Subcommands

Discover build targets, resolve dependency graphs, and upload analysis results to FOSSA.

Analyze and test container images for license and vulnerability policy violations.

Generate starter fossa-deps and .

List analysis targets the CLI would run in a directory without uploading results.

Create, view, and manage FOSSA projects from the command line.

Manage FOSSA release groups and their member projects from the command line.

Download compliance or attribution reports for the latest project revision.

Upload SPDX or CycloneDX SBOMs to FOSSA and run policy tests against them.

Fail CI when the latest scan has license or security policy violations.

Optional flags that modify how fossa analyze discovers and uploads projects.

Detect dynamically linked system libraries in C and C++ binaries during analyze.

Find vendored open source libraries copied beside first-party code during analyze.

Use Podman as the container engine when running fossa container analysis.

Supported image sources, package managers, and analysis options for container scanning.

Update FOSSA project settings such as title, URL, and default branch from the CLI.

Add existing FOSSA projects to a release group.

Create a release snapshot inside a FOSSA release group.

Create a new FOSSA release group.

Delete a release snapshot from a FOSSA release group.

Delete a FOSSA release group.