Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/microsoft/component-detection
Scans your project to determine what components you use
https://github.com/microsoft/component-detection
dependencies package-management sbom software-bill-of-materials software-composition-analysis static-analysis
Last synced: 5 days ago
JSON representation
Scans your project to determine what components you use
- Host: GitHub
- URL: https://github.com/microsoft/component-detection
- Owner: microsoft
- License: mit
- Created: 2021-11-16T22:07:13.000Z (about 3 years ago)
- Default Branch: main
- Last Pushed: 2024-11-28T03:24:27.000Z (14 days ago)
- Last Synced: 2024-11-30T18:32:20.906Z (12 days ago)
- Topics: dependencies, package-management, sbom, software-bill-of-materials, software-composition-analysis, static-analysis
- Language: C#
- Homepage:
- Size: 5.68 MB
- Stars: 440
- Watchers: 18
- Forks: 91
- Open Issues: 99
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE.txt
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
- awesome-software-supply-chain-security - microsoft/component-detection: Scans your project to determine what components you use
README
Component Detection
Automatically detect the open-source libraries you use.
Features •
Getting started •
Download •
Contributing
**Component Detection** (CD) is a package scanning tool that is intended to be used at build time. It produces a graph-based output of all detected components across a variety of package ecosystems.
Component Detection can also be used as a library to detect dependencies in your own applications.
## Features
Component Detection supports detecting libraries from the following ecosystem:
| Ecosystem | Scanning | Graph Creation |
| -------------------------------------------------------------------------------- | ----------------------------------------------- | -------------- |
| CocoaPods | ✔ | ✔ |
| [Go](docs/detectors/go.md) | ✔ | ❌ |
| [Gradle (lockfiles only)](docs/detectors/gradle.md) | ✔ | ❌ |
| [Linux (Debian, Alpine, Rhel, Centos, Fedora, Ubuntu)](docs/detectors//linux.md) | ✔ (via [syft](https://github.com/anchore/syft)) | ❌ |
| [Maven](docs/detectors/maven.md) | ✔ | ✔ |
| [NPM (including Yarn, Pnpm)](docs/detectors/npm.md) | ✔ | ✔ |
| [NuGet (including Paket)](docs/detectors/nuget.md) | ✔ | ✔ |
| [Pip (Python)](docs/detectors/pip.md) | ✔ | ✔ |
| [Poetry (Python, lockfiles only)](docs/detectors/poetry.md) | ✔ | ❌ |
| Ruby | ✔ | ✔ |
| Rust | ✔ | ✔ |
For a complete feature overview refer to [feature-overview.md](docs/feature-overview.md)
## Getting Started
To clone and run this application, you'll need [Git](https://git-scm.com) and [.NET 6](https://aka.ms/download-dotnet) installed on your computer. From your command line:
```bash
# Clone this repository
$ git clone https://github.com/microsoft/component-detection
# Go into the repository
$ cd component-detection
# Run the app
$ dotnet run --project ".\src\Microsoft.ComponentDetection\Microsoft.ComponentDetection.csproj" scan --SourceDirectory [PATH TO THE REPO TO SCAN]
```
View the [detector arguments](docs/detector-arguments.md) for more information on how to use the tool.
## Download
You can [download](https://github.com/microsoft/component-detection/releases/latest) the latest version of Component Detection for Windows, macOS and Linux.
## Contributing
### Using Codespaces
You can use [GitHub Codespaces](https://docs.github.com/en/codespaces/overview) to run and develop Component Detection in the cloud. To do so, click the green "Code" button at the top of the repository and select "Open with Codespaces". This will open a new Codespace with the repository cloned and ready to go.
### Using VS Code DevContainer
This is similar to Codespaces:
1. Make sure you meet [the requirements](https://code.visualstudio.com/docs/remote/containers#_getting-started) and follow the installation steps for DevContainers in VS Code
1. `git clone https://github.com/microsoft/component-detection`
1. Open this repo in VS Code
1. A notification should popup to reopen the workspace in the container. If it doesn't, open the [`Command Palette`](https://code.visualstudio.com/docs/getstarted/tips-and-tricks#_command-palette) and type `Remote-Containers: Reopen in Container`.
### Community Meetings
Once a month, we host a community meeting that anyone is allowed to join and discuss the project. We typically cover the changes over the last month, the roadmap and issues, and any questions or concerns that the community has.
You can find the future and past meeting details in the [Community Meeting Overview](https://github.com/microsoft/component-detection/issues/47).
You can additionally find the details in the [Discussions Tab](https://github.com/microsoft/component-detection/discussions).
# Telemetry
By default, telemetry will output to your output file path and will be a JSON blob. No data is submitted to Microsoft.
# Code of Conduct
This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/)
or contact [[email protected]](mailto:[email protected]) with any additional questions or comments.
# Trademarks
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.