Integrate with `cargo auditable`?

[thomaseizinger]

Any thoughts on integrating cargo auditable into the build-process? It would be great if more projects would embed their SBOM so vulnerability scanners like trivy can automatically pick that up.

[taiki-e]

I would accept a PR to support this.

[thomaseizinger]

I read through the implementation a bit. Should this be added as another predefined build-tool? Or do you think there is a better way?

[taiki-e]

Build tools other than cross are compatible with cargo-auditable (rust-cross/cargo-zigbuild#192, cross-rs/cross#716), so I think having a separate input option something like auditable: true makes sense.

[thomaseizinger]

Please have a look at #120.