OpenSCA Cli

<div align="center"> <img alt="logo" src="/resources/logo.svg"> <h2>Manage Open Source Risks via Open Source Solution</h2> </div>

<!-- [](/go.mod) [](https://marketplace.visualstudio.com/items?itemName=xmirror.opensca) -->

English|中文

• Introduction
• Detection Ability
• Installation
  • Method 1: Download from Releases
  • Method 2: Use install script
  • Method 3: Use package manager(Homebrew)
  • Method 4: Build from source
• Use OpenSCA
  • Parameters
  • Ignore Paths in Configuration
  • Report Formats
  • Sample
    • Scan & Report via Docker Container
  • Local Vulnerability Database
    • The Format of the Vulnerability Database File
    • Explanations of Vulnerability Database Fields
    • Sample of Setting the Vulnerability Database
• FAQ
  • Is the environment variable needed while using OpenSCA?
  • About the vulnerability database?
  • About the time cost of OpenSCA scanning?
• Contact Us
• Authors
• Contributing

Introduction

OpenSCA is intended for scanning third-party dependencies, vulnerabilities and licenses.

Our website: https://opensca.xmirror.cn

Click STAR to leave encouragement.

---

Detection Ability

OpenSCA is now capable of parsing configuration files in the listed programming languages and correspondent package managers. The team is now dedicated to introducing more languages and enriching the parsing of relevant configuration files gradually.

| LANGUAGE | PACKAGE MANAGER | FILE | | ------------ | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | Java | Maven | pom.xml | | Java | Gradle | .gradle .gradle.kts | | JavaScript | Npm | package-lock.json package.json yarn.lock | | PHP | Composer | composer.json composer.lock | | Ruby | gem | gemfile.lock | | Golang | gomod | go.mod go.sum Gopkg.toml Gopkg.lock | | Rust | cargo | Cargo.lock | | Erlang | Rebar | rebar.lock | | Python | Pip | Pipfile Pipfile.lock setup.py requirements.txt requirements.in(For the latter two, pipenv environment & internet connection are needed) |

Installation

OpenSCA-cli is available for Windows, Linux and MacOS. The installation method is as follows:

Method 1: Download from Releases

1. Download the appropriate executable file according to your system architecture from releases.
2. Unzip the downloaded file and run opensca-cli directly.

Method 2: Use install script

• For Mac/Linux Users

  curl -sSL https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.sh | sh
  
  # Try this when internet connection fails
  curl -sSL https://gitee.com/XmirrorSecurity/OpenSCA-cli/raw/master/scripts/install.sh | sh -s -- gitee
  

• For Windows Users(need PowerShell)

  iex "&{$(irm https://raw.githubusercontent.com/XmirrorSecurity/OpenSCA-cli/master/scripts/install.ps1)}"
  
  # Try this when internet connection fails
  iex "&{$(irm https://gitee.com/XmirrorSecurity/OpenSCA-cli/raw/master/scripts/install.ps1)} gitee"
  

Method 3: Use package manager(Homebrew)

brew install opensca-cli

Method 4: Build from source

Clone the source code and compile (go 1.18 and above is needed)

# github linux/mac
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
# gitee linux/mac
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca && cd opensca && go build
# github windows
git clone https://github.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build
# gitee windows
git clone https://gitee.com/XmirrorSecurity/OpenSCA-cli.git opensca ; cd opensca ; go build

The default option is to generate the program of the current system architecture. If you want to try it for other system architectures, you can set the following environment variables before compiling.

• Disable CGO_ENABLED CGO_ENABLED=0
• Set the operating system GOOS=${OS} \\ darwin,liunx,windows
• Set the architecture GOARCH=${arch} \\ amd64,arm64

Use OpenSCA

Parameters

| PARAMETER | TYPE | Descripation | SAMPLE | | --------- | -------- | ------------------------------------------------------------------------------------------- | ------------------------- | | config | string | Set the path of the configuration file | -config config.json | | path | string | Set the path of the target file or directory | -path ./foo | | out | string | Save the result to the specified file whose format is defined by the suffix | -out out.json, out.html | | log | string | Specify the path of log file | -log my_log.txt | | token | string | Cloud service verification from our offical website | -token xxx | | proj | string | SaaS project token to sync report with OpenSCA SaaS | -proj xxx |

From v3.0.0, apart from these parameters available for CMD/CRT, there are also others for different requirements which have to be set in the configuration file.

Full introduction about each parameters can be found in config.json

v3.0.2 and above allows OpenSCA-cli to snyc reports with OpenSCA SaaS (via proj), so that all reports of multiple projects can be managed together.

If the configuration parameter conflicts with the command-line input parameter, the latter will be taken.

When there's no configuration file in the set path, one in default settings will be generated there.

If no path of configuration file is set, the following ones will be checked:

1. config.json under the working directory
2. opensca_config.json under the user directory
3. config.json under opensca-cli directory

Ignore Paths in Configuration

Use optional.ignore in the configuration file to skip files or directories during scanning. OpenSCA only reads ignore rules from the current configuration file and does not automatically load the project's .gitignore. The rules are compatible with common .gitignore syntax, including directory matches, wildcards, and ! negation.

{
  "optional": {
    "ignore": [
      "JarCollection/",
      "*.jar",
      "!libs/keep.jar"
    ]
  }
}

From v3.0.0, url has been put in the configuration file. The default set goes to our cloud vulnerability database. Other online database in accordance w