Detector Properties 6.4.0

This page lists and describes detectors and the properties that you can use to configure how the detector functions in a Detect scan. For example, the Docker detector uses the property --detect.docker.image.id to specify the Docker image ID to inspect.

Detectors and properties:

You configure Synopsys Detect detector properties by assigning values to properties.

Bazel

Bazel cquery additional options

A comma-separated list of additional options to pass to the bazel cquery command.

Bazel workspace external dependency rule

The Bazel workspace rule used to pull in external dependencies. If not set, Detect will attempt to determine the rule from the contents of the WORKSPACE file.

Bazel executable

The path to the Bazel executable.

Bazel target

The Bazel target (for example, //foo:foolib) for which dependencies are collected. For Detect to run Bazel, this property must be set.

Bitbake

BitBake init script name

The name of the build environment init script.

BitBake package names

A comma-separated list of package names from which dependencies are extracted.

BitBake search depth

The depth at which Detect will search for the recipe-depends.dot or package-depends.dot files.

BitBake source arguments

A comma-separated list of arguments to supply when sourcing the build environment init script.

Reference implementation (Deprecated)

The reference implementation of the Yocto project. These characters are stripped from the discovered target architecture.

DEPRECATED: This property is no longer required and will not be used in the Bitbake Detector. It will cause failure in 7.0.0 and be removed in 8.0.0.

Conda

Anaconda Environment Name

The name of the anaconda environment used by your project.

Conda Executable

The path to the Conda executable.

Cpan

cpanm executable

The path to the cpanm executable.

cpan executable

The path to the cpan executable.

Docker

Docker image name

The Docker image name to inspect. For Detect to run Docker Inspector, either this property or detect.docker.tar must be set. Docker Inspector finds packages installed by the Linux package manager in Linux-based images.

Docker image ID

The Docker image ID to inspect.

Docker executable

Path to the docker executable.

Docker image archive file

A saved Docker image must be a .tar file. For Detect to run Docker Inspector, either this property or detect.docker.tar must be set. Docker Inspector finds packages installed by the Linux package manager in Linux-based images.

Docker Inspector air-gap path (Advanced)

The path to the directory containing the Docker Inspector jar and images.

Docker Inspector .jar file path (Advanced)

This is used to override using the hosted Docker Inspector .jar file by binary repository URL. You can use a compatible (the same major version that Detect downloads by default) local Docker Inspector .jar file at this path.

Docker Inspector version (Advanced)

Version of the Docker Inspector to use. By default, Detect will attempt to automatically determine the version to use.

Run without Docker in path (Advanced)

If set to true, Detect will attempt to run the Docker Inspector only if it finds a docker client executable.

Platform top layer ID (Advanced)

To exclude components from platform layers from the results, assign the ID of the top layer of the platform image to this property. Get the platform top layer ID from the output of docker inspect platformimage:tag. The platform top layer ID is the last item in RootFS.Layers. For more information, see 'Isolating application components' in the Docker Inspector documentation.

If you are interested in components from the application layers of your image, but not interested in components from the underlying platform layers, you can exclude components from platform layers from the results by using this property to specify the boundary between platform layers and application layers.

Docker passthrough (Advanced)

Additional properties may be passed to the docker inspector by adding the prefix detect.docker.passthrough. The keys will be given to docker inspector without the prefix.

Phone home passthrough (Advanced)

Additional values may be sent home for usage information. The keys will be sent without the prefix.

Go

Go executable

Path to the Go executable.

Gradle

Gradle build command

Gradle command-line arguments to add to the mvn/mvnw command line.

By default, Detect runs the Gradle (or gradlew) command with one task: dependencies. You can use this property to insert one or more additional Gradle command-line arguments (options or tasks) before the dependencies argument.

Gradle executable

The path to the Gradle executable (gradle or gradlew). If set, Detect will use the given Gradle executable instead of searching for one.

Gradle exclude configurations (Advanced)

A comma-separated list of Gradle configurations to exclude. As Detect examines the Gradle project for dependencies, Detect will skip any Gradle configurations specified via this property. This property accepts filename globbing-style wildcards. 

Gradle exclude projects (Advanced)

A comma-separated list of Gradle sub-projects to exclude. As Detect examines the Gradle project for dependencies, Detect will skip any Gradle sub-projects specified via this property. This property accepts filename globbing-style wildcards. 

Gradle include configurations (Advanced)

A comma-separated list of Gradle configurations to include.

As Detect examines the Gradle project for dependencies, if this property is set, Detect will include only those Gradle configurations specified via this property that are not excluded. Leaving this unset implies 'include all'. Exclusion rules always win. This property accepts filename globbing-style wildcards. 

Gradle include projects (Advanced)

A comma-separated list of Gradle sub-projects to include.

As Detect examines the Gradle project for dependencies, if this property is set, Detect will include only those sub-projects specified via this property that are not excluded. Leaving this unset implies 'include all'. Exclusion rules always win. This property accepts filename globbing-style wildcards. 

Gradle Inspector air-gap path (Advanced)

The path to the directory containing the air gap dependencies for the Gradle inspector.

Use this property when running Detect on a Gradle project in 'air gap' mode (offline). Download and unzip the Detect air gap zip file, and point this property to the packaged-inspectors/gradle directory.

Gradle Inspector version (Advanced)

The version of the Gradle Inspector that Detect should use. By default, Detect will try to automatically determine the correct Gradle Inspector version.

The Detect Gradle detector uses a separate program, the Gradle Inspector, to discover dependencies from Gradle projects. Detect automatically downloads the Gradle Inspector as needed. Use the property to use a specific version of the Gradle Inspector.

Detect Gradle Inspector Repository Url (Deprecated)

The repository Gradle should use to look for the Gradle inspector dependencies.

DEPRECATED: In the future, the Gradle inspector will no longer be downloaded from a custom repository.
Use Detect Air Gap instead. It will cause failure in 6.0.0 and be removed in 7.0.0.

Hex

Rebar3 Executable

The path to the rebar3 executable.

Lerna

Include Lerna packages defined as private

Lerna allows for private packages that do not get published. Set this to true to include all packages including private packages.

Lerna executable

Path of the lerna executable.

Maven

Maven build command

Maven command line arguments to add to the mvn/mvnw command line.

By default, Detect runs the mvn (or mvnw) command with one argument: dependency:tree. You can use this property to insert one or more additional mvn command line arguments (goals, etc.) before the dependency:tree argument. For example: suppose you are running in bash on Linux, and want to point maven to your settings file (maven_dev_settings.xml in your home directory) and assign the value 'other' to property 'reason'. You could do this with: --detect.maven.build.command='--settings ${HOME}/maven_dev_settings.xml --define reason=other'

Dependency scope excluded

A Comma separated list of Maven scopes. Output will be limited to dependencies outside these scopes (overrides include).

If set, Detect will include only dependencies outside of the given Maven scope. This property accepts filename globbing-style wildcards.

Dependency scope included

A Comma separated list of Maven scopes. Output will be limited to dependencies within these scopes (overridden by exclude). If set, Detect will include only dependencies of the given Maven scope. This property accepts filename globbing-style wildcards.

Maven executable

The path to the Maven executable (mvn or mvnw).

If set, Detect will use the given Maven executable instead of searching for one.

Maven modules excluded (Advanced)

A comma-separated list of Maven modules (sub-projects) to exclude.

As Detect parses the mvn dependency:tree output for dependencies, Detect will skip any Maven modules specified via this property. This property accepts filename globbing-style wildcards.

Maven modules included (Advanced)

A comma-separated list of Maven modules (sub-projects) to include.

As Detect parses the mvn dependency:tree output for dependencies, if this property is set, Detect will include only those Maven modules specified via this property that are not excluded. Leaving this unset implies 'include all'. Exclusion rules always win. This property accepts filename globbing-style wildcards.

Maven include plugins (Advanced)

Whether or not detect will include the plugins section when parsing a pom.xml.

Dependency scope included (Deprecated)

The name of a Maven scope. Output will be limited to dependencies with this scope. If set, Detect will include only dependencies of the given Maven scope.

DEPRECATED: This property is changing.
Use --detect.maven.included.scope in the future. It will cause failure in 7.0.0 and be removed in 8.0.0.

npm

Additional npm command arguments

A space-separated list of additional arguments to add to the npm command line when running Detect against an npm project.

Include npm development dependencies

Set this value to false if you would like to exclude your development dependencies when ran.

npm executable

The path to the npm executable.

NuGet

.NET (dotnet) executable

The path to the .NET (Microsoft .NET) executable.

NuGet config file

The path to the NuGet.Config file to supply to the NuGet exe.

NuGet packages Repository URL

The source for NuGet packages. Set the source to "https://www.NuGet.org/api/v2/" if you are still using a NuGet client expecting the v2 API.

NuGet projects excluded (Advanced)

The names of the projects in a solution to exclude.

Ignore NuGet failures (Advanced)

If true errors will be logged and then ignored.

NuGet modules included (Advanced)

The names of the projects in a solution to include (overrides exclude).

NuGet Inspector air-gap path (Advanced)

The path to the directory containing the NuGet inspector nupkg.

NuGet Inspector version (Advanced)

Version of the NuGet Inspector. By default Detect will run the latest version that is compatible with the Detect version.

Detect NuGet Inspector Name (Deprecated)

Name of the NuGet Inspector package and the NuGet Inspector exe. (Do not include '.exe'.)

The NuGet inspector (previously) could be hosted on a custom NuGet feed. In this case, Detect needed to know the name of the package to pull and the name of the exe file (which has to match). In the future, Detect will only retrieve it from Artifactory or from Air Gap so a custom name is no longer supported.

DEPRECATED: In the future, Detect will not look for a custom named inspector. It will cause failure in 6.0.0 and be removed in 7.0.0.

Detect NuGet path (Deprecated)

The path to the NuGet executable. NuGet is used to download the classic inspectors' NuGet package.

DEPRECATED: In the future, Detect will no longer need a NuGet executable as it will download the inspector from Artifactory exclusively. It will cause failure in 6.0.0 and be removed in 7.0.0.

Packagist

Include packagist development dependencies

Set this value to false if you would like to exclude your dev requires dependencies when ran.

Pear

Include only required pear dependencies

Set to true if you would like to include only required packages.

pear executable

The path to the pear executable.

Pip

Pipenv executable

The path to the Pipenv executable.

PIP Include only project tree

By default, pipenv includes all dependencies found in the graph. Set to true to only include dependencies found underneath the dependency that matches the provided pip project and version name.

PIP project name

The name of your PIP project, to be used if your project's name cannot be correctly inferred from its setup.py file.

PIP project version name

The version of your PIP project, to be used if your project's version name cannot be correctly inferred from its setup.py file.

PIP requirements path

A comma-separated list of paths to requirements.txt files.

Python

Python executable

The path to the Python executable.

Use Python3

If true will use Python 3 if available on class path.

Ruby

Ruby development dependencies

If set to true, development dependencies will be included when parsing *.gemspec files.

Ruby runtime dependencies

If set to false, runtime dependencies will not be included when parsing *.gemspec files.

sbt

sbt report search depth

Depth the sbt detector will use to search for report files.

sbt configurations excluded (Advanced)

The names of the sbt configurations to exclude. This property accepts filename globbing-style wildcards.

sbt configurations included (Advanced)

The names of the sbt configurations to include. This property accepts filename globbing-style wildcards.

Yarn

Include Yarn production dependencies only

Set this to true to only scan production dependencies.