{"id":3156,"date":"2023-01-03T08:29:54","date_gmt":"2023-01-03T13:29:54","guid":{"rendered":"https:\/\/dft.wiki\/?p=3156"},"modified":"2026-06-08T17:21:28","modified_gmt":"2026-06-08T21:21:28","slug":"how-to-scan-a-source-code-with-osv-scanner","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=3156","title":{"rendered":"How to Scan a Source-Code with OSV-Scanner"},"content":{"rendered":"<p>OSV-Scanner is a command-line open source tool developed by Google&#8217;s Open Source Security Team to enumerate and check open-source dependencies for known vulnerabilities [<a href=\"https:\/\/github.com\/google\/osv-scanner\">Link<\/a>].<\/p>\n<p>It queries an aggregated vulnerability database of sources that have adopted the OSV schema, including GitHub Security Advisories, PyPA, RustSec, and the Global Security Database [<a href=\"https:\/\/osv.dev\/\">Link<\/a>].<\/p>\n<p>Some of the 16 currently available ecosystems are:<\/p>\n<ul>\n<li>Alpine<\/li>\n<li>Android<\/li>\n<li>crates.io<\/li>\n<li>Debian<\/li>\n<li>Go<\/li>\n<li>Linux<\/li>\n<li>Maven (Java, C#, C++)<\/li>\n<li>npm (JavaScript)<\/li>\n<li>NuGet (C#)<\/li>\n<li>OSS-Fuzz<\/li>\n<li>Packagist (PHP)<\/li>\n<li>PyPI (Python)<\/li>\n<li>RubyGems (Ruby)<\/li>\n<\/ul>\n<hr \/>\n<p><strong>INSTALLING ON UBUNTU 22.04<\/strong><\/p>\n<p>Environment:<\/p>\n<pre>sudo apt update &amp;&amp; sudo apt install golang-go -y &amp;&amp; go version<\/pre>\n<p>Application:<\/p>\n<pre>go install github.com\/google\/osv-scanner\/cmd\/osv-scanner@v1<\/pre>\n<hr \/>\n<p><strong>USING THE SCANNER<\/strong><\/p>\n<pre>cd ~\/Documents\/\r\ngit clone https:\/\/github.com\/nette\/nette.git\r\n~\/go\/bin\/osv-scanner -r ~\/Documents\/nette<\/pre>\n<p>The output looks as follows (I manually added a few dependencies to a clean copy of the repository to provide an example):<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-3159\" src=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/01\/Screenshot-from-2023-01-03-08-08-29.png\" alt=\"\" width=\"1056\" height=\"271\" srcset=\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/01\/Screenshot-from-2023-01-03-08-08-29.png 1056w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/01\/Screenshot-from-2023-01-03-08-08-29-300x77.png 300w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/01\/Screenshot-from-2023-01-03-08-08-29-1024x263.png 1024w, https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/01\/Screenshot-from-2023-01-03-08-08-29-768x197.png 768w\" sizes=\"auto, (max-width: 1056px) 100vw, 1056px\" \/><\/p>\n<p>It can also scan based on an SBOM or lockfile:<\/p>\n<pre>osv-scanner --sbom=sbom.json\r\nosv-scanner --lockfile=lock.json\r\nosv-scanner --docker image_name:latest<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>OSV-Scanner is a command-line open source tool developed by Google&#8217;s Open Source Security Team to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-3156","post","type-post","status-publish","format-standard","hentry","category-programming"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3156"}],"version-history":[{"count":4,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3156\/revisions"}],"predecessor-version":[{"id":5663,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3156\/revisions\/5663"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}