README.md

User Manual

For most users, the fossa-cli will work out-of-the-box without any configuration. Get an API key, run fossa analyze, and view your results in the FOSSA web application.

If you haven't read the Getting Started section in the README yet, we highly recommend starting there first.

This manual is organized into three sections:

1. Walkthroughs explain how to accomplish common use cases, including common troubleshooting steps and follow-ups.

2. Features explain specific CLI features and how to use them.

3. References provide an exhaustive listing and explanation of all CLI functionality.

Every piece of documentation is accessible via hyperlink from this user manual. You should never need to manually explore docs/ to find the page you need.

Table of Contents

• Quick Start

Concepts

• FOSSA CLI Concepts
• Analysis Targets
• Discovery and Analysis
• Strategy Tactics
• Static and Dynamic Strategies

Walkthroughs

• Integrating a project
• Debugging an Integration
• Analysis target configuration
• Custom integration
• Integrating a Conan Project
• Configuring SSL/TLS Support Manually
• Integrating Container Scanning in CI

Features

Analyzing Projects

• Language and Tool (Strategy) Support
• Configuring Which Targets Are Analyzed
  • Analyzing Specific Submodules
• Dynamic Strategy Command Selection
• fossa analyze Reference
• Vulnerable Reachability

Manually Specifying Dependencies

• Overview
• Deps from a Known Package Manager (Referenced Dependencies)
• Fully Specifying a Dep and License Manually (Custom Dependencies)
• Specifying a Source URL for Analysis (Remote Dependencies)
• Performance Characteristics of Manual Dependencies

Analyzing Vendored Dependencies

• Overview
• Vendored Dependency Names and Scope
• How Vendored Dependencies are Scanned
• Filtering Paths for License Scanning in Vendored Dependencies
• Path Filtering on Windows
• How to Debug Path Filters
• Vendored Dependency Performance
• Detecting Vendored Source Code with Vendored Source Identification (VSI)

Searching for Custom Keywords and Licenses

• Overview
• Keyword Searches
• License Text Searches
• Text Search Term Format
• Configuring Custom-License Searches Organization-Wide
  • Escape characters in organization-wide custom licenses searches
  • Turning Off Organization-Wide Custom-Licenses Searches

Analyzing Containers

• Overview
• How FOSSA's Container Scanner Works
• Container Image Sources
  • Exported docker archive
  • From Docker Engine
  • From Container Registries
• Supported Container Package Managers
• Container Jar File Analysis
• Distroless Containers
• Viewing Detected Projects
• Configuring Container Analysis Targets
• Integrating Container Scanning in CI
• Frequently Asked Questions
• Debugging
• Limitations & Workarounds
• Scanning Images using Podman (Experimental)

Analyzing SBOM Files

• Overview
• sbom analyze
• sbom test

Experimental Features

• Overview and Support Policy

Scanning Projects for Source Snippets

• Overview
• Quickstart
• Frequently Asked Questions

Subcommands

• fossa snippets analyze
• fossa snippets commit

References

CLI commands

• fossa analyze: Analyze a project.
• fossa container: Scan a container for vulnerabilities and compliance issues.
• fossa init: Generate sample config files.
• fossa list-targets: Retrieve a list of filterable targets in a project.
• fossa report: Download a report of the most recent scan of a project.
• fossa snippets: Analyze snippets of a project and check if they exist in other open source projects FOSSA knows about.
• fossa test: View the results of the most recent scan of a project.
• fossa release-group: Interact with FOSSA release groups.
• fossa project: Interact with FOSSA projects.

Configuration

• Specifying Dependencies Manually with fossa-deps.yml
• Specifying Project Settings with .fossa.yml
• Upgrading from FOSSA CLI v1 to a Supported FOSSA CLI

Troubleshooting

• Debugging FOSSA CLI
  • Debugging a Missing Project
  • Debugging a Failing Strategy
  • Debugging a FOSSA CLI Specific Error
  • Debugging with the Debug Bundle
• How to Debug Path Filters
• Debugging Container Analysis
• Understanding SSL/TLS Certificates and FOSSA

FAQs

When are you adding support for (some buildtool/language)?

If we don't support your choice of language/buildtool, please create a support ticket to express interest!

What kind of data gets uploaded to FOSSA's servers?

Please see our 'What data gets uploaded?' doc for more information.

How can I contribute a change to FOSSA CLI?

Please see our contributing documentation.