osvscanner

package
v2.3.2 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jan 15, 2026 License: Apache-2.0 Imports: 61 Imported by: 5

Documentation

Overview

Package osvscanner provides the main logic for the OSV-Scanner.

Index

Constants

This section is empty.

Variables

View Source
var ErrAPIFailed = errors.New("API query failed")

ErrAPIFailed describes errors related to querying API endpoints. TODO(v2): Actually use this error

View Source
var ErrExtractorNotFound = errors.New("could not determine extractor suitable to this file")
View Source
var ErrNoPackagesFound = errors.New("no packages found in scan")

ErrNoPackagesFound for when no packages are found during a scan.

View Source
var ErrVulnerabilitiesFound = errors.New("vulnerabilities found")

ErrVulnerabilitiesFound includes vulnerabilities, license violations, and package deprecation, however, will not be raised if only uncalled vulnerabilities are found.

Functions

func DoContainerScan

func DoContainerScan(actions ScannerActions) (models.VulnerabilityResults, error)

func DoScan

DoScan performs the osv scanner action, with optional reporter to output information

func SetLogger added in v2.2.0

func SetLogger(handler slog.Handler)

SetLogger sets the global slog handler for the cmdlogger.

Types

type ExperimentalScannerActions

type ExperimentalScannerActions struct {
	TransitiveScanning TransitiveScanningActions

	PluginsEnabled    []string
	PluginsDisabled   []string
	PluginsNoDefaults bool

	// Currently unused.
	// TODO(another-rex): Use or wrap this
	StatsCollector stats.Collector

	HTTPClient *http.Client

	// Report deprecated packages as findings
	FlagDeprecatedPackages bool

	// Allows specifying user agent
	RequestUserAgent string
}

type ExternalAccessors

type ExternalAccessors struct {
	// Matchers
	VulnMatcher    clientinterfaces.VulnerabilityMatcher
	LicenseMatcher clientinterfaces.LicenseMatcher

	// Required for vendored Extractor
	OSVDevClient *osvdev.OSVClient
}

type ScannerActions

type ScannerActions struct {
	ExperimentalScannerActions

	LockfilePaths      []string
	DirectoryPaths     []string
	GitCommits         []string
	Recursive          bool
	IncludeGitRoot     bool
	NoIgnore           bool
	Image              string
	IsImageArchive     bool
	ConfigOverridePath string
	CallAnalysisStates map[string]bool
	ShowAllPackages    bool
	ShowAllVulns       bool

	// local databases
	CompareOffline    bool
	DownloadDatabases bool
	LocalDBPath       string

	// license scanning
	ScanLicensesSummary   bool
	ScanLicensesAllowlist []string

	// Deprecated: in favor of LockfilePaths
	SBOMPaths []string
}

type TransitiveScanningActions

type TransitiveScanningActions struct {
	Disabled         bool
	NativeDataSource bool
	MavenRegistry    string
}

Directories

Path Synopsis
internal
imagehelpers
Package imagehelpers provides helper functions for working with container images.
Package imagehelpers provides helper functions for working with container images.
scanners
Package scanners provides functionality for scanning lockfiles.
Package scanners provides functionality for scanning lockfiles.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL