https://korea-wg.openchainproject.org/en/tags/osv-scalibr/Recent content in OSV-SCALIBR on OpenChain KWGHugoenhttps://korea-wg.openchainproject.org/en/guide/tools/4-osvscalibr/Mon, 01 Jan 0001 00:00:00 +0000https://korea-wg.openchainproject.org/en/guide/tools/4-osvscalibr/<p>OSV-SCALIBR (Open Source Vulnerabilities - Software Composition Analysis LIBRary) is an open source software composition analysis tool developed by Google. It scans filesystems, container images, and binaries to identify included packages and detects known vulnerabilities by cross-referencing the <a href="https://osv.dev/">OSV (Open Source Vulnerabilities)</a> database. It also supports SBOM generation in SPDX format.</p> <ul> <li>GitHub: <a href="https://github.com/google/osv-scalibr">https://github.com/google/osv-scalibr</a></li> <li>License: Apache-2.0</li> </ul> <h3 id="1-features">1. Features</h3> <ul> <li><strong>Multiple scan targets</strong>: Local filesystem, container images, archive files</li> <li><strong>Wide ecosystem support</strong>: Go, Python, Java (Maven), JavaScript (npm), Rust, Ruby, and more</li> <li><strong>OSV DB integration</strong>: Cross-references scan results with the OSV database to provide CVE and other vulnerability information</li> <li><strong>SBOM output</strong>: Exports results in SPDX 2.3 format</li> <li><strong>CLI and library</strong>: Provided as both a standalone binary (CLI) and a Go library</li> </ul> <h3 id="2-installation">2. Installation</h3> <p>Build with Go 1.21 or later:</p>