# Installer flawfinder avec Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de flawfinder pour les workflows d'agents IA. ## installation ```sh sudo av install brew:flawfinder ``` Commandes d'installation supplémentaires: ### macOS - Homebrew (100%): ```sh brew install flawfinder ``` Preuve: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install flawfinder ``` Preuve: MacPorts ports tree: devel/flawfinder/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add flawfinder ``` Preuve: Alpine Linux edge package indexes: flawfinder from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install flawfinder ``` Preuve: Debian stable package indexes: flawfinder from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install flawfinder ``` Preuve: Fedora Rawhide package metadata: flawfinder from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#flawfinder ``` Preuve: nixpkgs package indexes: pkgs/by-name/fl/flawfinder/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S flawfinder ``` Preuve: Arch Linux sync databases: flawfinder from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install flawfinder ``` Preuve: openSUSE Tumbleweed package metadata: flawfinder from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ## Faits du paquet - **Clé du paquet:** brew:flawfinder - **Gestionnaire de paquets:** Homebrew - **Version:** 2.0.20 - **Résumé source:** Examines code and reports possible security weaknesses - **Page d'accueil:** - **Dépôt:** - **Dernière mise à jour:** 2026-05-18T00:00:27Z - **Généré:** 2026-08-03T19:37:03+00:00 ## exécutables - flawfinder (alias) ## Comportement d'installation - Bouteille: non disponible ## Version et fraîcheur - page générée: 2026-08-03 - version du gestionnaire: 2.0.20 ## Historique du projet et usages flawfinder is David A. Wheeler's command-line static analysis tool for C and C++ security review. It scans source text for calls and constructs associated with possible weaknesses, ranks findings by risk, and remains a lightweight package-manager staple because it is easy to install, fast to run, and useful before deeper review. ### Historique du projet Wheeler developed flawfinder as an open source source-code scanner for security weaknesses. The official site explains that it was created to encourage use of static analysis tools and that no one tool is sufficient; flawfinder is meant to be one simple advisor among several. The project has long been hosted through SourceForge for source, releases, mailing lists, and issue tracking, while later documentation also references GitHub issues, pull requests, a GitHub Action, SARIF output, SonarQube integration, and modern Python packaging. The ChangeLog records the 2.0 series move to semantic versioning in 2017, Python 2.7/3 compatibility, direct pip installation through setuptools, SARIF support in 2021, and security hardening in 2.0.20 in 2026. ### Historique d'adoption The official homepage says prepackaged versions are available for many Unix-like systems, explicitly naming Fedora, Debian, Ubuntu, Cygwin, FreeBSD Ports, OpenBSD ports, NetBSD pkgsrc, and Fink. The supplied package-manager metadata also records packaging in Homebrew, MacPorts, Nix, pacman, zypper, apk, Debian, Ubuntu, and Fedora ecosystems. flawfinder also earned official CWE compatibility and a CII Best Practices passing badge, which helped make it recognizable in security tooling catalogs and CI pipelines. ### Modes d'utilisation The basic use case is intentionally small: install with pip or a system package manager, then run `flawfinder` over a file or directory. Findings are assigned risk levels, and output formats include text, HTML, CSV, SARIF, and SonarQube-compatible output. The tool's design trades deep semantic analysis for speed and availability. Its README notes that it can analyze programs that cannot be built or linked, while also warning that it can produce false positives and miss issues because it lacks full control-flow, data-flow, type, namespace, and scope information. ### Pourquoi les passionnés de paquets s'y intéressent flawfinder is a classic small security package: a single-purpose scanner with no heavyweight service dependency, available through many OS package managers, pip, and CI integrations. It is especially relevant to package history because it bridges early-2000s free-software security scanning, distribution packaging, CWE-era rule classification, and modern SARIF-based code scanning. ### Chronologie - 2001: flawfinder and RATS are released simultaneously on May 21. - 2002: SANS review coverage appears among the official site's collected reviews. - 2004: Debian Security Audit Project testimonial records use of flawfinder. - 2017: 2.0.0 changes versioning to semantic versioning. - 2017: 2.0.2 adds Python 2.7 and Python 3 support. - 2017: 2.0.4 switches to setuptools and direct pip install support. - 2021: 2.0.16 adds SARIF output. - 2026: 2.0.20 ships security hardening, Sonar output, encoding handling improvements, and CI workflow updates. ### Related projects - RATS is the historically closest related project; the official site says the two scanners were developed independently and released simultaneously. - ITS4, Warnbuf, Stumoch, CWE, SARIF, SonarQube, and GitHub code scanning are related security-analysis or reporting contexts discussed by the official documentation. ### Sources - - - - - - ## Notes de sécurité Aucun manifest local de gestion des secrets correspondant n'a été trouvé pour flawfinder. Les métadonnées de paquet Nucleus restent publiées ici afin que la couverture future dispose d'une URL stable. ## Autres enregistrements de gestionnaires de paquets - Debian apt - flawfinder - 2.0.19-1.1: normalized package name match | Debian stable package indexes: flawfinder from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | examines source code and looks for security weaknesses | https://dwheeler.com/flawfinder/ - Nix - flawfinder: normalized package name match | nixpkgs package indexes: pkgs/by-name/fl/flawfinder/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - flawfinder - 2.0.19-1.1: normalized package name match | Ubuntu 24.04 LTS package indexes: flawfinder from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | examines source code and looks for security weaknesses | https://dwheeler.com/flawfinder/ - apk - flawfinder - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Examines C/C++ source code for security flaws | https://dwheeler.com/flawfinder/ - apk - flawfinder-doc - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Examines C/C++ source code for security flaws (documentation) | https://dwheeler.com/flawfinder/ - apk - flawfinder-pyc - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder-pyc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Precompiled Python bytecode for flawfinder | https://dwheeler.com/flawfinder/ - dnf - flawfinder - 2.0.11-17.fc45: normalized package name match | Fedora Rawhide package metadata: flawfinder from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Examines C/C++ source code for security flaws | http://www.dwheeler.com/flawfinder/ - pacman - flawfinder - 2.0.20-1: normalized package name match | Arch Linux sync databases: flawfinder from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Searches through source code for potential security flaws | https://dwheeler.com/flawfinder/ - zypper - flawfinder - 2.0.20-1.2: normalized package name match | openSUSE Tumbleweed package metadata: flawfinder from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | C/C++ source code security flaw examination tool | https://www.dwheeler.com/flawfinder/ - MacPorts - flawfinder: normalized package name match | MacPorts ports tree: devel/flawfinder/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/flawfinder.yml](https://github.com/mxcl/pkgdb/blob/main/combined/flawfinder.yml) ## Sources - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph