# Rust

What licenseal reads in a Cargo project. The rules that hold for every ecosystem are under [How a scan works](<https://licenseal.shcherbak.ai/concepts/index.md>).

- **Registry:** crates.io
- **Manifests:** `Cargo.toml` (`[dependencies]`, `[dev-dependencies]`, `[build-dependencies]`, `[target.<cfg>.*]`, `[workspace.dependencies]` via `workspace = true` references)
- **Lockfiles:** `Cargo.lock`

## What is read

With a `Cargo.lock`, the locked graph is reported as it is.

## Dev dependencies

`[dev-dependencies]` are dev dependencies. `[build-dependencies]` are production.

## Off-registry dependencies

These are reported as [off-registry dependencies](<https://licenseal.shcherbak.ai/concepts/off-registry/index.md>):

- a `git = …` dependency;
- a `path = …` the scan does not read;
- a crate that a `[patch]` or `[replace]` entry points at either.

## Not evaluated

- Without a `Cargo.lock`, the optional (feature-gated) dependencies of the crates the [registry walk](<https://licenseal.shcherbak.ai/concepts/dependency-resolution/index.md>) visits.
- A path crate that `Cargo.lock` reaches only through another path crate the scan does not read is not reported.
- Cargo's `.cargo/config.toml` is not read: see [What is not read](<https://licenseal.shcherbak.ai/concepts/off-registry/#what-is-not-read>).

## See also

- [Dependency resolution](<https://licenseal.shcherbak.ai/concepts/dependency-resolution/index.md>) and [Versions and estimates](<https://licenseal.shcherbak.ai/concepts/version-resolution/index.md>), which apply to every ecosystem
- [Failed lookups and rate limits](<https://licenseal.shcherbak.ai/concepts/version-resolution/#failed-lookups-and-rate-limits>), for the pace of crates.io requests in a scan without a `Cargo.lock`
- [Network egress](<https://licenseal.shcherbak.ai/security/network/index.md>), for the hosts contacted and what each is asked