How google/osv-scalibr works
OSV-SCALIBR is an extensible software-composition-analysis library. Its principal workflow configures and runs a scan over filesystem or container inputs, extracts inventory, detects vulnerabilities, optionally enriches and annotates findings, and returns scan results; results can also be converted to SPDX. A separate guided-remediation capability proposes upgrade patches for transitive vulnerabilities. The README documents these capabilities and the scan workflow; sampled source was limited, so internal wiring beyond that documented flow is not asserted.
Main entry points: scalibr.go Scan API · guidedremediation.go Remediation workflow · enricher Finding enrichment · result.go Scan results
Components 20
Scanning
- Scan API
scalibr.go - Filesystem extraction
extractor/filesystem - Container extraction
extractor/containerimage.go - Software inventory
inventory/inventory.go
Analysis plugins
- Vulnerability detectors
detector - Finding enrichment
enricher - Inventory annotation
annotator - Plugin configuration
plugin
Results and output
- Scan results
result/result.go - Result schema
binary/proto - SPDX conversion
converter/spdx/spdx.go - Wrapper binary
binary/scalibr/scalibr.go
Guided remediation
- Remediation workflow
guidedremediation/guidedremediation.go - Manifest parsing
guidedremediation/internal/manifest - Vulnerability resolution
guidedremediation/internal/resolution - Upgrade strategies
guidedremediation/internal/strategy - Upgrade patch
guidedremediation/result/result.go
External data
- OSV vulnerability data
- deps.dev package data
Other components
- Library caller
Connections 21
- Library caller → Scan API: configures and calls
- Scan API → Plugin configuration: selects plugins
- Scan API → Filesystem extraction: scans filesystem
- Scan API → Container extraction: scans image
- Filesystem extraction → Software inventory: extracts packages
- Container extraction → Software inventory: extracts packages
- Scan API → Vulnerability detectors: runs detectors
- Scan API → Finding enrichment: runs enrichers
- Scan API → Inventory annotation: runs annotators
- Scan API → Scan results: returns results
- Scan results → Result schema: serializes as
- Scan results → SPDX conversion: converts inventory
- Library caller → Wrapper binary: invokes optionally
- Wrapper binary → Scan API: runs scan
- Library caller → Remediation workflow: requests patches
- Remediation workflow → Manifest parsing: parses project files
- Remediation workflow → Vulnerability resolution: resolves vulnerable dependencies
- Remediation workflow → Upgrade strategies: selects upgrade strategy
- Remediation workflow → Upgrade patch: produces patch
- Finding enrichment → OSV vulnerability data: queries vulnerability data
- Finding enrichment → deps.dev package data: queries package data