Gentoo Packages

Search

Install

Install this package:

emerge -a dev-util/osv-scanner

Package Information

Description:

OSV-Scanner is Google's official frontend to the OSV.dev vulnerability database. It scans a project's dependencies (lockfiles, SBOMs, container images, Git submodules and installed artifacts), matches them against known vulnerabilities in the OSV database, and reports actionable results. It also supports guided remediation to help upgrade affected packages.

Homepage:

https://google.github.io/osv-scanner/ https://github.com/google/osv-scanner

License:

Apache-2.0 BSD BSD-2 ISC MIT MPL-2.0 Unlicense

Versions

Metadata

Description

• OSV-Scanner is Google's official frontend to the OSV.dev vulnerability database. It scans a project's dependencies (lockfiles, SBOMs, container images, Git submodules and installed artifacts), matches them against known vulnerabilities in the OSV database, and reports actionable results. It also supports guided remediation to help upgrade affected packages.

Maintainers

• Lucas Couto (otakugeekx@gmail.com) - Type: person

Upstream

• Bugs: https://github.com/google/osv-scanner/issues
• Remote IDs:
  • github: google/osv-scanner

<pkgmetadata>
	<maintainer type="person">
		<email>otakugeekx@gmail.com</email>
		<name>Lucas Couto</name>
	</maintainer>
	<longdescription lang="en">
		OSV-Scanner is Google's official frontend to the OSV.dev
		vulnerability database. It scans a project's dependencies (lockfiles,
		SBOMs, container images, Git submodules and installed artifacts),
		matches them against known vulnerabilities in the OSV database, and
		reports actionable results. It also supports guided remediation to
		help upgrade affected packages.
	</longdescription>
	<upstream>
		<doc>https://google.github.io/osv-scanner/</doc>
		<bugs-to>https://github.com/google/osv-scanner/issues</bugs-to>
		<remote-id type="github">google/osv-scanner</remote-id>
	</upstream>
</pkgmetadata>

Lint Warnings

• Bypassing the network sandbox using `RESTRICT="network-sandbox"` violates Gentoo's core packaging policies. Ebuilds must support offline and reproducible builds, meaning all assets must be fetched via `SRC_URI` during the fetch phase and verified using Manifest checksums. To resolve this, you should package the required dependencies (e.g., node modules, cargo crates) into a tarball, host it, reference it in `SRC_URI` and perform an offline installation.
• [Error] Missing md5-cache for ebuild osv-scanner-2.4.0

Manifest