google / google/osv-scanner

How to scan C/C++ language with conan.lock?

Open
#884 3 comments 0 reactions 0 assignees View on GitHub
backlog question
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

Hi everyone,

I would like to use this great tool for scanning C/C++ language.

I already know how to scan C/C++ lanuage from github commit hash.

From [osv-scanner document](https://google.github.io/osv-scanner/supported-languages-and-lockfiles/), I found conan.lock can be used to scan also.
And from [API document](https://ossf.github.io/osv-schema/#affectedpackage-field), the ConanCenter echo system is included.

Therefore, I tried to install openssl package from [ConanCenter](https://conan.io/center/recipes/openssl?version=).

After installing, I tried to use following 2 ways to do OSV scan but both got "No issues found" result.

a. Scan by option "--sbom".
Because conan CLI can create the SBOM with CycloneDX format, so I created the SBOM file.

b. Scan by option "--lockfile".
The conan CLI can create conan.lock form conanfile.txt.

Could anyone share information for reference?

Thank you very much.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.