In 2022, Google released a tool to easily scan for security vulnerabilities in dependencies. The tool was called OSV-Scanner.
“Together with the open source community, we’ve continued to develop this tool, adding remediation features,” according to Google’s security blog, “and expanded ecosystem support to 11 programming languages and 20 package management formats. Users looking for an out-of-the-box CLI vulnerability scanning tool should check out OSV-Scanner, which already provides comprehensive package scanning capabilities…”
So on Thursday they announced an extensible library for “software composition analysis” scanning (as well as file system scanning) called OSV-SCALIBR (from Open Source Vulnerability — Software Composition Analysis LIBRary).
The new library “combines Google’s internal expertise in vulnerability management into a scanning library with significant new capabilities.
“OSV-SCALIBR is now the primary software composition analysis engine used at Google for live servers, code repositories, and containers. It has been used and tested extensively across many different products and internal tools to help build SBOMs, find vulnerabilities, and protect user data at Google scale. Today, we offer OSV-SCALIBR primarily as an open source Go library, and we are working to add its new capabilities to OSV-Scanner as the primary CLI interface.”
George is still wondering what he is doing here….
