# osv-scanner を Homebrew, apk, Nix, pacman, zypper, scoop, winget でインストール osv-scanner のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。 ## インストール ```sh sudo av install brew:osv-scanner ``` 追加のインストールコマンド: ### macOS - Homebrew (100%): ```sh brew install osv-scanner ``` 証拠: local Homebrew formula metadata ### Linux - apk (92%): ```sh sudo apk add osv-scanner ``` 証拠: Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Nix (92%): ```sh nix profile install nixpkgs#osv-scanner ``` 証拠: nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S osv-scanner ``` 証拠: Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install osv-scanner ``` 証拠: openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ### Windows - Scoop (92%): ```sh scoop install main/osv-scanner ``` 証拠: Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id Google.OSVScanner -e ``` 証拠: Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix ## パッケージ情報 - **パッケージキー:** brew:osv-scanner - **パッケージマネージャ:** Homebrew - **パッケージマネージャページ:** - **バージョン:** 2.4.0 - **ソース概要:** Vulnerability scanner which uses the OSV database - **ホームページ:** - **リポジトリ:** - **上流ドキュメント:** - **ライセンス:** Apache-2.0 - **ソースアーカイブ:** - **最終更新:** 2026-07-27T23:46:53+02:00 - **生成日時:** 2026-08-04T22:13:35+00:00 ## 実行可能ファイル - osv-scanner (cli) - osv-scanner (エイリアス) ## ビルド依存関係 - go ## インストール挙動 - post-install フック: 未定義 - Bottle: 利用可能 対象 arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## バージョンと鮮度 - ページ生成日: 2026-08-04 - マネージャ版: 2.4.0 - マネージャ更新日: 2026-07-27 - ローカルデータ: OK - 上流リポジトリ: https://github.com/google/osv-scanner - 検出された最新: v2.4.0 (最新) ## プロジェクトの歴史と使われ方 OSV-Scanner is Google's command-line vulnerability scanner for matching project dependencies, source trees, SBOMs, and container contents against the OSV.dev vulnerability database. It is significant because it turns the OSV schema and distributed advisory corpus into a developer-facing tool that package maintainers, security teams, and CI systems can run without buying into a proprietary advisory database. ### プロジェクトの歴史 Google's GitHub repository records `google/osv-scanner` as created on 2022-11-14, and the Google Online Security Blog announced OSV-Scanner on 2022-12-13 as a free tool from the Google Open Source Security Team. The announcement framed it as an access layer for OSV vulnerability information: it would scan manifests, lockfiles, SBOMs, and git directories, then report known vulnerabilities affecting the discovered packages. The project later moved beyond a thin OSV lookup client. Its README describes OSV-Scanner as both the officially supported frontend to the OSV database and a CLI interface to OSV-Scalibr, Google's extraction/scanning library. The V2 line added broader package extraction, OS package detection, container image scanning, license scanning through deps.dev data, offline database downloads, and guided remediation workflows for selected ecosystems. ### 採用の歴史 OSV-Scanner's adoption path is closely tied to OSV.dev itself. OSV.dev presents OSV as an open, precise, distributed vulnerability database and publishes GitHub workflows that run OSV-Scanner in CI/CD. That made the scanner useful not just as a local audit command, but also as a reusable supply-chain check for pull requests and scheduled repository scans. Package-manager availability widened the audience beyond Go developers: the input metadata records packages for Homebrew, Alpine, Nix, Arch, Scoop, winget, and zypper. Homebrew packaging is especially important for a CLI security tool because it lets macOS developers add the scanner to local and CI environments with the same command style they use for other developer tools. ### 使われ方 Developers use OSV-Scanner to recursively scan a source directory, point it at lockfiles and manifests, scan SBOMs, or inspect container images. Its documented `scan source` and `scan image` modes cover the common package-nerd cases: checking npm, Go, Maven, PyPI, Cargo, RubyGems, Composer, NuGet, and other ecosystem metadata against advisories. Security teams use it in automation because the output is tied to machine-readable OSV records and because it can run without a custom service. The README also documents offline scanning after downloading local OSV databases, which matters for reproducible audits and restricted build environments. ### パッケージ好きにとっての重要性 OSV-Scanner is package-nerd infrastructure: it operationalizes lockfile parsing, package URL/ecosystem mapping, advisory matching, and remediation suggestions. Its significance is not just that it scans dependencies, but that it exposes how much package metadata quality determines vulnerability precision. The tool also sits at the intersection of multiple package ecosystems and OS package databases. For av.db-style metadata, it is a useful example of a CLI whose value comes from being able to understand many package managers consistently rather than from managing one package format deeply. ### タイムライン - 2022-11-14: GitHub records creation of `google/osv-scanner`. - 2022-12-13: Google announced OSV-Scanner on the Google Online Security Blog. - 2025-01-24: the project opened a discussion thread for OSV-Scanner V2 beta feedback. - 2026-06-18: GitHub release v2.4.0 added support including CycloneDX 1.7, more default source-scanning plugins, Alpine PURL distro qualifiers, Swift Package.resolved scanning, and Chisel container extraction. ### Related projects - OSV.dev provides the vulnerability database and API that OSV-Scanner queries. - OSV-Scalibr provides extraction and scanning components used under the OSV-Scanner V2 architecture. - deps.dev supplies supplemental package data used by OSV-Scanner for dependency resolution, license scanning, container metadata, and package deprecation checks. ### ソース - - - - - - - - ## セキュリティノート escape, surveillance, or offensive capability signal. - **Geiger リスク:** red / 中 - escape, surveillance, or offensive capability signal ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: osv-scanner.toml ## ソースデータベース詳細 - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** osv-scanner - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## 他のパッケージマネージャ記録 - Nix - osv-scanner: normalized package name match | nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - apk - osv-scanner - 2.4.0-r1: normalized package name match | Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner - pacman - osv-scanner - 2.4.0-1: normalized package name match | Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner - zypper - osv-scanner - 2.4.0-1.4: normalized package name match | openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Vulnerability scanner written in Go | https://github.com/google/osv-scanner - Scoop - main/osv-scanner: normalized package name match | Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 - winget - Google.OSVScanner: normalized package name match | Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix ## 関連リンク - [Source-control packages](https://pkg.so/ja/source-control-tools/) - Belongs to a source-control command family. - [Secret-risk packages](https://pkg.so/ja/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://pkg.so/ja/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://pkg.so/ja/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [go](https://pkg.so/ja/brew/go/) - Build dependency declared by Homebrew. - [nuclei](https://pkg.so/ja/brew/nuclei/) - Shares pkgdb curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning. - [bomber](https://pkg.so/ja/brew/bomber/) - Shares pkgdb curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning. - [safety](https://pkg.so/ja/brew/safety/) - Shares pkgdb curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning. - [cve-bin-tool](https://pkg.so/ja/brew/cve-bin-tool/) - Shares pkgdb curated category or tags: cli, security, vulnerability-scanner, vulnerability-scanning. - [grype](https://pkg.so/ja/brew/grype/) - Shares pkgdb curated category or tags: cli, security, vulnerability-scanner. - [gobuster](https://pkg.so/ja/brew/gobuster/) - Shares pkgdb curated category or tags: cli, go, security. - [govulncheck](https://pkg.so/ja/brew/govulncheck/) - Shares pkgdb curated category or tags: cli, go, security, vulnerability-scanning. - [gosec](https://pkg.so/ja/brew/gosec/) - Shares pkgdb curated category or tags: cli, go, security. ## Combined YAML source View the package source record on GitHub. [combined/osv-scanner.yml](https://github.com/mxcl/pkgdb/blob/main/combined/osv-scanner.yml) ## ソース - pkg.so package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph