C/C++
Review C/C++ source and binary scanning support in JFrog Xray.
Introduction
JFrog Xray provides security and compliance analysis for C/C++ applications throughout the software development lifecycle. This page describes the supported scan contexts, capabilities, and dependency analysis available for C/C++.
Capabilities
The following capabilities are available for C/C++.
| Capability | Source Code Scanning | Binary Scanning |
|---|---|---|
| Vulnerability Matching (CVEs) | 🔜 |  |
| License Detection | 🔜 | |
| Malicious Package Detection |  | |
| Operational Risk | | |
| Smart Remediation | | |
Software Composition Analysis (SCA) for C/C++ currently supports only the Conan package manager. For more information, see Scan Your Source Code.
Which files a source scan reads depends on the scan method. For those differences, see Source Scanning Engines and Frogbot Versions.
Supported Files
| Package Manager | Supported Files | Available with |
|---|---|---|
| Conan | Not supported | Default jf audit |
| Conan | conanfile.txt, conanfile.py – Flat package list, no resolved versions | Frogbot V3 |
Dependency Graph
| Package Manager | Dependency Graph |
|---|---|
| Conan | Flat – No lockfile support, limited parsing, profiles not evaluated |
Binary scanning analyzes built artifacts stored in JFrog Artifactory repositories, extracting package metadata from the artifact format itself. For more information, see Scan Your Binaries.
Supported Files
The following package formats are supported for C/C++ binary scanning.
| Package Manager | Supported Files |
|---|---|
| Conan | Conan packages, including conanmanifest.txt |
Additional Information
- Binary scanning is the primary method for C/C++ SCA.
- Frogbot V3 will add dependency extraction from Conan manifests for SBOM visibility.
Related Topics
Updated 25 days ago