macOS
Homebrewverifiziert · 100%
brew install sonar-scannerprovider-native install command
brew / Rang 675
sonar-scanner mit Homebrew installieren
Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für sonar-scanner in AI-Agent-Workflows.
Installation
Weitere Installationsbefehle
Überblick
Paketzusammenfassung
Launcher to analyze a project with SonarQube
Projektlinks
Befehle und Aliase
- sonar-scanner
Verlauf
Projektgeschichte und Nutzung
SonarScanner CLI is SonarSource's command-line scanner for running SonarQube Server and SonarQube Cloud code analysis when there is no build-system-specific scanner. It is a CI/CD staple because it turns a checked-out source tree plus `sonar-project.properties` into an analysis uploaded to a Sonar service.
Projektgeschichte
The public GitHub repository is the official scanner CLI source tree, and its tags include older 2.x releases. Current SonarSource documentation presents a maintained release line from 4.x through 8.x, with the README stating that project configuration is read from `sonar-project.properties` or passed on the command line.
Notable documented release changes include the 4.3 release using the SonarScanner name in logs, the 4.4 release adding a supported Docker image, the 5.0 release embedding Java 17, the 6.0 release adding a new bootstrapping mechanism and JRE provisioning for SonarQube 10.6+ and SonarCloud, and the 8.0.1 release updating embedded JREs to Java 21.
Adoptionsgeschichte
The scanner is distributed as OS-specific downloads, a Docker image, a generic JVM zip, and package-manager formulae. Homebrew analytics show tens of thousands of yearly installs, which fits its role as a common CI dependency rather than a library used inside application code.
Wie es verwendet wird
Users create `sonar-project.properties` in the project root, run `sonar-scanner`, and provide server/project credentials through scanner parameters, CI secrets, or environment configuration rather than a dedicated credentials file. SonarSource warns users to prefer dedicated Maven, Gradle, or .NET scanners for those build systems.
Warum Paket-Nerds sich dafür interessieren
SonarScanner CLI matters to package maintainers because CI images and developer machines need a reproducible scanner binary with the right Java behavior. Changes such as embedded JRE updates, Docker distribution, and auto-provisioning affect whether a package works in minimal runners, corporate networks, and long-lived build pipelines.
Zeitleiste
- 2019: SonarScanner CLI 4.3 documents use of the SonarScanner name in logs.
- 2020: Version 4.4 adds a supported Docker image.
- 2023: Version 5.0 updates the embedded JRE to Java 17.
- 2024: Version 6.0 adds new bootstrapping and JRE provisioning.
- 2025: Version 7.3 adds z/OS support for scanner execution.
- 2025: Version 8.0.1 updates embedded JREs to Java 21.
Related projects
- SonarQube Server and SonarQube Cloud receive the analysis results.
- Dedicated SonarScanners exist for Maven, Gradle, and .NET and are recommended for those ecosystems.
- The scanner is also distributed as the official `sonarsource/sonar-scanner-cli` Docker image.
Quellen
Sicherheitslage
Risikostufe: grün
narrow executable package without higher-risk signals.
Risikoklassifikator
grün Risiko · niedrig Konfidenz · appliance
Warum
- narrow executable package without higher-risk signals
Signale
- metadata:no-higher-risk-signals
Installationsverhalten
- Es wurden keine Homebrew-Bottle-Metadaten erfasst.
Empfohlene Prüfung
Prüfe vor unbeaufsichtigter Agent-Nutzung, ob das Tool Klartext-Credentials liest, Remote-Zustand schreibt, Artefakte veröffentlicht oder Plugins ausführt.
local files
Configuration and credential file locations
These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.
Configuration files
Config paths the tool may read or write during local use.
- Unix
sonar-project.properties${scanner.home}/conf/sonar-scanner.properties
Executables
Installierte Executables
| Befehl | Art | Sichtbarkeit | Hinweis |
|---|---|---|---|
sonar-scanner | Executable | indexiertes Executable | Aus dem lokalen Executable-Index erkannt. |
Aktualität
Version und Aktualität
Diese Signale trennen das Alter der Seitengenerierung, Aktivität des Paketmanagers und Upstream-Release-Vergleich. Versionsrückstand wird nur gemeldet, wenn eine Evidenz-URL und vergleichbare Versionen vorhanden sind.
Seite generiert2026-08-03
Manager-Version8.1.0.6389
Manager aktualisiert
lokale Datenunbekannt
Upstreamnicht verfügbar
neueste erkannte Versionnicht erkannt
- OKEs wurden keine Aktualitätswarnungen generiert.
Installationsmetadaten
Paketmetadaten
| Paketschlüssel | brew:sonar-scanner |
|---|---|
| Version | 8.1.0.6389 |
| Paketmanager | Homebrew |
| Homepage | https://docs.sonarqube.org/latest/analysis/scan/sonarscanner/ |
| Repository | https://github.com/SonarSource/sonar-scanner-cli |
| Bottle | nicht erfasst |
| Dienst | keiner deklariert |
Quellspur
Aus Repository-Daten generiert
Diese Seite wird von av-web aus dem privaten Paket-SQLite-Artefakt bereitgestellt, das scripts/generate-pkg-sqlite.py erstellt.
Combined YAML source
View the package source record on GitHub.
Verwendete Quellen
- Geiger risk classifier
- Nucleus package database
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation