community/*: build with cargo-auditable

this allows auditing the dependencies embedded in the cargo-built
binaries with cargo audit, to track potential vulnerabilities in the
used crates.

142 files changed, 439 insertions, 390 deletions

diff --git a/community/acme-redirect/APKBUILD b/community/acme-redirect/APKBUILD
index 2d3738655eb..3765197ecd5 100644
--- a/community/acme-redirect/APKBUILD
+++ b/community/acme-redirect/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=acme-redirect
 pkgver=0.6.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Tiny http daemon that answers acme challenges and redirects everything else to https"
 url="https://github.com/kpcyrd/acme-redirect"
 # ppc64le and s390x and riscv64 blocked by ring crate
@@ -10,6 +10,7 @@ arch="all !ppc64le !s390x !riscv64"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	openssl-dev>3
 	scdoc
 	"
@@ -25,7 +26,7 @@ source="$pkgname-$pkgver.tar.gz::https://github.com/kpcyrd/acme-redirect/archive
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 
 	mkdir -p completions
 	"target/release/acme-redirect" completions bash > completions/acme-redirect.bash
diff --git a/community/acmed/APKBUILD b/community/acmed/APKBUILD
index 24310b7588c..28e6ab979b7 100644
--- a/community/acmed/APKBUILD
+++ b/community/acmed/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Patrycja Rosa <alpine@ptrcnull.me>
 pkgname=acmed
 pkgver=0.21.0
-pkgrel=2
+pkgrel=3
 pkgdesc="ACME (RFC 8555) client daemon"
 url="https://github.com/breard-r/acmed"
 # s390x, riscv64: blocked by cargo
@@ -10,7 +10,7 @@ arch="all !s390x !riscv64"
 license="MIT"
 pkgusers="acmed"
 pkggroups="acmed"
-makedepends="cargo openssl-dev>3"
+makedepends="cargo openssl-dev>3 cargo-auditable"
 subpackages="$pkgname-doc $pkgname-openrc $pkgname-tacd $pkgname-tacd-doc:tacd_doc"
 install="acmed.pre-install"
 source="https://github.com/breard-r/acmed/archive/refs/tags/v$pkgver/acmed-$pkgver.tar.gz
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/alacritty/APKBUILD b/community/alacritty/APKBUILD
index 5beaddc5d99..a83259e81ed 100644
--- a/community/alacritty/APKBUILD
+++ b/community/alacritty/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Sören Tempel <soeren+alpine@soeren-tempel.net>
 pkgname=alacritty
 pkgver=0.12.0
-pkgrel=1
+pkgrel=2
 pkgdesc="cross-platform, GPU-accelerated terminal emulator"
 url="https://github.com/alacritty/alacritty"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le" # limited by rust/cargo
@@ -10,14 +10,15 @@ license="Apache-2.0"
 # libxi and libcursor are both loaded via dlopen by x11-rs crate.
 depends="ncurses-terminfo-base wayland-libs-egl libxi libxcursor"
 makedepends="
-	rust
 	cargo
+	cargo-auditable
 	cmake
 	fontconfig-dev
 	freetype-dev
-	libxkbcommon-dev
 	libxcb-dev
+	libxkbcommon-dev
 	python3
+	rust
 	"
 subpackages="
 	$pkgname-doc
@@ -31,7 +32,7 @@ source="$pkgname-$pkgver.tar.gz::https://github.com/alacritty/alacritty/archive/
 export CARGO_HOME="$srcdir"/cargo
 
 build() {
-	cargo build --release --verbose
+	cargo auditable build --release --verbose
 }
 
 check() {
diff --git a/community/arti/APKBUILD b/community/arti/APKBUILD
index 3366da6ddbe..adc96e67f68 100644
--- a/community/arti/APKBUILD
+++ b/community/arti/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=arti
 pkgver=1.1.4
-pkgrel=0
+pkgrel=1
 pkgdesc="An implementation of Tor, in Rust"
 url="https://docs.rs/arti/latest/arti/"
 license="GPL-3.0-or-later"
 # ppc64le & s390x blocked by ring crate
 arch="all !ppc64le !s390x !riscv64"
-makedepends="cargo openssl-dev>3 sqlite-dev zstd-dev xz-dev"
+makedepends="cargo openssl-dev>3 sqlite-dev zstd-dev xz-dev cargo-auditable"
 subpackages="$pkgname-doc"
 source="$pkgname-$pkgver.tar.gz::https://gitlab.torproject.org/tpo/core/arti/-/archive/arti-v$pkgver/arti-arti-v$pkgver.tar.gz"
 builddir="$srcdir/$pkgname-$pkgname-v$pkgver"
@@ -20,7 +20,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/asfa/APKBUILD b/community/asfa/APKBUILD
index 0ec511356f8..963ffb8672b 100644
--- a/community/asfa/APKBUILD
+++ b/community/asfa/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=asfa
 pkgver=0.9.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Share files by uploading via SSH and generating a non-guessable link"
 url="https://github.com/obreitwi/asfa"
 # s390x: build failure
@@ -10,6 +10,7 @@ arch="all !s390x"
 license="MIT OR Apache-2.0"
 makedepends="
 	cargo
+	cargo-auditable
 	libssh2-dev
 	openssl-dev>3
 	"
@@ -30,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/atuin/APKBUILD b/community/atuin/APKBUILD
index 3e48e04ecb3..589eeae0f0c 100644
--- a/community/atuin/APKBUILD
+++ b/community/atuin/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=atuin
 pkgver=14.0.1
-pkgrel=0
+pkgrel=1
 # Keep in sync with sqlx version in Cargo.lock.
 _sqlx_ver=0.6.2
 pkgdesc="Magical shell history"
@@ -13,6 +13,7 @@ arch="all !armhf !riscv64 !s390x"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	clang-dev
 	jq
 	libsodium-dev
@@ -78,15 +79,15 @@ prepare() {
 
 build() {
 	msg2 'Building server'
-	cargo build --frozen --release --no-default-features --features server
+	cargo auditable build --frozen --release --no-default-features --features server
 	mv target/release/atuin target/release/atuin-server
 
 	msg2 'Building client with sync'
-	cargo build --frozen --release --no-default-features --features client,sync
+	cargo auditable build --frozen --release --no-default-features --features client,sync
 	mv target/release/atuin target/release/atuin-sync
 
 	msg2 'Building client without sync'
-	cargo build --frozen --release --no-default-features --features client
+	cargo auditable build --frozen --release --no-default-features --features client
 
 	mkdir -p comp
 	local shell; for shell in bash fish zsh; do
diff --git a/community/b3sum/APKBUILD b/community/b3sum/APKBUILD
index 60940731ee8..9b304f23cd9 100644
--- a/community/b3sum/APKBUILD
+++ b/community/b3sum/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=b3sum
 pkgver=1.3.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Command line implementation of the BLAKE3 hash function"
 url="https://blake3.io"
 arch="all !s390x !riscv64"
 license="CC0-1.0 OR Apache-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="b3sum-$pkgver.tar.gz::https://crates.io/api/v1/crates/b3sum/$pkgver/download"
 
 case "$CARCH" in
@@ -28,7 +28,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen ${_features:+--features $_features}
+	cargo auditable build --release --frozen ${_features:+--features $_features}
 }
 
 check() {
diff --git a/community/bandwhich/APKBUILD b/community/bandwhich/APKBUILD
index ba9c1e0ea3b..b24f46ec257 100644
--- a/community/bandwhich/APKBUILD
+++ b/community/bandwhich/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Anjandev Momi <anjan@momi.ca>
 pkgname=bandwhich
 pkgver=0.20.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Terminal bandwidth utilization tool"
 url="https://github.com/imsnif/bandwhich"
 # s390x and riscv64 blocked by cargo/rust
 arch="all !s390x !riscv64"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/imsnif/bandwhich/archive/$pkgver/$pkgname-$pkgver.tar.gz
 	update-socket2.patch
 	"
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/bat/APKBUILD b/community/bat/APKBUILD
index 233212315b4..aaea6b33d82 100644
--- a/community/bat/APKBUILD
+++ b/community/bat/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=bat
 pkgver=0.23.0
-pkgrel=1
+pkgrel=2
 pkgdesc="cat(1) clone with wings"
 url="https://github.com/sharkdp/bat"
 # s390x: nix crate fails to build
@@ -12,6 +12,7 @@ license="Apache-2.0"
 depends="less" # Required for RAW-CONTROL-CHARS
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	oniguruma-dev
 	"
@@ -38,7 +39,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/below/APKBUILD b/community/below/APKBUILD
index cb4a14d6518..17246624a54 100644
--- a/community/below/APKBUILD
+++ b/community/below/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=below
 pkgver=0.6.3
-pkgrel=1
+pkgrel=2
 pkgdesc="A time traveling resource monitor for modern Linux systems"
 url="https://github.com/facebookincubator/below"
 # riscv64: blocked by cargo
@@ -12,6 +12,7 @@ license="Apache-2.0"
 # NOTE: libbpf-cargo requires rustfmt
 makedepends="
 	cargo
+	cargo-auditable
 	clang
 	libbpf-dev
 	rustfmt
@@ -48,7 +49,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 
 	mkdir -p target/completion
 	local sh; for sh in bash fish zsh; do
diff --git a/community/bottom/APKBUILD b/community/bottom/APKBUILD
index caade8092b7..25d052f37c5 100644
--- a/community/bottom/APKBUILD
+++ b/community/bottom/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: guddaff <guddaff@protonmail.com>
 pkgname=bottom
 pkgver=0.9.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Graphical process/system monitor with a customizable interface"
 url="https://github.com/ClementTsang/bottom"
 # s390x: fails to build nix crate
 arch="all !s390x"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-fish-completion
 	$pkgname-bash-completion
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	BTM_GENERATE=true cargo build --frozen --release
+	BTM_GENERATE=true cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/broot/APKBUILD b/community/broot/APKBUILD
index 2eb16fffd7f..a2719c2209d 100644
--- a/community/broot/APKBUILD
+++ b/community/broot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=broot
 pkgver=1.21.3
-pkgrel=0
+pkgrel=1
 pkgdesc="New way to see and navigate directory trees"
 url="https://github.com/Canop/broot"
 # riscv64: TODO
@@ -11,6 +11,7 @@ arch="all !riscv64 !s390x"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	libxcb-dev
 	"
@@ -37,7 +38,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/bupstash/APKBUILD b/community/bupstash/APKBUILD
index 9e435dfe3ad..b289baba03d 100644
--- a/community/bupstash/APKBUILD
+++ b/community/bupstash/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Drew DeVault <sir@cmpwn.com>
 pkgname=bupstash
 pkgver=0.12.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Easy and efficient encrypted backups"
 url="https://bupstash.io/"
 # armhf,armv7,x86: sodium bindgen test fails
@@ -11,6 +11,7 @@ arch="all !armhf !armv7 !s390x !x86"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	libsodium-dev
 	lz4-dev
 	sqlite-dev
@@ -46,7 +47,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/cargo-audit/APKBUILD b/community/cargo-audit/APKBUILD
index 5f1732e8e49..39123ecd16d 100644
--- a/community/cargo-audit/APKBUILD
+++ b/community/cargo-audit/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=cargo-audit
 pkgver=0.17.6
-pkgrel=0
+pkgrel=1
 pkgdesc="Audit Cargo.lock for crates with security vulnerabilities"
 url="https://github.com/RustSec/rustsec"
 # s390x, ppc64le, riscv64: blocked by ring crate
 arch="all !s390x !ppc64le !riscv64"
 license="MIT OR Apache-2.0"
-makedepends="cargo libgit2-dev openssl-dev>3"
+makedepends="cargo libgit2-dev openssl-dev>3 cargo-auditable"
 subpackages="$pkgname-doc"
 options="net"
 source="$pkgname-$pkgver.tar.gz::https://github.com/RustSec/cargo-audit/archive/cargo-audit/v$pkgver.tar.gz"
@@ -30,7 +30,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen --features fix
+	cargo auditable build --release --frozen --features fix
 }
 
 check() {
diff --git a/community/cargo-bloat/APKBUILD b/community/cargo-bloat/APKBUILD
index afe4b532c85..a3c95dfff83 100644
--- a/community/cargo-bloat/APKBUILD
+++ b/community/cargo-bloat/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=cargo-bloat
 pkgver=0.11.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Find out what takes most of the space in your Rust executable"
 url="https://github.com/RazrFalcon/cargo-bloat"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="MIT"
-depends="cargo"
+depends="cargo cargo-auditable"
 source="https://github.com/RazrFalcon/cargo-bloat/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
 
 _cargo_opts="--frozen --features regex-filter"
@@ -19,7 +19,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release $_cargo_opts
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/cargo-c/APKBUILD b/community/cargo-c/APKBUILD
index 5c70d863212..b6ced67e822 100644
--- a/community/cargo-c/APKBUILD
+++ b/community/cargo-c/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Oleg Titov <oleg.titov@gmail.com>
 pkgname=cargo-c
 pkgver=0.9.19
-pkgrel=0
+pkgrel=1
 pkgdesc="cargo subcommand to build and install C-ABI compatibile dynamic and static libraries"
 url="https://github.com/lu-zero/cargo-c"
 arch="all"
@@ -10,6 +10,7 @@ license="MIT"
 # nghttp2-sys doesn't support system
 makedepends="
 	cargo
+	cargo-auditable
 	curl-dev
 	libgit2-dev
 	libssh2-dev
@@ -38,7 +39,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/cargo-edit/APKBUILD b/community/cargo-edit/APKBUILD
index 367f3ead57c..52765588d64 100644
--- a/community/cargo-edit/APKBUILD
+++ b/community/cargo-edit/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=cargo-edit
 pkgver=0.11.9
-pkgrel=1
+pkgrel=2
 pkgdesc="Managing cargo dependencies from the command line"
 url="https://github.com/killercup/cargo-edit"
 # s390x, ppc64le, riscv64: blocked by ring crate
@@ -10,6 +10,7 @@ arch="all !s390x !ppc64le !riscv64"
 license="MIT OR Apache-2.0"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	libssh2-dev
 	openssl-dev>3
@@ -32,7 +33,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release $_cargo_opts
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/cargo-gra/APKBUILD b/community/cargo-gra/APKBUILD
index c25465dec33..0db81c38eea 100644
--- a/community/cargo-gra/APKBUILD
+++ b/community/cargo-gra/APKBUILD
@@ -7,7 +7,7 @@ pkgdesc="gtk-rust-app CLI for building Flatpak apps with ease"
 url="https://gitlab.com/floers/cargo-gra"
 arch="all !s390x" # not interested in debugging issues on s390x
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://gitlab.com/floers/cargo-gra/-/archive/v$pkgver/cargo-gra-v$pkgver.tar.gz"
 builddir="$srcdir/$pkgname-v$pkgver"
 options="!check" # Tests fail
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/cargo-license/APKBUILD b/community/cargo-license/APKBUILD
index 435fce34cfa..58afb81b854 100644
--- a/community/cargo-license/APKBUILD
+++ b/community/cargo-license/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=cargo-license
 pkgver=0.5.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Cargo subcommand to see license of dependencies"
 url="https://github.com/onur/cargo-license"
 arch="all !s390x !riscv64" # rust
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://crates.io/api/v1/crates/cargo-license/$pkgver/download"
 
 
@@ -17,7 +17,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/cargo-make/APKBUILD b/community/cargo-make/APKBUILD
index afd30079467..43760d92d5f 100644
--- a/community/cargo-make/APKBUILD
+++ b/community/cargo-make/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=cargo-make
 pkgver=0.36.7
-pkgrel=0
+pkgrel=1
 pkgdesc="Rust task runner and build tool"
 url="https://github.com/sagiegurari/cargo-make"
 # riscv64: TODO
 # s390x: fails to build nix crate
 arch="all !riscv64 !s390x"
 license="Apache-2.0"
-makedepends="cargo openssl-dev"
+makedepends="cargo openssl-dev cargo-auditable"
 subpackages="$pkgname-bash-completion"
 source="https://github.com/sagiegurari/cargo-make/archive/$pkgver/cargo-make-$pkgver.tar.gz"
 options="!check"  # FIXME: some tests are broken
@@ -24,7 +24,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/cargo-nextest/APKBUILD b/community/cargo-nextest/APKBUILD
index 7e79312e6f2..e5f1dec5d36 100644
--- a/community/cargo-nextest/APKBUILD
+++ b/community/cargo-nextest/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=cargo-nextest
 pkgver=0.9.49
-pkgrel=0
+pkgrel=1
 pkgdesc="A next-generation test runner for Rust"
 url="https://nexte.st/"
 # s390x, ppc64le: no ring crate
@@ -11,6 +11,7 @@ license="Apache-2.0 OR MIT"
 depends="cargo"
 makedepends="
 	cargo
+	cargo-auditable
 	zstd-dev
 	"
 source="https://github.com/nextest-rs/nextest/archive/$pkgname-$pkgver.tar.gz"
@@ -41,11 +42,11 @@ prepare() {
 }
 
 build() {
-	cargo build -p cargo-nextest $_cargo_opts --release
+	cargo auditable build -p cargo-nextest $_cargo_opts --release
 }
 
 check() {
-	cargo build -p nextest-runner --bin passthrough --frozen
+	cargo auditable build -p nextest-runner --bin passthrough --frozen
 	PATH="$PWD/target/release:$PWD/target/debug:$PATH" cargo nextest run $_cargo_opts
 }
 
diff --git a/community/cargo-outdated/APKBUILD b/community/cargo-outdated/APKBUILD
index 88f8b7e44f9..e5ede871135 100644
--- a/community/cargo-outdated/APKBUILD
+++ b/community/cargo-outdated/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=cargo-outdated
 pkgver=0.11.2
-pkgrel=1
+pkgrel=2
 pkgdesc="A cargo subcommand for displaying when Rust dependencies are out of date"
 url="https://github.com/kbknapp/cargo-outdated"
 arch="all"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	curl-dev
 	libgit2-dev
 	libssh2-dev
@@ -34,7 +35,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/cargo-release/APKBUILD b/community/cargo-release/APKBUILD
index a9f5aeef388..90cc668af01 100644
--- a/community/cargo-release/APKBUILD
+++ b/community/cargo-release/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=cargo-release
 pkgver=0.24.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Everything about releasing a rust crate"
 url="https://github.com/crate-ci/cargo-release"
 license="MIT OR Apache-2.0"
 arch="all"
-makedepends="cargo libgit2-dev openssl-dev"
+makedepends="cargo libgit2-dev openssl-dev cargo-auditable"
 source="https://github.com/crate-ci/cargo-release/archive/v$pkgver/cargo-release-$pkgver.tar.gz"
 options="net" # fetch dependencies
 
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release --no-default-features
+	cargo auditable build --frozen --release --no-default-features
 }
 
 check() {
diff --git a/community/cargo-watch/APKBUILD b/community/cargo-watch/APKBUILD
index f26bcbfe628..60bc05eee2f 100644
--- a/community/cargo-watch/APKBUILD
+++ b/community/cargo-watch/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=cargo-watch
 pkgver=8.4.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Utility for Cargo to compile projects when sources change"
 url="https://github.com/watchexec/cargo-watch"
 # s390x and riscv64 blocked by cargo
 arch="all !s390x !riscv64"
 license="CC0-1.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-zsh-completion
@@ -24,7 +24,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/cbindgen/APKBUILD b/community/cbindgen/APKBUILD
index 052968f82c8..30a18896caf 100644
--- a/community/cbindgen/APKBUILD
+++ b/community/cbindgen/APKBUILD
@@ -5,12 +5,12 @@ pkgname=cbindgen
 # Please be VERY careful bumping this - Firefox regularly fails to build
 # with new versions!
 pkgver=0.24.3
-pkgrel=2
+pkgrel=3
 pkgdesc="Tool to generate C bindings from Rust code"
 url="https://github.com/eqrion/cbindgen"
 arch="all"
 license="MPL-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 checkdepends="cython"
 source="$pkgname-$pkgver.tar.gz::https://crates.io/api/v1/crates/cbindgen/$pkgver/download"
 options="net"
@@ -28,7 +28,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/choose/APKBUILD b/community/choose/APKBUILD
index 5c1ab5eec8f..821d1338073 100644
--- a/community/choose/APKBUILD
+++ b/community/choose/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=choose
 pkgver=1.3.4
-pkgrel=2
+pkgrel=3
 pkgdesc="A human-friendly and fast alternative to cut and (sometimes) awk"
 url="https://github.com/theryangeary/choose"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/theryangeary/choose/archive/v$pkgver/choose-$pkgver.tar.gz"
 
 prepare() {
@@ -17,7 +17,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/cjdns/APKBUILD b/community/cjdns/APKBUILD
index bd78b03f884..554075aaf3d 100644
--- a/community/cjdns/APKBUILD
+++ b/community/cjdns/APKBUILD
@@ -3,13 +3,14 @@
 # Contributor: Bartłomiej Piotrowski <bpiotrowski@alpinelinux.org>
 pkgname=cjdns
 pkgver=22
-pkgrel=2
+pkgrel=3
 pkgdesc="A routing engine designed for security, scalability, speed and ease of use"
 url="https://github.com/cjdelisle/cjdns"
 arch="all !s390x !ppc64le !riscv64"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	linux-headers
 	nodejs
 	"
@@ -28,7 +29,7 @@ prepare() {
 
 build() {
 	export CJDNS_RELEASE_VERSION="$pkgver"
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/committed/APKBUILD b/community/committed/APKBUILD
index 3fb313e74b1..93102919805 100644
--- a/community/committed/APKBUILD
+++ b/community/committed/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=committed
 pkgver=1.0.17
-pkgrel=0
+pkgrel=1
 pkgdesc="Nitpicking your commit history"
 url="https://github.com/crate-ci/committed"
 license="MIT OR Apache-2.0"
 arch="all"
-makedepends="cargo libgit2-dev"
+makedepends="cargo libgit2-dev cargo-auditable"
 source="https://github.com/crate-ci/committed/archive/v$pkgver/committed-$pkgver.tar.gz"
 options="net" # fetch dependencies
 
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/connman-resolvconf/APKBUILD b/community/connman-resolvconf/APKBUILD
index d58eafb23c0..bd581ea5b07 100644
--- a/community/connman-resolvconf/APKBUILD
+++ b/community/connman-resolvconf/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=connman-resolvconf
 pkgver=0.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc="ConnMan integration with resolvconf(8)"
 url="https://github.com/jirutka/connman-resolvconf"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # blocked by rust/cargo
@@ -12,7 +12,7 @@ depends="
 	connman
 	dbus
 	"
-makedepends="cargo dbus-dev"
+makedepends="cargo dbus-dev cargo-auditable"
 subpackages="$pkgname-openrc"
 source="https://github.com/jirutka/connman-resolvconf/archive/v$pkgver/connman-resolvconf-$pkgver.tar.gz"
 options="!check"  # no tests provided
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/csview/APKBUILD b/community/csview/APKBUILD
index facb078a859..9a652660f3e 100644
--- a/community/csview/APKBUILD
+++ b/community/csview/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=csview
 pkgver=1.2.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Pretty csv viewer for cli with cjk/emoji support"
 url="https://github.com/wfxr/csview"
 arch="all"
 license="Apache-2.0 OR MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/czkawka/APKBUILD b/community/czkawka/APKBUILD
index b50c949670e..55735ec6c31 100644
--- a/community/czkawka/APKBUILD
+++ b/community/czkawka/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=czkawka
 pkgver=4.1.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Multi functional app to find duplicates, empty folders, similar images etc. (CLI)"
 url="https://github.com/qarmin/czkawka"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
@@ -11,6 +11,7 @@ makedepends="
 	alsa-lib-dev
 	bzip2-dev
 	cargo
+	cargo-auditable
 	gtk+3.0-dev
 	"
 subpackages="$pkgname-gui $pkgname-doc"
@@ -26,7 +27,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/delta/APKBUILD b/community/delta/APKBUILD
index 5ce89eb0bce..33d379f7055 100644
--- a/community/delta/APKBUILD
+++ b/community/delta/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Aleks Bunin <alpinelinux@compuix.com>
 pkgname=delta
 pkgver=0.15.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Syntax-highlighting pager for git and diff output"
 url="https://github.com/dandavison/delta"
 license="MIT"
 arch="all !s390x !riscv64" # limited by rust/cargo
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	oniguruma-dev
 	"
@@ -27,7 +28,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/diffsitter/APKBUILD b/community/diffsitter/APKBUILD
index eae3b38936e..e7818684c21 100644
--- a/community/diffsitter/APKBUILD
+++ b/community/diffsitter/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=diffsitter
 pkgver=0.7.3
-pkgrel=0
+pkgrel=1
 pkgdesc="A tree-sitter based AST difftool to get meaningful semantic diffs"
 url="https://github.com/afnanenayet/diffsitter"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # limited by rust/cargo
@@ -11,7 +11,7 @@ checkdepends="
 	tree-sitter-python
 	tree-sitter-rust
 	"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.post-install"
 subpackages="
 	$pkgname-bash-completion
@@ -33,7 +33,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 
 	mkdir -p comp
 	local shell; for shell in bash fish zsh; do
diff --git a/community/difftastic/APKBUILD b/community/difftastic/APKBUILD
index 988b1e5fd6f..b293dd97008 100644
--- a/community/difftastic/APKBUILD
+++ b/community/difftastic/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=difftastic
 pkgver=0.46.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Diff tool that understands syntax"
 url="https://difftastic.wilfred.me.uk/"
 license="MIT"
 arch="all !s390x !riscv64" # blocked by rust/cargo
-makedepends="cargo openssl-dev"
+makedepends="cargo openssl-dev cargo-auditable"
 source="https://github.com/Wilfred/difftastic/archive/$pkgver/difftastic-$pkgver.tar.gz"
 
 
@@ -17,7 +17,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/display-switch/APKBUILD b/community/display-switch/APKBUILD
index e3c0aae7d4a..df098f5c096 100644
--- a/community/display-switch/APKBUILD
+++ b/community/display-switch/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Clayton Craft <clayton@craftyguy.net>
 pkgname=display-switch
 pkgver=1.2.0
-pkgrel=2
+pkgrel=3
 pkgdesc="utility for switching displays over DDC/CI on USB disconnect/connect events"
 url="https://github.com/haimgel/display-switch"
 arch="all !s390x !riscv64"  # no rust
 license="MIT"
-makedepends="cargo eudev-dev libusb-dev"
+makedepends="cargo eudev-dev libusb-dev cargo-auditable"
 install="$pkgname.pre-install"
 source="
 	$pkgname-$pkgver.tar.gz::https://github.com/haimgel/display-switch/archive/$pkgver.tar.gz
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/docuum/APKBUILD b/community/docuum/APKBUILD
index 3f094750c55..f3c2788f52a 100644
--- a/community/docuum/APKBUILD
+++ b/community/docuum/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=docuum
 pkgver=0.22.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Perform least recently used (LRU) eviction of Docker images"
 url="https://github.com/stepchowfun/docuum"
 # riscv64: rust is broken on this arch
 arch="all !riscv64"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.pre-install"
 subpackages="$pkgname-openrc"
 source="https://github.com/stepchowfun/docuum/archive/v$pkgver/docuum-$pkgver.tar.gz
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/dog/APKBUILD b/community/dog/APKBUILD
index e38e6300dbb..adcf2db4b65 100644
--- a/community/dog/APKBUILD
+++ b/community/dog/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: omni <omni@gitlab.alpinelinux.org>
 pkgname=dog
 pkgver=0.1.0
-pkgrel=3
+pkgrel=4
 pkgdesc="dog is a command-line DNS client"
 url="https://github.com/ogham/dog"
 arch="x86_64 armv7 armhf aarch64 ppc64le x86"
 license="EUPL-1.2"
-makedepends="cargo openssl-dev"
+makedepends="cargo openssl-dev cargo-auditable"
 subpackages="$pkgname-doc"
 source="$pkgname-$pkgver.tar.gz::https://github.com/ogham/dog/archive/v$pkgver.tar.gz
 	openssl3.patch
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/dssim/APKBUILD b/community/dssim/APKBUILD
index 33e29b8f3df..c2aa488c2cd 100644
--- a/community/dssim/APKBUILD
+++ b/community/dssim/APKBUILD
@@ -2,18 +2,18 @@
 # Maintainer: Adam Jensen <adam@acj.sh>
 pkgname=dssim
 pkgver=3.2.3
-pkgrel=1
+pkgrel=2
 pkgdesc="Tool for image similarity comparison, simulating human perception"
 url="https://kornel.ski/dssim"
 arch="all !s390x !riscv64" # limited by rust/cargo
 arch="$arch !ppc64le !armv7 !armhf" # Tries to compile mozjpeg-sys with 'with_simd'
 license="AGPL-3.0-only"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://github.com/kornelski/dssim/archive/$pkgver.tar.gz"
 
 
 build() {
-	cargo build --release
+	cargo auditable build --release
 }
 
 check() {
diff --git a/community/dua/APKBUILD b/community/dua/APKBUILD
index c02e3c36338..b9a37dad4fd 100644
--- a/community/dua/APKBUILD
+++ b/community/dua/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=dua
 pkgver=2.20.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Tool to conveniently learn about the usage of disk space"
 url="https://github.com/Byron/dua-cli"
 license="MIT"
 arch="all"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/Byron/dua-cli/archive/v$pkgver/dua-$pkgver.tar.gz"
 builddir="$srcdir/dua-cli-$pkgver"
 options="net" # fetch dependencies
@@ -23,7 +23,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/duckscript/APKBUILD b/community/duckscript/APKBUILD
index fae3b7934a3..ca5c9367361 100644
--- a/community/duckscript/APKBUILD
+++ b/community/duckscript/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=duckscript
 pkgver=0.8.18
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple, extendable and embeddable scripting language"
 url="https://sagiegurari.github.io/duckscript/"
 arch="all"
@@ -10,6 +10,7 @@ license="Apache-2.0"
 makedepends="
 	bzip2-dev
 	cargo
+	cargo-auditable
 	openssl-dev
 	zlib-dev
 	"
@@ -34,7 +35,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/dummyhttp/APKBUILD b/community/dummyhttp/APKBUILD
index 30db157d189..78beee06033 100644
--- a/community/dummyhttp/APKBUILD
+++ b/community/dummyhttp/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=dummyhttp
 pkgver=1.0.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Super simple HTTP server that replies a fixed body with a fixed response code"
 url="https://github.com/svenstaro/dummyhttp"
 license="MIT"
 arch="all !s390x !riscv64" # limited by rust/cargo
 arch="$arch !ppc64le" # fails to build ring crate
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	./target/release/dummyhttp --print-manpage > $pkgname.1
 
diff --git a/community/dust/APKBUILD b/community/dust/APKBUILD
index 555292413c8..10bce27e5f1 100644
--- a/community/dust/APKBUILD
+++ b/community/dust/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=dust
 pkgver=0.8.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A more intuitive version of du in Rust"
 url="https://github.com/bootandy/dust"
 # riscv64: rust broken
 arch="all !riscv64"
 license="Apache-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 options="net"
 source="https://github.com/bootandy/dust/archive/v$pkgver/dust-$pkgver.tar.gz"
 
@@ -24,7 +24,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/electrs/APKBUILD b/community/electrs/APKBUILD
index 0b94e410685..13a20c8bdb0 100644
--- a/community/electrs/APKBUILD
+++ b/community/electrs/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Adamski <michal@ert.pl>
 pkgname=electrs
 pkgver=0.9.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Efficient re-implementation of Electrum Server in Rust"
 url="https://github.com/romanz/electrs"
 license="MIT"
 arch="all !s390x !riscv64" # limited by rust/cargo
-makedepends="cargo rocksdb-dev<7.10 clang15-libclang"
+makedepends="cargo rocksdb-dev<7.10 clang15-libclang cargo-auditable"
 source="https://github.com/romanz/electrs/archive/v$pkgver/electrs-$pkgver.tar.gz
 	10-rocksdb.patch
 	11-rocksdb-locked.patch
@@ -16,7 +16,7 @@ source="https://github.com/romanz/electrs/archive/v$pkgver/electrs-$pkgver.tar.g
 
 
 build() {
-	ROCKSDB_INCLUDE_DIR=/usr/include ROCKSDB_LIB_DIR=/usr/lib cargo build --all --features "metrics_process" --release --locked
+	ROCKSDB_INCLUDE_DIR=/usr/include ROCKSDB_LIB_DIR=/usr/lib cargo auditable build --all --features "metrics_process" --release --locked
 }
 
 check() {
diff --git a/community/exa/APKBUILD b/community/exa/APKBUILD
index 2f3a0bb0a2e..f737b59f1af 100644
--- a/community/exa/APKBUILD
+++ b/community/exa/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=exa
 pkgver=0.10.1
-pkgrel=5
+pkgrel=6
 pkgdesc="ls replacement written in Rust"
 url="https://the.exa.website/"
 # riscv64: doesn't build
 arch="all !riscv64"
 license="MIT"
-makedepends="cargo zlib-dev libgit2-dev"
+makedepends="cargo zlib-dev libgit2-dev cargo-auditable"
 subpackages="$pkgname-doc
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/fclones/APKBUILD b/community/fclones/APKBUILD
index 4ea0995eadc..4d9b008ab51 100644
--- a/community/fclones/APKBUILD
+++ b/community/fclones/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=fclones
 pkgver=0.30.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Efficient duplicate file finder"
 url="https://github.com/pkolaczk/fclones"
 license="MIT"
 arch="all !s390x !riscv64" # blocked by rust/cargo
 arch="$arch !armhf !armv7 !x86 !ppc64le" # tests fail
-makedepends="cargo eudev-dev"
+makedepends="cargo eudev-dev cargo-auditable"
 source="https://github.com/pkolaczk/fclones/archive/v$pkgver/fclones-$pkgver.tar.gz
 	musl-fix.patch
 	"
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/fd/APKBUILD b/community/fd/APKBUILD
index 277e781cf24..31f1fa6b5e1 100644
--- a/community/fd/APKBUILD
+++ b/community/fd/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=fd
 pkgver=8.7.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Simple, fast, user-friendly alternative to find"
 url="https://github.com/sharkdp/fd"
 # s390x: fails to build nix crate
 arch="all !s390x"
 license="MIT Apache-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 checkdepends="coreutils"
 options="net"
 subpackages="
@@ -33,11 +33,11 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 	make completions
 
 	# Rebuild without completions (-0.9 MiB).
-	cargo build --frozen --release --no-default-features --features use-jemalloc
+	cargo auditable build --frozen --release --no-default-features --features use-jemalloc
 }
 
 check() {
diff --git a/community/fisher/APKBUILD b/community/fisher/APKBUILD
index 63c8a819f14..37f3fc6582d 100644
--- a/community/fisher/APKBUILD
+++ b/community/fisher/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=fisher
 pkgver=1.0.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Simple yet powerful webhooks catcher"
 url="https://github.com/pietroalbini/fisher"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.pre-install"
 subpackages="$pkgname-openrc"
 source="https://github.com/pietroalbini/$pkgname/archive/v$pkgver/$pkgname-$pkgver.tar.gz
@@ -27,7 +27,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/garage/APKBUILD b/community/garage/APKBUILD
index a4b03749950..8bb2ec86645 100644
--- a/community/garage/APKBUILD
+++ b/community/garage/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=garage
 pkgver=0.8.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Lightweight S3-compatible distributed object store"
 url="https://garagehq.deuxfleurs.fr"
 # armhf,armv7,x86: fails to build (std::bad_alloc)
@@ -11,6 +11,7 @@ arch="all !armhf !armv7 !x86 !riscv64"
 license="AGPL-3.0"
 makedepends="
 	cargo
+	cargo-auditable
 	libsodium-dev
 	protoc
 	sqlite-dev
@@ -52,8 +53,8 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
-	cargo build -p garage_db --bin convert --features cli,lmdb,sqlite --frozen --release
+	cargo auditable build $_cargo_opts --release
+	cargo auditable build -p garage_db --bin convert --features cli,lmdb,sqlite --frozen --release
 }
 
 check() {
diff --git a/community/gfold/APKBUILD b/community/gfold/APKBUILD
index e07994052f5..09adafdce3f 100644
--- a/community/gfold/APKBUILD
+++ b/community/gfold/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=gfold
 pkgver=4.3.3
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI tool to help keep track of Git repositories"
 url="https://github.com/nickgerace/gfold"
 license="Apache-2.0"
 arch="all !s390x !riscv64" # blocked by rust/cargo
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/nickgerace/gfold/archive/$pkgver/gfold-$pkgver.tar.gz"
 
 
@@ -18,7 +18,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/gifski/APKBUILD b/community/gifski/APKBUILD
index 7faec3b571c..b4e3c20f0e5 100644
--- a/community/gifski/APKBUILD
+++ b/community/gifski/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=gifski
 pkgver=1.11.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Highest-quality GIF encoder based on pngquant"
 url="https://gif.ski/"
 license="AGPL-3.0-or-later"
 arch="all"
-makedepends="cargo clang15-dev ffmpeg-dev"
+makedepends="cargo clang15-dev ffmpeg-dev cargo-auditable"
 source="https://github.com/ImageOptim/gifski/archive/$pkgver/gifski-$pkgver.tar.gz"
 
 case "$CARCH" in
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release $_features
+	cargo auditable build --frozen --release $_features
 }
 
 check() {
diff --git a/community/git-branchless/APKBUILD b/community/git-branchless/APKBUILD
index 13a8655b743..f66eb3ab89c 100644
--- a/community/git-branchless/APKBUILD
+++ b/community/git-branchless/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=git-branchless
 pkgver=0.7.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Suite of tools to help you visualize, navigate, manipulate, and repair your commit graph"
 url="https://github.com/arxanas/git-branchless"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # blocked by rust/cargo
 license="GPL-2.0-only"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	libssh2-dev
 	openssl-dev>3
@@ -31,7 +32,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/git-cliff/APKBUILD b/community/git-cliff/APKBUILD
index 57c4a7aa395..b823ac0bd30 100644
--- a/community/git-cliff/APKBUILD
+++ b/community/git-cliff/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Orhun Parmaksız <orhunparmaksiz@gmail.com>
 pkgname=git-cliff
 pkgver=1.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A highly customizable changelog generator"
 url="https://github.com/orhun/git-cliff"
 # s390x, ppc64le, riscv64: blocked by ring crate
@@ -10,6 +10,7 @@ arch="all !s390x !ppc64le !riscv64"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	"
 subpackages="
@@ -29,7 +30,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 	mkdir -p man
 	OUT_DIR=man/ "./target/release/$pkgname-mangen"
 	mkdir -p completions
diff --git a/community/git-interactive-rebase-tool/APKBUILD b/community/git-interactive-rebase-tool/APKBUILD
index 4cd24ecd1f6..da04e224c33 100644
--- a/community/git-interactive-rebase-tool/APKBUILD
+++ b/community/git-interactive-rebase-tool/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=git-interactive-rebase-tool
 pkgver=2.2.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A terminal based sequence editor for interactive rebase"
 url="https://gitrebasetool.mitmaro.ca"
 arch="all !s390x !riscv64" # limited by rust/cargo
 license="GPL-3.0-or-later"
-makedepends="cargo libgit2-dev zlib-dev"
+makedepends="cargo libgit2-dev zlib-dev cargo-auditable"
 subpackages="$pkgname-doc"
 source="https://github.com/MitMaro/git-interactive-rebase-tool/archive/$pkgver/$pkgname-$pkgver.tar.gz"
 
@@ -20,7 +20,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/git-metafile/APKBUILD b/community/git-metafile/APKBUILD
index 4457332c6ad..06aa9e44680 100644
--- a/community/git-metafile/APKBUILD
+++ b/community/git-metafile/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=git-metafile
 pkgver=0.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Store and restore files metadata in a git repository"
 url="https://github.com/jirutka/git-metafile"
 # ppc64le, s390x - fails to build
 arch="all !ppc64le !s390x"
 license="MIT"
 depends="git"
-makedepends="cargo rust"
+makedepends="cargo rust cargo-auditable"
 source="https://github.com/jirutka/git-metafile/archive/v$pkgver/git-metafile-$pkgver.tar.gz
 	post-checkout
 	pre-commit
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/git-warp-time/APKBUILD b/community/git-warp-time/APKBUILD
index 6d3ab6ad8b8..79284978da6 100644
--- a/community/git-warp-time/APKBUILD
+++ b/community/git-warp-time/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=git-warp-time
 pkgver=0.4.10
-pkgrel=0
+pkgrel=1
 pkgdesc="Reset timestamps of Git repository files to the time of the last modifying commit"
 url="https://github.com/alerque/git-warp-time"
 license="GPL-3.0-only"
 arch="all !s390x !riscv64" # blocked by rust/cargo
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="$pkgname-bash-completion $pkgname-fish-completion $pkgname-zsh-completion"
 source="https://github.com/alerque/git-warp-time/archive/v$pkgver/git-warp-time-$pkgver.tar.gz"
 
@@ -19,7 +19,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/gitui/APKBUILD b/community/gitui/APKBUILD
index 1e0b5589006..d0306c8c3c2 100644
--- a/community/gitui/APKBUILD
+++ b/community/gitui/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=gitui
 pkgver=0.22.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Blazing fast terminal client for git"
 url="https://github.com/extrawurst/gitui"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	oniguruma-dev
 	openssl-dev
@@ -29,7 +30,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/gpg-tui/APKBUILD b/community/gpg-tui/APKBUILD
index cb7cc782527..c2036023e82 100644
--- a/community/gpg-tui/APKBUILD
+++ b/community/gpg-tui/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Orhun Parmaksız <orhunparmaksiz@gmail.com>
 pkgname=gpg-tui
 pkgver=0.9.5
-pkgrel=1
+pkgrel=2
 pkgdesc="Terminal user interface for GnuPG"
 url="https://github.com/orhun/gpg-tui"
 license="MIT"
 arch="all !s390x" # FTBFS
-makedepends="cargo gpgme-dev libxcb-dev libxkbcommon-dev libgpg-error-dev"
+makedepends="cargo gpgme-dev libxcb-dev libxkbcommon-dev libgpg-error-dev cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -24,7 +24,7 @@ riscv64)
 esac
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 
 	mkdir completions
 	OUT_DIR=completions cargo run --release --bin gpg-tui-completions
diff --git a/community/gping/APKBUILD b/community/gping/APKBUILD
index 058e188035f..6b9efc9576b 100644
--- a/community/gping/APKBUILD
+++ b/community/gping/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=gping
 pkgver=1.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Ping, but with a graph"
 url="https://github.com/orf/gping"
 license="MIT"
 arch="all"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/orf/gping/archive/gping-v$pkgver/gping-$pkgver.tar.gz"
 builddir="$srcdir/gping-gping-v$pkgver"
 
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/greetd-tuigreet/APKBUILD b/community/greetd-tuigreet/APKBUILD
index d11a312b49b..cacf4c346b9 100644
--- a/community/greetd-tuigreet/APKBUILD
+++ b/community/greetd-tuigreet/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=greetd-tuigreet
 _projname=tuigreet
 pkgver=0.8.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Graphical console greeter for greetd"
 url="https://github.com/apognu/tuigreet"
 # riscv64: blocked by cargo
@@ -11,7 +11,7 @@ url="https://github.com/apognu/tuigreet"
 arch="all !riscv64 !s390x"
 license="GPL-3.0"
 depends="greetd"
-makedepends="cargo scdoc"
+makedepends="cargo scdoc cargo-auditable"
 pkgusers="greetd"
 subpackages="$pkgname-doc"
 source="https://github.com/apognu/tuigreet/archive/$pkgver/tuigreet-$pkgver.tar.gz"
@@ -27,7 +27,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 
 	scdoc < contrib/man/tuigreet-1.scd > contrib/man/tuigreet.1
 }
diff --git a/community/greetd/APKBUILD b/community/greetd/APKBUILD
index 66a282ec234..1c2da0f9d77 100644
--- a/community/greetd/APKBUILD
+++ b/community/greetd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Sean McAvoy <seanmcavoy@gmail.com>
 pkgname=greetd
 pkgver=0.9.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Minimal and flexible login manager daemon"
 url="https://git.sr.ht/~kennylevinsen/greetd"
 # riscv64: blocked by cargo
@@ -11,6 +11,7 @@ arch="all !s390x !riscv64"
 license="GPL-3.0-only"
 makedepends="
 	cargo
+	cargo-auditable
 	linux-pam-dev
 	scdoc
 	"
@@ -38,7 +39,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 	make -C man
 }
 
diff --git a/community/handlr/APKBUILD b/community/handlr/APKBUILD
index 417d072e7ea..81d936cad6b 100644
--- a/community/handlr/APKBUILD
+++ b/community/handlr/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=handlr
 pkgver=0.6.4
-pkgrel=2
+pkgrel=3
 pkgdesc="A better xdg-utils - manage mimeapps.list and default applications with ease"
 url="https://github.com/chmln/handlr"
 # riscv64: build failure in libc crate
 arch="all !riscv64"
 license="MIT"
 depends="shared-mime-info"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="$pkgname-fish-completion $pkgname-zsh-completion"
 source="https://github.com/chmln/handlr/archive/v$pkgver/handlr-$pkgver.tar.gz
 	$pkgname-fix-crash-on-readonly-mimeapps-list.patch::https://github.com/chmln/handlr/commit/a782886f05191c1834404d777e74d00f9fa60f7e.patch
@@ -24,7 +24,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/helix/APKBUILD b/community/helix/APKBUILD
index e6450a5f1bf..e9c17779a22 100644
--- a/community/helix/APKBUILD
+++ b/community/helix/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=helix
 pkgver=23.03
-pkgrel=2
+pkgrel=3
 pkgdesc="A post-modern modal text editor"
 url="https://helix-editor.com/"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64" # blocked by rust/cargo
 license="MPL-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 checkdepends="tree-sitter-rust tree-sitter-ruby"
 options="net"
 install="$pkgname.post-install"
@@ -38,7 +38,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/hexyl/APKBUILD b/community/hexyl/APKBUILD
index 7f772a175af..49528a5890e 100644
--- a/community/hexyl/APKBUILD
+++ b/community/hexyl/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=hexyl
 pkgver=0.13.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Command-line hex viewer with colored output"
 url="https://github.com/sharkdp/hexyl"
 license="MIT OR Apache-2.0"
 arch="all"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/sharkdp/hexyl/archive/v$pkgver/hexyl-$pkgver.tar.gz"
 options="net" # fetch dependencies
 
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/himalaya/APKBUILD b/community/himalaya/APKBUILD
index 049b15e2924..6b7f595a9af 100644
--- a/community/himalaya/APKBUILD
+++ b/community/himalaya/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=himalaya
 pkgver=0.7.3
-pkgrel=1
+pkgrel=2
 pkgdesc="CLI email client"
 url="https://github.com/soywod/himalaya"
 license="MIT"
 arch="all !ppc64le !riscv64 !s390x" # fails to build ring crate
-makedepends="cargo openssl-dev sqlite-dev"
+makedepends="cargo openssl-dev sqlite-dev cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -28,7 +28,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen $_features
+	cargo auditable build --release --frozen $_features
 
 	./target/release/himalaya man man-pages
 
diff --git a/community/hkdm/APKBUILD b/community/hkdm/APKBUILD
index 7865cc66c48..329e912cb51 100644
--- a/community/hkdm/APKBUILD
+++ b/community/hkdm/APKBUILD
@@ -2,7 +2,7 @@
 
 pkgname=hkdm
 pkgver=0.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Lighter-weight hotkey daemon"
 url="https://gitlab.com/postmarketOS/hkdm"
 arch="all !s390x" # s390x: fails to build
@@ -10,7 +10,7 @@ license="GPL-3.0-only"
 source="https://gitlab.com/postmarketOS/hkdm/-/archive/$pkgver/hkdm-$pkgver.tar.gz
 	hkdm.openrc
 	hkdm.conf"
-makedepends="cargo libevdev-dev"
+makedepends="cargo libevdev-dev cargo-auditable"
 _cargo_opts="--frozen --no-default-features"
 
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/httm/APKBUILD b/community/httm/APKBUILD
index 1ed5e432ade..a63bfefde20 100644
--- a/community/httm/APKBUILD
+++ b/community/httm/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=httm
 pkgver=0.26.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Interactive, file-level Time Machine-like tool for ZFS/btrfs"
 url="https://github.com/kimono-koans/httm"
 # riscv64: TODO
 # s390x: fails to build nix crate
 arch="all !riscv64 !s390x"
 license="MPL-2.0"
-makedepends="cargo acl-dev"
+makedepends="cargo acl-dev cargo-auditable"
 subpackages="$pkgname-doc"
 source="https://github.com/kimono-koans/httm/archive/refs/tags/$pkgver/httm-$pkgver.tar.gz"
 options="!check"  # no tests provided
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release --features acls
+	cargo auditable build --frozen --release --features acls
 }
 
 package() {
diff --git a/community/hyperfine/APKBUILD b/community/hyperfine/APKBUILD
index 91d66eac4c3..b9540426edd 100644
--- a/community/hyperfine/APKBUILD
+++ b/community/hyperfine/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=hyperfine
 pkgver=1.16.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Command-line benchmarking tool"
 url="https://github.com/sharkdp/hyperfine"
 # s390x: nix statfs broken with musl
 arch="all !s390x"
 license="Apache-2.0 AND MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -32,7 +32,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/image-roll/APKBUILD b/community/image-roll/APKBUILD
index 0d0c706aa3c..aaae7879ec3 100644
--- a/community/image-roll/APKBUILD
+++ b/community/image-roll/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=image-roll
 pkgver=2.1.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Simple and fast GTK image viewer with basic image manipulation tools"
 url="https://github.com/weclaw1/image-roll"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="MIT"
-makedepends="cargo gtk4.0-dev"
+makedepends="cargo gtk4.0-dev cargo-auditable"
 source="https://github.com/weclaw1/image-roll/archive/$pkgver/image-roll-$pkgver.tar.gz"
 options="!check"  # no tests provided
 
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release --no-default-features  # w/o wallpaper
+	cargo auditable build --frozen --release --no-default-features  # w/o wallpaper
 }
 
 package() {
diff --git a/community/ion-shell/APKBUILD b/community/ion-shell/APKBUILD
index ce71092900f..cdc7d8fbfd2 100644
--- a/community/ion-shell/APKBUILD
+++ b/community/ion-shell/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=ion-shell
 pkgver=1.0.5_git20220727
-pkgrel=0
+pkgrel=1
 _commit=fc153ac4e83d879ab70208c5452faae2e7d69b6b
 pkgdesc="modern system shell with simple, yet powerful, syntax"
 url="https://doc.redox-os.org/ion-manual/"
 arch="all !s390x !riscv64" # s390x blocked by nix crate
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.post-install $pkgname.post-upgrade $pkgname.pre-deinstall"
 source="$pkgname-$_commit.tar.gz::https://gitlab.redox-os.org/redox-os/ion/-/archive/$_commit.tar.gz"
 builddir="$srcdir/ion-$_commit"
@@ -20,7 +20,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/jless/APKBUILD b/community/jless/APKBUILD
index 568f1305b6d..4e19c3cd170 100644
--- a/community/jless/APKBUILD
+++ b/community/jless/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Kevin Daudt <kdaudt@alpinelinux.org>
 pkgname=jless
 pkgver=0.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="command-line pager for JSON data"
 url="https://pauljuliusmartinez.github.io/"
 # riscv64, s390x: rust missing
@@ -10,7 +10,7 @@ url="https://pauljuliusmartinez.github.io/"
 arch="all !riscv64 !s390x"
 options="net"
 license="MIT"
-makedepends="rust cargo python3 libxcb-dev"
+makedepends="rust cargo python3 libxcb-dev cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://github.com/PaulJuliusMartinez/jless/archive/refs/tags/v$pkgver.tar.gz"
 
 
@@ -31,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/jp/APKBUILD b/community/jp/APKBUILD
index 7ad7a44b419..6a1b895d5dd 100644
--- a/community/jp/APKBUILD
+++ b/community/jp/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=jp
 pkgver=0.3.0
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI for JMESPath query language for JSON (Rust implementation)"
 url="https://github.com/jmespath/jmespath.rs"
 arch="all"
 license="MIT"
 provides="jmespath=$pkgver-r$pkgrel"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/jmespath/jmespath.rs/archive/$pkgver/jmespath.rs-$pkgver.tar.gz
 	Cargo.lock
 	"
@@ -29,7 +29,7 @@ prepare() {
 }
 
 build() {
-	cargo build -p jmespath-cli --frozen --release
+	cargo auditable build -p jmespath-cli --frozen --release
 }
 
 check() {
diff --git a/community/jql/APKBUILD b/community/jql/APKBUILD
index 8269322b576..955c1889942 100644
--- a/community/jql/APKBUILD
+++ b/community/jql/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=jql
 pkgver=6.0.7
-pkgrel=0
+pkgrel=1
 pkgdesc="A JSON Query Language CLI tool"
 url="https://github.com/yamafaktory/jql"
 arch="all"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/yamafaktory/jql/archive/jql-v$pkgver.tar.gz"
 options="net" # fetch dependencies
 builddir="$srcdir/jql-jql-v$pkgver"
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/just/APKBUILD b/community/just/APKBUILD
index 9f70eac7c11..69f5476f3b3 100644
--- a/community/just/APKBUILD
+++ b/community/just/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=just
 pkgver=1.13.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Just a command runner"
 url="https://github.com/casey/just"
 # riscv64: rust currently broken on this arch
@@ -10,7 +10,7 @@ url="https://github.com/casey/just"
 arch="all !riscv64 !s390x"
 license="CC0-1.0"
 checkdepends="bash fzf"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -28,7 +28,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/karlender/APKBUILD b/community/karlender/APKBUILD
index 4d25439fe65..f8199a358b6 100644
--- a/community/karlender/APKBUILD
+++ b/community/karlender/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Newbyte <newbie13xd@gmail.com>
 pkgname=karlender
 pkgver=0.9.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Mobile friendly GTK based calendar app written in Rust"
 url="https://gitlab.com/floers/karlender"
 # ppc64le: build script for dependency ring 0.16.20 fails
@@ -12,6 +12,7 @@ arch="all !ppc64le !riscv64 !s390x"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	cargo-gra
 	libadwaita-dev
 	"
@@ -29,7 +30,7 @@ prepare() {
 
 build() {
 	cargo gra gen
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 package() {
diff --git a/community/keepassxc-proxy-static/APKBUILD b/community/keepassxc-proxy-static/APKBUILD
index eb58f7816a3..595abbd37be 100644
--- a/community/keepassxc-proxy-static/APKBUILD
+++ b/community/keepassxc-proxy-static/APKBUILD
@@ -3,13 +3,13 @@
 pkgname=keepassxc-proxy-static
 _projname=keepassxc-proxy-rust
 pkgver=0.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A statically linked proxy between Native Messaging browser extension and KeePassXC (for use with Flatpak)"
 url="https://github.com/varjolintu/keepassxc-proxy-rust"
 # armhf, armv7, riscv64, s390x: fails to build libc crate (SIGSEGV)
 arch="all !armhf !armv7 !riscv64 !s390x"
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.post-install"
 source="https://github.com/varjolintu/keepassxc-proxy-rust/archive/$pkgver/$_projname-$pkgver.tar.gz
 	keepassxc-proxy-install.in
@@ -29,7 +29,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/kibi/APKBUILD b/community/kibi/APKBUILD
index 9853a4e6fb4..4d982d8695a 100644
--- a/community/kibi/APKBUILD
+++ b/community/kibi/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=kibi
 pkgver=0.2.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Text editor in ≤1024 lines of code, written in Rust"
 url="https://github.com/ilai-deutel/kibi"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le"  # limited by rust/cargo
 license="( Apache-2.0 OR MIT ) AND BSD-2-Clause"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/ilai-deutel/kibi/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
 
 prepare() {
@@ -17,7 +17,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/kmon/APKBUILD b/community/kmon/APKBUILD
index b78d16cbb44..7d2420e205c 100644
--- a/community/kmon/APKBUILD
+++ b/community/kmon/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=kmon
 pkgver=1.6.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux Kernel Manager and Activity Monitor"
 arch="all !s390x !riscv64" # limited by cargo
 url="https://kmon.cli.rs/"
 license="GPL-3.0-or-later"
 depends="kmod util-linux-misc" # dmesg
-makedepends="cargo python3 libxcb-dev"
+makedepends="cargo python3 libxcb-dev cargo-auditable"
 subpackages="$pkgname-doc
 	$pkgname-bash-completion $pkgname-fish-completion $pkgname-zsh-completion
 	"
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/krapslog/APKBUILD b/community/krapslog/APKBUILD
index 15a84a0ba8b..c904c2b524a 100644
--- a/community/krapslog/APKBUILD
+++ b/community/krapslog/APKBUILD
@@ -2,19 +2,19 @@
 # Maintainer: Adam Jensen <adam@acj.sh>
 pkgname=krapslog
 pkgver=0.5.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Tool for visualizing log file volume as sparklines in your terminal"
 url="https://github.com/acj/krapslog-rs"
 arch="all"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-rs-$pkgver.tar.gz::https://github.com/acj/krapslog-rs/archive/$pkgver.tar.gz"
 builddir="$srcdir/$pkgname-rs-$pkgver"
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 }
 
 check() {
diff --git a/community/lfs/APKBUILD b/community/lfs/APKBUILD
index a88a45708b1..890221b6e4c 100644
--- a/community/lfs/APKBUILD
+++ b/community/lfs/APKBUILD
@@ -2,18 +2,18 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=lfs
 pkgver=2.6.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Get information on your mounted disks"
 url="https://github.com/Canop/lfs"
 license="MIT"
 arch="all"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/Canop/lfs/archive/v$pkgver/lfs-$pkgver.tar.gz"
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 }
 
 check() {
diff --git a/community/lightdm-mobile-greeter/APKBUILD b/community/lightdm-mobile-greeter/APKBUILD
index b3a91f77497..9f8fd331977 100644
--- a/community/lightdm-mobile-greeter/APKBUILD
+++ b/community/lightdm-mobile-greeter/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Raatty <me@raatty.club>
 pkgname=lightdm-mobile-greeter
 pkgver=6
-pkgrel=1
+pkgrel=2
 pkgdesc="A simple lightdm greeter for mobile"
 url="https://git.raatty.club/raatty/lightdm-mobile-greeter"
 arch="x86_64 armv7 armhf aarch64 x86 ppc64le" # thats all rust is build for
 license="MIT"
-makedepends="cargo libhandy-dev lightdm-dev"
+makedepends="cargo libhandy-dev lightdm-dev cargo-auditable"
 source="$pkgname-$pkgver-2.tar.gz::https://git.raatty.club/raatty/lightdm-mobile-greeter/archive/$pkgver.tar.gz
 	lock.patch
 	"
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 package() {
diff --git a/community/mandown/APKBUILD b/community/mandown/APKBUILD
index 467c51177c4..ac5f6d067c6 100644
--- a/community/mandown/APKBUILD
+++ b/community/mandown/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=mandown
 pkgver=0.1.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Create man pages from markdown markup"
 url="https://gitlab.com/kornelski/mandown"
 license="Apache-2.0"
 # riscv64: found textrels
 arch="all !riscv64"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://gitlab.com/kornelski/mandown/-/archive/$pkgver/mandown-$pkgver.tar.gz
 	cargo-lock.patch
 	"
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/mcfly/APKBUILD b/community/mcfly/APKBUILD
index e97dfcfb0f3..3ce6ca0b123 100644
--- a/community/mcfly/APKBUILD
+++ b/community/mcfly/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=mcfly
 pkgver=0.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Fly through your shell history"
 url="https://github.com/cantino/mcfly"
 arch="all"
 license="MIT"
-makedepends="cargo sqlite-dev"
+makedepends="cargo sqlite-dev cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -34,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/mdbook/APKBUILD b/community/mdbook/APKBUILD
index 2047fe1d0cc..95da3d92011 100644
--- a/community/mdbook/APKBUILD
+++ b/community/mdbook/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: crapStone <crapstone01@gmail.com>
 pkgname=mdbook
 pkgver=0.4.29
-pkgrel=0
+pkgrel=1
 pkgdesc="mdBook is a utility to create modern online books from Markdown files"
 url="https://rust-lang.github.io/mdBook/"
 arch="all"
 license="MPL-2.0"
-makedepends="rust cargo"
+makedepends="rust cargo cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -23,7 +23,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	./target/release/mdbook completions bash > $pkgname.bash
 	./target/release/mdbook completions fish > $pkgname.fish
diff --git a/community/meilisearch/APKBUILD b/community/meilisearch/APKBUILD
index 18e67d627eb..3bc08b5fbf7 100644
--- a/community/meilisearch/APKBUILD
+++ b/community/meilisearch/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=meilisearch
 pkgver=1.1.1
-pkgrel=2
+pkgrel=3
 pkgdesc="A lightning-fast search engine that fits into your apps, websites and workflow"
 url="https://www.meilisearch.com/"
 # ppc64le, riscv64, s390x: fails to build ring crate
@@ -12,6 +12,7 @@ license="MIT"
 depends="ca-certificates"
 makedepends="
 	cargo
+	cargo-auditable
 	libgit2-dev
 	mimalloc2-dev
 	"
@@ -75,7 +76,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/mercurial/APKBUILD b/community/mercurial/APKBUILD
index 1eecd79454d..a1b99420a00 100644
--- a/community/mercurial/APKBUILD
+++ b/community/mercurial/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=mercurial
 pkgver=6.4.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Scalable distributed SCM tool"
 url="https://www.mercurial-scm.org/"
 arch="all"
 license="GPL-2.0-or-later"
 depends="python3"
 makedepends="
+	cargo-auditable
 	gettext-dev
 	py3-gpep517
 	py3-setuptools
@@ -75,7 +76,7 @@ build() {
 
 	if [ "$HGWITHRUSTEXT" = "cpython" ]; then
 		cd rust/chg
-		cargo build --release --frozen
+		cargo auditable build --release --frozen
 	fi
 }
 
diff --git a/community/miniserve/APKBUILD b/community/miniserve/APKBUILD
index 69966b1389c..8a2cf4977ba 100644
--- a/community/miniserve/APKBUILD
+++ b/community/miniserve/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=miniserve
 pkgver=0.21.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Quickly serve files via HTTP"
 url="https://github.com/svenstaro/miniserve"
 license="MIT"
 arch="all !s390x !riscv64" # limited by rust/cargo
 arch="$arch !ppc64le" # FTBFS
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-bash-completion
@@ -33,7 +33,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	./target/release/miniserve --print-manpage > $pkgname.1
 
diff --git a/community/monolith/APKBUILD b/community/monolith/APKBUILD
index c473e4e6f6d..934af01327b 100644
--- a/community/monolith/APKBUILD
+++ b/community/monolith/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=monolith
 pkgver=2.7.0
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI tool for saving complete web pages as a single HTML file"
 url="https://github.com/Y2Z/monolith"
 # riscv64: rust is broken on this arch
@@ -10,6 +10,7 @@ arch="all !riscv64"
 license="CC0-1.0"
 makedepends="
 	cargo
+	cargo-auditable
 	openssl-dev
 	"
 source="https://github.com/Y2Z/monolith/archive/v$pkgver/monolith-$pkgver.tar.gz"
@@ -22,7 +23,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/mprocs/APKBUILD b/community/mprocs/APKBUILD
index fbd6817ca97..b7dcdd359ef 100644
--- a/community/mprocs/APKBUILD
+++ b/community/mprocs/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=mprocs
 pkgver=0.6.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Run multiple commands in parallel"
 url="https://github.com/pvolok/mprocs"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # blocked by rust/cargo
 license="MIT"
-makedepends="cargo lua5.4-dev"
+makedepends="cargo lua5.4-dev cargo-auditable"
 source="https://github.com/pvolok/mprocs/archive/v$pkgver/mprocs-$pkgver.tar.gz
 	fix-portable_pty-tests.patch
 	unbundle-lua.patch
@@ -27,7 +27,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/mqttui/APKBUILD b/community/mqttui/APKBUILD
index 5ac319b9ca6..cf518fd13da 100644
--- a/community/mqttui/APKBUILD
+++ b/community/mqttui/APKBUILD
@@ -9,7 +9,7 @@ url="https://github.com/EdJoPaTo/mqttui"
 # riscv64, s390x: blocked by cargo/rust
 arch="all !ppc64le !riscv64 !s390x"
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/navi/APKBUILD b/community/navi/APKBUILD
index a4d59575e1d..45e3f421d05 100644
--- a/community/navi/APKBUILD
+++ b/community/navi/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=navi
 pkgver=2.22.1
-pkgrel=0
+pkgrel=1
 pkgdesc="An interactive cheatsheet tool for the command-line"
 url="https://github.com/denisidoro/navi"
 # s390x: fails to build nix crate
 arch="all !s390x"
 license="Apache-2.0"
 depends="git"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 install="$pkgname.post-install"
 subpackages="
 	$pkgname-bash-plugin:_bash:noarch
@@ -32,7 +32,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/ncspot/APKBUILD b/community/ncspot/APKBUILD
index 75076e28464..e7e0ad70808 100644
--- a/community/ncspot/APKBUILD
+++ b/community/ncspot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=ncspot
 pkgver=0.13.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Cross-platform ncurses Spotify client inspired by ncmpc and the likes"
 url="https://github.com/hrkfdn/ncspot"
 # riscv64: takes eternity to build
@@ -11,6 +11,7 @@ arch="all !riscv64 !s390x"
 license="BSD-2-Clause"
 makedepends="
 	cargo
+	cargo-auditable
 	libxcb-dev
 	ncurses-dev
 	openssl-dev>3
@@ -36,7 +37,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/onefetch/APKBUILD b/community/onefetch/APKBUILD
index f12de42c71c..fcb16ae8df5 100644
--- a/community/onefetch/APKBUILD
+++ b/community/onefetch/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=onefetch
 pkgver=2.17.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Git repository summary on your terminal"
 url="https://github.com/o2sh/onefetch"
 # s390x: build failure
 arch="all !s390x"
 license="MIT"
-makedepends="cargo cmake libgit2-dev zlib-dev"
+makedepends="cargo cmake libgit2-dev zlib-dev cargo-auditable"
 checkdepends="bash"
 subpackages="
 	$pkgname-doc
@@ -29,7 +29,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 	for shellcomp in bash fish zsh; do
 		./target/release/onefetch --generate "$shellcomp" > onefetch."$shellcomp"
 	done
diff --git a/community/oxipng/APKBUILD b/community/oxipng/APKBUILD
index f18e4af32c1..a9274e1f035 100644
--- a/community/oxipng/APKBUILD
+++ b/community/oxipng/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Maxim Karasev <mxkrsv@disroot.org>
 pkgname=oxipng
 pkgver=8.0.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Multithreaded PNG optimizer written in Rust"
 url="https://github.com/shssoichiro/oxipng"
 # armhf: does not build here, and useless
 arch="all !armhf"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/shssoichiro/oxipng/archive/v$pkgver/oxipng-$pkgver.tar.gz"
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
 
@@ -20,7 +20,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/peep/APKBUILD b/community/peep/APKBUILD
index 2c128d62b41..c7832920394 100644
--- a/community/peep/APKBUILD
+++ b/community/peep/APKBUILD
@@ -3,14 +3,14 @@
 pkgname=peep
 pkgver=0.1.6_git20220920
 _gitrev=ac0bd79fb9d8d05e4ed059bb37b93a7cce4b9bc5
-pkgrel=0
+pkgrel=1
 pkgdesc="Text viewer that works like less(1) on small pane within terminal window"
 url="https://github.com/ryochack/peep"
 # riscv64: found textrels
 # s390x: nix crate fails to build
 arch="all !riscv64 !s390x"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/ryochack/peep/archive/$_gitrev/peep-$_gitrev.tar.gz
 	regex-features.patch
 	"
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/piow/APKBUILD b/community/piow/APKBUILD
index aa7602c91dc..c4ac4964c02 100644
--- a/community/piow/APKBUILD
+++ b/community/piow/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=piow
 pkgver=0.4.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Put Icons On your sway Workspaces"
 url="https://github.com/KuabeM/piow"
 arch="all"
 license="MIT OR Apache-2.0"
 depends="sway-virtual"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/KuabeM/piow/archive/v$pkgver/piow-$pkgver.tar.gz"
 options="!check"  # no tests provided
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/pipr/APKBUILD b/community/pipr/APKBUILD
index 2671f6ec93d..b8a7f036bf5 100644
--- a/community/pipr/APKBUILD
+++ b/community/pipr/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=pipr
 pkgver=0.0.16
-pkgrel=0
+pkgrel=1
 pkgdesc="A tool to interactively write shell pipelines"
 url="https://github.com/elkowar/pipr"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # limited by rust/cargo
@@ -10,6 +10,7 @@ license="MIT"
 depends="bubblewrap"
 makedepends="
 	cargo
+	cargo-auditable
 	oniguruma-dev
 	"
 source="https://github.com/elkowar/pipr/archive/v$pkgver/pipr-$pkgver.tar.gz
@@ -25,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/pngquant/APKBUILD b/community/pngquant/APKBUILD
index 79f1f479c04..d187ef1cbff 100644
--- a/community/pngquant/APKBUILD
+++ b/community/pngquant/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: André Klitzing <aklitzing@gmail.com>
 pkgname=pngquant
 pkgver=3.0.1
-pkgrel=0
+pkgrel=1
 _libimagequant=9f15d1c53938a441a6bbfb2de866492797f69e22
 pkgdesc="Lossy PNG compressor"
 url="https://pngquant.org/"
@@ -10,6 +10,7 @@ arch="all"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	lcms2-dev
 	libpng-dev
 	"
@@ -36,7 +37,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/procs/APKBUILD b/community/procs/APKBUILD
index edef795f576..954ede42f70 100644
--- a/community/procs/APKBUILD
+++ b/community/procs/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer:
 pkgname=procs
 pkgver=0.14.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Modern replacement for ps written in Rust"
 url="https://github.com/dalance/procs"
 arch="all"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -27,7 +27,7 @@ prepare() {
 build() {
 	# Default features enables "docker" feature that doubles the size of
 	# the resulting binary with unnecessary bloat!
-	cargo build --release --frozen --no-default-features
+	cargo auditable build --release --frozen --no-default-features
 
 	# generate shell completions
 	target/release/procs --gen-completion bash
diff --git a/community/prometheus-wireguard-exporter/APKBUILD b/community/prometheus-wireguard-exporter/APKBUILD
index 92b19af7d9d..204dac24e52 100644
--- a/community/prometheus-wireguard-exporter/APKBUILD
+++ b/community/prometheus-wireguard-exporter/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=prometheus-wireguard-exporter
 pkgver=3.6.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A Prometheus exporter for WireGuard, written in Rust"
 url="https://github.com/MindFlavor/prometheus_wireguard_exporter"
 # ppc64le: https://github.com/briansmith/ring/issues/389
 # s390x, riscv64: cargo
 arch="all !s390x !ppc64le !riscv64"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="$pkgname-openrc"
 source="https://github.com/MindFlavor/prometheus_wireguard_exporter/archive/$pkgver/prometheus_wireguard_exporter-$pkgver.tar.gz
 	prometheus-wireguard-exporter.initd
@@ -26,7 +26,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/pueue/APKBUILD b/community/pueue/APKBUILD
index 0103db4908e..33ce3ad3000 100644
--- a/community/pueue/APKBUILD
+++ b/community/pueue/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=pueue
 pkgver=3.1.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Manage your shell commands"
 url="https://github.com/nukesor/pueue"
 # ppc64le, riscv64, s390x: fails to build ring crate
 arch="all !ppc64le !riscv64 !s390x"
 license="MIT"
 checkdepends="bash"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-bash-completion
 	$pkgname-fish-completion
@@ -29,7 +29,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 
 	mkdir -p target/completion
 	local sh; for sh in bash fish zsh; do
diff --git a/community/purism-ectool/APKBUILD b/community/purism-ectool/APKBUILD
index a27128e0d3c..b454cb98309 100644
--- a/community/purism-ectool/APKBUILD
+++ b/community/purism-ectool/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Clayton Craft <clayton@craftyguy.net>
 pkgname=purism-ectool
 pkgver=1.12
-pkgrel=0
+pkgrel=1
 pkgdesc="EC firmware tool for Purism systems"
 url="https://source.puri.sm/firmware/librem-ec"
 arch="x86_64"
 license="MIT"
-makedepends="cargo eudev-dev linux-headers"
+makedepends="cargo eudev-dev linux-headers cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://source.puri.sm/firmware/librem-ec/-/archive/$pkgver/librem-ec-$pkgver.tar.gz"
 builddir="$srcdir/librem-ec-$pkgver/tool"
 
@@ -19,7 +19,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/rbspy/APKBUILD b/community/rbspy/APKBUILD
index 870c9dc25db..fba424c02a1 100644
--- a/community/rbspy/APKBUILD
+++ b/community/rbspy/APKBUILD
@@ -2,19 +2,19 @@
 # Maintainer: Adam Jensen <adam@acj.sh>
 pkgname=rbspy
 pkgver=0.17.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Sampling profiler for Ruby"
 url="https://rbspy.github.io/"
 arch="all !armv7 !ppc64le !s390x !riscv64" # limited by cargo and build errors
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 checkdepends="ruby"
 options="net"
 source="$pkgname-$pkgver.tar.gz::https://github.com/rbspy/rbspy/archive/v$pkgver.tar.gz"
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 }
 
 check() {
diff --git a/community/rebuilderd/APKBUILD b/community/rebuilderd/APKBUILD
index fd2636e4532..4848d6ff8f0 100644
--- a/community/rebuilderd/APKBUILD
+++ b/community/rebuilderd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=rebuilderd
 pkgver=0.19.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Independent verification system of binary packages"
 url='https://github.com/kpcyrd/rebuilderd'
 arch="all !s390x !ppc64le !riscv64"
@@ -16,11 +16,12 @@ depends="
 	"
 makedepends="
 	cargo
+	cargo-auditable
 	openssl-dev>3
+	scdoc
 	sqlite-dev
 	xz-dev
 	zstd-dev
-	scdoc
 	"
 subpackages="
 	$pkgname-doc
@@ -44,7 +45,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 
 	mkdir -p completions
 	target/release/rebuildctl completions bash > completions/rebuildctl.bash
diff --git a/community/ripgrep/APKBUILD b/community/ripgrep/APKBUILD
index 6e58000a7dd..09ae02d8246 100644
--- a/community/ripgrep/APKBUILD
+++ b/community/ripgrep/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: André Klitzing <aklitzing@gmail.com>
 pkgname=ripgrep
 pkgver=13.0.0
-pkgrel=3
+pkgrel=4
 pkgdesc="ripgrep combines the usability of The Silver Searcher with the raw speed of grep"
 url="https://github.com/BurntSushi/ripgrep"
 arch="all !riscv64" # libc crate sup
 license="MIT OR Public-Domain"
-makedepends="cargo asciidoc pcre2-dev"
+makedepends="cargo asciidoc pcre2-dev cargo-auditable"
 checkdepends="xz"
 subpackages="$pkgname-doc
 	$pkgname-bash-completion:bashcomp:noarch
@@ -20,7 +20,7 @@ export PCRE2_SYS_STATIC=0  # use system libpcre2
 export JEMALLOC_SYS_WITH_LG_PAGE=16 # 2**16 = 64k
 
 build() {
-	cargo build --release --locked --features 'pcre2'
+	cargo auditable build --release --locked --features 'pcre2'
 }
 
 check() {
diff --git a/community/rtx/APKBUILD b/community/rtx/APKBUILD
index 57c9c286d98..c51fb92e1de 100644
--- a/community/rtx/APKBUILD
+++ b/community/rtx/APKBUILD
@@ -1,12 +1,12 @@
 # Maintainer: Jeff Dickey <alpine@rtx.pub>
 pkgname=rtx
 pkgver=1.29.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Polyglot runtime and dev tool version manager"
 url="https://rtx.pub"
 arch="all !s390x !riscv64 !ppc64le" # limited by cargo
 license="MIT"
-makedepends="cargo bash direnv"
+makedepends="cargo bash direnv cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://github.com/jdxcode/rtx/archive/refs/tags/v$pkgver.tar.gz"
 
 
@@ -17,7 +17,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/rust-analyzer/APKBUILD b/community/rust-analyzer/APKBUILD
index cb8f36ecdae..654e92c5fa7 100644
--- a/community/rust-analyzer/APKBUILD
+++ b/community/rust-analyzer/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=rust-analyzer
 pkgver=2023.05.15
 _pkgver=${pkgver//./-}
-pkgrel=0
+pkgrel=1
 pkgdesc="A Rust compiler front-end for IDEs"
 url="https://github.com/rust-lang/rust-analyzer"
 # armhf, armv7, x86: some tests fail, not supported by upstream
@@ -11,7 +11,7 @@ url="https://github.com/rust-lang/rust-analyzer"
 arch="aarch64 ppc64le x86_64"
 license="MIT OR Apache-2.0"
 depends="rust-src"
-makedepends="cargo mimalloc2-dev"
+makedepends="cargo mimalloc2-dev cargo-auditable"
 checkdepends="rustfmt"
 subpackages="$pkgname-doc"
 source="https://github.com/rust-lang/rust-analyzer/archive/$_pkgver/rust-analyzer-$pkgver.tar.gz"
@@ -42,7 +42,7 @@ prepare() {
 
 build() {
 	CFG_RELEASE="$pkgver" \
-		cargo build \
+		cargo auditable build \
 		--frozen \
 		--release \
 		--features="mimalloc"
diff --git a/community/rustup/APKBUILD b/community/rustup/APKBUILD
index 3a4200a51a8..80778b65aa9 100644
--- a/community/rustup/APKBUILD
+++ b/community/rustup/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Rasmus Thomsen <oss@cogitri.dev>
 pkgname=rustup
 pkgver=1.25.2
-pkgrel=1
+pkgrel=2
 pkgdesc="The Rust toolchain installer"
 url="https://rustup.rs/"
 arch="aarch64 x86_64" # limited by upstream only supporting these arches
 license="Apache-2.0"
 makedepends="
 	cargo
+	cargo-auditable
 	curl-dev
 	openssl-dev>3
 	perl
@@ -37,7 +38,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen \
+	cargo auditable build --release --frozen \
 		--no-default-features \
 		--features no-self-update,curl-backend,reqwest-default-tls,reqwest-backend \
 		--bin rustup-init
diff --git a/community/sad/APKBUILD b/community/sad/APKBUILD
index b81eae41a22..22cbb7fd8c7 100644
--- a/community/sad/APKBUILD
+++ b/community/sad/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=sad
 pkgver=0.4.22
-pkgrel=0
+pkgrel=1
 pkgdesc="CLI search and replace - a batch file edit tool"
 url="https://github.com/ms-jpq/sad"
 arch="all"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/ms-jpq/sad/archive/v$pkgver/sad-$pkgver.tar.gz"
 [ "$CARCH" = "riscv64" ] && options="$options textrels"
 
@@ -19,7 +19,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/sccache/APKBUILD b/community/sccache/APKBUILD
index b95a1ded70e..80186949fd3 100644
--- a/community/sccache/APKBUILD
+++ b/community/sccache/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=sccache
 pkgver=0.4.2
-pkgrel=0
+pkgrel=1
 pkgdesc="shared compilation cache for C/C++ and Rust"
 url="https://github.com/mozilla/sccache/"
 # s390x & riscv64: limited by cargo
@@ -10,7 +10,7 @@ url="https://github.com/mozilla/sccache/"
 # armhf: sigbus
 arch="all !s390x !ppc64le !armhf !riscv64"
 license="Apache-2.0"
-makedepends="cargo openssl-dev>3"
+makedepends="cargo openssl-dev>3 cargo-auditable"
 subpackages="$pkgname-doc"
 source="$pkgname-$pkgver.tar.gz::https://github.com/mozilla/sccache/archive/v$pkgver.tar.gz
 	test_musl_ldd_parse.patch
@@ -34,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen --features $_features
+	cargo auditable build --release --frozen --features $_features
 }
 
 check() {
diff --git a/community/sequoia-sq/APKBUILD b/community/sequoia-sq/APKBUILD
index 44492d75088..dbc65d14f0f 100644
--- a/community/sequoia-sq/APKBUILD
+++ b/community/sequoia-sq/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=sequoia-sq
 pkgver=0.30.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Command-line frontends for Sequoia"
 url="https://gitlab.com/sequoia-pgp/sequoia-sq"
 # rust-ring
@@ -10,6 +10,7 @@ license="GPL-2.0-or-later"
 makedepends="
 	bzip2-dev
 	cargo
+	cargo-auditable
 	clang-dev
 	openssl-dev
 	sqlite-dev
@@ -36,7 +37,7 @@ prepare() {
 
 build() {
 	export CARGO_TARGET_DIR=target
-	cargo build --frozen --release --no-default-features --features crypto-openssl
+	cargo auditable build --frozen --release --no-default-features --features crypto-openssl
 }
 
 check() {
diff --git a/community/sheldon/APKBUILD b/community/sheldon/APKBUILD
index 4a309799059..0f305e40343 100644
--- a/community/sheldon/APKBUILD
+++ b/community/sheldon/APKBUILD
@@ -2,13 +2,14 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=sheldon
 pkgver=0.7.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Fast, configurable, shell plugin manager"
 url="https://github.com/rossmacarthur/sheldon"
 arch="aarch64 armhf armv7 ppc64le x86 x86_64"  # blocked by rust/cargo
 license="MIT OR Apache-2.0"
 makedepends="
 	cargo
+	cargo-auditable
 	curl-dev
 	libgit2-dev
 	libssh2-dev
@@ -34,7 +35,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/skim/APKBUILD b/community/skim/APKBUILD
index df6f8cc920e..b460b371660 100644
--- a/community/skim/APKBUILD
+++ b/community/skim/APKBUILD
@@ -3,12 +3,12 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=skim
 pkgver=0.10.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Fuzzy finder written in Rust"
 url="https://github.com/lotabout/skim"
 arch="all !s390x !riscv64"  # limited by rust/cargo
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 subpackages="
 	$pkgname-doc
 	$pkgname-tmux::noarch
@@ -38,7 +38,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/sn0int/APKBUILD b/community/sn0int/APKBUILD
index e6901f15b1a..ab22242eb32 100644
--- a/community/sn0int/APKBUILD
+++ b/community/sn0int/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=sn0int
 pkgver=0.25.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Semi-automatic OSINT framework and package manager"
 url="https://github.com/kpcyrd/sn0int"
 # s390x and riscv64 blocked by cargo
@@ -11,12 +11,13 @@ arch="all !s390x !ppc64le !riscv64"
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
-	lua5.2-dev
-	sqlite-dev
+	cargo-auditable
+	libcap-utils
 	libseccomp-dev
 	libsodium-dev
+	lua5.2-dev
 	py3-sphinx
-	libcap-utils
+	sqlite-dev
 	"
 subpackages="$pkgname-doc
 	$pkgname-bash-completion
@@ -28,7 +29,7 @@ source="$pkgname-$pkgver.tar.gz::https://github.com/kpcyrd/sn0int/archive/v$pkgv
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 
 	mkdir -p completions
 	"target/release/sn0int" completions bash > completions/sn0int.bash
diff --git a/community/sniffglue/APKBUILD b/community/sniffglue/APKBUILD
index 0b4539ecc9e..a86bb5fb221 100644
--- a/community/sniffglue/APKBUILD
+++ b/community/sniffglue/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: kpcyrd <git@rxv.cc>
 pkgname=sniffglue
 pkgver=0.15.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Secure multithreaded packet sniffer"
 url="https://github.com/kpcyrd/sniffglue"
 # !ppc64le: fails to build ring
@@ -10,6 +10,7 @@ arch="x86_64 armhf armv7 aarch64 x86" # limited by cargo
 license="GPL-3.0-or-later"
 makedepends="
 	cargo
+	cargo-auditable
 	libpcap-dev
 	libseccomp-dev
 	scdoc
@@ -23,7 +24,7 @@ source="$pkgname-$pkgver.tar.gz::https://github.com/kpcyrd/sniffglue/archive/v$p
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 	make docs
 }
 
diff --git a/community/songrec/APKBUILD b/community/songrec/APKBUILD
index aac0a205d86..254ea22289b 100644
--- a/community/songrec/APKBUILD
+++ b/community/songrec/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Bart Ribbers <bribbers@disroot.org>
 pkgname=songrec
 pkgver=0.3.2
-pkgrel=1
+pkgrel=2
 pkgdesc="Open-source Shazam client for Linux"
 url="https://github.com/marin-m/SongRec"
 # s390x fails to build
@@ -12,6 +12,7 @@ license="GPL-3.0-only"
 makedepends="
 	alsa-lib-dev
 	cargo
+	cargo-auditable
 	gdk-pixbuf-dev
 	glib-dev
 	gtk+3.0-dev
@@ -31,7 +32,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/spotifyd/APKBUILD b/community/spotifyd/APKBUILD
index 087db19bbe0..e5c2392151f 100644
--- a/community/spotifyd/APKBUILD
+++ b/community/spotifyd/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Thomas Kienlen <kommander@laposte.net>
 pkgname=spotifyd
 pkgver=0.3.5
-pkgrel=0
+pkgrel=1
 pkgdesc="Open source Spotify client running as a UNIX daemon"
 url="https://github.com/Spotifyd/spotifyd"
 # rust-ring
@@ -11,6 +11,7 @@ license="GPL-3.0-or-later"
 makedepends="
 	alsa-lib-dev
 	cargo
+	cargo-auditable
 	dbus-dev
 	libogg-dev
 	openssl-dev>3
@@ -33,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen --features pulseaudio_backend,dbus_mpris,dbus_keyring,rodio_backend
+	cargo auditable build --release --frozen --features pulseaudio_backend,dbus_mpris,dbus_keyring,rodio_backend
 }
 
 check() {
diff --git a/community/starship/APKBUILD b/community/starship/APKBUILD
index 2663d6a158e..7fb54ea55ec 100644
--- a/community/starship/APKBUILD
+++ b/community/starship/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=starship
 pkgver=1.14.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Minimal, blazing-fast and infinitely customizable prompt for any shell"
 url="https://starship.rs"
 # s390x: fails to build nix crate
@@ -10,6 +10,7 @@ arch="all !s390x"
 license="ISC"
 makedepends="
 	cargo
+	cargo-auditable
 	dbus-dev
 	openssl-dev>3
 	zlib-ng-dev
@@ -50,7 +51,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	local i; for i in bash fish zsh; do
 		./target/release/starship completions $i > target/starship.$i
diff --git a/community/stylua/APKBUILD b/community/stylua/APKBUILD
index ad5f18a9a91..920be50ef93 100644
--- a/community/stylua/APKBUILD
+++ b/community/stylua/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=stylua
 pkgver=0.17.1
-pkgrel=0
+pkgrel=1
 pkgdesc="Opinionated Lua code formatter"
 url="https://github.com/JohnnyMorganz/StyLua"
 arch="all !s390x !riscv64" # blocked by cargo
 license="MPL-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://github.com/JohnnyMorganz/StyLua/archive/refs/tags/v$pkgver.tar.gz"
 builddir="$srcdir/StyLua-$pkgver"
 
@@ -20,7 +20,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen $_features
+	cargo auditable build --release --frozen $_features
 }
 
 check() {
diff --git a/community/swayr/APKBUILD b/community/swayr/APKBUILD
index 9c917dc71e8..6fa6e85e207 100644
--- a/community/swayr/APKBUILD
+++ b/community/swayr/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=swayr
 pkgver=0.26.1
-pkgrel=0
+pkgrel=1
 pkgdesc="A window switcher (and more) for Sway"
 url="https://sr.ht/~tsdh/swayr/"
 arch="all"
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://git.sr.ht/~tsdh/swayr/archive/swayr-$pkgver.tar.gz"
 builddir="$srcdir/$pkgname-swayr-$pkgver"
 
@@ -29,7 +29,7 @@ prepare() {
 }
 
 build() {
-	cargo build -p swayr --release --frozen
+	cargo auditable build -p swayr --release --frozen
 }
 
 check() {
diff --git a/community/swayrbar/APKBUILD b/community/swayrbar/APKBUILD
index 392c8ad4ba0..a79df347be1 100644
--- a/community/swayrbar/APKBUILD
+++ b/community/swayrbar/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=swayrbar
 pkgver=0.3.6
-pkgrel=0
+pkgrel=1
 pkgdesc="A status command for Sway's swaybar"
 url="https://sr.ht/~tsdh/swayr/"
 arch="all"
 license="GPL-3.0-or-later"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://git.sr.ht/~tsdh/swayr/archive/swayrbar-$pkgver.tar.gz"
 builddir="$srcdir/swayr-swayrbar-$pkgver"
 
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build -p swayrbar --release --frozen
+	cargo auditable build -p swayrbar --release --frozen
 }
 
 check() {
diff --git a/community/taplo/APKBUILD b/community/taplo/APKBUILD
index d6b84023fe0..40c6b3595db 100644
--- a/community/taplo/APKBUILD
+++ b/community/taplo/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=taplo
 _pkgname=release-taplo-cli
 pkgver=0.8.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A TOML toolkit written in Rust"
 url="https://taplo.tamasfe.dev/"
 # riscv64: blocked by cargo
@@ -11,6 +11,7 @@ arch="all !riscv64"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	openssl-dev
 	"
 source="https://github.com/tamasfe/taplo/archive/$_pkgname-$pkgver/$_pkgname-$pkgver.tar.gz"
@@ -33,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build -p taplo-cli $_cargo_opts --release
+	cargo auditable build -p taplo-cli $_cargo_opts --release
 }
 
 check() {
diff --git a/community/tectonic/APKBUILD b/community/tectonic/APKBUILD
index 2d568e96c1f..a80dcb36c85 100644
--- a/community/tectonic/APKBUILD
+++ b/community/tectonic/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Rasmus Thomsen <oss@cogitri.dev>
 pkgname=tectonic
 pkgver=0.13.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Tectonic is a modernized, complete, self-contained TeX/LaTeX engine"
 url="https://tectonic-typesetting.github.io"
 # s390x, riscv64: rust
@@ -13,6 +13,7 @@ license="MIT"
 depends="icu-data-full"
 makedepends="
 	cargo
+	cargo-auditable
 	curl-dev
 	fontconfig-dev
 	harfbuzz-dev
@@ -33,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen $_features
+	cargo auditable build --release --frozen $_features
 }
 
 check() {
diff --git a/community/thin-provisioning-tools/APKBUILD b/community/thin-provisioning-tools/APKBUILD
index 12138c89a46..0d0b5cc84ec 100644
--- a/community/thin-provisioning-tools/APKBUILD
+++ b/community/thin-provisioning-tools/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer:
 pkgname=thin-provisioning-tools
 pkgver=1.0.4
-pkgrel=0
+pkgrel=1
 pkgdesc="suite of tools for manipulating the metadata of the dm-thin device-mapper target"
 url="https://github.com/jthornber/thin-provisioning-tools"
 # ucontext libc fs_type_t
 arch="all !s390x"
 license="GPL-3.0-or-later"
-makedepends="cargo gawk"
+makedepends="cargo gawk cargo-auditable"
 subpackages="$pkgname-doc"
 source="$pkgname-$pkgver.tar.gz::https://github.com/jthornber/thin-provisioning-tools/archive/v$pkgver.tar.gz
 	ioctl-musl.patch
@@ -31,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/tokei/APKBUILD b/community/tokei/APKBUILD
index 2d3b0fa9801..576c0f7ef29 100644
--- a/community/tokei/APKBUILD
+++ b/community/tokei/APKBUILD
@@ -2,19 +2,19 @@
 # Maintainer: Francesco Colista <fcolista@alpinelinux.org>
 pkgname=tokei
 pkgver=12.1.2
-pkgrel=2
+pkgrel=3
 pkgdesc="A blazingly fast CLOC (Count Lines Of Code) program"
 url="https://github.com/XAMPPRocky/tokei"
 arch="all !s390x !riscv64" # limited by cargo
 license="MIT AND Apache-2.0"
-makedepends="rust cargo"
+makedepends="rust cargo cargo-auditable"
 source="$pkgname-$pkgver.tar.gz::https://github.com/XAMPPRocky/tokei/archive/v$pkgver.tar.gz
 	minimize-size.patch
 	"
 
 
 build() {
-	cargo build --release --locked --features all
+	cargo auditable build --release --locked --features all
 }
 
 check() {
diff --git a/community/tree-sitter/APKBUILD b/community/tree-sitter/APKBUILD
index 50718124815..519b3575882 100644
--- a/community/tree-sitter/APKBUILD
+++ b/community/tree-sitter/APKBUILD
@@ -3,13 +3,13 @@
 # Maintainer: TBK <alpine@jjtc.eu>
 pkgname=tree-sitter
 pkgver=0.20.8
-pkgrel=0
+pkgrel=1
 pkgdesc="Incremental parsing system for programming tools"
 url="https://tree-sitter.github.io/"
 license="MIT"
 arch="all"
 depends_dev="jq"  # needed for abuild-tree-sitter
-makedepends="bash"
+makedepends="bash cargo-auditable"
 checkdepends="cargo nodejs"
 subpackages="
 	$pkgname-static
@@ -58,7 +58,7 @@ build() {
 	#script/build-wasm
 
 	if $_with_cli; then
-		cargo build -p tree-sitter-cli --frozen --release
+		cargo auditable build -p tree-sitter-cli --frozen --release
 	fi
 }
 
diff --git a/community/tuc/APKBUILD b/community/tuc/APKBUILD
index 16e8832eda0..c925c8651fd 100644
--- a/community/tuc/APKBUILD
+++ b/community/tuc/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Michał Polański <michal@polanski.me>
 pkgname=tuc
 pkgver=1.0.0
-pkgrel=0
+pkgrel=1
 pkgdesc="When cut doesn't cut it"
 url="https://github.com/riquito/tuc"
 license="GPL-3.0-or-later"
 # riscv64: build failure in libc crate
 arch="all !riscv64"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/riquito/tuc/archive/v$pkgver/tuc-$pkgver.tar.gz"
 
 
@@ -19,7 +19,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/virtiofsd/APKBUILD b/community/virtiofsd/APKBUILD
index 715048865f8..a441c9ad51f 100644
--- a/community/virtiofsd/APKBUILD
+++ b/community/virtiofsd/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=virtiofsd
 pkgver=1.6.1
-pkgrel=0
+pkgrel=1
 pkgdesc="virtio-fs vhost-user device daemon"
 url="https://gitlab.com/virtio-fs/virtiofsd"
 # fails to build on 32-bit
@@ -9,6 +9,7 @@ arch="all !x86 !armhf !armv7"
 license="Apache-2.0 AND BSD-3-Clause"
 makedepends="
 	cargo
+	cargo-auditable
 	libcap-ng-dev
 	libseccomp-dev
 	"
@@ -31,7 +32,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/viu/APKBUILD b/community/viu/APKBUILD
index d99c98c2fc7..45df5dd426b 100644
--- a/community/viu/APKBUILD
+++ b/community/viu/APKBUILD
@@ -1,13 +1,13 @@
 # Maintainer: omni <omni+alpine@hack.org>
 pkgname=viu
 pkgver=1.4.0
-pkgrel=2
+pkgrel=3
 pkgdesc="Terminal image viewer"
 # s390x: the trait `From<i32>` is not implemented for `u64` (in `terminal_size` crate)
 arch="all !s390x !riscv64"
 url="https://github.com/atanunq/viu"
 license="MIT"
-makedepends="cargo libsixel-dev"
+makedepends="cargo libsixel-dev cargo-auditable"
 subpackages="$pkgname-doc"
 source="$pkgname-$pkgver.tar.gz::https://github.com/atanunq/viu/archive/v$pkgver.tar.gz"
 
@@ -27,7 +27,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen --features sixel
+	cargo auditable build --release --frozen --features sixel
 }
 
 check() {
diff --git a/community/wasm-pack/APKBUILD b/community/wasm-pack/APKBUILD
index f6a8d327a02..5fc611d8a38 100644
--- a/community/wasm-pack/APKBUILD
+++ b/community/wasm-pack/APKBUILD
@@ -1,13 +1,14 @@
 # Maintainer: psykose <alice@ayaya.dev>
 pkgname=wasm-pack
 pkgver=0.11.1
-pkgrel=0
+pkgrel=1
 pkgdesc="rust to wasm build tool"
 url="https://github.com/rustwasm/wasm-pack"
 arch="all !s390x !riscv64" # rust
 license="Apache-2.0"
 depends="cargo rust-wasm"
 makedepends="
+	cargo-auditable
 	curl-dev
 	openssl-dev>3
 	wasi-sdk
@@ -23,7 +24,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/wayshot/APKBUILD b/community/wayshot/APKBUILD
index 800796ef431..33d9acdcaf2 100644
--- a/community/wayshot/APKBUILD
+++ b/community/wayshot/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=wayshot
 pkgver=1.2.2
-pkgrel=0
+pkgrel=1
 pkgdesc="A native screenshot tool for wlroots based compositors"
 url="https://github.com/waycrate/wayshot"
 # riscv64: blocked by cargo/rust
@@ -10,7 +10,7 @@ url="https://github.com/waycrate/wayshot"
 arch="all !riscv64 !s390x"
 license="BSD-2-Clause"
 depends="wlroots"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/waycrate/wayshot/archive/$pkgver/wayshot-$pkgver.tar.gz"
 options="!check"  # no tests provided
 
@@ -22,7 +22,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/websocat/APKBUILD b/community/websocat/APKBUILD
index ed776bf2f6e..7fbc5e88814 100644
--- a/community/websocat/APKBUILD
+++ b/community/websocat/APKBUILD
@@ -1,18 +1,18 @@
 # Maintainer: Olliver Schinagl <oliver@schinagl.nl>
 pkgname=websocat
 pkgver=1.11.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Netcat, curl and socat for WebSockets"
 url="https://github.com/vi/websocat"
 arch="all !s390x !riscv64" # Limited by cargo/rust
 license="MIT"
-makedepends="cargo openssl-dev>3"
+makedepends="cargo openssl-dev>3 cargo-auditable"
 options="net"
 source="https://github.com/vi/websocat/archive/v$pkgver/websocat-$pkgver.tar.gz"
 
 
 build() {
-	cargo build --release --locked
+	cargo auditable build --release --locked
 }
 
 check() {
diff --git a/community/wezterm/APKBUILD b/community/wezterm/APKBUILD
index 00151c15ad7..265914158ac 100644
--- a/community/wezterm/APKBUILD
+++ b/community/wezterm/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=wezterm
 pkgver=20230408.112425
 _pkgver="20230408-112425-69ae8472"
-pkgrel=0
+pkgrel=1
 pkgdesc="GPU-accelerated cross-platform terminal emulator and multiplexer written in Rust"
 url="https://wezfurlong.org/wezterm/"
 # s390x, riscv64 limited by rust
@@ -22,6 +22,7 @@ _depends_fonts="
 makedepends="
 	$_depends_fonts
 	cargo
+	cargo-auditable
 	fontconfig-dev
 	freetype-dev
 	harfbuzz-dev
@@ -75,10 +76,10 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen --manifest-path wezterm/Cargo.toml
-	cargo build --release --frozen --manifest-path wezterm-gui/Cargo.toml --no-default-features --features wayland,distro-defaults
-	cargo build --release --frozen --manifest-path wezterm-mux-server/Cargo.toml
-	cargo build --release --frozen --manifest-path strip-ansi-escapes/Cargo.toml
+	cargo auditable build --release --frozen --manifest-path wezterm/Cargo.toml
+	cargo auditable build --release --frozen --manifest-path wezterm-gui/Cargo.toml --no-default-features --features wayland,distro-defaults
+	cargo auditable build --release --frozen --manifest-path wezterm-mux-server/Cargo.toml
+	cargo auditable build --release --frozen --manifest-path strip-ansi-escapes/Cargo.toml
 
 	# Regenerate shell completions (to be up-to-date).
 	local sh; for sh in bash fish zsh; do
diff --git a/community/wldash/APKBUILD b/community/wldash/APKBUILD
index 334bfba1ea8..6ee315e31f0 100644
--- a/community/wldash/APKBUILD
+++ b/community/wldash/APKBUILD
@@ -12,6 +12,7 @@ license="GPL-3.0"
 makedepends="
 	alsa-lib-dev
 	cargo
+	cargo-auditable
 	dbus-dev
 	fontconfig-dev
 	pulseaudio-dev
@@ -32,7 +33,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {
diff --git a/community/wluma/APKBUILD b/community/wluma/APKBUILD
index 1ac69674d2c..dae5fcf057a 100644
--- a/community/wluma/APKBUILD
+++ b/community/wluma/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=wluma
 pkgver=4.1.2
-pkgrel=2
+pkgrel=3
 pkgdesc="Automatic brightness adjustment based on screen contents and ALS"
 url="https://github.com/maximbaz/wluma"
 # riscv64, s390x: blocked by rust/cargo
@@ -11,11 +11,12 @@ arch="aarch64 ppc64le x86_64"
 license="ISC"
 makedepends="
 	cargo
+	cargo-auditable
 	clang15-dev
 	eudev-dev
 	v4l-utils-dev
-	wayland-dev
 	vulkan-loader-dev
+	wayland-dev
 	"
 install="$pkgname.post-install"
 subpackages="$pkgname-wlroots"
@@ -56,7 +57,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/xh/APKBUILD b/community/xh/APKBUILD
index eeddf213af1..1937c1f5a1a 100644
--- a/community/xh/APKBUILD
+++ b/community/xh/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=xh
 pkgver=0.18.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Yet another HTTPie clone"
 url="https://github.com/ducaale/xh"
 # riscv64: blocked by rust/cargo
@@ -11,6 +11,7 @@ arch="all !riscv64 !s390x"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	oniguruma-dev
 	openssl-dev
 	"
@@ -37,7 +38,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/xsv/APKBUILD b/community/xsv/APKBUILD
index d8d6f4398d4..bf19cb8cd53 100644
--- a/community/xsv/APKBUILD
+++ b/community/xsv/APKBUILD
@@ -2,14 +2,14 @@
 # Maintainer: guddaff <guddaff@protonmail.com>
 pkgname=xsv
 pkgver=0.13.0
-pkgrel=1
+pkgrel=2
 pkgdesc="CSV command line toolkit"
 url="https://github.com/BurntSushi/xsv"
 # ppc64le: fails to build
 # others: blocked by rust/cargo
 arch="aarch64 armhf armv7 x86 x86_64"
 license="MIT OR Unlicense"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/BurntSushi/xsv/archive/$pkgver/$pkgname-$pkgver.tar.gz"
 
 export CARGO_PROFILE_RELEASE_OPT_LEVEL=2
@@ -21,7 +21,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 check() {
diff --git a/community/yj/APKBUILD b/community/yj/APKBUILD
index e46408dbdfb..2c5ecd6c17b 100644
--- a/community/yj/APKBUILD
+++ b/community/yj/APKBUILD
@@ -2,12 +2,12 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=yj
 pkgver=1.2.3
-pkgrel=0
+pkgrel=1
 pkgdesc="Command line tool that converts YAML to JSON"
 url="https://github.com/bruceadams/yj"
 arch="all"
 license="Apache-2.0"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 source="https://github.com/bruceadams/yj/archive/v$pkgver/yj-$pkgver.tar.gz"
 options="!check"  # no tests provided
 
@@ -25,7 +25,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 package() {
diff --git a/community/yofi/APKBUILD b/community/yofi/APKBUILD
index de0c59d3d8e..c91cae6b56a 100644
--- a/community/yofi/APKBUILD
+++ b/community/yofi/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=yofi
 pkgver=0.2.0
-pkgrel=0
+pkgrel=1
 pkgdesc="A minimalistic menu for wayland"
 url="https://github.com/l4l/yofi"
 # riscv64: TEXTREL
@@ -11,6 +11,7 @@ arch="all !riscv64 !s390x"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	fontconfig-dev
 	freetype-dev
 	wayland-dev
@@ -30,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build $_cargo_opts --release
+	cargo auditable build $_cargo_opts --release
 }
 
 check() {
diff --git a/community/zellij/APKBUILD b/community/zellij/APKBUILD
index a92c0f651ec..251213ec9bc 100644
--- a/community/zellij/APKBUILD
+++ b/community/zellij/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: guddaff <guddaff@protonmail.com>
 pkgname=zellij
 pkgver=0.34.4
-pkgrel=0
+pkgrel=1
 pkgdesc="Terminal multiplexer"
 url="https://zellij.dev/"
 license="MIT"
@@ -13,9 +13,10 @@ license="MIT"
 arch="all !armhf !armv7 !ppc64le !s390x !x86 !riscv64"
 makedepends="
 	cargo
+	cargo-auditable
 	libc-dev
-	openssl-dev>3
 	mandown
+	openssl-dev>3
 	"
 subpackages="
 	$pkgname-doc
@@ -43,7 +44,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	mandown docs/MANPAGE.md > target/$pkgname.1
 
diff --git a/community/zenith/APKBUILD b/community/zenith/APKBUILD
index be0dde275de..800e57323b6 100644
--- a/community/zenith/APKBUILD
+++ b/community/zenith/APKBUILD
@@ -2,7 +2,7 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=zenith
 pkgver=0.14.0
-pkgrel=0
+pkgrel=1
 pkgdesc="Sort of like htop but with zoom-able charts, CPU, GPU, network, disk usage"
 url="https://github.com/bvaisvil/zenith"
 # riscv64: couldn't verify - broken CI
@@ -11,6 +11,7 @@ arch="all !riscv64 !s390x"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	clang-dev
 	linux-headers
 	llvm-dev
@@ -30,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 }
 
 package() {
diff --git a/community/zola/APKBUILD b/community/zola/APKBUILD
index 1afe1a34f68..6d49c0bfd6f 100644
--- a/community/zola/APKBUILD
+++ b/community/zola/APKBUILD
@@ -3,7 +3,7 @@
 # Maintainer: Erwan Rouchet <lucidiot@brainshit.fr>
 pkgname=zola
 pkgver=0.17.2
-pkgrel=0
+pkgrel=1
 pkgdesc="Opionated static site generator"
 url="https://github.com/getzola/zola"
 # ppc64le, s390x, riscv64: rust-ring
@@ -12,6 +12,7 @@ arch="all !armhf !ppc64le !s390x !riscv64"
 license="MIT"
 makedepends="
 	cargo
+	cargo-auditable
 	libsass-dev
 	oniguruma-dev
 	openssl-dev>3
@@ -33,7 +34,7 @@ prepare() {
 }
 
 build() {
-	cargo build --frozen --release
+	cargo auditable build --frozen --release
 
 	mkdir -p completions
 	target/release/zola completion bash > completions/zola.bash
diff --git a/community/zoxide/APKBUILD b/community/zoxide/APKBUILD
index 7d0d7cbb8bd..6116a0773a1 100644
--- a/community/zoxide/APKBUILD
+++ b/community/zoxide/APKBUILD
@@ -2,13 +2,13 @@
 # Maintainer: Jakub Jirutka <jakub@jirutka.cz>
 pkgname=zoxide
 pkgver=0.9.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Faster way to navigate your filesystem"
 url="https://github.com/ajeetdsouza/zoxide"
 # s390x: https://github.com/nix-rust/nix/issues/1968
 arch="all !s390x"
 license="MIT"
-makedepends="cargo"
+makedepends="cargo cargo-auditable"
 checkdepends="dash bash fish shfmt zsh"
 subpackages="
 	$pkgname-doc
@@ -31,7 +31,7 @@ prepare() {
 }
 
 build() {
-	cargo build --release --frozen
+	cargo auditable build --release --frozen
 }
 
 check() {