使用 Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper 安装 flawfinder

项目链接

• 主页
• 仓库
• 上游文档
• 软件包管理器页面

命令和别名

• flawfinder

项目历史

Wheeler developed flawfinder as an open source source-code scanner for security weaknesses. The official site explains that it was created to encourage use of static analysis tools and that no one tool is sufficient; flawfinder is meant to be one simple advisor among several.

The project has long been hosted through SourceForge for source, releases, mailing lists, and issue tracking, while later documentation also references GitHub issues, pull requests, a GitHub Action, SARIF output, SonarQube integration, and modern Python packaging. The ChangeLog records the 2.0 series move to semantic versioning in 2017, Python 2.7/3 compatibility, direct pip installation through setuptools, SARIF support in 2021, and security hardening in 2.0.20 in 2026.

采用历史

The official homepage says prepackaged versions are available for many Unix-like systems, explicitly naming Fedora, Debian, Ubuntu, Cygwin, FreeBSD Ports, OpenBSD ports, NetBSD pkgsrc, and Fink. The supplied package-manager metadata also records packaging in Homebrew, MacPorts, Nix, pacman, zypper, apk, Debian, Ubuntu, and Fedora ecosystems.

flawfinder also earned official CWE compatibility and a CII Best Practices passing badge, which helped make it recognizable in security tooling catalogs and CI pipelines.

使用方式

The basic use case is intentionally small: install with pip or a system package manager, then run `flawfinder` over a file or directory. Findings are assigned risk levels, and output formats include text, HTML, CSV, SARIF, and SonarQube-compatible output.

The tool's design trades deep semantic analysis for speed and availability. Its README notes that it can analyze programs that cannot be built or linked, while also warning that it can produce false positives and miss issues because it lacks full control-flow, data-flow, type, namespace, and scope information.

为什么软件包爱好者会关心

flawfinder is a classic small security package: a single-purpose scanner with no heavyweight service dependency, available through many OS package managers, pip, and CI integrations. It is especially relevant to package history because it bridges early-2000s free-software security scanning, distribution packaging, CWE-era rule classification, and modern SARIF-based code scanning.

时间线

• 2001: flawfinder and RATS are released simultaneously on May 21.
• 2002: SANS review coverage appears among the official site's collected reviews.
• 2004: Debian Security Audit Project testimonial records use of flawfinder.
• 2017: 2.0.0 changes versioning to semantic versioning.
• 2017: 2.0.2 adds Python 2.7 and Python 3 support.
• 2017: 2.0.4 switches to setuptools and direct pip install support.
• 2021: 2.0.16 adds SARIF output.
• 2026: 2.0.20 ships security hardening, Sonar output, encoding handling improvements, and CI workflow updates.

Related projects

• RATS is the historically closest related project; the official site says the two scanners were developed independently and released simultaneously.
• ITS4, Warnbuf, Stumoch, CWE, SARIF, SonarQube, and GitHub code scanning are related security-analysis or reporting contexts discussed by the official documentation.

来源

• https://dwheeler.com/flawfinder
• https://dwheeler.com/flawfinder/flawfinder.pdf
• https://formulae.brew.sh/formula/flawfinder
• https://sourceforge.net/p/flawfinder/code
• https://sourceforge.net/p/flawfinder/code/ci/master/tree/ChangeLog?format=raw
• https://sourceforge.net/p/flawfinder/code/ci/master/tree/README.md?format=raw