OSSGadget - GitLite

KO | EN

gitlite — search

#javascript #python #ai #typescript #llm #rust #linux #docker #macos #nodejs #java #cli #mcp #open-source

OSSGadget

(★ 370)

Collection of tools for analyzing open source packages.

파일 탐색기

최종 버전 다운로드 (.zip)

- devcontainer.json
- Dockerfile
- dependabot.yml
- tasks.json
- core-pipeline.yml
- ossgadget-pr.yml
- - App.config
  - CodeSnippet.cs
  - CryptoGatherer.csproj
  - CryptoGatherer.sln
  - Form1.cs
  - Form1.Designer.cs
  - Form1.resx
  - ListViewColumnSorter.cs
  - Program.cs
  - README.md
  - Types.cs
- - FindPackageSquatResult.cs
  - FindPackageSquats.cs
  - MutateExtension.cs
  - MutateOptions.cs
  - oss-find-squats-lib.csproj
  - QwertyKeyboardHelper.cs
- - oss-gadget-cli.csproj
  - OssGadgetCli.cs
- - .editorconfig
  - ArchiveHelperTests.cs
  - DefoggerTests.cs
  - DetectCryptographyTests.cs
  - DownloadTests.cs
  - FindSourceTests.cs
  - FindSquatsTests.cs
  - GlobalUsing.cs
  - MetadataTests.cs
  - oss-tests.csproj
  - PackageExistenceTests.cs
  - PackageUrlExtensionsTests.cs
  - ReproducibleTests.cs
  - SharedTests.cs
  - SkipInADOFact.cs
  - StringExtensionsTests.cs
  - VersionTests.cs
- - AssemblyInfo.cs
  - DefaultHttpClientFactory.cs
  - nlog.config
  - OssGadgetJsonSerializer.cs
  - OssGadgetLib.cs
  - Shared.Lib.csproj
- - BaseTool.cs
  - ErrorCode.cs
  - OSSGadget.cs
  - Shared.CLI.csproj
- - Shared.Lib.Tests.csproj
- .editorconfig
- OSSGadget.sln
.dockerignore
.editorconfig
.gitattributes
.gitignore
CODE_OF_CONDUCT.md
CodeMaid.config
cst_logo.svg
Directory.Build.props
Dockerfile
icon-128.png
LICENSE.txt
NOTICE.txt
nuget.config
PRIVACY.md
README.md
SECURITY.md
SUPPORT.md
version.json

# 설치 가이드

1. 코드 내려받기

git clone https://github.com/microsoft/OSSGadget

깃허브에서 프로젝트 코드 전체를 내 컴퓨터로 내려받습니다.

cd OSSGadget

방금 내려받은 프로젝트 폴더 안으로 이동합니다.

2. Docker

쉬움 추천

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
Docker Desktop 컨테이너를 빌드하고 실행하려면 필요합니다. 설치 후 실행해서 백그라운드에 켜두세요.

docker build -t ossgadget .

Dockerfile을 기반으로 실행 가능한 이미지를 빌드합니다.

docker run -p 8080:80 ossgadget

빌드된 이미지를 실제 컨테이너로 실행합니다.

✅ 터미널에 docker compose ps 를 입력해 컨테이너들이 Up 상태인지 확인하세요. README에 포트 번호가 적혀있다면 브라우저에서 http://localhost:포트번호 로 접속해보세요.

3. .NET

보통

사전 준비물

Git GitHub에서 프로젝트 코드를 내려받으려면 필요합니다.
.NET SDK dotnet 명령어를 쓰기 위한 SDK입니다.

cd src/CryptoGatherer

이 프로젝트의 관련 파일이 하위 폴더 안에 있어서, 먼저 그 폴더로 이동합니다.

dotnet restore

프로젝트에 필요한 패키지를 내려받습니다.

dotnet run

프로젝트를 빌드하고 바로 실행합니다.

✅ dotnet run 실행 후 터미널에 나타나는 안내 메시지나 주소를 확인하세요.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

[![Nuget](https://img.shields.io/nuget/v/Microsoft.CST.OSSGadget.Shared)](https://www.nuget.org/packages/Microsoft.CST.OSSGadget.Shared)
![CodeQL](https://github.com/microsoft/OSSGadget/workflows/CodeQL/badge.svg)

## OSS Gadget

> **Note:** OSS Gadget is currently in **public preview** and is not ready for production use.

OSS Gadget is a collection of tools that can help analyze open source projects. These are intended to make it simple to perform low-level tasks, like locating the source code of a given package, downloading it, performing basic analyses on it, or estimating its health. The tools included in OSS Gadget will grow over time.

### Included Tools
A list of tools included is below.  Click on the name of a tool to go to the wiki for usage information.

* [oss-characteristic](https://github.com/microsoft/OSSGadget/wiki/OSS-Characteristics): Identify a package's notable characteristics and features. Uses
  [Application Inspector](https://github.com/Microsoft/ApplicationInspector).
* [oss-defog](https://github.com/microsoft/OSSGadget/wiki/OSS-Defog): Searches a package for obfuscated strings (Base-64).
* [oss-detect-backdoor](https://github.com/microsoft/OSSGadget/wiki/OSS-Detect-Backdoor): Identifies *potential* backdoors and malicious code within a package. Currently has a high false-positive rate.
* [oss-detect-cryptography](https://github.com/microsoft/OSSGadget/wiki/OSS-Detect-Cryptography): Identifies cryptographic implementations within a package.
* [oss-diff](https://github.com/microsoft/OSSGadget/wiki/OSS-Diff): Compares two packages using a standard diff/patch view.
* [oss-download](https://github.com/microsoft/OSSGadget/wiki/OSS-Download): Downloads a package and extracts it locally.
* [oss-find-domain-squats](https://github.com/microsoft/OSSGadget/wiki/OSS-Find-Domain-Squats): Identifies potential typo-squatting for a given domain name.
* [oss-find-source](https://github.com/microsoft/OSSGadget/wiki/OSS-Find-Source): Attempts to locate the source code (on GitHub, currently) of a given package.
* [oss-find-squats](https://github.com/microsoft/OSSGadget/wiki/OSS-Find-Squats): Identifies potential typo-squatting for a given package.
* [oss-health](https://github.com/microsoft/OSSGadget/wiki/OSS-Health): Calculates health metrics for a given package.
* [oss-metadata](https://github.com/microsoft/OSSGadget/wiki/OSS-Metadata): Retrieves metadata from deps.dev or libraries.io for a given package.
* [oss-risk-calculator](https://github.com/microsoft/OSSGadget/wiki/OSS-Risk-Calculator): Calculates a metric for risk of using a package.
* [oss-reproducible](https://github.com/microsoft/OSSGadget/wiki/OSS-Reproducible): Evaluates a package for semantic equivalency with the detected source code to produce an estimate of how well the two comport.

All OSS Gadget tools accept one or more [Package URLs](https://github.com/package-url/purl-spec) as a way to uniquely identify a package. Package URLs look like `pkg:npm/express` or `pkg:gem/azure@0.7.10`. If you leave the version number off, it implicitly means, "attempt to find the latest version". Using an asterisk (`pkg:npm/express@*`) means "perform the action on all available versions".

### Package Sources
OSS Gadget supports packages provided by these sources:

* Cargo - `pkg:cargo/...`
* Cocoapods - `pkg:cocoapods/...`
* Composer - `pkg:composer/...`
* CPAN - `pkg:cpan/...`
* CRAN - `pkg:cran/...`
* GitHub - `pkg:github/...`
* Go - `pkg:golang/...`
* Hackage - `pkg:hackage/...`
* Maven - `pkg:maven/...`
* NPM - `pkg:npm/...`
* NuGet - `pkg:nuget/...`
* RubyGems - `pkg:gem/...`
* PyPI - `pkg:pypi/...`
* Ubuntu - `pkg:ubuntu/...`
* Visual Studio Marketplace - `pkg:vsm/...`
* Generic - `pkg:url/...?url=URL`

We will continue expanding this list to cover additional package management systems and would be happy to accept contributions from the community.

## Basic Usage

All OSS Gadget tools are command line programs. When installed globally, they can be accessed from your path. For example, to download the NPM left-pad module, type:

```
$ oss-download pkg:npm/left-pad
```

This will download left-pad into a newly-created directory named `npm-left-pad@1.3.0`. (Because, at the time of this writing, 1.3.0 was the latest version of [left-pad](https://www.npmjs.com/package/left-pad)).

Each of the programs self-documents information on command line options (`--help`).

### Building from Source
OSS Gadget builds with standard `dotnet build` commands and includes tests via `dotnet test`.

See [Building from Source](https://github.com/microsoft/OSSGadget/wiki/Building-from-Source) in the wiki for information on building from source.

### Docker Image
See [Docker Image](https://github.com/microsoft/OSSGadget/wiki/Docker-Image) in the wiki for information on how to use the included Dockerfile.

### Advanced Usage
See [Advanced Usage](https://github.com/microsoft/OSSGadget/wiki/Advanced-Usage) in the wiki for advanced usage information like changing API endpoints.

### Reporting Security Vulnerabilities

To report a security vulnerability, please see [SECURITY.md](SECURITY.md).

### Contributing to OSS Gadget

This project welcomes contributions and suggestions.  Most contributions require you to agree to a
Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us
the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide
a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions
provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/).
For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or
contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.