v0.1.0

Changelog

Added

• scan <path> — fingerprint a file or folder (WFP winnowing), upload to the SCANOSS v3 batch
  API in parallel chunks, and poll to completion; an interrupted scan resumes with
  scanoss results <scan-id>. --format raw|spdx|cyclonedx selects the output and
  --include deps,vulns,licenses,crypto,geo opts into extra layers, narrowed to what the chosen
  format can render (a layer it can't represent is skipped with an up-front notice).
  scan wfp <file> scans a pre-generated WFP.
• wfp <path> — generate WFP fingerprints only, without uploading.
• results <scan-id> — resume or poll a previous scan by its id.
• sbom <input> — offline: produce an SBOM from a scanoss raw inventory, or convert between
  CycloneDX 1.7 and SPDX 2.3 (input format detected from content). No API calls; best-effort (data
  a target can't represent — e.g. SPDX vulnerabilities — is dropped with a warning).
• enrich <input> — online: decorate an existing raw inventory, CycloneDX, or SPDX with the
  purl-keyed layers vulns/licenses/crypto/geo, with no source tree or re-scan (re-runnable
  to refresh). The output format defaults to the input's; --format converts in the same pass.
• dependencies [path] — parse local manifests, or query direct/transitive dependencies for a
  PURL.
• attributions [sbom] — attribution text from an SBOM file or a PURL.
• Decoration commands over the SCANOSS Services API v3: vulnerabilities, licenses,
  cryptography, geoprovenance, copyright, and components.
• raw output (default) — a neutral inventory in a versioned envelope (schema_version +
  metadata + components + vulnerabilities): detected and declared components in one
  components list tagged by scope, per-component layers (licenses, cryptography,
  geoprovenance) inline, and vulnerabilities as a flat top-level list. Each component records
  where it came from in evidence — scanned files that matched (match_type file/snippet) or
  the manifest that declared it (match_type declared). A bare scan (no --include) makes no
  decoration calls.
• SBOM export — SPDX 2.3 and CycloneDX 1.7, with the SCANOSS url_hash preserved (an SPDX
  OTHER external reference / a CycloneDX scanoss:url_hash property) and vulnerability detail
  (CVSS score/vector/method, CWE, EPSS).
• Declared dependencies (--include deps) are sourced directly from the project's manifests
  (package.json, go.mod, …) and decorated alongside the scan matches — no dependency-resolution
  round trip.
• File filtering — built-in defaults, .gitignore, and scanoss.json rules; client-side
  bom.remove.
• Progress & status output — live progress bars for every phase (fingerprint, upload, server,
  dependency parsing, each enrichment layer); status notices with icons and color (⚠ warnings,
  ℹ info, ✓ success) on an interactive terminal (Windows 10+ included), disabled when
  piped/redirected or NO_COLOR is set; a Results written to <path> line for --output.
• -v, --verbose — structured log/slog debug output on stderr (the scan flow, each API
  request with method/URL/status/duration, fingerprinting, and decoration).
• Go SDK (pkg/scanoss) — scan and decoration services with a parallel decoration pipeline;
  pkg/scanpipeline assembles a neutral sbom.Inventory, and pkg/sbom reads and writes
  CycloneDX and SPDX (with WithTool/WithAuthor/WithTimestamp document-metadata options).
• C shared library (libscanoss) with Node.js and Python bindings.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss onto your PATH. On Linux (amd64):

tar xzf scanoss-linux-amd64.tar.gz
sudo mv scanoss /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss@latest

See the README and
CLIENT_HELP.md
to get started.