Component Detection

Automatically detect the open-source libraries you use.

Features • Getting started • Download • Contributing

Component Detection (CD) is a package scanning tool that is intended to be used at build time. It produces a graph-based output of all detected components across a variety of package ecosystems.

Component Detection can also be used as a library to detect dependencies in your own applications.

Features

Component Detection supports detecting libraries from the following ecosystem:

Ecosystem	Scanning	Graph Creation
CocoaPods	✔	✔
Go	✔	❌
Gradle (lockfiles only)	✔	❌
Linux (Debian, Alpine, Rhel, Centos, Fedora, Ubuntu)	✔ (via syft)	❌
Maven	✔	✔
NPM (including Yarn, Pnpm)	✔	✔
NuGet (including Paket)	✔	✔
Pip (Python)	✔	✔
Poetry (Python, lockfiles only)	✔	❌
Ruby	✔	✔
Rust	✔	✔

For a complete feature overview refer to feature-overview.md

Getting Started

To clone and run this application, you'll need Git and .NET 6 installed on your computer. From your command line:

# Clone this repository
$ git clone https://github.com/microsoft/component-detection

# Go into the repository
$ cd component-detection 

# Run the app
$ dotnet run --project ".\src\Microsoft.ComponentDetection\Microsoft.ComponentDetection.csproj" scan --SourceDirectory [PATH TO THE REPO TO SCAN]

View the detector arguments for more information on how to use the tool.

Download

You can download the latest version of Component Detection for Windows, macOS and Linux.

Contributing

Using Codespaces

You can use GitHub Codespaces to run and develop Component Detection in the cloud. To do so, click the green "Code" button at the top of the repository and select "Open with Codespaces". This will open a new Codespace with the repository cloned and ready to go.

Using VS Code DevContainer

This is similar to Codespaces:

1. Make sure you meet the requirements and follow the installation steps for DevContainers in VS Code
2. git clone https://github.com/microsoft/component-detection
3. Open this repo in VS Code
4. A notification should popup to reopen the workspace in the container. If it doesn't, open the Command Palette and type Remote-Containers: Reopen in Container.

Community Meetings

Once a month, we host a community meeting that anyone is allowed to join and discuss the project. We typically cover the changes over the last month, the roadmap and issues, and any questions or concerns that the community has.

You can find the future and past meeting details in the Community Meeting Overview.

You can additionally find the details in the Discussions Tab.

Telemetry

By default, telemetry will output to your output file path and will be a JSON blob. No data is submitted to Microsoft.

Code of Conduct

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.