Features • Getting started • Download • Contributing
Component Detection (CD) is a package scanning tool that is intended to be used at build time. It produces a graph-based output of all detected components across a variety of package ecosystems.
Component Detection can also be used as a library to detect dependencies in your own applications.
Component Detection supports detecting libraries from the following ecosystem:
| Ecosystem | Scanning | Graph Creation |
|---|---|---|
| CocoaPods | ✔ | ✔ |
| Go | ✔ | ❌ |
| Gradle (lockfiles only) | ✔ | ❌ |
| Linux (Debian, Alpine, Rhel, Centos, Fedora, Ubuntu) | ✔ (via syft) | ❌ |
| Maven | ✔ | ✔ |
| NPM (including Yarn, Pnpm) | ✔ | ✔ |
| NuGet (including Paket) | ✔ | ✔ |
| Pip (Python) | ✔ | ✔ |
| Poetry (Python, lockfiles only) | ✔ | ❌ |
| Ruby | ✔ | ✔ |
| Rust | ✔ | ✔ |
For a complete feature overview refer to feature-overview.md
To clone and run this application, you'll need Git and .NET 6 installed on your computer. From your command line:
# Clone this repository
$ git clone https://github.com/microsoft/component-detection
# Go into the repository
$ cd component-detection
# Run the app
$ dotnet run --project ".\src\Microsoft.ComponentDetection\Microsoft.ComponentDetection.csproj" scan --SourceDirectory [PATH TO THE REPO TO SCAN]View the detector arguments for more information on how to use the tool.
You can download the latest version of Component Detection for Windows, macOS and Linux.
You can use GitHub Codespaces to run and develop Component Detection in the cloud. To do so, click the green "Code" button at the top of the repository and select "Open with Codespaces". This will open a new Codespace with the repository cloned and ready to go.
This is similar to Codespaces:
- Make sure you meet the requirements and follow the installation steps for DevContainers in VS Code
git clone https://github.com/microsoft/component-detection- Open this repo in VS Code
- A notification should popup to reopen the workspace in the container. If it doesn't, open the
Command Paletteand typeRemote-Containers: Reopen in Container.
Once a month, we host a community meeting that anyone is allowed to join and discuss the project. We typically cover the changes over the last month, the roadmap and issues, and any questions or concerns that the community has.
You can find the future and past meeting details in the Community Meeting Overview.
You can additionally find the details in the Discussions Tab.
By default, telemetry will output to your output file path and will be a JSON blob. No data is submitted to Microsoft.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.