Feature Request: Generate BOM from cargo-auditable embedded dependency information

[cyclonedx]

Feature Request: Generate BOM from cargo-auditable embedded dependency information

[amy-keibler]

Thanks for the feature request! I looked at cargo-auditable previously, but I didn't see that auditable-info existed.

I'm curious what your thoughts are on the potential usecases? If it is intended to scan a binary that has been provided by a third party, my initial thought is that it would probably make sense for us to create a different CLI tool from cargo-cyclonedx for that purpose. We'd probably be able to fetch information from crates.io to fill in the package metadata, such as license information that doesn't appear to be embedded in the binary, but there are probably fields that the user would have to supply via command line parameters or via a file format for convenience.

[taladar]

The use-case for me would be to scan binaries compiled in the past before our CI jobs included cargo-cyclonedx, specifically for some binaries which no longer compile due to yanked crates.