Cargo.lock with Bomdesk
This opens a small Cargo.lock with crates that carry dual and weak-copyleft licences. Press Scan to see how each licence is read and which versions have advisories.
- Paste Cargo.lock or drop the file.
- Press Scan to look up each crate's licence and advisories.
- Download CycloneDX or SPDX.
- Use cargo audit or cargo deny in CI for continuous checks.
What to know
Cargo.lock lists every crate that resolved, with its exact version and where it came from. Bomdesk keeps the crates that come from a registry and leaves out your own workspace members and git or path dependencies, because those have no registry coordinates to look up.
Rust crates are very often dual-licensed, written MIT OR Apache-2.0, and the lookup keeps that expression intact. Bomdesk treats an OR as a choice you can make, so such a crate counts as permissive. Older Cargo metadata uses a slash (MIT/Apache-2.0) for the same thing, which is understood too.
Cargo.lock holds no licence and no dev-only flag, so licences come from the lookup and the direct and dev counts are left out rather than guessed. Build scripts, proc-macros and test-only crates all appear in the list, because the lock does not tell them apart.
Updated · Cosmovex
Questions
Why were some packages left out?
Crates from git or a local path have no registry coordinates. The page tells you how many were skipped.
What does MIT OR Apache-2.0 mean for classification?
You may use the crate under either licence, so it counts as permissive.
Is this a replacement for cargo audit?
No. cargo audit and cargo deny run in CI against every change. Bomdesk is for the one-off report and the licence picture.
Are build-only crates listed?
Yes. Cargo.lock does not separate build, dev and runtime crates, so every registry crate in the file is listed.
The free plan covers everything on this page. Bomdesk Pro ($19, paid once) is described on the Bomdesk page.
