How to scan C/C++ language with conan.lock?
- Dominant language
- Go
- Stars
- 11k
- Forks
- 792
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 48
Description
Hi everyone,
I would like to use this great tool for scanning C/C++ language.
I already know how to scan C/C++ lanuage from github commit hash.
From [osv-scanner document](https://google.github.io/osv-scanner/supported-languages-and-lockfiles/), I found conan.lock can be used to scan also.
And from [API document](https://ossf.github.io/osv-schema/#affectedpackage-field), the ConanCenter echo system is included.
Therefore, I tried to install openssl package from [ConanCenter](https://conan.io/center/recipes/openssl?version=).
After installing, I tried to use following 2 ways to do OSV scan but both got "No issues found" result.
a. Scan by option "--sbom".
Because conan CLI can create the SBOM with CycloneDX format, so I created the SBOM file.
b. Scan by option "--lockfile".
The conan CLI can create conan.lock form conanfile.txt.
Could anyone share information for reference?
Thank you very much.
Contributor guide
Assessment
This issue has not been assessed yet.