{"id":36613898,"url":"https://github.com/scanoss/scanoss-sonar-plugin","last_synced_at":"2026-01-12T09:04:16.450Z","repository":{"id":173419353,"uuid":"650744871","full_name":"scanoss/scanoss-sonar-plugin","owner":"scanoss","description":"SonarQube Plugin leveraging the SCANOSS Java SDK to perform scans, compatible with SonarQube 10.x.","archived":false,"fork":false,"pushed_at":"2025-02-17T11:09:59.000Z","size":98,"stargazers_count":3,"open_issues_count":1,"forks_count":1,"subscribers_count":5,"default_branch":"main","last_synced_at":"2025-02-17T12:23:28.911Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/scanoss.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-06-07T18:03:49.000Z","updated_at":"2024-10-15T16:20:51.000Z","dependencies_parsed_at":"2024-04-08T13:29:54.020Z","dependency_job_id":"d98b89ab-42d1-4b03-902c-add6c8970471","html_url":"https://github.com/scanoss/scanoss-sonar-plugin","commit_stats":null,"previous_names":["scanoss/scanoss-sonar-example-plugin"],"tags_count":10,"template":false,"template_full_name":null,"purl":"pkg:github/scanoss/scanoss-sonar-plugin","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fscanoss-sonar-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fscanoss-sonar-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fscanoss-sonar-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fscanoss-sonar-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/scanoss","download_url":"https://codeload.github.com/scanoss/scanoss-sonar-plugin/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/scanoss%2Fscanoss-sonar-plugin/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28337617,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-12T06:09:07.588Z","status":"ssl_error","status_checked_at":"2026-01-12T06:05:18.301Z","response_time":98,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-12T09:04:13.336Z","updated_at":"2026-01-12T09:04:16.427Z","avatar_url":"https://github.com/scanoss.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"SCANOSS SonarQube Custom Plugin\n==========\n\nSonarQube Plugin leveraging the SCANOSS Java SDK to perform scans, compatible with SonarQube 10.x.\n\n## Breaking change v1.0.1\n\n- Removed parameters:\n  - `identify.json`\n  - `ignore.json`\n\n### Converting from sbom.json to scanoss.json\nThe SBOM configuration format has changed and the file name must be updated from **sbom.json** to **scanoss.json**. Here's how to convert your existing configuration:\n\nOld format (sbom.json):\n```json\n{\n  \"components\": [\n    {\n      \"purl\": \"pkg:github/scanoss/scanner.c\"\n    }\n  ]\n}\n```\n\nNew format (scanoss.json):\n```json\n{\n  \"bom\": {\n    \"include\": [\n      {\n        \"purl\": \"pkg:github/scanoss/scanner.c\"\n      }\n    ]\n  }\n}\n```\n\n## Features\n\n### Capabilities\n* High Precision Snippet Matching (HPSM)\n* SCANOSS Settings Ingestion\n\n### Reported metrics \n* Copyleft License Count\n* Copyright Declarations Count\n* Vulnerability Count\n\n### Reported Issues\n* Undeclared Components\n\n**NOTE**: Some information may require a SCANOSS Premium subscription. \n\n## Building\n\nTo build the plugin JAR file, call:\n\n```\nmvn clean package\n```\n\nThe JAR will be deployed to `target/scanoss-sonar-plugin-VERSION.jar`. Copy this to your SonarQube's `extensions/plugins/` directory, and re-start SonarQube.\n\n## How to use\n\nOnce the plugin has been copied into SonarQube, restart Sonar and proceed to configure the SCANOSS plugin as needed.\n\n### Configuration options:\n| **Parameter**              | **Description**                                                                                                                                          | **Required** | **Default**             | \n|----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|-------------------------|\n| Scan API URL               | SCANOSS API Endpoint with format \"http(s)://host:ip\".                                                                                                    | Optional     | `https://api.osskb.org` |\n| Scan API Token             | SCANOSS API token.                                                                                                                                       | Optional     | -                       |\n| Custom Certificate Chain   | The custom certificate chain pem value.                                                                                                                  | Optional     | -                       |\n| SCANOSS HPSM               | Use High Precision Snippet Matching algorithm (Only available with premium subscription).                                                                | Optional     | `false`                 |\n| SCANOSS Settings           | Settings file to use for scanning. See the SCANOSS settings [documentation](https://scanoss.readthedocs.io/projects/scanoss-py/en/latest/#settings-file) | Optional     | `true`                  |\n| SCANOSS Settings File Path | Filepath of the SCANOSS settings to be used for scanning                                                                                                 | Optional     | `scanoss.json`          |\n\n\n\n### Issues Reporting\n\nThe plugin identifies Undeclared Components that are not listed in the SCANOSS settings file.\n\nTo activate this feature, ensure that you have configured the SCANOSS Settings file and set up the following Quality Profile.\n\n#### Setting Up Quality Profile\n1. Navigate to the Quality Profile tab.\n2. In the desired language section, create a new profile named \"SCANOSS Way\".\n3. Within the \"SCANOSS Way\" profile, include a new activity.\n4. Search for the \"Undeclared Component\" activity in the SCANOSS Analyser repository.\n5. Activate the \"Undeclared Component\" activity to add it to the \"SCANOSS Way\" profile.\n\n#### Setting Up Project Quality Profile or issues\n1. Navigate to your project.\n2. Click on Project Settings and select Quality Profiles option.\n3. Click on \"Add language\".\n4. Choose \"text\" language and select \"SCANOSS Way\" profile.\n\n\n### Running\n\nTo run a scan, execute the following command:\n\n```\nexport SONARQUBE_URL=host.docker.internal:9000\nexport PROJECT_KEY=[PROJECT_KEY]\nexport myAuthenticationToken=[AUTH_TOKEN]\ndocker run \\\n    --rm \\\n    --add-host=host.docker.internal:host-gateway \\\n    -e SONAR_HOST_URL=\"http://${SONARQUBE_URL}\" \\\n    -e SONAR_SCANNER_OPTS=\"-Dsonar.projectKey=${PROJECT_KEY}\" \\\n    -e SONAR_TOKEN=\"${myAuthenticationToken}\" \\\n    -v \"$(pwd):/usr/src\" \\\n    sonarsource/sonar-scanner-cli -Dsonar.java.binaries=target    \n```\n\n\n\n# Extracting SCANOSS data from Sonar Web API\n\n## API Requirements:\nAccess to the Sonar Web API requires a user-type token. Refer to the SonarQube API documentation https://next.sonarqube.com/sonarqube/web_api.\n\n\n## Authorization:\nFollowing header in your request is required:\nAuthorization: Bearer [TOKEN]\n\n## Metrics API\n\n- ### List metrics\n  This endpoint lists all available metrics and can be filtered to find all SCANOSS metrics\n\n       https://{SONARQUBE_URL}/api/metrics/search?ps=500\n\n- ### Show metric\n  This endpoint shows details of the given metrics\n\n       https://{SONARQUBE_URL}/api/measures/component?component=integration-sonarqube\u0026metricKeys=copyleft_license_count,copyright_count,vulnerability_count \n\n- ### Issues API\n    This endpoint allows searching of created issues given a Rule ID\n    \n      https://{SONARQUBE_URL}/api/issues/search?rules=SCANOSS:UndeclaredComponent","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscanoss%2Fscanoss-sonar-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fscanoss%2Fscanoss-sonar-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fscanoss%2Fscanoss-sonar-plugin/lists"}