Skip to content

Use cargo auditable to include SBOM in uv builds#18276

Merged
zanieb merged 2 commits intomainfrom
zb/cargo-auditable
Mar 6, 2026
Merged

Use cargo auditable to include SBOM in uv builds#18276
zanieb merged 2 commits intomainfrom
zb/cargo-auditable

Conversation

@zanieb
Copy link
Member

@zanieb zanieb commented Mar 3, 2026 •
edited
Loading

Inspired by #18252

This required an upstream change rust-secure-code/cargo-auditable#245 which is now released.

This increases binary sizes slightly, ~4KB.

The cargo wrapper implementation will be extended in #18280 to code sign binaries.

zanieb
zanieb commented Mar 3, 2026
View reviewed changes
zanieb
zanieb commented Mar 3, 2026
View reviewed changes
zanieb
zanieb commented Mar 3, 2026
View reviewed changes
@zanieb zanieb temporarily deployed to uv-test-publish March 3, 2026 21:51 — with GitHub Actions Inactive
@zanieb zanieb temporarily deployed to uv-test-publish March 3, 2026 22:15 — with GitHub Actions Inactive
@zanieb zanieb force-pushed the zb/cargo-auditable branch 7 times, most recently from 18af0b2 to 49125e3 Compare March 4, 2026 16:14
@zanieb
Embed SBOM in release binaries via cargo-auditable
355fe05 
Use `cargo auditable` instead of plain `cargo` for release builds, embedding
dependency metadata (SBOM) into every compiled binary.

- Add `scripts/cargo.sh` and `scripts/cargo.cmd` wrappers that invoke
  `cargo auditable` and set `CARGO` env var in the release workflow
- Add `scripts/install-cargo-extensions.sh` to install `cargo-auditable`,
  building a static musl binary on x86_64 Linux containers
- Add `scripts/check-release-artifact-sboms.sh` to verify all release
  artifacts contain SBOM data
- Pass `CARGO` env var into Docker containers via `docker-options`
@zanieb zanieb force-pushed the zb/cargo-auditable branch from 49125e3 to 355fe05 Compare March 4, 2026 16:15
@zanieb zanieb marked this pull request as ready for review March 4, 2026 17:58
zanieb
zanieb commented Mar 4, 2026
View reviewed changes
scripts/check-release-artifact-sboms.sh
@@ -0,0 +1,91 @@
#!/usr/bin/env bash
## Verify that all release artifacts contain cargo-auditable SBOM data.
Copy link
Member Author

@zanieb zanieb Mar 4, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I used this to test that this pull request was working as intended

@zanieb zanieb mentioned this pull request Mar 5, 2026
Draft
@zanieb zanieb requested review from Gankra, konstin and woodruffw March 5, 2026 12:23
charliermarsh
charliermarsh reviewed Mar 6, 2026
View reviewed changes
Copy link
Member

@charliermarsh charliermarsh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where does the SBOM go exactly?

@zanieb
Copy link
Member Author

zanieb commented Mar 6, 2026 •
edited
Loading

It's embedded as a JSON blob in a linker section in the top of the binary which can be read by various tools https://github.com/rust-secure-code/cargo-auditable?tab=readme-ov-file#vulnerability-reporting

https://github.com/rust-secure-code/cargo-auditable/blob/master/PARSING.md is helpful for understanding the embedding

We're using this in our Docker artifacts in which case it's embedded in the binary, then read by syft, then included in an image-level SBOM that lives in a registry. I presume other consumers would something similar.

@charliermarsh
Copy link
Member

charliermarsh commented Mar 6, 2026

Ahh I see. Partly asking because I believe there is an SBOMs directory for wheels: https://peps.python.org/pep-0770/#reserving-the-dist-info-sboms-directory

@zanieb
Copy link
Member Author

zanieb commented Mar 6, 2026

Yeah I'm not sure what the best way to populate the wheel standard data would be yet, this does not do so.

@zanieb
Copy link
Member Author

zanieb commented Mar 6, 2026

Maturin is actually already populating that with a cyclonedx SBOM as of a recent uv release. See #18173

Gankra
Gankra approved these changes Mar 6, 2026
View reviewed changes
Copy link
Contributor

@Gankra Gankra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I continue to have a vague feeling that this kind of thing better belongs as features upstream in maturin but that also sucks in a different way.

Do we also want the trampoline binaries SBOM'd? Does that even make sense?

@zanieb
Copy link
Member Author

zanieb commented Mar 6, 2026

That's a good question... I guess we probably do? I can open an issue to track that.

@zanieb zanieb merged commit 9345450 into main Mar 6, 2026
137 checks passed
@zanieb zanieb deleted the zb/cargo-auditable branch March 6, 2026 17:38
@zanieb zanieb mentioned this pull request Mar 6, 2026
Open
@BrewTestBot BrewTestBot mentioned this pull request Mar 7, 2026
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Mar 11, 2026
build(deps): update uv to v0.10.9
a8a79c7 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [uv](https://github.com/astral-sh/uv) | patch | `0.10.7` → `0.10.9` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>astral-sh/uv (uv)</summary>

### [`v0.10.9`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0109)

[Compare Source](astral-sh/uv@0.10.8...0.10.9)

Released on 2026-03-06.

##### Enhancements

- Add `fbgemm-gpu`, `fbgemm-gpu-genai`, `torchrec`, and `torchtune` to the PyTorch list ([#&#8203;18338](astral-sh/uv#18338))
- Add torchcodec to PyTorch List ([#&#8203;18336](astral-sh/uv#18336))
- Log the duration we took before erroring ([#&#8203;18231](astral-sh/uv#18231))
- Warn when using `uv_build` settings without `uv_build` ([#&#8203;15750](astral-sh/uv#15750))
- Add fallback to `/usr/lib/os-release` on Linux system lookup failure ([#&#8203;18349](astral-sh/uv#18349))
- Use `cargo auditable` to include SBOM in uv builds ([#&#8203;18276](astral-sh/uv#18276))

##### Configuration

- Add an environment variable for `UV_VENV_RELOCATABLE` ([#&#8203;18331](astral-sh/uv#18331))

##### Performance

- Avoid toml `Document` overhead ([#&#8203;18306](astral-sh/uv#18306))
- Use a single global workspace cache ([#&#8203;18307](astral-sh/uv#18307))

##### Bug fixes

- Continue on trampoline job assignment failures ([#&#8203;18291](astral-sh/uv#18291))
- Handle the hard link limit gracefully instead of failing ([#&#8203;17699](astral-sh/uv#17699))
- Respect build constraints for workspace members ([#&#8203;18350](astral-sh/uv#18350))
- Revalidate editables and other dependencies in scripts ([#&#8203;18328](astral-sh/uv#18328))
- Support Python 3.13+ on Android ([#&#8203;18301](astral-sh/uv#18301))
- Support `cp3-none-any` ([#&#8203;17064](astral-sh/uv#17064))
- Skip tool environments with broken links to Python on Windows ([#&#8203;17176](astral-sh/uv#17176))

##### Documentation

- Add documentation for common marker values ([#&#8203;18327](astral-sh/uv#18327))
- Improve documentation on virtual dependencies ([#&#8203;18346](astral-sh/uv#18346))

### [`v0.10.8`](https://github.com/astral-sh/uv/blob/HEAD/CHANGELOG.md#0108)

[Compare Source](astral-sh/uv@0.10.7...0.10.8)

Released on 2026-03-03.

##### Python

- Add CPython 3.10.20
- Add CPython 3.11.15
- Add CPython 3.12.13

##### Enhancements

- Add Docker images based on Docker Hardened Images ([#&#8203;18247](astral-sh/uv#18247))
- Add resolver hint when `--exclude-newer` filters out all versions of a package ([#&#8203;18217](astral-sh/uv#18217))
- Configure a real retry minimum delay of 1s ([#&#8203;18201](astral-sh/uv#18201))
- Expand `uv_build` direct build compatibility ([#&#8203;17902](astral-sh/uv#17902))
- Fetch CPython from an Astral mirror by default ([#&#8203;18207](astral-sh/uv#18207))
- Download uv releases from an Astral mirror in installers by default ([#&#8203;18191](astral-sh/uv#18191))
- Add SBOM attestations to Docker images ([#&#8203;18252](astral-sh/uv#18252))
- Improve hint for installing meson-python when missing as build backend ([#&#8203;15826](astral-sh/uv#15826))

##### Configuration

- Add `UV_INIT_BARE` environment variable for `uv init` ([#&#8203;18210](astral-sh/uv#18210))

##### Bug fixes

- Prevent `uv tool upgrade` from installing excluded dependencies ([#&#8203;18022](astral-sh/uv#18022))
- Promote authentication policy when saving tool receipts ([#&#8203;18246](astral-sh/uv#18246))
- Respect exclusions in scripts ([#&#8203;18269](astral-sh/uv#18269))
- Retain default-branch Git SHAs in `pylock.toml` files ([#&#8203;18227](astral-sh/uv#18227))
- Skip installed Python check for URL dependencies ([#&#8203;18211](astral-sh/uv#18211))
- Respect constraints during `--upgrade` ([#&#8203;18226](astral-sh/uv#18226))
- Fix `uv tree` orphaned roots and premature deduplication ([#&#8203;17212](astral-sh/uv#17212))

##### Documentation

- Mention cooldown and tweak inline script metadata in dependency bots documentation ([#&#8203;18230](astral-sh/uv#18230))
- Move cache prune in GitLab to `after_script` ([#&#8203;18206](astral-sh/uv#18206))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My40OS4wIiwidXBkYXRlZEluVmVyIjoiNDMuNTcuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90IiwiYXV0b21hdGlvbjpib3QtYXV0aG9yZWQiLCJkZXBlbmRlbmN5LXR5cGU6OnBhdGNoIl19-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@charliermarsh charliermarsh charliermarsh left review comments

@Gankra Gankra Gankra approved these changes

@konstin konstin Awaiting requested review from konstin

@woodruffw woodruffw Awaiting requested review from woodruffw

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@zanieb @charliermarsh @Gankra