Rust
Review Rust source and binary scanning support in JFrog Xray.
Introduction
JFrog Xray provides security and compliance analysis for Rust applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for Rust.
Capabilities
The following capabilities are available for Rust.
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) | 🔜 |  |
| License Detection | 🔜 | |
| Malicious Package Detection | 🔜 | |
| Operational Risk |  | |
| Smart Remediation | | |
Software Composition Analysis (SCA) isn't currently available for Rust source code scanning. For more information, see Scan Your Source Code.
For how scan methods differ, see Source Scanning Engines and Frogbot Versions.
Supported Files
| Package Manager | Supported Files | Available with |
|---|---|---|
| Cargo | Not supported | Default jf audit |
| Cargo | Cargo.lock – Flat package list, no regular/dev/build distinction | Frogbot V3 |
Dependency Graph
| Package Manager | Dependency Graph |
|---|---|
| Cargo | Flat – Features not tracked, no dependency graph |
Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see Scan Your Binaries.
Supported Files
The following files are supported for Rust binary scanning.
| Package Manager | Supported Files |
|---|---|
| Cargo | Crate packages and compiled Rust binaries |
Additional Information
- Binary scanning is the primary method for Rust SCA analysis.
- Frogbot V3 will add dependency extraction from
Cargo.lockfor software bill of materials (SBOM) visibility.
Related Topics
Updated 26 days ago