In December 2022, we introduced OSV-Scanner, a software to allow builders to simply scan for vulnerabilities of their open supply dependencies. Along with the open supply group, we’ve continued to construct this software, including remediation options, in addition to increasing ecosystem help to 11 programming languages and 20 package deal supervisor codecs.
Right this moment, we’re excited to launch OSV-SCALIBR (Software program Composition Evaluation LIBRary), an extensible library for SCA and file system scanning. OSV-SCALIBR combines Google’s inner vulnerability administration experience into one scanning library with vital new capabilities corresponding to:
-
SCA for put in packages, standalone binaries, in addition to supply code
-
OSes package deal scanning on Linux (COS, Debian, Ubuntu, RHEL, and way more), Home windows, and Mac
-
Artifact and lockfile scanning in main language ecosystems (Go, Java, Javascript, Python, Ruby, and way more)
-
Vulnerability scanning instruments corresponding to weak credential detectors for Linux, Home windows, and Mac
-
SBOM era in SPDX and CycloneDX, the 2 hottest doc codecs
-
Optimization for on-host scanning of useful resource constrained environments the place efficiency and low useful resource consumption is essential
OSV-SCALIBR is now the first SCA engine used inside Google for reside hosts, code repos, and containers. It’s been used and examined extensively throughout many alternative merchandise and inner instruments to assist generate SBOMs, discover vulnerabilities, and assist shield our customers’ knowledge at Google scale.
We provide OSV-SCALIBR primarily as an open supply Go library in the present day, and we’re engaged on including its new capabilities into OSV-Scanner as the first CLI interface.
Utilizing OSV-SCALIBR as a library
All of OSV-SCALIBR’s capabilities are modularized into plugins for software program extraction and vulnerability detection that are quite simple to increase.You should use OSV-SCALIBR as a library to:
1.Generate SBOMs from the construct artifacts and code repos in your reside host:
2. Scan a git repo for SBOMs:
Merely substitute “/” with the trail to your git repo. Additionally check out the varied language extractors to allow for code scanning.
3. Scan a distant container for SBOMs:
Change the scan config from the above code snippet with
4. Discover vulnerabilities in your filesystem or a distant container:
Extract the PURLs from the SCALIBR stock outcomes from the earlier steps:
And ship them to osv.dev, e.g.
See the utilization docs for extra particulars.
OSV-Scanner + OSV-SCALIBR
Customers in search of an out-of-the-box vulnerability scanning CLI software ought to take a look at OSV-Scanner, which already offers complete language package deal scanning capabilities utilizing a lot of the identical extraction as OSV-SCALIBR.
A few of OSV-SCALIBR’s capabilities are usually not but out there in OSV-Scanner, however we’re at the moment engaged on integrating OSV-SCALIBR extra deeply into OSV-Scanner. It will make increasingly more of OSV-SCALIBR’s capabilities out there in OSV-Scanner within the subsequent few months, together with put in package deal extraction, weak credentials scanning, SBOM era, and extra.
Look out quickly for an announcement of OSV-Scanner V2 with many of those new options out there. OSV-Scanner will change into the first frontend to the OSV-SCALIBR library for customers who require a CLI interface. Present customers of OSV-Scanner can proceed to make use of the software the identical manner, with backwards compatibility maintained for all current use circumstances.
For set up and utilization directions, take a look at OSV-Scanner’s documentation right here.
What’s subsequent
Along with making all of OSV-SCALIBR’s options out there in OSV-Scanner, we’re additionally engaged on further new capabilities. Here is a number of the issues you may count on:
-
Help for extra OS and language ecosystems, each for normal extraction and for Guided Remediation
-
Layer attribution and base picture identification for container scanning
-
Reachability evaluation to cut back false optimistic vulnerability matches
-
Extra vulnerability and misconfiguration detectors for Home windows
-
Extra weak credentials detectors
We hope that this library helps builders and organizations to safe their software program and encourages the open supply group to contribute again by sharing new plugins on prime of OSV-SCALIBR.
You probably have any questions or if you want to contribute, do not hesitate to achieve out to us at osv-discuss@google.com or by posting a difficulty in our situation tracker.
