---
title: "Announcing the GA of C and C++ Security and License Scanning"
description: "FOSSA announces the general availability of its security and license scanning for C and C++ projects, offering tailored solutions for dependency identification."
canonical_url: "https://fossa.com/blog/announcing-c-security-license-scanning-ga/"
markdown_url: "https://fossa.com/blog/announcing-c-security-license-scanning-ga.md"
content_type: "blog"
language: "en"
date_published: "2022-11-01"
date_modified: "2022-11-01"
author: "Gauthami Polasani"
organization: "FOSSA"
---

# Announcing the GA of C and C++ Security and License Scanning

> FOSSA announces the general availability of its security and license scanning for C and C++ projects, offering tailored solutions for dependency identification.

C and C++ are popular languages because of their performance and ubiquity, especially in performance-critical domains such as browser engines, databases, and games.

But, historically, many organizations have faced challenges identifying dependencies in these languages. This is because C and C++ are unmanaged languages lacking manifests. While a few package managers like Conan exist, they are not universally adopted. Each organization has its own way of using and organizing dependencies in C and C++ projects, so accurately identifying dependencies in any arbitrary C or C++ project is rather complex.

FOSSA is excited to announce the GA of our security and license scanning for C and C++ projects, which will help users tackle these challenges and secure their mission-critical applications.

Unlike other C/C++ scanning tools, FOSSA does not take a one-solution-fits-all approach to dependency identification in such a complex and layered ecosystem. FOSSA uses multi-pronged strategies (as described below) to accurately identify dependencies and surface security and license risks — regardless of how the code is included.

## Using FOSSA C/C++ Security and License Compliance

To get started with FOSSA C/C++, download FOSSA CLI version 3.1.3 or later from our [GitHub releases page](https://github.com/fossas/fossa-cli).

The next step depends on how C/C++ dependencies are included in your project — since they are unmanaged languages, there are a few ways that C/C++ could be used in your organization.

### Vendored Code

In this scenario, C/C++ dependencies are included via an _src_ or _vendor_ folder as shown below. Since these dependencies are considered part of their first-party projects, the open source dependencies also get built along with the first-party project.

**Detecting Vendored Source Code Dependencies**

Use the `--detect-vendored` flag to enable vendored source code identification.

Example:

```bash
fossa analyze --detect-vendored
```

### Static Linking

In some cases, teams distribute the binary and its associated headers instead of vendoring the code. Typically, these statically linked binaries are also stored inside the project directory, as shown in the screenshot below.

![Static Linking Example](https://fossa.com/cc-static.png)

**Detecting Statically Linked Dependencies**

Use the `--experimental-link-project-binary ` flag to enable registering files in the provided directory as outputs of the project being analyzed.

Example:

```bash
fossa analyze --experimental-link-project-binary out/bin/
```

### Dynamic Linking

This is the most popular way of including dependencies in C/C++ projects. It involves using pre-built dependencies that are typically provided by the operating system package manager; the application loader then links them into the first-party application at run time.

![Dynamic Linking Example](https://fossa.com/cc-dynamic.png)

**Detecting Dynamically Linked Libraries**

Use the `--detect-dynamic ` flag to enable inspecting the binary at the provided path for dynamically linked libraries.

Example:

```bash
fossa analyze --detect-dynamic out/bin/service
```

Once scanning is done, you can find a summary of your security and licensing issues in the FOSSA dashboard. You can proceed to triage, resolve or remediate them.

We will begin rolling this feature out to customers next week. For any questions or feedback, please reach out to us at [support@fossa.com](mailto:support@fossa.com). If you aren't currently a FOSSA customer but are interested in trying this feature, you can [request a demo here](https://fossa.com/request-demo).

## Source

Canonical page: https://fossa.com/blog/announcing-c-security-license-scanning-ga/