# osv-scanner を Homebrew, apk, Nix, pacman, zypper, scoop, winget でインストール

osv-scanner のインストール経路、実行ファイル、メタデータ、AI エージェント向けセキュリティノートを確認します。

## インストール

```sh
sudo av install brew:osv-scanner
```

追加のインストールコマンド:

### macOS

- Homebrew (100%):

```sh
brew install osv-scanner
```

  証拠: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add osv-scanner
```

  証拠: Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Nix (92%):

```sh
nix profile install nixpkgs#osv-scanner
```

  証拠: nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S osv-scanner
```

  証拠: Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install osv-scanner
```

  証拠: openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Scoop (92%):

```sh
scoop install main/osv-scanner
```

  証拠: Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

- winget (92%):

```sh
winget install --id Google.OSVScanner -e
```

  証拠: Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix

## パッケージ情報

- **パッケージキー:** brew:osv-scanner
- **パッケージマネージャ:** Homebrew
- **バージョン:** 2.4.0
- **ソース概要:** Vulnerability scanner which uses the OSV database
- **ホームページ:** <https://google.github.io/osv-scanner/>
- **リポジトリ:** <https://github.com/google/osv-scanner>
- **最終更新:** 2026-07-27T23:46:53+02:00
- **生成日時:** 2026-08-03T19:37:03+00:00

## 実行可能ファイル

- osv-scanner (エイリアス)

## インストール挙動

- Bottle: 利用不可

## バージョンと鮮度

- ページ生成日: 2026-08-03
- マネージャ版: 2.4.0
## プロジェクトの歴史と使われ方

OSV-Scanner is Google's command-line vulnerability scanner for matching project dependencies, source trees, SBOMs, and container contents against the OSV.dev vulnerability database. It is significant because it turns the OSV schema and distributed advisory corpus into a developer-facing tool that package maintainers, security teams, and CI systems can run without buying into a proprietary advisory database.

### プロジェクトの歴史

Google's GitHub repository records `google/osv-scanner` as created on 2022-11-14, and the Google Online Security Blog announced OSV-Scanner on 2022-12-13 as a free tool from the Google Open Source Security Team. The announcement framed it as an access layer for OSV vulnerability information: it would scan manifests, lockfiles, SBOMs, and git directories, then report known vulnerabilities affecting the discovered packages.

The project later moved beyond a thin OSV lookup client. Its README describes OSV-Scanner as both the officially supported frontend to the OSV database and a CLI interface to OSV-Scalibr, Google's extraction/scanning library. The V2 line added broader package extraction, OS package detection, container image scanning, license scanning through deps.dev data, offline database downloads, and guided remediation workflows for selected ecosystems.

### 採用の歴史

OSV-Scanner's adoption path is closely tied to OSV.dev itself. OSV.dev presents OSV as an open, precise, distributed vulnerability database and publishes GitHub workflows that run OSV-Scanner in CI/CD. That made the scanner useful not just as a local audit command, but also as a reusable supply-chain check for pull requests and scheduled repository scans.

Package-manager availability widened the audience beyond Go developers: the input metadata records packages for Homebrew, Alpine, Nix, Arch, Scoop, winget, and zypper. Homebrew packaging is especially important for a CLI security tool because it lets macOS developers add the scanner to local and CI environments with the same command style they use for other developer tools.

### 使われ方

Developers use OSV-Scanner to recursively scan a source directory, point it at lockfiles and manifests, scan SBOMs, or inspect container images. Its documented `scan source` and `scan image` modes cover the common package-nerd cases: checking npm, Go, Maven, PyPI, Cargo, RubyGems, Composer, NuGet, and other ecosystem metadata against advisories.

Security teams use it in automation because the output is tied to machine-readable OSV records and because it can run without a custom service. The README also documents offline scanning after downloading local OSV databases, which matters for reproducible audits and restricted build environments.

### パッケージ好きにとっての重要性

OSV-Scanner is package-nerd infrastructure: it operationalizes lockfile parsing, package URL/ecosystem mapping, advisory matching, and remediation suggestions. Its significance is not just that it scans dependencies, but that it exposes how much package metadata quality determines vulnerability precision.

The tool also sits at the intersection of multiple package ecosystems and OS package databases. For av.db-style metadata, it is a useful example of a CLI whose value comes from being able to understand many package managers consistently rather than from managing one package format deeply.

### タイムライン

- 2022-11-14: GitHub records creation of `google/osv-scanner`.
- 2022-12-13: Google announced OSV-Scanner on the Google Online Security Blog.
- 2025-01-24: the project opened a discussion thread for OSV-Scanner V2 beta feedback.
- 2026-06-18: GitHub release v2.4.0 added support including CycloneDX 1.7, more default source-scanning plugins, Alpine PURL distro qualifiers, Swift Package.resolved scanning, and Chisel container extraction.

### Related projects

- OSV.dev provides the vulnerability database and API that OSV-Scanner queries.
- OSV-Scalibr provides extraction and scanning components used under the OSV-Scanner V2 architecture.
- deps.dev supplies supplemental package data used by OSV-Scanner for dependency resolution, license scanning, container metadata, and package deprecation checks.

### ソース

- <https://api.github.com/repos/google/osv-scanner>
- <https://formulae.brew.sh/formula/osv-scanner>
- <https://github.com/google/osv-scanner>
- <https://github.com/google/osv-scanner/releases/tag/v2.4.0>
- <https://google.github.io/osv-scanner/>
- <https://osv.dev/>
- <https://raw.githubusercontent.com/google/osv-scanner/main/README.md>
- <https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html>


## セキュリティノート

escape, surveillance, or offensive capability signal.

- **Geiger リスク:** red / 中
- escape, surveillance, or offensive capability signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: osv-scanner.toml
## 他のパッケージマネージャ記録

- Nix - osv-scanner: normalized package name match | nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - osv-scanner - 2.4.0-r1: normalized package name match | Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner
- pacman - osv-scanner - 2.4.0-1: normalized package name match | Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner
- zypper - osv-scanner - 2.4.0-1.4: normalized package name match | openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Vulnerability scanner written in Go | https://github.com/google/osv-scanner
- Scoop - main/osv-scanner: normalized package name match | Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
- winget - Google.OSVScanner: normalized package name match | Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/osv-scanner.yml](https://github.com/mxcl/pkgdb/blob/main/combined/osv-scanner.yml)


## ソース

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph