使用 Homebrew, apk, dnf, Nix, pacman 安装 cargo-cyclonedx

项目链接

• 主页
• 仓库
• 上游文档
• 软件包管理器页面

命令和别名

• cargo-cyclonedx

项目历史

The cyclonedx-rust-cargo repository was created in 2019 and contains both the cyclonedx-bom Rust library and the cargo-cyclonedx application. The cargo-cyclonedx crate was published later as the command-line plugin for Cargo users.

The project belongs to the OWASP CycloneDX ecosystem. The CycloneDX site describes CycloneDX as a full-stack Bill of Materials standard for cyber-risk reduction, while the Rust plugin adapts that standard to Cargo workspaces.

采用历史

cargo-cyclonedx adoption tracks the broader rise of SBOM requirements in software supply-chain security. It is packaged across multiple operating-system package managers and crates.io metadata shows more than one million downloads by June 2026.

Its value increased as organizations began asking Rust projects for SBOMs that can be consumed by security, compliance, and asset-management tooling.

使用方式

The documented command is `cargo cyclonedx`, run inside a Rust project containing Cargo.toml. By default it writes BOM files adjacent to Cargo.toml files in the workspace.

The plugin can emit XML or JSON, choose CycloneDX spec versions, select targets and feature sets, and describe crates, binaries, or all Cargo targets. The README notes that it uses both Cargo.lock and `cargo metadata`, which gives it more build-configuration context than lockfile-only scanners.

为什么软件包爱好者会关心

cargo-cyclonedx is important because it turns Cargo's dependency graph into a standardized interchange artifact. Package managers and security systems can consume the resulting BOM without knowing Rust internals.

It also illustrates a practical distinction in SBOM generation: registry lockfiles are not enough when features, targets, binaries, and package metadata affect what a Rust build actually contains.

时间线

• 2019: cyclonedx-rust-cargo repository created.
• 2021: crates.io records the cargo-cyclonedx crate publication.
• 2021-2026: Project continues as the Rust Cargo plugin within the CycloneDX tool ecosystem.
• 2026: crates.io metadata shows more than one million downloads.

Related projects

• cyclonedx-bom is the Rust library in the same repository used to read and write CycloneDX BOM data.
• CycloneDX is the OWASP BOM standard that defines the output format.
• Cargo metadata is the upstream Cargo command whose output helps the plugin model Rust projects more accurately.

来源

• https://api.github.com/repos/CycloneDX/cyclonedx-rust-cargo
• https://crates.io/api/v1/crates/cargo-cyclonedx
• https://cyclonedx.org/
• https://github.com/CycloneDX/cyclonedx-rust-cargo
• https://github.com/CycloneDX/cyclonedx-rust-cargo/tree/main/cargo-cyclonedx#readme