# 使用 Homebrew, apk, Nix, pacman, zypper, scoop, winget 安装 osv-scanner

查看 osv-scanner 的安装路径、可执行文件、元数据以及面向 AI 代理工作流的安全说明。

## 安装

```sh
sudo av install brew:osv-scanner
```

其他安装命令:

### macOS

- Homebrew (100%):

```sh
brew install osv-scanner
```

  证据: local Homebrew formula metadata

### Linux

- apk (92%):

```sh
sudo apk add osv-scanner
```

  证据: Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz

- Nix (92%):

```sh
nix profile install nixpkgs#osv-scanner
```

  证据: nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S osv-scanner
```

  证据: Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

- zypper (92%):

```sh
sudo zypper install osv-scanner
```

  证据: openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

### Windows

- Scoop (92%):

```sh
scoop install main/osv-scanner
```

  证据: Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

- winget (92%):

```sh
winget install --id Google.OSVScanner -e
```

  证据: Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix

## 软件包事实

- **软件包键:** brew:osv-scanner
- **软件包管理器:** Homebrew
- **版本:** 2.4.0
- **来源摘要:** Vulnerability scanner which uses the OSV database
- **主页:** <https://google.github.io/osv-scanner/>
- **仓库:** <https://github.com/google/osv-scanner>
- **最后更新:** 2026-07-27T23:46:53+02:00
- **已生成:** 2026-08-03T19:37:03+00:00

## 可执行文件

- osv-scanner (别名)

## 安装行为

- Bottle: 不可用

## 版本和新鲜度

- 页面生成时间: 2026-08-03
- 管理器版本: 2.4.0
## 项目历史与用法

OSV-Scanner is Google's command-line vulnerability scanner for matching project dependencies, source trees, SBOMs, and container contents against the OSV.dev vulnerability database. It is significant because it turns the OSV schema and distributed advisory corpus into a developer-facing tool that package maintainers, security teams, and CI systems can run without buying into a proprietary advisory database.

### 项目历史

Google's GitHub repository records `google/osv-scanner` as created on 2022-11-14, and the Google Online Security Blog announced OSV-Scanner on 2022-12-13 as a free tool from the Google Open Source Security Team. The announcement framed it as an access layer for OSV vulnerability information: it would scan manifests, lockfiles, SBOMs, and git directories, then report known vulnerabilities affecting the discovered packages.

The project later moved beyond a thin OSV lookup client. Its README describes OSV-Scanner as both the officially supported frontend to the OSV database and a CLI interface to OSV-Scalibr, Google's extraction/scanning library. The V2 line added broader package extraction, OS package detection, container image scanning, license scanning through deps.dev data, offline database downloads, and guided remediation workflows for selected ecosystems.

### 采用历史

OSV-Scanner's adoption path is closely tied to OSV.dev itself. OSV.dev presents OSV as an open, precise, distributed vulnerability database and publishes GitHub workflows that run OSV-Scanner in CI/CD. That made the scanner useful not just as a local audit command, but also as a reusable supply-chain check for pull requests and scheduled repository scans.

Package-manager availability widened the audience beyond Go developers: the input metadata records packages for Homebrew, Alpine, Nix, Arch, Scoop, winget, and zypper. Homebrew packaging is especially important for a CLI security tool because it lets macOS developers add the scanner to local and CI environments with the same command style they use for other developer tools.

### 使用方式

Developers use OSV-Scanner to recursively scan a source directory, point it at lockfiles and manifests, scan SBOMs, or inspect container images. Its documented `scan source` and `scan image` modes cover the common package-nerd cases: checking npm, Go, Maven, PyPI, Cargo, RubyGems, Composer, NuGet, and other ecosystem metadata against advisories.

Security teams use it in automation because the output is tied to machine-readable OSV records and because it can run without a custom service. The README also documents offline scanning after downloading local OSV databases, which matters for reproducible audits and restricted build environments.

### 为什么软件包爱好者会关心

OSV-Scanner is package-nerd infrastructure: it operationalizes lockfile parsing, package URL/ecosystem mapping, advisory matching, and remediation suggestions. Its significance is not just that it scans dependencies, but that it exposes how much package metadata quality determines vulnerability precision.

The tool also sits at the intersection of multiple package ecosystems and OS package databases. For av.db-style metadata, it is a useful example of a CLI whose value comes from being able to understand many package managers consistently rather than from managing one package format deeply.

### 时间线

- 2022-11-14: GitHub records creation of `google/osv-scanner`.
- 2022-12-13: Google announced OSV-Scanner on the Google Online Security Blog.
- 2025-01-24: the project opened a discussion thread for OSV-Scanner V2 beta feedback.
- 2026-06-18: GitHub release v2.4.0 added support including CycloneDX 1.7, more default source-scanning plugins, Alpine PURL distro qualifiers, Swift Package.resolved scanning, and Chisel container extraction.

### Related projects

- OSV.dev provides the vulnerability database and API that OSV-Scanner queries.
- OSV-Scalibr provides extraction and scanning components used under the OSV-Scanner V2 architecture.
- deps.dev supplies supplemental package data used by OSV-Scanner for dependency resolution, license scanning, container metadata, and package deprecation checks.

### 来源

- <https://api.github.com/repos/google/osv-scanner>
- <https://formulae.brew.sh/formula/osv-scanner>
- <https://github.com/google/osv-scanner>
- <https://github.com/google/osv-scanner/releases/tag/v2.4.0>
- <https://google.github.io/osv-scanner/>
- <https://osv.dev/>
- <https://raw.githubusercontent.com/google/osv-scanner/main/README.md>
- <https://security.googleblog.com/2022/12/announcing-osv-scanner-vulnerability.html>


## 安全说明

escape, surveillance, or offensive capability signal.

- **Geiger 风险:** red / 中
- escape, surveillance, or offensive capability signal


## Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.


## Configuration files

- Unix: osv-scanner.toml
## 其他软件包管理器记录

- Nix - osv-scanner: normalized package name match | nixpkgs package indexes: pkgs/by-name/os/osv-scanner/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - osv-scanner - 2.4.0-r1: normalized package name match | Alpine Linux edge package indexes: osv-scanner from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner
- pacman - osv-scanner - 2.4.0-1: normalized package name match | Arch Linux sync databases: osv-scanner from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Vulnerability scanner written in Go which uses the data provided by https://osv.dev | https://github.com/google/osv-scanner
- zypper - osv-scanner - 2.4.0-1.4: normalized package name match | openSUSE Tumbleweed package metadata: osv-scanner from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Vulnerability scanner written in Go | https://github.com/google/osv-scanner
- Scoop - main/osv-scanner: normalized package name match | Scoop official bucket manifest trees: bucket/osv-scanner.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1
- winget - Google.OSVScanner: normalized package name match | Windows Package Manager source index: Google.OSVScanner from https://cdn.winget.microsoft.com/cache/source.msix


## Combined YAML source

View the package source record on GitHub. [combined/osv-scanner.yml](https://github.com/mxcl/pkgdb/blob/main/combined/osv-scanner.yml)


## 来源

- pkg.so package database
- Geiger risk classifier
- curated configuration and credential file locations
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph