CycloneDX/cyclonedx-rust-cargo

View on GitHub

Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects

Stars: 178
Forks: 66
Open beginner issues: 0
Indexed issues: 38

Dominant language: Rust
License: Apache-2.0
Last GitHub push: May 5, 2026
Latest indexed: Sep 15, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed
PR merge metrics: No merged PRs in 30d

Open All

38 open issues indexed

Investigate using tools to generate serialization / deserialization implementations Open

enhancement

CycloneDX/cyclonedx-rust-cargo#88 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Investigate if custom registries should result in purl's with a different type from "cargo" Open

cargo-cyclonedx enhancement

CycloneDX/cyclonedx-rust-cargo#231 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Document important design decisions in the Wiki Open

documentation

CycloneDX/cyclonedx-rust-cargo#346 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 15, 2026
Trailing zeros in fractional digits of timestamp fails validation. Open

CycloneDX/cyclonedx-rust-cargo#353 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Support for -sys style crates Open

enhancement

CycloneDX/cyclonedx-rust-cargo#366 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Consider using `packageurl::PackageUrl` instead of custom `Purl` type. Open

CycloneDX/cyclonedx-rust-cargo#410 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Consider using `url::Url` instead of custom `Uri` type. Open

CycloneDX/cyclonedx-rust-cargo#411 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Reproducible SBOMs Open

CycloneDX/cyclonedx-rust-cargo#514 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Capture data only available during the build process Open

cargo-cyclonedx enhancement

CycloneDX/cyclonedx-rust-cargo#532 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Make bom-ref use relative paths for workspace items as well Open

CycloneDX/cyclonedx-rust-cargo#556 · 11 comments · 3 reactions · 0 assignees · Indexed Sep 15, 2026
Provide an easy way to map an artifact to a SBOM Open

CycloneDX/cyclonedx-rust-cargo#557 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Use a license id or name instead of an expression if there is only one license Open

CycloneDX/cyclonedx-rust-cargo#570 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Replace qualifier with optional namespace for local packages Open

CycloneDX/cyclonedx-rust-cargo#612 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
`cyclonedx-bom` is unsuitable for `cargo auditable` use case Open

CycloneDX/cyclonedx-rust-cargo#628 · 0 comments · 2 reactions · 0 assignees · Indexed Sep 15, 2026
Hashes for packages from registries with parameters in the URL may not be recorded Open

CycloneDX/cyclonedx-rust-cargo#629 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The type of external references shouldn't be "open" Open

CycloneDX/cyclonedx-rust-cargo#664 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Refactor `.new_unchecked()` on enums into `impl From<&str>` Open

CycloneDX/cyclonedx-rust-cargo#684 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Do round trip tests Open

CycloneDX/cyclonedx-rust-cargo#696 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Split `specs` module for XML and JSON Open

CycloneDX/cyclonedx-rust-cargo#697 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Avoid null fields Open

CycloneDX/cyclonedx-rust-cargo#698 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
XML de/serialization of `normalizedstring` fields is incorrect Open

CycloneDX/cyclonedx-rust-cargo#737 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Support Cargo resolver v2 Open

enhancement

CycloneDX/cyclonedx-rust-cargo#760 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Metadata components should not have sub-components Open

CycloneDX/cyclonedx-rust-cargo#763 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Optional Dependencies Open

CycloneDX/cyclonedx-rust-cargo#766 · 6 comments · 4 reactions · 0 assignees · Indexed Sep 15, 2026
[Feature] Support CycloneDX 1.6 Open

CycloneDX/cyclonedx-rust-cargo#769 · 17 comments · 6 reactions · 0 assignees · Indexed Sep 15, 2026
Add ability to specify output path when using as library. Open

CycloneDX/cyclonedx-rust-cargo#778 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
[cyclonedx-bom] top-level `bom.version` should be optional in `Bom` struct Open

CycloneDX/cyclonedx-rust-cargo#785 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Expose spec in cyclonedx-bom Open

CycloneDX/cyclonedx-rust-cargo#802 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Latest release doesn't compile on loongarch64 Open

CycloneDX/cyclonedx-rust-cargo#814 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Output is target specific but does not go in target directory Open

CycloneDX/cyclonedx-rust-cargo#820 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Generated SBOMs use deprecated features Open

CycloneDX/cyclonedx-rust-cargo#825 · 4 comments · 1 reaction · 0 assignees · Indexed Sep 15, 2026
Better feedback when no SBOMs are generated Open

CycloneDX/cyclonedx-rust-cargo#827 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Reliance on unstable `source` field in `cargo metadata` output Open

CycloneDX/cyclonedx-rust-cargo#854 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
License of cargo-cyclonedx declared Apache-2.0, but “derived from” MIT project Open

legal

CycloneDX/cyclonedx-rust-cargo#864 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
chore(legal): add license headers to all significant Rust source files Open

legal

CycloneDX/cyclonedx-rust-cargo#865 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026
Add configurable XML parser maxDepth support Open

CycloneDX/cyclonedx-rust-cargo#867 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The --target flag does not seem to respect target-conditional features in generated SBOM. Open

CycloneDX/cyclonedx-rust-cargo#871 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 15, 2026
The tool leaves the repo in a dirty state Open

CycloneDX/cyclonedx-rust-cargo#878 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 15, 2026

CycloneDX/cyclonedx-rust-cargo

Get new issues in your inbox