Osv-Scalibr FAQs

Question 1

Does OSV-Scalibr support container image analysis?

Accepted Answer

Yes, OSV-Scalibr supports container image analysis. You can scan remote images or local image tarballs using the `--remote-image` or `--image-tarball` flags, respectively.

Question 2

How do I generate SBOMs using OSV-Scalibr?

Accepted Answer

OSV-Scalibr can generate SPDX v2.3 SBOMs in JSON, YAML, or tag-value format. Use the `-o spdx23-json=result.spdx.json` flag, or similar, to specify the output format and file.

Question 3

How can I use OSV-Scalibr?

Accepted Answer

You can use it as a library within your Go projects, or through the OSV-Scanner CLI for command-line vulnerability scanning and extraction. A wrapper binary is also available.

Question 4

What is OSV-Scalibr?

Accepted Answer

OSV-Scalibr is a software composition analysis library that helps you extract software inventory data, detect known vulnerabilities, and generate Software Bill of Materials (SBOMs).

Question 5

What are the main features of OSV-Scalibr?

Accepted Answer

Key features include file system scanning for inventory, vulnerability detection via OSV, SBOM generation in SPDX format, container analysis, and guided remediation suggestions.

Osv-Scalibr

概要

主な機能

ユースケース