# 使用 Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper 安装 flawfinder

查看 flawfinder 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:flawfinder
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install flawfinder
```

  证据: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install flawfinder
```

  证据: MacPorts ports tree: devel/flawfinder/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add flawfinder
```

  证据: Alpine Linux edge package indexes: flawfinder from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Debian apt (92%):

```sh
sudo apt install flawfinder
```

  证据: Debian stable package indexes: flawfinder from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

- dnf (92%):

```sh
sudo dnf install flawfinder
```

  证据: Fedora Rawhide package metadata: flawfinder from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#flawfinder
```

  证据: nixpkgs package indexes: pkgs/by-name/fl/flawfinder/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S flawfinder
```

  证据: Arch Linux sync databases: flawfinder from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install flawfinder
```

  证据: openSUSE Tumbleweed package metadata: flawfinder from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

## 软件包事实

- **软件包键:** brew:flawfinder
- **软件包管理器:** Homebrew
- **版本:** 2.0.20
- **来源摘要:** Examines code and reports possible security weaknesses
- **主页:** <https://dwheeler.com/flawfinder/>
- **仓库:** <https://github.com/david-a-wheeler/flawfinder>
- **最后更新:** 2026-05-18T00:00:27Z
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- flawfinder (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 2.0.20
## 项目历史与用法

flawfinder is David A. Wheeler's command-line static analysis tool for C and C++ security review. It scans source text for calls and constructs associated with possible weaknesses, ranks findings by risk, and remains a lightweight package-manager staple because it is easy to install, fast to run, and useful before deeper review.

### 项目历史

Wheeler developed flawfinder as an open source source-code scanner for security weaknesses. The official site explains that it was created to encourage use of static analysis tools and that no one tool is sufficient; flawfinder is meant to be one simple advisor among several.

The project has long been hosted through SourceForge for source, releases, mailing lists, and issue tracking, while later documentation also references GitHub issues, pull requests, a GitHub Action, SARIF output, SonarQube integration, and modern Python packaging. The ChangeLog records the 2.0 series move to semantic versioning in 2017, Python 2.7/3 compatibility, direct pip installation through setuptools, SARIF support in 2021, and security hardening in 2.0.20 in 2026.

### 采用历史

The official homepage says prepackaged versions are available for many Unix-like systems, explicitly naming Fedora, Debian, Ubuntu, Cygwin, FreeBSD Ports, OpenBSD ports, NetBSD pkgsrc, and Fink. The supplied package-manager metadata also records packaging in Homebrew, MacPorts, Nix, pacman, zypper, apk, Debian, Ubuntu, and Fedora ecosystems.

flawfinder also earned official CWE compatibility and a CII Best Practices passing badge, which helped make it recognizable in security tooling catalogs and CI pipelines.

### 使用方式

The basic use case is intentionally small: install with pip or a system package manager, then run `flawfinder` over a file or directory. Findings are assigned risk levels, and output formats include text, HTML, CSV, SARIF, and SonarQube-compatible output.

The tool's design trades deep semantic analysis for speed and availability. Its README notes that it can analyze programs that cannot be built or linked, while also warning that it can produce false positives and miss issues because it lacks full control-flow, data-flow, type, namespace, and scope information.

### 为什么软件包爱好者会关心

flawfinder is a classic small security package: a single-purpose scanner with no heavyweight service dependency, available through many OS package managers, pip, and CI integrations. It is especially relevant to package history because it bridges early-2000s free-software security scanning, distribution packaging, CWE-era rule classification, and modern SARIF-based code scanning.

### 时间线

- 2001: flawfinder and RATS are released simultaneously on May 21.
- 2002: SANS review coverage appears among the official site's collected reviews.
- 2004: Debian Security Audit Project testimonial records use of flawfinder.
- 2017: 2.0.0 changes versioning to semantic versioning.
- 2017: 2.0.2 adds Python 2.7 and Python 3 support.
- 2017: 2.0.4 switches to setuptools and direct pip install support.
- 2021: 2.0.16 adds SARIF output.
- 2026: 2.0.20 ships security hardening, Sonar output, encoding handling improvements, and CI workflow updates.

### Related projects

- RATS is the historically closest related project; the official site says the two scanners were developed independently and released simultaneously.
- ITS4, Warnbuf, Stumoch, CWE, SARIF, SonarQube, and GitHub code scanning are related security-analysis or reporting contexts discussed by the official documentation.

### 来源

- <https://dwheeler.com/flawfinder>
- <https://dwheeler.com/flawfinder/flawfinder.pdf>
- <https://formulae.brew.sh/formula/flawfinder>
- <https://sourceforge.net/p/flawfinder/code>
- <https://sourceforge.net/p/flawfinder/code/ci/master/tree/ChangeLog?format=raw>
- <https://sourceforge.net/p/flawfinder/code/ci/master/tree/README.md?format=raw>


## 安全说明

没有找到 flawfinder 的匹配本地密钥处理 manifest。Nucleus 软件包元数据仍在此发布，以便未来覆盖拥有稳定的软件包 URL。


## 其他软件包管理器记录

- Debian apt - flawfinder - 2.0.19-1.1: normalized package name match | Debian stable package indexes: flawfinder from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | examines source code and looks for security weaknesses | https://dwheeler.com/flawfinder/
- Nix - flawfinder: normalized package name match | nixpkgs package indexes: pkgs/by-name/fl/flawfinder/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- Ubuntu apt - flawfinder - 2.0.19-1.1: normalized package name match | Ubuntu 24.04 LTS package indexes: flawfinder from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | examines source code and looks for security weaknesses | https://dwheeler.com/flawfinder/
- apk - flawfinder - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Examines C/C++ source code for security flaws | https://dwheeler.com/flawfinder/
- apk - flawfinder-doc - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Examines C/C++ source code for security flaws (documentation) | https://dwheeler.com/flawfinder/
- apk - flawfinder-pyc - 2.0.19-r5: normalized package name match | Alpine Linux edge package indexes: flawfinder-pyc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Precompiled Python bytecode for flawfinder | https://dwheeler.com/flawfinder/
- dnf - flawfinder - 2.0.11-17.fc45: normalized package name match | Fedora Rawhide package metadata: flawfinder from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Examines C/C++ source code for security flaws | http://www.dwheeler.com/flawfinder/
- pacman - flawfinder - 2.0.20-1: normalized package name match | Arch Linux sync databases: flawfinder from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Searches through source code for potential security flaws | https://dwheeler.com/flawfinder/
- zypper - flawfinder - 2.0.20-1.2: normalized package name match | openSUSE Tumbleweed package metadata: flawfinder from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | C/C++ source code security flaw examination tool | https://www.dwheeler.com/flawfinder/
- MacPorts - flawfinder: normalized package name match | MacPorts ports tree: devel/flawfinder/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1


## Combined YAML source

View the package source record on GitHub. [combined/flawfinder.yml](https://github.com/mxcl/pkgdb/blob/main/combined/flawfinder.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph