Conan

Introduction

Conan is the primary C/C++ package manager supported by JFrog Xray. Conan packages follow a reference format (name/version@user/channel) and use recipe files (conanfile.txt or conanfile.py) to declare dependencies.

This page provides a detailed breakdown of Conan-specific scanning support across all scan contexts.

Capabilities

Capability	Source Code Scanning	Binary Scanning
Vulnerability Matching (CVEs)	✅	✅
License Detection	✅	✅
Malicious Package Detection	✅	✅
Operational Risk	❌	❌
Smart Remediation	❌	❌

SCA capabilities are not currently available for Conan in the source code scanning context via jf audit.

Supported Files

File	Supported
`conanfile.txt`	❌ Not supported
`conanfile.py`	❌ Not supported
`conan.lock`	❌ Not supported

Supported Files

File	Supported	Details
`conanfile.txt`	✅	Parses `[requires]` and `[tool_requires]` / `[build_requires]` sections
`conanfile.py`	⚠️ Limited	Basic parsing only. Complex Python logic, conditional dependencies, and dynamic version resolution are not evaluated
`conan.lock`	❌	Lockfile parsing is not supported

Dependency Graph

File	Dependency Graph
`conanfile.txt`	❌ Flat – No transitive dependency resolution
`conanfile.py`	❌ Flat – No transitive dependency resolution

Binary scanning analyzes Conan packages stored in Artifactory Conan repositories, extracting package metadata from the Conan package format.

Supported Package Formats

Format	Supported	Details
Conan packages	✅	Identified via `conanmanifest.txt` and `conaninfo.txt`
Conan recipe exports	✅	Recipe-level metadata extracted

How Binary Scanning Works

Conan packages are stored in an Artifactory Conan repository
Xray indexes the repository and identifies Conan packages via manifest files
Package name, version, user, and channel are extracted from the Conan reference
Vulnerability matching is performed against the JFrog vulnerability database
License information is extracted from package metadata

Artifactory Repository Types

Repository Type	Supported
Conan Local	✅
Conan Remote	✅
Conan Virtual	✅

Best Practices

Practice	Recommendation
Use `conanfile.txt` over `.py`	Simpler format with more reliable parsing
Pin exact versions	Use `boost/1.82.0` instead of version ranges for accurate scanning
Store in Artifactory	Binary scanning provides the richest analysis for Conan
Use Conan revisions	Enables precise package identification in Artifactory