Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update readme usage section #171

Merged
merged 15 commits into from
Feb 2, 2023
39 changes: 15 additions & 24 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,46 +83,43 @@ All releases on the same Major version will be guaranteed to have backward compa

## Usage

OSV-Scanner collects a list of dependencies and versions that are used in your project, before matching this list against the OSV database via the [OSV.dev API](https://osv.dev#use-the-api). To build the list of dependencies, you can point OSV-Scanner at your project directory, or manually pass in the path to individual manifest files.
OSV-scanner parses lockfiles, SBOMs, and git directories to determine your project's open source dependencies. These dependencies are matched against the the OSV database via the [OSV.dev API](https://osv.dev#use-the-api) and known vulnerabilities are returned to you in the output.
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

### Scan a directory
### General Use Case: Scanning a Directory
hayleycd marked this conversation as resolved.
Show resolved Hide resolved
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

Walks through a list of directories to find:
```console
osv-scanner -r /path/to/your/dir
```

- Lockfiles
- SBOMs
- git directories for the latest commit hash
The above command will find lockfiles, SBOMs, and git directories in your target directory and use them to determine the dependencies to check against the OSV database. It will give you the most complete understanding of the known vulnerabilities in your project.
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

which is used to build the list of dependencies to be matched against OSV vulnerabilities.
The recursive flag `-r` or `--recursive` will tell the scanner to search all subdirectories in addition to the specified directory. It can find additional lockfiles, dependencies, and vulnerabilities. If your project has deeply nested subdirectories, a recursive search may take a long time.

Can be configured to recursively walk through subdirectories with the `--recursive` / `-r` flag.
Git directories are searched for the latest commit hash. Searching for git commit has is intended to work with projects that use git submodules or a similar mechanism where dependencies are checked out as real git repositories.
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

Searching for git commit hash is intended to work with projects that use
git submodules or a similar mechanism where dependencies are checked out
as real git repositories.
### Specify SBOM

#### Example
If you want to see the vulnerabilities only from dependencies in your SBOM use the following command:
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

```console
osv-scanner -r /path/to/your/dir
osv-scanner --sbom=/path/to/your/sbom.json
```

### Input an SBOM

[SPDX] and [CycloneDX] SBOMs using [Package URLs] are supported. The format is
auto-detected based on the input file contents.

[SPDX]: https://spdx.dev/
[CycloneDX]: https://cyclonedx.org/
[Package URLs]: https://github.com/package-url/purl-spec

#### Example
### Specify Lockfile(s)
If you want to see vulnerabilities from specific lockfiles, you can use the following command:
hayleycd marked this conversation as resolved.
Show resolved Hide resolved

```console
osv-scanner --sbom=/path/to/your/sbom.json
osv-scanner --lockfile=/path/to/your/package-lock.json --lockfile=/path/to/another/Cargo.lock
```

### Input a lockfile
It is possible to specify more than one lockfile at a time.

A wide range of lockfiles are supported by utilizing this [lockfile package](https://github.com/google/osv-scanner/tree/main/pkg/lockfile). This is the current list of supported lockfiles:

Expand All @@ -145,12 +142,6 @@ A wide range of lockfiles are supported by utilizing this [lockfile package](htt
- `yarn.lock`
- `/lib/apk/db/installed` (Alpine)

#### Example

```console
$ osv-scanner --lockfile=/path/to/your/package-lock.json --lockfile=/path/to/another/Cargo.lock
```

### Scanning a Debian based docker image packages (preview)

This tool will scrape the list of installed packages in a Debian image and query for vulnerabilities on them.
Expand Down