it connects Rust crates to platform-native artifacts such as `.app`, `.deb`, and `.msi`, making it a small but useful example of Cargo crossing from language package manager into OS package production.

Timeline

  • 2016-01-10: GitHub repository burtonageo/cargo-bundle was created.
  • 2016-03-22: cargo-bundle 0.0.0 was published on crates.io.
  • 2016 onward: README documented `[package.metadata.bundle]` as the Cargo.toml integration point for bundle metadata.
  • 2026-05-30: Version 0.11.0 was published.

Related projects

  • Cargo provides the build and subcommand interface cargo-bundle extends.
  • Platform packaging formats documented by the project include macOS app bundles, Debian packages, Windows MSI installers, RPM packages, and AppImage.
  • The Rust desktop packaging space overlaps conceptually with later application-packaging frameworks, but cargo-bundle remains a small Cargo-native bundling tool.

Sources

  • GitHub repository API metadata: https://api.github.com/repos/burtonageo/cargo-bundle
  • Official README: https://github.com/burtonageo/cargo-bundle#readme
  • Package-manager adoption from source_facts.package-manager.
  • crates.io API metadata and versions: https://crates.io/api/v1/crates/cargo-bundle

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 2 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
Cargo.toml
Windows
Cargo.toml

executables

Installed executables

CommandKindExposureNote
cargo-bundlecliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.11.0
manager updated2026-05-31
local dataok
upstreamcurrent
latest detectedv0.11.0

https://github.com/burtonageo/cargo-bundle

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:cargo-bundle
Version0.11.0
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/cargo-bundle
Homepagehttps://github.com/burtonageo/cargo-bundle
Repositoryhttps://github.com/burtonageo/cargo-bundle
Upstream docshttps://github.com/burtonageo/cargo-bundle#readme
LicenseApache-2.0 OR MIT
Source archivehttps://github.com/burtonageo/cargo-bundle/archive/refs/tags/v0.11.0.tar.gz
Last updated2026-05-31T10:36:43Z
Pulseupdated
Build dependenciespkgconf, rust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecargo-bundle
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cargo-bundle

nix profile install nixpkgs#cargo-bundle
  • normalized package name match
  • Matched by: Cargo Bundle
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ca/cargo-bundle/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment