# Install cargo-audit with Homebrew, apk, Nix, pacman, zypper

Audit Cargo.lock files for crates with security vulnerabilities. Version 0.22.2 via Homebrew; verified 2026-06-05. Also installable with nix: nix profile install nixpkgs#cargo-audit.

## Install

```sh
sudo av install brew:cargo-audit
```

Additional install commands:

### macOS

- Homebrew (100%):

```sh
brew install cargo-audit
```

  Evidence: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add cargo-audit
```

  Evidence: Alpine Linux edge package indexes: cargo-audit from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Nix (92%):

```sh
nix profile install nixpkgs#cargo-audit
```

  Evidence: nixpkgs package indexes: pkgs/by-name/ca/cargo-audit/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S cargo-audit
```

  Evidence: Arch Linux sync databases: cargo-audit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install cargo-audit
```

  Evidence: openSUSE Tumbleweed package metadata: cargo-audit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

## Package facts

- **Package key:** brew:cargo-audit
- **Package manager:** Homebrew
- **Version:** 0.22.2
- **Source summary:** Audit Cargo.lock files for crates with security vulnerabilities
- **Homepage:** <https://rustsec.org/>
- **Repository:** <https://github.com/rustsec/rustsec>
- **Last updated:** 2026-06-05T15:11:00Z
- **Generated:** 2026-08-03T19:37:03+00:00

## Executables

- cargo-audit (alias)

## Install behavior

- Bottle: not available

## Freshness

- Page generated: 2026-08-03
- Package-manager version: 0.22.2
## Project history and usage

cargo-audit is the canonical RustSec command-line tool for scanning Cargo.lock files against the RustSec Advisory Database. It is one of the Rust ecosystem's best-known supply-chain security utilities because it connects ordinary Cargo projects to a community-maintained vulnerability database.

### Project history

The RustSec repository was created in February 2017 as RustSec API and tooling. cargo-audit became the user-facing Cargo subcommand for checking project lockfiles against advisories published in the RustSec Advisory Database.

The official RustSec site describes RustSec as a vulnerability database for Rust crates published through crates.io and lists cargo-audit as the get-started tool for auditing Cargo.lock files. The cargo-audit README documents lockfile auditing, advisory ignores, CI usage, an experimental fix command, and binary auditing.

### Adoption history

cargo-audit became a standard safety check in Rust projects because it fits Cargo's workflow: install the subcommand, run it at the top level of a project, and fail CI when a dependency matches an advisory.

Distribution adoption is broad. The supplied Homebrew facts list Alpine, Homebrew, Nix, Arch Linux, and openSUSE packages, and the upstream README explicitly documents installation through Alpine, Arch Linux, Homebrew, and OpenBSD in addition to `cargo install`.

### How it is used

The common usage is `cargo audit` in a project containing Cargo.lock. The tool reports advisories from the RustSec database and can be wired into CI systems; the README includes examples for Travis CI and points GitHub Actions users to the RustSec audit-check action.

cargo-audit also has a binary-auditing path. The README documents `cargo audit bin`, noting that binaries built with cargo-auditable can be audited accurately because their dependency lists are embedded in the executable.

### Why package nerds care

cargo-audit is package-nerd significant because it made Rust vulnerability metadata operational at package-install and CI time. For Rust projects, Cargo.lock is the exact package graph, and cargo-audit turns that graph into a security boundary.

It also helped normalize advisory-driven package hygiene in Rust. Instead of treating vulnerability feeds as external enterprise tooling, cargo-audit made them part of the everyday Cargo subcommand culture.

### Timeline

- 2017: rustsec/rustsec repository created on GitHub.
- 2021: GitHub releases include cargo-audit/v0.16.0 under the rustsec repository release scheme.
- 2026: RustSec site continues to list cargo-audit as primary tooling for Cargo.lock vulnerability auditing.

### Related projects

- cargo-audit is tied directly to the RustSec Advisory Database and the RustSec advisory-db repository where vulnerabilities are reported.
- Related tools include cargo-auditable for binary dependency embedding, audit-check for GitHub Actions, cargo-deny for broader dependency policy checks, and reachsec as an experimental reachability companion mentioned by the cargo-audit README.

### Sources

- <https://api.github.com/repos/rustsec/rustsec>
- <https://github.com/rustsec/rustsec>
- <https://raw.githubusercontent.com/rustsec/rustsec/main/cargo-audit/README.md>
- <https://rustsec.org/>
- source_facts.package-manager


## Security Notes

narrow executable package without higher-risk signals.

- **Geiger risk:** green / low
- narrow executable package without higher-risk signals

## Other Package-Manager Records

- Nix - cargo-audit: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cargo-audit/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - cargo-audit - 0.22.1-r0: normalized package name match | Alpine Linux edge package indexes: cargo-audit from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Audit Cargo.lock for crates with security vulnerabilities | https://github.com/RustSec/rustsec
- apk - cargo-audit-doc - 0.22.1-r0: normalized package name match | Alpine Linux edge package indexes: cargo-audit-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Audit Cargo.lock for crates with security vulnerabilities (documentation) | https://github.com/RustSec/rustsec
- pacman - cargo-audit - 0.22.2-1: normalized package name match | Arch Linux sync databases: cargo-audit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Audit Cargo.lock for crates with security vulnerabilities | https://github.com/RustSec/cargo-audit
- zypper - cargo-audit - 0.22.2~git0.281452c-1.3: normalized package name match | openSUSE Tumbleweed package metadata: cargo-audit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Audit rust sources for known security vulnerabilities | https://github.com/RustSec/cargo-audit


## Related links

- [cargo-audit](https://pkg.so/pkg/cargo/cargo-audit/) - Same normalized package name exists in another local package ecosystem.

## Combined YAML source

View the package source record on GitHub. [combined/cargo-audit.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cargo-audit.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph