Installation

Weitere Installationsbefehle

macOS

Homebrewverifiziert · 100%

brew install sonar-scanner

local Homebrew formula metadata

Linux

Alpine Linux apkverifiziert · 92%

sudo apk add sonar-scanner

Alpine Linux edge package indexes · sonar-scanner · Quelle: dl-cdn.alpinelinux.org

Windows

Scoopverifiziert · 92%

scoop install main/sonar-scanner

Scoop official bucket manifest trees · bucket/sonar-scanner.json · Quelle: api.github.com

Überblick

Paketzusammenfassung

Launcher to analyze a project with SonarQube

Projektlinks

Befehle und Aliase

sonar-scanner

Verlauf

Projektgeschichte und Nutzung

SonarScanner CLI is SonarSource's command-line scanner for running SonarQube Server and SonarQube Cloud code analysis when there is no build-system-specific scanner. It is a CI/CD staple because it turns a checked-out source tree plus `sonar-project.properties` into an analysis uploaded to a Sonar service.

Projektgeschichte

The public GitHub repository is the official scanner CLI source tree, and its tags include older 2.x releases. Current SonarSource documentation presents a maintained release line from 4.x through 8.x, with the README stating that project configuration is read from `sonar-project.properties` or passed on the command line.

Notable documented release changes include the 4.3 release using the SonarScanner name in logs, the 4.4 release adding a supported Docker image, the 5.0 release embedding Java 17, the 6.0 release adding a new bootstrapping mechanism and JRE provisioning for SonarQube 10.6+ and SonarCloud, and the 8.0.1 release updating embedded JREs to Java 21.

Adoptionsgeschichte

The scanner is distributed as OS-specific downloads, a Docker image, a generic JVM zip, and package-manager formulae. Homebrew analytics show tens of thousands of yearly installs, which fits its role as a common CI dependency rather than a library used inside application code.

Wie es verwendet wird

Users create `sonar-project.properties` in the project root, run `sonar-scanner`, and provide server/project credentials through scanner parameters, CI secrets, or environment configuration rather than a dedicated credentials file. SonarSource warns users to prefer dedicated Maven, Gradle, or .NET scanners for those build systems.

Warum Paket-Nerds sich dafür interessieren

SonarScanner CLI matters to package maintainers because CI images and developer machines need a reproducible scanner binary with the right Java behavior. Changes such as embedded JRE updates, Docker distribution, and auto-provisioning affect whether a package works in minimal runners, corporate networks, and long-lived build pipelines.

Zeitleiste

2019: SonarScanner CLI 4.3 documents use of the SonarScanner name in logs.
2020: Version 4.4 adds a supported Docker image.
2023: Version 5.0 updates the embedded JRE to Java 17.
2024: Version 6.0 adds new bootstrapping and JRE provisioning.
2025: Version 7.3 adds z/OS support for scanner execution.
2025: Version 8.0.1 updates embedded JREs to Java 21.

Related projects

SonarQube Server and SonarQube Cloud receive the analysis results.
Dedicated SonarScanners exist for Maven, Gradle, and .NET and are recommended for those ecosystems.
The scanner is also distributed as the official `sonarsource/sonar-scanner-cli` Docker image.

Quellen

Sicherheitslage

Risikostufe: grün

narrow executable package without higher-risk signals.

Risikoklassifikator

grün Risiko · niedrig Konfidenz · appliance

Warum

narrow executable package without higher-risk signals

Signale

metadata:no-higher-risk-signals

Installationsverhalten

In den Formelmetadaten ist kein Homebrew-Post-install-Hook erfasst.
Homebrew-Bottle-Metadaten sind für 1 Plattformziele verfügbar.
Installiert mit 1 Laufzeitabhängigkeiten.

Empfohlene Prüfung

Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix: sonar-project.properties${scanner.home}/conf/sonar-scanner.properties

Executables

Installierte Executables

Befehl	Art	Sichtbarkeit	Hinweis
`sonar-scanner`	cli	globales Executable

Aktualität

Version und Aktualität

Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.

Seite generiert2026-08-04

Manager-Version8.1.0.6389

Manager aktualisiert

lokale DatenOK

Upstreamnot checked

neueste erkannte Versionnicht erkannt

https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/

InfoNo package-manager update timestamp was available.niedrig Konfidenz
InfoRelease/tag comparison is only available for GitHub repositories.https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/none Konfidenz

Installationsmetadaten

Paketmetadaten

Paketschlüssel	brew:sonar-scanner
Version	8.1.0.6389
Paketmanager	Homebrew
Paketmanager-Seite	https://formulae.brew.sh/formula/sonar-scanner
Homepage	https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/
Repository	https://github.com/SonarSource/sonar-scanner-cli
Upstream-Dokumentation	https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/
Lizenz	LGPL-3.0-or-later
Quellarchiv	https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-8.1.0.6389.zip
Abhängigkeiten	openjdk
Bottle	verfügbar (auf all)
Homebrew post-install	nicht definiert
Dienst	keiner deklariert

Registry-Fakten

Details aus der Quelldatenbank

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	sonar-scanner
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

Source-Datenbank-Treffer

Andere Paketmanager-Einträge

Treffer stammen aus externen Paketmanager-Indizes und bleiben von lokalen Automic-Vault-Paketlinks getrennt.

apk95%

sonar-scanner 8.1.0.6389-r0

Scanner CLI for SonarQube and SonarCloud

https://github.com/SonarSource/sonar-scanner-cli

sudo apk add sonar-scanner

License: LGPL-3.0-or-later
Architecture: x86_64
Source Package: sonar-scanner
1 Abhängigkeiten
1 stellt bereit
normalized package name match
Abgeglichen nach: Sonar Scanner

Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: sonar-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

Scoop95%

main/sonar-scanner

scoop install main/sonar-scanner

normalized package name match
Abgeglichen nach: Sonar Scanner

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/sonar-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

Paketgraph

Links stammen aus dem lokalen Paketbeziehungsgraph, Ergänzungen, Abhängigkeitskanten, Ecosystem-Matches und Paket-Hub-Mitgliedschaft.

Quellspur

Aus Repository-Daten generiert

Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.

Combined YAML source

View the package source record on GitHub.

combined/sonar-scanner.yml

Verwendete Quellen

Geiger risk classifier
cross-ecosystem install command graph
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment
pkg.so package database
pkgdb category and tag curation

sonar-scanner mit Homebrew, apk, scoop installieren