# Install cargo-cyclonedx with Homebrew, apk, dnf, Nix, pacman Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects. Version 0.5.9 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:cargo-cyclonedx ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install cargo-cyclonedx ``` Evidence: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add cargo-cyclonedx ``` Evidence: Alpine Linux edge package indexes: cargo-cyclonedx from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - dnf (92%): ```sh sudo dnf install cargo-cyclonedx ``` Evidence: Fedora Rawhide package metadata: cargo-cyclonedx from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#cargo-cyclonedx ``` Evidence: nixpkgs package indexes: pkgs/by-name/ca/cargo-cyclonedx/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S cargo-cyclonedx ``` Evidence: Arch Linux sync databases: cargo-cyclonedx from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz ## Package facts - **Package key:** brew:cargo-cyclonedx - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.5.9 - **Source summary:** Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - cargo-cyclonedx (cli) - cargo-cyclonedx (alias) ## Build dependencies - rust ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.5.9 - Local data: ok - Upstream repository: https://github.com/CycloneDX/cyclonedx-rust-cargo - Upstream latest detected: cargo-cyclonedx-0.5.9 (current) - info: No package-manager update timestamp was available. ## Project history and usage cargo-cyclonedx is the Rust Cargo plugin from the CycloneDX project. It generates CycloneDX Software Bill of Materials files for Cargo projects, using Cargo metadata and lockfile information to describe Rust dependencies. ### Project history The cyclonedx-rust-cargo repository was created in 2019 and contains both the cyclonedx-bom Rust library and the cargo-cyclonedx application. The cargo-cyclonedx crate was published later as the command-line plugin for Cargo users. The project belongs to the OWASP CycloneDX ecosystem. The CycloneDX site describes CycloneDX as a full-stack Bill of Materials standard for cyber-risk reduction, while the Rust plugin adapts that standard to Cargo workspaces. ### Adoption history cargo-cyclonedx adoption tracks the broader rise of SBOM requirements in software supply-chain security. It is packaged across multiple operating-system package managers and crates.io metadata shows more than one million downloads by June 2026. Its value increased as organizations began asking Rust projects for SBOMs that can be consumed by security, compliance, and asset-management tooling. ### How it is used The documented command is `cargo cyclonedx`, run inside a Rust project containing Cargo.toml. By default it writes BOM files adjacent to Cargo.toml files in the workspace. The plugin can emit XML or JSON, choose CycloneDX spec versions, select targets and feature sets, and describe crates, binaries, or all Cargo targets. The README notes that it uses both Cargo.lock and `cargo metadata`, which gives it more build-configuration context than lockfile-only scanners. ### Why package nerds care cargo-cyclonedx is important because it turns Cargo's dependency graph into a standardized interchange artifact. Package managers and security systems can consume the resulting BOM without knowing Rust internals. It also illustrates a practical distinction in SBOM generation: registry lockfiles are not enough when features, targets, binaries, and package metadata affect what a Rust build actually contains. ### Timeline - 2019: cyclonedx-rust-cargo repository created. - 2021: crates.io records the cargo-cyclonedx crate publication. - 2021-2026: Project continues as the Rust Cargo plugin within the CycloneDX tool ecosystem. - 2026: crates.io metadata shows more than one million downloads. ### Related projects - cyclonedx-bom is the Rust library in the same repository used to read and write CycloneDX BOM data. - CycloneDX is the OWASP BOM standard that defines the output format. - Cargo metadata is the upstream Cargo command whose output helps the plugin model Rust projects more accurately. ### Sources - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** cargo-cyclonedx - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - cargo-cyclonedx: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cargo-cyclonedx/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - cargo-cyclonedx - 0.5.9-r0: normalized package name match | Alpine Linux edge package indexes: cargo-cyclonedx from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects | https://github.com/CycloneDX/cyclonedx-rust-cargo - dnf - cargo-cyclonedx - 0.5.9-1.fc45: normalized package name match | Fedora Rawhide package metadata: cargo-cyclonedx from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | CycloneDX Software Bill of Materials (SBOM) for Rust Crates | https://crates.io/crates/cargo-cyclonedx - pacman - cargo-cyclonedx - 0.5.9-1: normalized package name match | Arch Linux sync databases: cargo-cyclonedx from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects | https://github.com/CycloneDX/cyclonedx-rust-cargo ## Related links - [Package publisher tools](https://www.automicvault.com/pkg/package-publishers/) - Belongs to a package publishing or registry command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [rust](https://www.automicvault.com/pkg/brew/rust/) - Build dependency declared by Homebrew. - [cyclonedx-cli](https://www.automicvault.com/pkg/brew/cyclonedx-cli/) - Shares the same upstream homepage. - [cyclonedx-gomod](https://www.automicvault.com/pkg/brew/cyclonedx-gomod/) - Shares the same upstream homepage. - [cyclonedx-python](https://www.automicvault.com/pkg/brew/cyclonedx-python/) - Shares the same upstream homepage. - [cargo-deny](https://www.automicvault.com/pkg/brew/cargo-deny/) - Shares av.db curated category or tags: cargo, cli, rust, security, software-composition-analysis. - [sbom-tool](https://www.automicvault.com/pkg/brew/sbom-tool/) - Shares av.db curated category or tags: cli, sbom, security, software-supply-chain. - [tern](https://www.automicvault.com/pkg/brew/tern/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-composition-analysis. - [cargo-audit](https://www.automicvault.com/pkg/brew/cargo-audit/) - Shares av.db curated category or tags: cargo, cli, rust, security, software-supply-chain. - [cdxgen](https://www.automicvault.com/pkg/brew/cdxgen/) - Shares av.db curated category or tags: cli, cyclonedx, sbom, security, software-supply-chain. - [cargo-geiger](https://www.automicvault.com/pkg/brew/cargo-geiger/) - Shares av.db curated category or tags: cargo, cli, rust, security. - [cargo-cyclonedx](https://www.automicvault.com/pkg/cargo/cargo-cyclonedx/) - Same normalized package name exists in another local package ecosystem. ## Combined YAML source View the package source record on GitHub. [combined/cargo-cyclonedx.yml](https://github.com/automic-vault/db/blob/main/combined/cargo-cyclonedx.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph