From a8f26a79f944c344d42f1a30ba4e9674c534bbb0 Mon Sep 17 00:00:00 2001 From: casjay Date: Fri, 21 Aug 2026 21:14:58 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=A7=20Add=20cargo-about=20to=20the=20r?= =?UTF-8?q?ust-tools=20prebuilt=20loop=20=F0=9F=94=A7?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds cargo-about (third-party license report/notice generation from Cargo.lock) to the toolchain — it was previously absent from the tool list entirely, not broken or missing a prebuilt. Confirmed musl prebuilts exist for both x86_64 and aarch64 via the GitHub releases API before placing it in the main prebuilt-fetch loop (not the compile-fallback one). - Dockerfile: added cargo-about to the rust-tools stage's main cargo binstall loop, grouped with the other license/SBOM tools (cargo-audit, cargo-deny, cargo-cyclonedx). - README.md: documented cargo-about in the linting & static analysis tool table. --- Dockerfile | 1 + README.md | 1 + 2 files changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 47070c4..182fb89 100644 --- a/Dockerfile +++ b/Dockerfile @@ -110,6 +110,7 @@ RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local cargo-expand \ bacon \ cargo-audit \ + cargo-about \ cargo-deny \ cargo-cyclonedx \ cargo-machete \ diff --git a/README.md b/README.md index f5f18ee..d089ab3 100644 --- a/README.md +++ b/README.md @@ -181,6 +181,7 @@ Run miri with: `cargo +nightly miri test` | `cargo-geiger` | Counts `unsafe` blocks and dependencies — reports unsafe surface area | | `cargo-deny` | Policy enforcement — license allow-lists, ban crates, advisories | | `cargo-audit` | Scan `Cargo.lock` against the RustSec advisory DB | +| `cargo-about` | Generate a third-party license report/notice from `Cargo.lock` | | `cargo-cyclonedx` | Generate a CycloneDX SBOM from `Cargo.lock` | | `cargo-machete` | Detect unused dependencies (stable) | | `cargo-udeps` | Detect unused dependencies (nightly; `cargo +nightly udeps`) |