In order to use these strategies special options must be provided to the CLI. See the linked documentation above for details.
Languages supported by FOSSA CLI can have multiple strategies for detecting dependencies, one primary strategy that yields ideal results and zero or more fallback strategies. Within this list of strategies, we have the concept of static and dynamic strategies. Static strategies parse files to find a dependency graph (example: parse a package-lock.json file). Dynamic strategies are required when analyzing package managers that do not offer complete lockfiles, such as Gradle or Go. Dynamic strategies require a working build environment to operate in.
Running the tool with all possible strategies enabled is recommended, but if you need to limit FOSSA CLI to only use static strategies the CLI offers the --static-only-analysis flag.
This flag prevents FOSSA CLI from using any third party tools, such as npm, pip, maven plugins, etc.
With this option enabled, strategies that don't offer a way to analyze statically will fail with an error.
It is important to note that neither type of strategy has an inherent benefit when detecting dependencies. If a supported language has only a static or only a dynamic strategy, this does not mean it is less supported than a language that has both.
Strict analysis enforces the use of the most accurate strategy for detecting dependencies, ensuring precise and consistent results by rejecting fallback methods that may offer less reliable detection.
For example, in Maven projects, FOSSA CLI attempts analysis with the following strategy order:
- Run the mavenplugin strategy, which provides the most accurate dependency information.
- If that fails, it attempts the treecmd strategy, which parses the output of the
mvn dependency:treecommand. - Finally, it falls back to the pomxml strategy, scanning pom.xml files for dependencies.
However, with the --strict flag, only the mavenplugin strategy will be used. If the mavenplugin command fails, FOSSA will not attempt the treecmd or pomxml methods. This ensures that your Maven analysis relies solely on the most precise and validated strategy.
Invoke strict analysis with the --strict flag when running fossa analyze.
Note
Dynamic strategies require a working build environment for analysis.
If a given package manager has a dynamic strategy with a static fallback, that means the static fallback provides worse results, so it is only used when the dynamic strategy fails. If the package manager only has static strategies, that means dynamic analysis is not required for ideal results.
Tip
If FOSSA CLI is forced to utilize a fallback strategy, meaning it did not detect ideal results,
a warning is emitted in the scan summary after running fossa analyze.
Warning
"Custom" strategies work very differently than the standard package manager based analysis; read their docs for more details.
| Language/Package Manager | Kind of analysis | Detect Vendored Code |
|---|---|---|
| C#/.NET (nuget) | Static | ❌ |
| C#/.NET (packagereference) | Static | ❌ |
| C#/.NET (packagesconfig) | Static | ❌ |
| C#/.NET (paket) | Static | ❌ |
| C#/.NET (projectassetsjson) | Static | ❌ |
| C#/.NET (projectjson) | Static | ❌ |
| C | Custom | ✅ |
| C++ | Custom | ✅ |
| Clojure (leiningen) | Dynamic | ❌ |
| Dart (pub) | Dynamic with static fallback | ❌ |
| Elixer (mix) | Dynamic | ❌ |
| Erlang (rebar3) | Dynamic | ❌ |
| Fortran | Static | ❌ |
| Go (dep) | Static | ❌ |
| Go (glide) | Static | ❌ |
| Go (gomodules) | Dynamic with static fallback | ❌ |
| Gradle | Dynamic | ❌ |
| Haskell (cabal) | Dynamic | ❌ |
| Haskell (stack) | Dynamic | ❌ |
| iOS (carthage) | Static | ❌ |
| iOS (cocoapods) | Static | ❌ |
| iOS (swift) | Static | ❌ |
| Maven | Dynamic with static fallback | ❌ |
| NodeJS (NPM/Yarn/pnpm) | Static | ❌ |
| Perl | Static | ❌ |
| PHP (Composer) | Static | ❌ |
| Python (Conda) | Dynamic with static fallback | ❌ |
| Python (Pipenv) | Dynamic with static fallback | ❌ |
| Python (Poetry) | Static | ❌ |
| Python (Pdm) | Static | ❌ |
| Python (setup.py/requirements.txt) | Dynamic with static fallback | ❌ |
| R (renv) | Static | ❌ |
| Ruby (bundler) | Dynamic with static fallback | ❌ |
| Rust (cargo) | Dynamic | ❌ |
| Scala (sbt) | Dynamic | ❌ |