# 使用 Homebrew, apk, Nix, pacman, zypper 安装 cargo-audit
查看 cargo-audit 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。
## 安装
```sh
sudo av install brew:cargo-audit
```
其他安装命令:
### macOS
- Homebrew (100%):
```sh
brew install cargo-audit
```
证据: local Homebrew formula metadata
### Linux
- apk (92%):
```sh
sudo apk add cargo-audit
```
证据: Alpine Linux edge package indexes: cargo-audit from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz
- Nix (92%):
```sh
nix profile install nixpkgs#cargo-audit
```
证据: nixpkgs package indexes: pkgs/by-name/ca/cargo-audit/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- pacman (92%):
```sh
sudo pacman -S cargo-audit
```
证据: Arch Linux sync databases: cargo-audit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz
- zypper (92%):
```sh
sudo zypper install cargo-audit
```
证据: openSUSE Tumbleweed package metadata: cargo-audit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst
## 软件包事实
- **软件包键:** brew:cargo-audit
- **软件包管理器:** Homebrew
- **版本:** 0.22.2
- **来源摘要:** Audit Cargo.lock files for crates with security vulnerabilities
- **主页:**
- **仓库:**
- **最后更新:** 2026-06-05T15:11:00Z
- **已生成:** 2026-08-03T19:37:03+00:00
## 可执行文件
- cargo-audit (别名)
## 安装行为
- Bottle: 不可用
## 版本和新鲜度
- 页面生成时间: 2026-08-03
- 管理器版本: 0.22.2
## 项目历史与用法
cargo-audit is the canonical RustSec command-line tool for scanning Cargo.lock files against the RustSec Advisory Database. It is one of the Rust ecosystem's best-known supply-chain security utilities because it connects ordinary Cargo projects to a community-maintained vulnerability database.
### 项目历史
The RustSec repository was created in February 2017 as RustSec API and tooling. cargo-audit became the user-facing Cargo subcommand for checking project lockfiles against advisories published in the RustSec Advisory Database.
The official RustSec site describes RustSec as a vulnerability database for Rust crates published through crates.io and lists cargo-audit as the get-started tool for auditing Cargo.lock files. The cargo-audit README documents lockfile auditing, advisory ignores, CI usage, an experimental fix command, and binary auditing.
### 采用历史
cargo-audit became a standard safety check in Rust projects because it fits Cargo's workflow: install the subcommand, run it at the top level of a project, and fail CI when a dependency matches an advisory.
Distribution adoption is broad. The supplied Homebrew facts list Alpine, Homebrew, Nix, Arch Linux, and openSUSE packages, and the upstream README explicitly documents installation through Alpine, Arch Linux, Homebrew, and OpenBSD in addition to `cargo install`.
### 使用方式
The common usage is `cargo audit` in a project containing Cargo.lock. The tool reports advisories from the RustSec database and can be wired into CI systems; the README includes examples for Travis CI and points GitHub Actions users to the RustSec audit-check action.
cargo-audit also has a binary-auditing path. The README documents `cargo audit bin`, noting that binaries built with cargo-auditable can be audited accurately because their dependency lists are embedded in the executable.
### 为什么软件包爱好者会关心
cargo-audit is package-nerd significant because it made Rust vulnerability metadata operational at package-install and CI time. For Rust projects, Cargo.lock is the exact package graph, and cargo-audit turns that graph into a security boundary.
It also helped normalize advisory-driven package hygiene in Rust. Instead of treating vulnerability feeds as external enterprise tooling, cargo-audit made them part of the everyday Cargo subcommand culture.
### 时间线
- 2017: rustsec/rustsec repository created on GitHub.
- 2021: GitHub releases include cargo-audit/v0.16.0 under the rustsec repository release scheme.
- 2026: RustSec site continues to list cargo-audit as primary tooling for Cargo.lock vulnerability auditing.
### Related projects
- cargo-audit is tied directly to the RustSec Advisory Database and the RustSec advisory-db repository where vulnerabilities are reported.
- Related tools include cargo-auditable for binary dependency embedding, audit-check for GitHub Actions, cargo-deny for broader dependency policy checks, and reachsec as an experimental reachability companion mentioned by the cargo-audit README.
### 来源
-
-
-
-
- source_facts.package-manager
## 安全说明
narrow executable package without higher-risk signals.
- **Geiger 风险:** 绿色 / 低
- narrow executable package without higher-risk signals
## 其他软件包管理器记录
- Nix - cargo-audit: normalized package name match | nixpkgs package indexes: pkgs/by-name/ca/cargo-audit/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - cargo-audit - 0.22.1-r0: normalized package name match | Alpine Linux edge package indexes: cargo-audit from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Audit Cargo.lock for crates with security vulnerabilities | https://github.com/RustSec/rustsec
- apk - cargo-audit-doc - 0.22.1-r0: normalized package name match | Alpine Linux edge package indexes: cargo-audit-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Audit Cargo.lock for crates with security vulnerabilities (documentation) | https://github.com/RustSec/rustsec
- pacman - cargo-audit - 0.22.2-1: normalized package name match | Arch Linux sync databases: cargo-audit from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Audit Cargo.lock for crates with security vulnerabilities | https://github.com/RustSec/cargo-audit
- zypper - cargo-audit - 0.22.2~git0.281452c-1.3: normalized package name match | openSUSE Tumbleweed package metadata: cargo-audit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Audit rust sources for known security vulnerabilities | https://github.com/RustSec/cargo-audit
## 相关链接
- [cargo-audit](https://pkg.so/zh-hans/pkg/cargo/cargo-audit/) - Same normalized package name exists in another local package ecosystem.
## Combined YAML source
View the package source record on GitHub. [combined/cargo-audit.yml](https://github.com/mxcl/pkgdb/blob/main/combined/cargo-audit.yml)
## 来源
- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph