Dependency Scanner
Last updated
Last updated
The Dependency Scanner (DS) is a useful tool to collect and analyze the dependencies of a software project. Aimed at identifying issues related to software supply-chain security. Dependencies are components or packages used in software that will be analyzed for known vulnerabilities or evidence of malware.
Use the following command to generate a list of both direct and indirect dependencies used within your project and identify potentially risky dependencies. Then upload them to the Xygeni Platform for review.
The Open Source Dependencies Scanner is launched using the xygeni deps [options]
command.
To view all available options, use the --help
flag:
The most important properties are:
Name of the Xygeni Project -n
or --name
.
Input source to analyze. Either specify a directory with: -d
or --dir
or specify a repository using: --repo
. The scan will analyze the current working directory when no target is specified.
Upload results to the service --upload
. By default, results are not uploaded.
Output file (-o
or --output
) and format (-f
or --format
). If no output file is specified (or stdout / - are used), the standard output is used. Use --format=none
for no output.
Specify what detectors to run with the --detectors
/ --skip-detectors
options. A common use-case is to consider only issues with high or critical severity with --detectors=high
.
A Software Bill Of Materials (SBOM) is an inventory that details the components, including direct and indirect dependencies, along with their relationships and relevant metadata.
The xygeni deps
can be used to generate the SBOM, in the following formats:
SBOM properties: output file --sbom
and format --sbom-format
. See for an example.
, a lightweight Software Bill of Materials (SBOM) standard designed for use in application security contexts and supply chain component analysis..
, The Software Package Data Exchange open standard (ISO/IEC 5962:2021).