Build binaries with cargo auditable

[Aloso]

This makes sure that all dependencies and their versions are embedded in the binary in a machine-readable format, and can be obtained with cargo audit bin. This allows auditing binaries for vulnerabilities that weren't yet known when the binaries were built.

[Shnatsel]

Hello! Author of cargo auditable here 👋

I'd love to see this integration and I'm happy to support it on my end!

There's precedent for transparently enabling this in Linux distros: Void Linux builds all their Cargo packages with cargo auditable, and Nix is canarying it on a few popular packages before rolling it out to the entire archive. So it's been tested pretty widely and is known to work with a wide variety of packages, and not break even in exotic configurations.

And it's not just cargo audit that consumes this data, Syft and Trivy can read it as well. That's how Microsoft uses it.

The only caveat I can think of is unsupported platforms - cargo auditable will refuse to build WASM because it doesn't know how to make it auditable. But I can just add an environment variable you can set to ignore unsupported platforms and that should ensure there's no breakage. Unsupported platforms now build but emit a warning. WASM is also supported starting with v0.6.3.

[Gankra]

(will re-evaluate this when core stuff is more settled, thanks for the info!)

[simonsan]

Hey, just wanted to chime in to state, that I'm really looking forward to this! (:

[duckinator]

This was implemented in #1528. Once there's been a release including it, you can have dist use cargo auditable build instead of cargo build by adding this to the [dist] section of dist-workspace.toml:

cargo-auditable = true

[Shnatsel]

That's great news!

Is this capability documented in the Dist Book?

[duckinator]

Forgot an important part: once you make that config change, you can run dist generate and your workflow will be modified to install cargo-auditable installed for you.

Locally, you still need to install cargo-auditable manually. #1527 has been opened to handle that.

[mistydemeo]

We also haven't yet cut a release with this feature - but we likely will fairly soon!

[duckinator]

Is this capability documented in the Dist Book?

I'd apparently set the docs aside with git stash yesterday and forgot to pull it out and commit it with #1528. 😓

I just opened #1530 to add that documentation.

[duckinator]

Documentation for the cargo-auditable feature has been merged. 🙂