From 13c6f906a210fb0e2020b75a17e6eed1d17a7fdb Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 21:32:20 +0000 Subject: [PATCH 1/9] Add 2026/stabilize-cargo-sbom.md --- src/2026/stabilize-cargo-sbom.md | 56 ++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 src/2026/stabilize-cargo-sbom.md diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md new file mode 100644 index 00000000..a2a377fa --- /dev/null +++ b/src/2026/stabilize-cargo-sbom.md @@ -0,0 +1,56 @@ +# Stabilize Cargo SBOM precursor + +| Metadata | | +| :--------------- | -------------------------------------------------------------------------------- | +| Point of contact | @Shnatsel | +| Status | Proposed for mentorship | +| Tracking issue | N/A | +| Zulip channel | N/A | + +## Summary + +Resolve known issues in Cargo's [SBOM precursor feature](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) and stabilize an MVP (minimal viable product) version of it. + +## Motivation + +[Software Bill of Materials](https://en.wikipedia.org/wiki/Software_supply_chain) is a list of project dependencies and their versions, analogous to Cargo.lock, in a format standardized across programming languages. They enable supply chain transparency and allow easily identifying dependencies with known vulnerabilities. + +SBOMs are turning from a best practice to being mandatory. In the US [Executive Order 14028](https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity) requires the federal government to only purchase software from vendors who provide a Software Bill of Materials for each product. In the EU the [Cyber Resilience Act](https://eur-lex.europa.eu/eli/reg/2024/2847/oj) mandates that any product with "digital elements" sold in the EU must have an SBOM as part of its technical documentation; obligations for reporting vulnerabilities begin in September 2026, with full compliance required by December 2027. Many other jurisdictions have similar regulations. + +### The status quo + +The crucial missing piece for SBOM generation for Rust+Cargo projects is accurate reporting of the dependency tree. `cargo metadata` falls short in [multiple](https://github.com/rust-lang/cargo/issues/7754) [ways](https://github.com/rust-lang/cargo/issues/10718). This results in either false negatives or false positives in the reported dependency tree. + +The [SBOM precursor](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) feature in Cargo addresses this by providing a mechanism to accurately report the dependency tree used in a given build. However, it is nightly-only, not yet widely used, and has [at least one known issue](https://github.com/rust-lang/cargo/issues/15695). + +Inaccurate SBOMs lead to false positives on vulnerability scans and/or compliance issues. + +### What we propose to do about it + +1. Resolve the already known issue(s) in the Cargo SBOM precursor feature +2. Modify [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) to use the Cargo SBOM precursor as a data source, to prove that it can be used to generate a complete and accurate SBOM in an industry standard format +3. Address any issues that point 2 uncovers in the Cargo SBOM precursor feature +4. Stabilize the MVP that is sufficient to power [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) and [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) + +### Work items over the next year + +| Task | Owner(s) | Notes | +| ----------- | -------- | ----- | +| Resolve known issues | @Shnatsel et al. | | +| convert cargo-cyclonedx to use the SBOM precursor | @Shnatsel et al. | outside the Rust Project repositories, no Rust Project mentorship needed | +| Resolve newly uncovered issues | @Shnatsel et al. | | +| Stabilize the MVP | @Shnatsel et al. | | + +I am in the process of applying for funding for this work, together with collaborators I'm not sure I can disclose. The amount of time we can dedicate to the project will depend on the outcome of that application. It is possible that the funding will only materialize in the second half of the year or not at all. + +## Team asks + +We will need a handful of 30-minute design meetings with someone on the Cargo team, plus guidance on the stabilization process. Not sure if that qualifies as "small" or "medium". + +| Team | Support level | Notes | +| ---------- | ------------- | --------------------------------------- | +| [cargo] | small/medium? | | + +## Frequently asked questions + +TODO - will fill in based on the review comments From ff52ed4ca8fad266162e1af0d7073bbe3df98cb4 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 22:16:35 +0000 Subject: [PATCH 2/9] Link tracking issue --- src/2026/stabilize-cargo-sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index a2a377fa..acb3b457 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -4,7 +4,7 @@ | :--------------- | -------------------------------------------------------------------------------- | | Point of contact | @Shnatsel | | Status | Proposed for mentorship | -| Tracking issue | N/A | +| Tracking issue |[ N/A ](https://github.com/rust-lang/cargo/issues/16565) | | Zulip channel | N/A | ## Summary From 256fe79634463de388e40b3f891ed1703d1b891c Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 22:16:59 +0000 Subject: [PATCH 3/9] Fix editing goof --- src/2026/stabilize-cargo-sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index acb3b457..bdfd6ea6 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -4,7 +4,7 @@ | :--------------- | -------------------------------------------------------------------------------- | | Point of contact | @Shnatsel | | Status | Proposed for mentorship | -| Tracking issue |[ N/A ](https://github.com/rust-lang/cargo/issues/16565) | +| Tracking issue | https://github.com/rust-lang/cargo/issues/16565 | | Zulip channel | N/A | ## Summary From 9f1d19564d100de0b0799dae05b022244be95e9c Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 22:26:05 +0000 Subject: [PATCH 4/9] Mention getting the RFC accepted --- src/2026/stabilize-cargo-sbom.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index bdfd6ea6..31233ae3 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -27,15 +27,17 @@ Inaccurate SBOMs lead to false positives on vulnerability scans and/or complianc ### What we propose to do about it +1. Complete [the RFC](https://github.com/rust-lang/rfcs/pull/3553) for this feature and get it accepted 1. Resolve the already known issue(s) in the Cargo SBOM precursor feature -2. Modify [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) to use the Cargo SBOM precursor as a data source, to prove that it can be used to generate a complete and accurate SBOM in an industry standard format -3. Address any issues that point 2 uncovers in the Cargo SBOM precursor feature -4. Stabilize the MVP that is sufficient to power [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) and [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) +1. Modify [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) to use the Cargo SBOM precursor as a data source, to prove that it can be used to generate a complete and accurate SBOM in an industry standard format +1. Address any issues that point 2 uncovers in the Cargo SBOM precursor feature +1. Stabilize the MVP that is sufficient to power [cargo-cyclonedx](https://crates.io/crates/cargo-cyclonedx) and [cargo-auditable](https://github.com/rust-secure-code/cargo-auditable) ### Work items over the next year | Task | Owner(s) | Notes | | ----------- | -------- | ----- | +| Complete the RFC | @Shnatsel et al. | | | Resolve known issues | @Shnatsel et al. | | | convert cargo-cyclonedx to use the SBOM precursor | @Shnatsel et al. | outside the Rust Project repositories, no Rust Project mentorship needed | | Resolve newly uncovered issues | @Shnatsel et al. | | From 49432fa678fc962dda27d1d9dcc1b28f3b13d6ab Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 22:32:18 +0000 Subject: [PATCH 5/9] Move tracking issue to "other tracking issues" to hopefully pass CI --- src/2026/stabilize-cargo-sbom.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index 31233ae3..f3185aa1 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -4,7 +4,8 @@ | :--------------- | -------------------------------------------------------------------------------- | | Point of contact | @Shnatsel | | Status | Proposed for mentorship | -| Tracking issue | https://github.com/rust-lang/cargo/issues/16565 | +| Tracking issue | | +| Other tracking issues | https://github.com/rust-lang/cargo/issues/16565 | | Zulip channel | N/A | ## Summary From 927d01e14b7750da5d4abc13c1a0730b8338e4cd Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Tue, 27 Jan 2026 22:43:36 +0000 Subject: [PATCH 6/9] Bump Team ask to medium to account for RFC process --- src/2026/stabilize-cargo-sbom.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index f3185aa1..5b07c0c2 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -48,11 +48,15 @@ I am in the process of applying for funding for this work, together with collabo ## Team asks -We will need a handful of 30-minute design meetings with someone on the Cargo team, plus guidance on the stabilization process. Not sure if that qualifies as "small" or "medium". +We will need: + + - Guidance to get the RFC finalized and accepted + - A handful of 30-minute design meetings with someone on the Cargo team to guide fixing the implementation issues + - Guidance on the stabilization process | Team | Support level | Notes | | ---------- | ------------- | --------------------------------------- | -| [cargo] | small/medium? | | +| [cargo] | Medium | | ## Frequently asked questions From c77d78cac113e018b6a5e03cf13c9f937fe762d6 Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Thu, 29 Jan 2026 17:38:17 +0000 Subject: [PATCH 7/9] apply review suggestion Co-authored-by: Niko Matsakis --- src/2026/stabilize-cargo-sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index 5b07c0c2..6dd934c6 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -10,7 +10,7 @@ ## Summary -Resolve known issues in Cargo's [SBOM precursor feature](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) and stabilize an MVP (minimal viable product) version of it. +Progress towarrds an MVP version of Cargo SBOM support by resolving known issues in Cargo's [SBOM precursor feature](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) and finalizing the RFC. ## Motivation From d6ccd65b80f3d4b3f195f0653613e942df1c8b9d Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Thu, 29 Jan 2026 17:38:48 +0000 Subject: [PATCH 8/9] apply review suggestion: Cargo champion Co-authored-by: Niko Matsakis --- src/2026/stabilize-cargo-sbom.md | 1 + 1 file changed, 1 insertion(+) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index 6dd934c6..b6d3aef1 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -7,6 +7,7 @@ | Tracking issue | | | Other tracking issues | https://github.com/rust-lang/cargo/issues/16565 | | Zulip channel | N/A | +| [cargo] champion | TBD | ## Summary From c206bd0f3233743161803d0c6a1b22be958cdeba Mon Sep 17 00:00:00 2001 From: "Sergey \"Shnatsel\" Davidoff" Date: Thu, 29 Jan 2026 17:43:22 +0000 Subject: [PATCH 9/9] apply review suggestion: fix typo MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Rémy Rakic --- src/2026/stabilize-cargo-sbom.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/2026/stabilize-cargo-sbom.md b/src/2026/stabilize-cargo-sbom.md index b6d3aef1..e7b56358 100644 --- a/src/2026/stabilize-cargo-sbom.md +++ b/src/2026/stabilize-cargo-sbom.md @@ -11,7 +11,7 @@ ## Summary -Progress towarrds an MVP version of Cargo SBOM support by resolving known issues in Cargo's [SBOM precursor feature](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) and finalizing the RFC. +Progress towards an MVP version of Cargo SBOM support by resolving known issues in Cargo's [SBOM precursor feature](https://doc.rust-lang.org/nightly/cargo/reference/unstable.html#sbom) and finalizing the RFC. ## Motivation