The SCANOSS Open Source Engine is a command-line tool written in C designed to perform open source software inventory analysis by comparing files and directories against the SCANOSS Knowledge Base. The engine enables developers to identify open source components, detect licenses, and assess vulnerabilities in their codebase from the earliest stages of development, shifting the software bill of materials creation process from a post-development audit to continuous real-time analysis.
The engine operates by matching scanned files through a hierarchical process. It first attempts to match files against entire packages by comparing them to downloaded archives, producing a "url" type identification. If that fails, it matches against known complete files for a "file" type identification. When neither succeeds, the engine performs snippet comparison using snippet hashes to identify partial matches, generating a "snippet" type identification. Files that match none of these criteria receive a "none" type identification. The engine includes a sophisticated file ranking algorithm that uses component hints, release dates, and SBOM ingestion to determine the best match when files appear across multiple components and versions.
Configuration options provide granular control over scanning behavior. Basic settings include processing targets as WFP files, enabling High Precision Snippet Match mode, and adjusting parameters like maximum snippets per file, component limits, and tolerance thresholds. The engine supports SBOM integration in CycloneDX and SPDX 2.2 formats, allowing users to include assets from existing SBOMs or blacklist specific components. Additional features include attribution notice generation, license metadata display, and comprehensive license reporting capabilities.
The engine provides multiple scanning flags that can be toggled to disable or enable specific analysis types including snippet matching, dependencies, licenses, copyrights, vulnerabilities, quality assessment, cryptography analysis, and health layer evaluation. These flags can be set via command-line parameters or configuration files. Environment variables allow customization of the snippet scanning match map size and API endpoint configuration for source file retrieval.
The engine requires the SCANOSS LDB shared library version 4.1.0 or higher and libgcrypt-dev as prerequisites. It outputs results in JSON format to standard output, allowing easy integration into existing development workflows and toolchains. The tool is released under the GPL 2.0 license and represents a developer-focused approach to compliance and supply chain security by embedding open source analysis directly into the development process rather than treating it as a separate compliance step.
