{"id":34967668,"url":"https://github.com/guacsec/trustify-da-javascript-client","last_synced_at":"2025-12-26T23:19:39.256Z","repository":{"id":175002308,"uuid":"648227388","full_name":"guacsec/trustify-da-javascript-client","owner":"guacsec","description":"Red-Hat Dependency Analytics Exhort JavaScript API","archived":false,"fork":false,"pushed_at":"2025-12-10T11:50:12.000Z","size":3522,"stargazers_count":1,"open_issues_count":25,"forks_count":10,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-12-10T12:58:01.010Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/guacsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":"DCO","cla":null}},"created_at":"2023-06-01T13:40:17.000Z","updated_at":"2025-12-10T11:49:06.000Z","dependencies_parsed_at":"2023-11-01T13:36:55.036Z","dependency_job_id":"dc736381-aa70-4001-93d6-75a32dccb8b6","html_url":"https://github.com/guacsec/trustify-da-javascript-client","commit_stats":null,"previous_names":["rhecosystemappeng/crda-javascript-api","rhecosystemappeng/exhort-javascript-api","trustification/exhort-javascript-api","guacsec/trustify-da-javascript-client"],"tags_count":160,"template":false,"template_full_name":null,"purl":"pkg:github/guacsec/trustify-da-javascript-client","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-da-javascript-client","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-da-javascript-client/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-da-javascript-client/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-da-javascript-client/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/guacsec","download_url":"https://codeload.github.com/guacsec/trustify-da-javascript-client/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify-da-javascript-client/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28064421,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-26T02:00:06.189Z","response_time":55,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-12-26T23:19:35.860Z","updated_at":"2025-12-26T23:19:39.247Z","avatar_url":"https://github.com/guacsec.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Trustify Dependency Analytics JavaScript Client\u003cbr/\u003e![latest-no-snapshot][0] ![latest-snapshot][1]\n\n* Looking for the OpenAPI Spec? Try [Trustify Dependency Analytics API](https://github.com/guacsec/trustify-da-api-spec)\n* Looking for our Java API? Try [Trustify Dependency Analytics Java Client](https://github.com/guacsec/trustify-da-java-client).\n* Looking for our Backend implementation? Try [Trustify Dependency Analytics](https://github.com/guacsec/trustify-dependency-analytics).\n\n\u003ch3\u003eUsage\u003c/h3\u003e\n\u003cp\u003e\n\n\u003cstrong\u003ePrerequisites:\u003c/strong\u003e The \u003ccode\u003eTRUSTIFY_DA_BACKEND_URL\u003c/code\u003e environment variable must be set to the URL of the Trustify Dependency Analytics backend service. You can set it as an environment variable or pass it in the options object (see \u003ca href=\"#customization\"\u003eCustomization\u003c/a\u003e section).\n\n\u003cul\u003e\n\u003cli\u003e\nUse as ESM Module from an ESM module\n\n```shell\nnpm install @trustify-da/trustify-da-javascript-client\n```\n\n```shell\n# Set the mandatory backend URL\nexport TRUSTIFY_DA_BACKEND_URL=https://trustify-da.example.com\n```\n\n```javascript\nimport client from '@trustify-da/trustify-da-javascript-client'\nimport fs from 'node:fs'\n\n// Get stack analysis in JSON format\nlet stackAnalysis = await client.stackAnalysis('/path/to/pom.xml')\n// Get stack analysis in HTML format (string)\nlet stackAnalysisHtml = await client.stackAnalysis('/path/to/pom.xml', true)\n// Get component analysis in JSON format\nlet componentAnalysis = await client.componentAnalysis('/path/to/pom.xml')\n// Get image analysis in JSON format\nlet imageAnalysis = await client.imageAnalysis(['docker.io/library/node:18'])\n// Get image analysis in HTML format (string)\nlet imageAnalysisHtml = await client.imageAnalysis(['docker.io/library/node:18'], true)\n// Analyze multiple images\nlet multipleImagesAnalysis = await client.imageAnalysis(['docker.io/library/node:18', 'docker.io/library/python:3.9'])\n// Specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)\nlet imageAnalysisWithArch = await client.imageAnalysis(['httpd:2.4.49^^amd64'])\n```\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cul\u003e\n\u003cli\u003e\nUse as ESM Module from Common-JS module\n\n```shell\nnpm install @trustify-da/trustify-da-javascript-client\n```\n\n```javascript\nasync function loadTrustifyDa()\n{\n// dynamic import is the only way to import ESM module into commonJS module\n  const { default: client } = await import('@trustify-da/trustify-da-javascript-client');\n  return client\n}\nconst runTrustifyDa = (manifestPath) =\u003e {\n  return new Promise(async ( resolve, reject) =\u003e {\n    try {\n      let stackAnalysisReport = await (await loadTrustifyDa()).stackAnalysis(manifestPath,false)\n      resolve(stackAnalysisReport)\n\n    } catch (error)\n    {\n      reject(error)\n    }\n  });\n};\n\nrunTrustifyDa(\"./path/to/manifest\").then(resp =\u003e console.log(JSON.stringify(resp,null,4)))\n```\n\u003c/li\u003e\n\n\u003cli\u003e\nUse as CLI Script\n\u003cdetails\u003e\n\u003csummary\u003eClick for help menu\u003c/summary\u003e\n\n```shell\n$ npx @trustify-da/trustify-da-javascript-client help\n\nUsage: trustify-da-javascript-client {component|stack|image|validate-token}\n\nCommands:\n  trustify-da-javascript-client stack \u003c/path/to/manifest\u003e [--html|--summary]               produce stack report for manifest path\n  trustify-da-javascript-client component \u003cpath/to/manifest\u003e [--summary]   produce component report for a manifest type and content\n  trustify-da-javascript-client image \u003cimage-refs..\u003e [--html|--summary]               produce image analysis report for OCI image references\n\nOptions:\n  --help  Show help                                                    [boolean]\n```\n\u003c/details\u003e\n\n```shell\n# get stack analysis in json format\n$ npx @trustify-da/trustify-da-javascript-client stack /path/to/pom.xml\n\n# get stack analysis in json format (summary only)\n$ npx @trustify-da/trustify-da-javascript-client stack /path/to/pom.xml --summary\n\n# get stack analysis in html format format\n$ npx @trustify-da/trustify-da-javascript-client stack /path/to/pom.xml --html\n\n# get component analysis\n$ npx @trustify-da/trustify-da-javascript-client component /path/to/pom.xml\n\n# get image analysis in json format\n$ npx @trustify-da/trustify-da-javascript-client image docker.io/library/node:18\n\n# get image analysis in json format (summary only)\n# Note: summary returns an object with imageRef as key\n$ npx @trustify-da/trustify-da-javascript-client image docker.io/library/node:18 --summary\n\n# get image analysis in html format\n$ npx @trustify-da/trustify-da-javascript-client image docker.io/library/node:18 --html\n\n# analyze multiple images\n$ npx @trustify-da/trustify-da-javascript-client image docker.io/library/node:18 docker.io/library/python:3.9\n\n# specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)\n$ npx @trustify-da/trustify-da-javascript-client image httpd:2.4.49^^amd64\n```\n\u003c/li\u003e\n\n\u003cli\u003e\nUse as Global Binary\n\n```shell\nnpm install --global @trustify-da/trustify-da-javascript-client\n```\n\n```shell\n# get stack analysis in json format\n$ trustify-da-javascript-client stack /path/to/pom.xml\n\n# get stack analysis in json format (summary only)\n$ trustify-da-javascript-client stack /path/to/pom.xml --summary\n\n# get stack analysis in html format format\n$ trustify-da-javascript-client stack /path/to/pom.xml --html\n\n# get component analysis\n$ trustify-da-javascript-client component /path/to/pom.xml\n\n# get image analysis in json format\n$ trustify-da-javascript-client image docker.io/library/node:18\n\n# get image analysis in json format (summary only)\n# Note: summary returns an object with imageRef as key\n$ trustify-da-javascript-client image docker.io/library/node:18 --summary\n\n# get image analysis in html format\n$ trustify-da-javascript-client image docker.io/library/node:18 --html\n\n# analyze multiple images\n$ trustify-da-javascript-client image docker.io/library/node:18 docker.io/library/python:3.9\n\n# specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)\n$ trustify-da-javascript-client image httpd:2.4.49^^amd64\n```\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eSupported Ecosystems\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.java.com/\"\u003eJava\u003c/a\u003e - \u003ca href=\"https://maven.apache.org/\"\u003eMaven\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.javascript.com/\"\u003eJavaScript\u003c/a\u003e - \u003ca href=\"https://www.npmjs.com/\"\u003eNpm\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.javascript.com/\"\u003eJavaScript\u003c/a\u003e - \u003ca href=\"https://pnpm.io/\"\u003epnpm\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.javascript.com/\"\u003eJavaScript\u003c/a\u003e - \u003ca href=\"https://classic.yarnpkg.com/\"\u003eYarn Classic\u003c/a\u003e /  \u003ca href=\"https://yarnpkg.com/\"\u003eYarn Berry\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://go.dev/\"\u003eGolang\u003c/a\u003e - \u003ca href=\"https://go.dev/blog/using-go-modules/\"\u003eGo Modules\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.python.org/\"\u003ePython\u003c/a\u003e - \u003ca href=\"https://pypi.org/project/pip/\"\u003epip Installer\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://gradle.org/\"\u003eGradle (Groovy and Kotlin DSL)\u003c/a\u003e - \u003ca href=\"https://gradle.org/install/\"\u003eGradle Installation\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eExcluding Packages\u003c/h3\u003e\n\u003cp\u003e\nExcluding a package from any analysis can be achieved by marking the package for exclusion.\n\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cem\u003eJava Maven\u003c/em\u003e users can add a comment in \u003cem\u003epom.xml\u003c/em\u003e\n\n```xml\n\u003cdependency\u003e \u003c!--exhortignore--\u003e\n  \u003cgroupId\u003e...\u003c/groupId\u003e\n  \u003cartifactId\u003e...\u003c/artifactId\u003e\n  \u003cversion\u003e...\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\u003c/li\u003e\n\n\u003c/ul\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cem\u003eJavascript\u003c/em\u003e users can add a root (key, value) pair with value of list of names (strings) to be ignored (without versions), and key called \u003cb\u003eexhortignore\u003c/b\u003e in \u003cem\u003epackage.json\u003c/em\u003e,  example:\n\n```json\n{\n  \"name\": \"sample\",\n  \"version\": \"1.0.0\",\n  \"description\": \"\",\n  \"main\": \"js\",\n  \"keywords\": [],\n  \"author\": \"\",\n  \"license\": \"ISC\",\n  \"dependencies\": {\n    \"dotenv\": \"^8.2.0\",\n    \"express\": \"^4.17.1\",\n    \"jsonwebtoken\": \"^8.5.1\",\n    \"mongoose\": \"^5.9.18\"\n  },\n  \"exhortignore\": [\n    \"jsonwebtoken\"\n  ]\n}\n```\n\n\u003cem\u003eGolang\u003c/em\u003e users can add in go.mod a comment with //exhortignore next to the package to be ignored, or to \"piggyback\" on existing comment ( e.g - //indirect) , for example:\n```go\nmodule github.com/trustify-da/SaaSi/deployer\n\ngo 1.19\n\nrequire (\n        github.com/gin-gonic/gin v1.9.1\n        github.com/google/uuid v1.1.2\n        github.com/jessevdk/go-flags v1.5.0 //exhortignore\n        github.com/kr/pretty v0.3.1\n        gopkg.in/yaml.v2 v2.4.0\n        k8s.io/apimachinery v0.26.1\n        k8s.io/client-go v0.26.1\n)\n\nrequire (\n        github.com/davecgh/go-spew v1.1.1 // indirect exhortignore\n        github.com/emicklei/go-restful/v3 v3.9.0 // indirect\n        github.com/go-logr/logr v1.2.3 // indirect //exhortignore\n\n)\n```\n\n\u003cem\u003ePython pip\u003c/em\u003e users can add in requirements.txt a comment with #exhortignore(or # exhortignore) to the right of the same artifact to be ignored, for example:\n```properties\nanyio==3.6.2\nasgiref==3.4.1\nbeautifulsoup4==4.12.2\ncertifi==2023.7.22\nchardet==4.0.0\nclick==8.0.4 #exhortignore\ncontextlib2==21.6.0\nfastapi==0.75.1\nFlask==2.0.3\nh11==0.13.0\nidna==2.10\nimmutables==0.19\nimportlib-metadata==4.8.3\nitsdangerous==2.0.1\nJinja2==3.0.3\nMarkupSafe==2.0.1\npydantic==1.9.2 # exhortignore\nrequests==2.25.1\nsix==1.16.0\nsniffio==1.2.0\nsoupsieve==2.3.2.post1\nstarlette==0.17.1\ntyping_extensions==4.1.1\nurllib3==1.26.16\nuvicorn==0.17.0\nWerkzeug==2.0.3\nzipp==3.6.0\n\n```\n\n\u003cem\u003eGradle\u003c/em\u003e users can add in build.gradle a comment with //exhortignore next to the package to be ignored:\n```build.gradle\nplugins {\nid 'java'\n}\n\ngroup = 'groupName'\nversion = 'version'\n\nrepositories {\n    mavenCentral()\n}\n\ndependencies {\n    implementation \"groupId:artifactId:version\" // exhortignore\n}\ntest {\n    useJUnitPlatform()\n}\n```\n\nAll of the 5 above examples are valid for marking a package to be ignored\n\u003c/li\u003e\n\n\u003c/ul\u003e\n\n\u003ch3\u003eCustomization\u003c/h3\u003e\n\u003cp\u003e\nThere are 2 approaches for customizing \u003cem\u003eTrustify Dependency Analytics JavaScript Client\u003c/em\u003e. Whether you're using this API as a\n\u003cem\u003eGlobal Module\u003c/em\u003e, a \u003cem\u003eRemote Script\u003c/em\u003e, or an \u003cem\u003eESM Module\u003c/em\u003e, you can use \u003cem\u003eEnvironment Variables\u003c/em\u003e\nfor various customization.\n\n\u003cstrong\u003eNote:\u003c/strong\u003e The \u003ccode\u003eTRUSTIFY_DA_BACKEND_URL\u003c/code\u003e environment variable is \u003cstrong\u003emandatory\u003c/strong\u003e and must be set to the URL of the Trustify Dependency Analytics backend service. Without this variable, the API will throw an error.\n\nHowever, \u003cem\u003eESM Module\u003c/em\u003e users, can opt for customizing programmatically:\n\n```javascript\nimport client from '@trustify-da/trustify-da-javascript-client'\nimport fs from 'node:fs'\n\nlet options = {\n  // Mandatory: Backend URL for Trustify Dependency Analytics service\n  'TRUSTIFY_DA_BACKEND_URL': 'https://api.trustify.dev',\n  'TRUSTIFY_DA_MVN_PATH': '/path/to/my/mvn',\n  'TRUSTIFY_DA_NPM_PATH': '/path/to/npm',\n  'TRUSTIFY_DA_PNPM_PATH': '/path/to/pnpm',\n  'TRUSTIFY_DA_GO_PATH': '/path/to/go',\n  //python - python3, pip3 take precedence if python version \u003e 3 installed\n  'TRUSTIFY_DA_PYTHON3_PATH' : '/path/to/python3',\n  'TRUSTIFY_DA_PIP3_PATH' : '/path/to/pip3',\n  'TRUSTIFY_DA_PYTHON_PATH' : '/path/to/python',\n  'TRUSTIFY_DA_PIP_PATH' : '/path/to/pip',\n  'TRUSTIFY_DA_GRADLE_PATH' : '/path/to/gradle',\n  // Configure proxy for all requests\n  'TRUSTIFY_DA_PROXY_URL': 'http://proxy.example.com:8080'\n}\n\n// Get stack analysis in JSON format ( all package managers, pom.xml is as an example here)\nlet stackAnalysis = await client.stackAnalysis('/path/to/pom.xml', false, options)\n// Get stack analysis in HTML format in string ( all package managers, pom.xml is as an example here)\nlet stackAnalysisHtml = await client.stackAnalysis('/path/to/pom.xml', true, options)\n\n// Get component analysis in JSON format\nlet componentAnalysis = await client.componentAnalysis('/path/to/pom.xml', options)\n\n// Get image analysis in JSON format\nlet imageAnalysis = await client.imageAnalysis(['docker.io/library/node:18'], false, options)\n// Get image analysis in HTML format in string\nlet imageAnalysisHtml = await client.imageAnalysis(['docker.io/library/node:18'], true, options)\n// Specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)\nlet imageAnalysisWithArch = await client.imageAnalysis(['httpd:2.4.49^^amd64'], false, options)\n```\n **_Environment variables takes precedence._**\n\u003c/p\u003e\n\n\u003ch4\u003eProxy Configuration\u003c/h4\u003e\n\u003cp\u003e\nYou can configure a proxy for all HTTP/HTTPS requests made by the API. This is useful when your environment requires going through a proxy to access external services.\n\nYou can set the proxy URL in two ways:\n\n1. Using environment variable:\n```shell\nexport TRUSTIFY_DA_PROXY_URL=http://proxy.example.com:8080\n```\n\n2. Using the options object when calling the API programmatically:\n```javascript\nconst options = {\n  'TRUSTIFY_DA_PROXY_URL': 'http://proxy.example.com:8080'\n}\n```\n\nThe proxy URL should be in the format: `http://host:port` or `https://host:port`. The API will automatically use the appropriate protocol (HTTP or HTTPS) based on the proxy URL provided.\n\u003c/p\u003e\n\n\u003ch4\u003eCustomizing Executables\u003c/h4\u003e\n\u003cp\u003e\nThis project uses each ecosystem's executable for creating dependency trees. These executables are expected to be\npresent on the system's PATH environment. If they are not, or perhaps you want to use custom ones. Use can use the\nfollowing keys for setting custom paths for the said executables.\n\u003c/p\u003e\n\n\u003ctable\u003e\n\u003ctr\u003e\n\u003cth\u003eEcosystem\u003c/th\u003e\n\u003cth\u003eDefault\u003c/th\u003e\n\u003cth\u003eExecutable Key\u003c/th\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://maven.apache.org/\"\u003eMaven\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003emvn\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_MVN_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://maven.apache.org/\"\u003eMaven\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003emaven\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PREFER_MVNW\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://www.npmjs.com/\"\u003eNPM\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003enpm\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_NPM_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://pnpm.io/\"\u003ePNPM\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003epnpm\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PNPM_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://classic.yarnpkg.com/\"\u003eYarn Classic\u003c/a\u003e / \u003ca href=\"https://yarnpkg.com/\"\u003eYarn Berry\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003eyarn\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_YARN_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://go.dev/blog/using-go-modules/\"\u003eGo Modules\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003ego\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_GO_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://www.python.org/\"\u003ePython programming language\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003epython3\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PYTHON3_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://pypi.org/project/pip/\"\u003ePython pip Package Installer\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003epip3\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PIP3_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://www.python.org/\"\u003ePython programming language\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003epython\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PYTHON_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://pypi.org/project/pip/\"\u003ePython pip Package Installer\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003epip\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PIP_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://gradle.org/\"\u003eGradle\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003egradle\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_GRADLE_PATH\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003e\u003ca href=\"https://gradle.org/\"\u003eGradle\u003c/a\u003e\u003c/td\u003e\n\u003ctd\u003e\u003cem\u003egradle\u003c/em\u003e\u003c/td\u003e\n\u003ctd\u003eTRUSTIFY_DA_PREFER_GRADLEW\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\n#### Match Manifest Versions Feature\n\n##### Background\n\nIn Python pip and in golang go modules package managers ( especially in Python pip) , There is a big chance that for a certain manifest and a given package inside it, the client machine environment has different version installed/resolved\nfor that package, which can lead to perform the analysis on the installed packages' versions , instead on the declared versions ( in manifests - that is requirements.txt/go.mod ), and this\ncan cause a confusion for the user in the client consuming the API and leads to inconsistent output ( in THE manifest there is version X For a given Package `A` , and in the analysis report there is another version for the same package `A` - Y).\n\n##### Usage\n\nTo eliminate confusion and improve clarity as discussed above, the following setting was introduced - `MATCH_MANIFEST_VERSIONS`, in the form of environment variable/key in opts ( as usual , environment variable takes precedence )\nfor two ecosystems:\n - Golang - Go Modules\n - Python - pip\n\nTwo possible values for this setting:\n\n1. MATCH_MANIFEST_VERSIONS=\"false\" - means that if installed/resolved versions of packages are different than the ones declared in the manifest, the process will ignore this difference and will continue to analysis with installed/resolved versions ( this is the original logic flow )\n\u003cbr\u003e\n\n\n2. MATCH_MANIFEST_VERSIONS=\"true\" - means that before starting the analysis,\n   the api will compare all the versions of packages in manifest against installed/resolved versions on client' environment, in case there is a difference, it will throw an error to the client/user with message containing the first encountered versions mismatch, including package name, and the versions difference, and will suggest to set setting `MATCH_MANIFEST_VERSIONS`=\"false\" to ignore all differences\n\n#### Golang Support\n\nBy default, Golang dependency resolution follows the [Minimal Version Selection (MVS) Algorithm](https://go.dev/ref/mod#minimal-version-selection).\nThis means that when analyzing a project, only the module versions that would actually be included in the final executable are considered.\n\nFor example, if your `go.mod` file declares two modules, `a` and `b`, and both depend on the same package `c` (same major version `v1`) but with different minor versions:\n\n- `namespace/c/v1@v1.1`\n- `namespace/c/v1@v1.2`\n\nOnly one of these versions — the minimal version selected by MVS — will be included in the generated SBOM and analysis results.\nThis mirrors the behavior of a real Go build, where only one minor version of a given major version can be present in the executable (since Go treats packages with the same name and major version as identical).\n\nThe MVS-based resolution is **enabled by default**.\nIf you want to disable this behavior and instead include **all transitive module versions** (as listed in `go.mod` dependencies), set the system property or environment variable:\n\n```bash\nTRUSTIFY_DA_GO_MVS_LOGIC_ENABLED=false\n```\n\n#### Python Support\n\nBy default, For python support, the api assumes that the package is installed using the pip/pip3 binary on the system PATH, or using the customized\nBinaries passed to environment variables. In any case, If the package is not installed , then an error will be thrown.\n\nThere is an experimental feature of installing the requirements.txt on a virtual env(only python3 or later is supported for this feature) - in this case,\nit's important to pass in a path to python3 binary as `TRUSTIFY_DA_PYTHON3_PATH` or instead make sure that python3 is on the system path.\nin such case, You can use that feature by setting environment variable `TRUSTIFY_DA_PYTHON_VIRTUAL_ENV` to true.\n\n##### \"Best Efforts Installation\"\nSince Python pip packages are very sensitive/picky regarding python version changes( every small range of versions is only tailored for a certain python version), I'm introducing this feature, that\ntries to install all packages in requirements.txt onto created virtual environment while **disregarding** versions declared for packages in requirements.txt.\nThis increasing the chances and the probability that the automatic installation will succeed.\n\n###### Usage\nA New setting is introduced - `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS` (as both env variable/key in `options` object)\n1. `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS`=\"false\" - install requirements.txt while respecting declared versions for all packages.\n2. `TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS`=\"true\" - install all packages from requirements.txt, not respecting the declared version, but trying to install a version tailored for the used python version. When using this setting, you must set setting `MATCH_MANIFEST_VERSIONS` to 'false'.\n\n##### Using `pipdeptree`\nBy default, The API algorithm will use native commands of PIP installer as data source to build the dependency tree.\nIt's also possible to use the lightweight Python PIP utility [pipdeptree](https://pypi.org/project/pipdeptree/) as data source instead. In order to activate this, you need to set the environment variable/option `TRUSTIFY_DA_PIP_USE_DEP_TREE` to 'true'.\n\n#### Toggle Red Hat Trusted Content recommendations\nBoth the HTML-based report and JSON response will by default contain recommendations for migrating to Red Hat-based Trusted Content repositories. This feature can be disabled by setting `TRUSTIFY_DA_RECOMMENDATIONS_ENABLED` to 'false' via environment variables or options.\n\n#### Additional CLI arguments\nFor some ecosystems we support passing additional CLI arguments to the underlying tools. The following table outlines the supported ecosystems and the environment variable/option that configures this. Note that the arguments are expected to be in the format of a JSON array.\n\n|Ecosystem|Key            |\n|---------|---------------|\n|Maven    |TRUSTIFY_DA_MVN_ARGS|\n\n\n\u003c!-- Badge links --\u003e\n[0]: https://img.shields.io/github/v/release/guacsec/trustify-da-javascript-client?color=green\u0026label=latest\n[1]: https://img.shields.io/github/v/release/guacsec/trustify-da-javascript-client?color=yellow\u0026include_prereleases\u0026label=early-access\n\n### Known Issues\n\n- For pip requirements.txt - It's been observed that for python versions 3.11.x, there might be slowness for invoking the analysis.\n  If you encounter a performance issue with version \u003e= 3.11.x, kindly try to set environment variable/option `TRUSTIFY_DA_PIP_USE_DEP_TREE=true`, before calling the analysis.\n\n\n- For maven pom.xml, it has been noticed that using java 17 might cause stack analysis to hang forever.\n  This is caused by maven [`dependency` plugin](https://maven.apache.org/plugins/maven-dependency-plugin/) bug when running with JDK/JRE' JVM version 17.\n\n  To overcome this, you can use any other java version (14,20,21, etc..). ( best way is to install JDK/JRE version different from 17 , and set the location of the installation in environment variable `JAVA_HOME` so maven will use it.)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify-da-javascript-client","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fguacsec%2Ftrustify-da-javascript-client","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify-da-javascript-client/lists"}