Project: FOSSA (Provisioning / Security & Compliance)
File: conan.md

Conan is a dependency and package manager for C and C++ languages. It is free and open-source, works on all platforms (Windows, Linux, OSX, FreeBSD, Solaris, etc.), and can be used to develop for all targets, including embedded, mobile (iOS, Android), and bare metal. It also integrates with all build systems like CMake, Visual Studio (MSBuild), Makefiles, etc., including proprietary ones. Conan v2.0.0 or greater (you can check the version by running: `conan -v`) Python v3 (so you can run the script) This integration uses the `conan graph info` command to retrieve the dependency graph and source code for all dependencies. From this data, it generates file with and . To use this integration, Download python script, and place it in the same directory as `conanfile.txt` or `conanfile.py.` Build your project (ensure it compiles) Run `python makefossadeps_conan.py` (this will generate `fossa-deps.yaml` in the same directory) Run `fossa analyze && fossa test` In this approach, `makefossadeps_conan.py` does the followings: Retrieve the project's dependency graph via the `conan graph info` command Uses `-c tools.build:download_source=True` option to ensure Conan always For each requirement with non `build` context and source code directory, it builds a vendor-dependency entry in the `fossa-deps.yaml` file For each requirement with non `build` context and empty source code directory, it builds a custom-dependency entry in the `fossa-deps.yaml` file This integration method uses and functionalities, and as such, it does not provide the following, Security functionalities (FOSSA will not be able to identify vulnerabilities, only licensing and copyright issues) Author information (in dependency view) This integration example uses the best alternative mode of analysis for each dependency. It tries to locate the source code for each dependency, and if it fails to locate the source code, it will create this dependency as entry in the file. In this case, it will use a declared license for this dependency. If the script locates the source code, it will create entry in the file. ```bash apt-get -y install python3 pip git wget pip3 install conan wget https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh bash install-latest.sh conan --version git clone https://github.com/conan-io/examples2.git cd /examples2/tutorial/consumingpackages/simplecmake_project conan profile detect --force conan install . --output-folder=build --build=missing wget https://raw.githubusercontent.com/fossas/fossa-cli/master/docs/walkthroughs/makefossadeps_conan.py export FOSSAAPIKEY=XXXX python3 makefossadeps_conan.py fossa analyze fossa test ``` FOSSA is actively working to develop native Conan support. We want to build a functionality that provides accurate and repeatable analysis for all versions of the Conan package manager. This integration script is supplied as a potential option if you want to start using FOSSA for Conan immediately. This integration example uses the `conan graph info` command with `--format json` and `-c tools.build:download_source=True` option, which are only available in Conan v2 (`v2.0.0+`). You can provide any additional options (except `--format` or `-f`) To do so, provide options to the Python script. For example, ```bash > python3 makefossadeps_conan.py -s compiler=gcc ``` You can file a support ticket with . This can be achieved by modifying . In the script, you can choose to always create entry, this will ensure that declared license is always used.