rust-supply-chain-attestation

To generate SBOM and SLSA build provenance for a Rust project, you use tools like cargo-cyclonedx for SBOM generation and attest-build-provenance for SLSA evidence. This Skill guides you through configuring these tools to produce the required compliance artifacts.

Required tools for Rust supply chain compliance with OpenSSF frameworks include cargo-deny, cargo-cyclonedx, cargo-auditable, cargo-vet, and OpenSSF Scorecard. This Skill details how to use these dependencies to gather necessary compliance evidence.

You need cargo-deny and cargo-vet for Rust supply chain attestation when asserting dependency integrity and framework compliance. This Skill outlines the specific certification scenarios where these tools provide necessary evidence.

Yes, this guide supports compliance with both NIST SSDF and EU CRA requirements. It maps specific Rust supply chain tools to the evidence needed to satisfy these certification frameworks.

The best way to integrate CycloneDX SBOM generation into a Rust build process is by using cargo-cyclonedx alongside other attestation tools. This Skill provides procedural guidance on combining these tools for comprehensive supply chain integrity.