Automic VaultAutomic Vault

brew

Install cargo-cyclonedx with Homebrew, apk, dnf, Nix, pacman

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects. Version 0.5.9 via Homebrew; verified from local package data.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install cargo-cyclonedx

local Homebrew formula metadata

Linux

Alpine Linux apkverified · 92%
sudo apk add cargo-cyclonedx

Alpine Linux edge package indexes · cargo-cyclonedx · source: dl-cdn.alpinelinux.org

Fedora dnfverified · 92%
sudo dnf install cargo-cyclonedx

Fedora Rawhide package metadata · cargo-cyclonedx · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#cargo-cyclonedx

nixpkgs package indexes · pkgs/by-name/ca/cargo-cyclonedx/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S cargo-cyclonedx

Arch Linux sync databases · cargo-cyclonedx · source: geo.mirror.pkgbuild.com

overview

Package summary

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

Commands and aliases

  • cargo-cyclonedx

history

Project history and usage

cargo-cyclonedx is the Rust Cargo plugin from the CycloneDX project. It generates CycloneDX Software Bill of Materials files for Cargo projects, using Cargo metadata and lockfile information to describe Rust dependencies.

Project history

The cyclonedx-rust-cargo repository was created in 2019 and contains both the cyclonedx-bom Rust library and the cargo-cyclonedx application. The cargo-cyclonedx crate was published later as the command-line plugin for Cargo users.

The project belongs to the OWASP CycloneDX ecosystem. The CycloneDX site describes CycloneDX as a full-stack Bill of Materials standard for cyber-risk reduction, while the Rust plugin adapts that standard to Cargo workspaces.

Adoption history

cargo-cyclonedx adoption tracks the broader rise of SBOM requirements in software supply-chain security. It is packaged across multiple operating-system package managers and crates.io metadata shows more than one million downloads by June 2026.

Its value increased as organizations began asking Rust projects for SBOMs that can be consumed by security, compliance, and asset-management tooling.

How it is used

The documented command is `cargo cyclonedx`, run inside a Rust project containing Cargo.toml. By default it writes BOM files adjacent to Cargo.toml files in the workspace.

The plugin can emit XML or JSON, choose CycloneDX spec versions, select targets and feature sets, and describe crates, binaries, or all Cargo targets. The README notes that it uses both Cargo.lock and `cargo metadata`, which gives it more build-configuration context than lockfile-only scanners.

Why package nerds care

cargo-cyclonedx is important because it turns Cargo's dependency graph into a standardized interchange artifact. Package managers and security systems can consume the resulting BOM without knowing Rust internals.

It also illustrates a practical distinction in SBOM generation: registry lockfiles are not enough when features, targets, binaries, and package metadata affect what a Rust build actually contains.

Timeline

  • 2019: cyclonedx-rust-cargo repository created.
  • 2021: crates.io records the cargo-cyclonedx crate publication.
  • 2021-2026: Project continues as the Rust Cargo plugin within the CycloneDX tool ecosystem.
  • 2026: crates.io metadata shows more than one million downloads.

Related projects

  • cyclonedx-bom is the Rust library in the same repository used to read and write CycloneDX BOM data.
  • CycloneDX is the OWASP BOM standard that defines the output format.
  • Cargo metadata is the upstream Cargo command whose output helps the plugin model Rust projects more accurately.

security posture

Risk level: green

narrow executable package without higher-risk signals.

Risk classifier

green risk · low confidence · appliance

Why

  • narrow executable package without higher-risk signals

Signals

  • metadata:no-higher-risk-signals

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
cargo-cyclonedxcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version0.5.9
manager updated
local dataok
upstreamcurrent
latest detectedcargo-cyclonedx-0.5.9

https://github.com/CycloneDX/cyclonedx-rust-cargo

  • infoNo package-manager update timestamp was available.low confidence

install metadata

Package metadata

Package keybrew:cargo-cyclonedx
Version0.5.9
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/cargo-cyclonedx
Homepagehttps://cyclonedx.org/
Repositoryhttps://github.com/CycloneDX/cyclonedx-rust-cargo
Upstream docshttps://github.com/CycloneDX/cyclonedx-rust-cargo/tree/main/cargo-cyclonedx#readme
LicenseApache-2.0
Source archivehttps://github.com/CycloneDX/cyclonedx-rust-cargo/archive/refs/tags/cargo-cyclonedx-0.5.9.tar.gz
Build dependenciesrust
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namecargo-cyclonedx
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

cargo-cyclonedx

nix profile install nixpkgs#cargo-cyclonedx
  • normalized package name match
  • Matched by: Cargo Cyclonedx
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ca/cargo-cyclonedx/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
apk95%

cargo-cyclonedx 0.5.9-r0

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

https://github.com/CycloneDX/cyclonedx-rust-cargo

sudo apk add cargo-cyclonedx
  • License: Apache-2.0
  • Architecture: x86_64
  • Source Package: cargo-cyclonedx
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Cargo Cyclonedx
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: cargo-cyclonedx from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
dnf95%

cargo-cyclonedx 0.5.9-1.fc45

CycloneDX Software Bill of Materials (SBOM) for Rust Crates

https://crates.io/crates/cargo-cyclonedx

sudo dnf install cargo-cyclonedx
  • License: Apache-2.0 AND CC0-1.0 AND MIT AND MIT-0 AND Unicode-3.0 AND Unicode-DFS-2016 AND (Apache-2.0 OR MIT) AND (Unlicense OR MIT)
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: rust-cargo-cyclonedx
  • 4 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Cargo Cyclonedx
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: cargo-cyclonedx from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

cargo-cyclonedx 0.5.9-1

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

https://github.com/CycloneDX/cyclonedx-rust-cargo

sudo pacman -S cargo-cyclonedx
  • License: Apache-2.0
  • Architecture: x86_64
  • 3 dependencies
  • normalized package name match
  • Matched by: Cargo Cyclonedx
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: cargo-cyclonedx from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Same workflow

  • cargo-denyShares av.db curated category or tags: cargo, cli, rust, security, software-composition-analysis.
  • sbom-toolShares av.db curated category or tags: cli, sbom, security, software-supply-chain.
  • ternShares av.db curated category or tags: cli, cyclonedx, sbom, security, software-composition-analysis.
  • cargo-auditShares av.db curated category or tags: cargo, cli, rust, security, software-supply-chain.
  • cdxgenShares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain.
  • cargo-geigerShares av.db curated category or tags: cargo, cli, rust, security.
  • cargo-cyclonedxSame normalized package name exists in another local package ecosystem.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment