google/osv-scalibr
OSV-SCALIBR: A library for Software Composition Analysis
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
2 releases in the last 90 days, the latest 36 days ago, with 108 contributors on GitHub.
Gained 48% fewer stars in the last 90 days than in the 90 days before.
Use Cases & Benefits
- Provides an extensible Go library for software composition analysis including vulnerability detection and software inventory extraction.
- Enables detailed scanning with built-in and custom plugins for file systems and container images, supporting SPDX generation and guided remediation.
- Use for scanning Linux-based container images to detect known vulnerabilities and generate SBOMs.
- Use for integrating custom vulnerability detection or inventory extraction plugins into Go-based security tools.
- Use for generating SPDX v2.3 compliant software bill of materials in multiple formats for compliance and auditing.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Apache 2.0
Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
OSV-SCALIBR (Software Composition Analysis Library) is an extensible library providing:
installed language packages) and detect known vulnerabilities or generate SBOMs. See the list of currently supported software inventory types.
This can be used as a library with a custom wrapper to perform scans on e.g. container images (only linux-based currently) or remote hosts, or via the OSV-Scanner CLI. It comes with built-in plugins for inventory extraction and vulnerability detection and it also allows users to run their custom plugins.
To build OSV-SCALIBR, you'll need to have
goinstalled. Follow https://go.dev/doc/install.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
Forks
210+31
Open issues
317-22
Compared with peers in Backend
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 1, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| anthropics/skills | 187.8K | +2.9K | 15 | — |
| DuarteSantos8/openGym | 19.7K | +2.4K | 60 | 2 days ago |
| shiyu-coder/Kronos | 47.0K | +2.3K | 16 | — |
| NationalSecurityAgency/ghidra | 98.2K | +2.3K | 64 | 14 days ago |
| microsoft/VibeVoice | 56.0K | +1.1K | 29 | — |
| google/osv-scalibr | 651 | — | 63 | 36 days ago |
| Category median | 56.0K | +2.3K | 29 | — |
Also by google
Other repositories from this maintainer that GStars tracks
- 54.2K stars
material-design-icons
Material Design icons by Google (Material Symbols)
- Java51.9K stars
guava
Google core libraries for Java
- JavaScript45.8K stars
zx
A tool for writing better scripts
- C++39.7K stars
googletest
GoogleTest - Google Testing and Mocking Framework
- Python39.0K stars
langextract
A Python library for extracting structured information from unstructured text using LLMs with precise source grounding and interactive visualization.
Discover Repositories
Search across tracked repositories by name or description