How does Kevlar-CheckDeps differ from cargo-audit?

cargo-audit requires installing cargo-audit binary crates and Rust toolchain compilation. Kevlar-CheckDeps is a zero-dependency CLI that parses Cargo.lock TOML files natively using Python stdlib and batch queries Google OSV DB.

Do I need cargo or rustc installed to audit Cargo.lock?

No. Kevlar-CheckDeps parses static Cargo.lock TOML files directly without compiling crates or needing Rust installed.

Can Kevlar-CheckDeps break CI/CD builds for vulnerable Rust crates?

Yes. Kevlar-CheckDeps supports --fail-on-vulns to break GitHub Actions or GitLab CI pipelines upon detecting critical or high vulnerabilities.

⚡ Rust Ecosystem SCA CLI

Rust Dependency Audit CLI: Fast, Zero-Dependency SCA for Cargo

Audit direct and transitive Rust dependencies, detect vulnerabilities in the Google OSV database, and validate Cargo.lock integrity—without compiling crates or API keys.

$ python kevlar.py --tech rust --path ./my-rust-app --all --vuls

Cargo (`Cargo.lock`) Crates Manifest (`Cargo.toml`)

bash - kevlar-checkdeps (rust)

user@devsecops ~/my-rust-app

$ python kevlar.py --tech rust --path . --all --vuls

[INFO] Detected Ecosystem: Rust (Cargo)

[INFO] Reading Cargo.lock & Cargo.toml...

[INFO] Checking 78 crates against Google OSV DB...

[INFO] Validating SHA-256 crate checksums...

[OK] Checked: 78 crates in 0.72s. 0 Vulns Found.

Status: ✅ PASS

The Problem with Traditional SCA Tools in Rust

Why do tools like cargo-audit require compiling binary binaries inside lightweight CI runners?

Traditional Tools

(cargo-audit / cargo-deny)

Limitations

Requires Crate Compilation

Requires installing cargo-audit via cargo install, forcing slow crate compilation in CI pipelines.

Kevlar-CheckDeps

(Rust Audit)

Solution

Zero Compilation Required

Executes standalone via Python stdlib, parsing Cargo.lock TOML files directly.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive Rust dependencies querying Google OSV DB:

Scan Command:


                                        $ python kevlar.py --tech rust --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:


                                            $ python kevlar.py --tech rust --path ./ --all --vuls --output report.html

Report SARIF:


                                            $ python kevlar.py --tech rust --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:


                                        $ python kevlar.py --tech rust --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Frequently Asked Questions (FAQ)

Quick answers to common questions about Rust dependency auditing.