Venlock (a.k.a. Vendor Lock)

Install/Run

You can download precompiled binaries, containers or install directly from source.

Binaries (arm, amd64)

Precompiled binaries can be found here.

Docker (arm, amd64)

docker run -ti docker pull ghcr.io/crashdump/venlock:latest 

Source

go install github.com/crashdump/venlock/cmd/venlock@latest

Use

Subcommands

./venlock

┌─────────────┐
│ Vendor Lock │
└─────────────┘

NAME:
venlock - Search for package manifests and identifies untrusted libraries.

USAGE:
venlock [global options] command [command options] [arguments...]

AUTHOR:
Adrien Pujol <[email protected]>

COMMANDS:
enumerate, e  enumerate all the libraries from source code.
generate, g   generate a config.json from source code.
enforce, v    enforce inventory libraries.
help, h       Shows a list of commands or help for one command

GLOBAL OPTIONS:
--help  (default: false)

Enumerate

./venlock enumerate test/fixtures

┌─────────────┐
│ Vendor Lock │
└─────────────┘

Enumerating libraries from source code...

> Go...
... found 12 dependencies.

github.com/PuerkitoBio/goquery
github.com/avelino/slugify
github.com/otiai10/copy
github.com/yuin/goldmark
golang.org/x/oauth2
github.com/andybalholm/cascadia
github.com/golang/protobuf
golang.org/x/net
golang.org/x/sys
golang.org/x/text
google.golang.org/appengine
google.golang.org/protobuf

> Maven...
... found 2 dependencies.

foo:bar
junit:junit

> NPM...
... found 2 dependencies.

express
compression

Enforce

./venlock enforce -c test/fixtures/config.json test/fixtures

enforce -c test/fixtures/config.json test/fixtures
┌─────────────┐
│ Vendor Lock │
└─────────────┘

Searching for foreign libraries in source code...

> Go...
... found foreign libraries:
  - github.com/PuerkitoBio/goquery
  - github.com/yuin/goldmark
  - golang.org/x/oauth2
  - github.com/andybalholm/cascadia
  - github.com/golang/protobuf
  - golang.org/x/net
  - golang.org/x/sys
  - golang.org/x/text
  - google.golang.org/appengine
  - google.golang.org/protobuf

> Maven...

No mismatch.

> Npm...

No mismatch.

non-compliant: found unexpected libraries

Contribute

Build

go build ./... -o dist/venlock

Test

go test ./...