Every ecosystem

Every package ecosystem Cordon reads, 28 of them, and how to scan each one. The files, the checks and the commands below are rendered from the shipped code, so this page names exactly what a scan reads. The same facts as one table: docs/07-ECOSYSTEMS.md.

   One command reads all of them at once. A repository with a package.json, a   go.mod, a Dockerfile and a workflow is four ecosystems in one scan:   cordon-scanner scan .   Offline by default. --online adds the registry and provenance checks, and   names each package to its own registry; nothing else leaves the machine.

Roles and collections a playbook installs. Ecosystem id ansible.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Modules from the Bazel Central Registry. Ecosystem id bazel.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Rust crates from crates.io. Ecosystem id cargo.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:cargo/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

IOS and macOS pods. Ecosystem id cocoapods.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

PHP packages from Packagist. Ecosystem id composer.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

C and C++ packages. Ecosystem id conan.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Conda-forge and Anaconda packages. Ecosystem id conda.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

The images a Dockerfile, compose file or workload runs. Ecosystem id image.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

R packages, through renv. Ecosystem id cran.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Workflows and the actions they use, pinned or not. Ecosystem id actions.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Go modules from the module proxy. Ecosystem id gomod.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:golang/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

JVM dependencies, Gradle's way. Ecosystem id gradle.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Haskell packages, through cabal and stack. Ecosystem id hackage.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Charts a chart depends on. Ecosystem id helm.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Elixir and Erlang packages. Ecosystem id hex.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:hex/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

Formulae and casks in a Brewfile. Ecosystem id homebrew.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Packages from the General registry. Ecosystem id julia.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

JVM dependencies from Maven Central. Ecosystem id maven.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:maven/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

Flake inputs. Ecosystem id nix.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

JavaScript and TypeScript packages, with npm, pnpm, Yarn or Bun. Ecosystem id npm.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:npm/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

.NET packages. Ecosystem id nuget.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:nuget/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

OCaml packages. Ecosystem id opam.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Dart and Flutter packages. Ecosystem id pub.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:pub/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

Python packages, with pip, Poetry, Pipenv, PDM or uv. Ecosystem id pypi.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:pypi/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

Ruby gems, through Bundler. Ecosystem id rubygems.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner scan pkg:gem/<name>@<version> --onlinecordon-scanner deps .                      # every package found, with its findings

Swift Package Manager dependencies. Ecosystem id swift.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

Providers and their pinned hashes. Ecosystem id terraform.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

C and C++ ports. Ecosystem id vcpkg.

cordon-scanner scan .                      # every file above, in the projectcordon-scanner deps .                      # every package found, with its findings

The source Cordon reads inside any of those projects: 38 languages, each identified by its file name or extension, by a script's interpreter line, or by its content. The last column counts the rule-pack rules written for that language. Every file also gets the checks that are not tied to one language (secrets, hidden characters, obfuscation, known-malware signatures), and Dockerfiles, YAML pipelines, manifests and infrastructure are read by their own detectors (tutorials 07 and 08), so a 0 there is not a file left unread. Every rule is in tutorial 28.

Language	Files	Rule-pack rules
C	*.c, *.h	0
C#	*.cs	10
C++	*.cc, *.cpp, *.cxx, *.hpp	0
Clojure	*.bb, *.clj, *.cljc, *.cljs	8
CMake	CMakeLists.txt	10
Dart	*.dart	7
Dockerfile	Containerfile, Dockerfile	0
Elixir	*.ex, *.exs	8
Go	*.go	10
Groovy	Jenkinsfile, build.gradle	11
Haskell	*.hs, *.lhs	8
Java	*.java	10
JavaScript	*.cjs, *.js, *.jsx, *.mjs	15
JSON	*.json	0
Julia	*.jl	8
Kotlin	*.kt, *.kts, build.gradle.kts	18
Lua	*.lua	8
Makefile	GNUmakefile, Makefile	10
Markdown	*.markdown, *.md, *.mdc	0
Nim	*.nim, *.nimble, *.nims	7
Objective-C	*.m, *.mm	8
OCaml	*.ml, *.mli	8
Perl	*.pl, *.pm	8
PHP	*.php	10
PowerShell	*.ps1, *.psm1	10
Python	*.pth, *.py, *.pyi, *.pyw, conanfile.py, setup.py	17
R	*.r	8
Ruby	*.rb, Gemfile, Podfile, Rakefile	10
Rust	*.rs, build.rs	10
Scala	*.scala	10
Shell	*.bash, *.sh, *.zsh	11
SQL	*.sql	0
Swift	*.swift, Package.swift	8
TOML	*.toml	0
TypeScript	*.cts, *.mts, *.ts, *.tsx	15
XML	*.csproj, *.fsproj, *.props, *.targets, *.vbproj, *.xml	11
YAML	*.yaml, *.yml	0
Zig	*.zig, build.zig	7

Next: 26 · Every command.