/
snyk.1
312 lines (311 loc) · 14.4 KB
/
snyk.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
.\" generated with Ronn-NG/v0.9.1
.\" http://github.com/apjanke/ronn-ng/tree/0.9.1
.TH "SNYK" "1" "August 2021" "Snyk.io"
.SH "NAME"
\fBsnyk\fR \- CLI and build\-time tool to find & fix known vulnerabilities in open\-source dependencies
.SH "SYNOPSIS"
\fBsnyk\fR [\fICOMMAND\fR] [\fISUBCOMMAND\fR] [\fIOPTIONS\fR] [\fIPACKAGE\fR] [\-\- \fICOMPILER_OPTIONS\fR]
.SH "DESCRIPTION"
Snyk helps you find, fix and monitor known vulnerabilities in open source dependencies\.
.br
For more information see https://snyk\.io
.SS "Not sure where to start?"
.IP "1." 4
authenticate with \fB$ snyk auth\fR
.IP "2." 4
test your local project with \fB$ snyk test\fR
.IP "3." 4
get alerted for new vulnerabilities with \fB$ snyk monitor\fR
.IP "" 0
.SH "COMMANDS"
To see command\-specific flags and usage, see \fBhelp\fR command, e\.g\. \fBsnyk container \-\-help\fR\. Available top\-level CLI commands:
.TP
\fBauth\fR [\fIAPI_TOKEN\fR]
Authenticate Snyk CLI with a Snyk account\.
.TP
\fBtest\fR
Test local project for vulnerabilities\.
.TP
\fBmonitor\fR
Snapshot and continuously monitor your project\.
.TP
\fBcontainer\fR
Test container images for vulnerabilities\. See \fBsnyk container \-\-help\fR for full instructions\.
.TP
\fBiac\fR
Find security issues in your Infrastructure as Code files\. See \fBsnyk iac \-\-help\fR for full instructions\.
.TP
\fBconfig\fR
Manage Snyk CLI configuration\.
.TP
\fBprotect\fR
Applies the patches specified in your \.snyk file to the local file system\.
.TP
\fBpolicy\fR
Display the \.snyk policy for a package\.
.TP
\fBignore\fR
Modifies the \.snyk policy to ignore stated issues\.
.TP
\fBwizard\fR
Configure your policy file to update, auto patch and ignore vulnerabilities\. Snyk wizard updates your \.snyk file\.
.SH "OPTIONS"
To see command\-specific flags and usage, see \fBhelp\fR command, e\.g\. \fBsnyk container \-\-help\fR\. For advanced usage, we offer language and context specific flags, listed further down this document\.
.TP
\fB\-\-all\-projects\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Auto\-detect all projects in working directory
.TP
\fB\-\-detection\-depth\fR=\fIDEPTH\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Use with \-\-all\-projects or \-\-yarn\-workspaces to indicate how many sub\-directories to search\. \fBDEPTH\fR must be a number\.
.IP
Default: 4 (the current working directory and 3 sub\-directories)
.TP
\fB\-\-exclude\fR=\fIDIRECTORY\fR[,\fIDIRECTORY\fR]\|\.\|\.\|\.>
(only in \fBtest\fR and \fBmonitor\fR commands) Can be used with \-\-all\-projects and \-\-yarn\-workspaces to indicate sub\-directories and files to exclude\. Must be comma separated\.
.IP
If using with \fB\-\-detection\-depth\fR exclude ignores directories at any level deep\.
.TP
\fB\-\-prune\-repeated\-subdependencies\fR, \fB\-p\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Prune dependency trees, removing duplicate sub\-dependencies\. Will still find all vulnerabilities, but potentially not all of the vulnerable paths\.
.TP
\fB\-\-print\-deps\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Print the dependency tree before sending it for analysis\.
.TP
\fB\-\-remote\-repo\-url\fR=\fIURL\fR
Set or override the remote URL for the repository that you would like to monitor\.
.TP
\fB\-\-dev\fR
Include development\-only dependencies\. Applicable only for some package managers\. E\.g\. \fIdevDependencies\fR in npm or \fI:development\fR dependencies in Gemfile\.
.IP
Default: scan only production dependencies
.TP
\fB\-\-org\fR=\fIORG_NAME\fR
Specify the \fIORG_NAME\fR to run Snyk commands tied to a specific organization\. This will influence where will new projects be created after running \fBmonitor\fR command, some features availability and private tests limits\. If you have multiple organizations, you can set a default from the CLI using:
.IP
\fB$ snyk config set org\fR=\fIORG_NAME\fR
.IP
Setting a default will ensure all newly monitored projects will be created under your default organization\. If you need to override the default, you can use the \fB\-\-org\fR=\fIORG_NAME\fR argument\.
.IP
Default: uses \fIORG_NAME\fR that sets as default in your Account settings \fIhttps://app\.snyk\.io/account\fR
.TP
\fB\-\-file\fR=\fIFILE\fR
Sets a package file\.
.IP
When testing locally or monitoring a project, you can specify the file that Snyk should inspect for package information\. When ommitted Snyk will try to detect the appropriate file for your project\.
.TP
\fB\-\-ignore\-policy\fR
Ignores all set policies\. The current policy in \fB\.snyk\fR file, Org level ignores and the project policy on snyk\.io\.
.TP
\fB\-\-trust\-policies\fR
Applies and uses ignore rules from your dependencies\' Snyk policies, otherwise ignore policies are only shown as a suggestion\.
.TP
\fB\-\-show\-vulnerable\-paths\fR=none|some|all
Display the dependency paths from the top level dependencies, down to the vulnerable packages\. Doesn\'t affect output when using JSON \fB\-\-json\fR output\.
.IP
Default: \fIsome\fR (a few example paths shown) \fIfalse\fR is an alias for \fInone\fR\.
.TP
\fB\-\-project\-name\fR=\fIPROJECT_NAME\fR
Specify a custom Snyk project name\.
.TP
\fB\-\-policy\-path\fR=\fIPATH_TO_POLICY_FILE\fR`
Manually pass a path to a snyk policy file\.
.TP
\fB\-\-json\fR
Prints results in JSON format\.
.TP
\fB\-\-json\-file\-output\fR=\fIOUTPUT_FILE_PATH\fR
(only in \fBtest\fR command) Save test output in JSON format directly to the specified file, regardless of whether or not you use the \fB\-\-json\fR option\. This is especially useful if you want to display the human\-readable test output via stdout and at the same time save the JSON format output to a file\.
.TP
\fB\-\-sarif\fR
Return results in SARIF format\.
.TP
\fB\-\-sarif\-file\-output\fR=\fIOUTPUT_FILE_PATH\fR
(only in \fBtest\fR command) Save test output in SARIF format directly to the \fIOUTPUT_FILE_PATH\fR file, regardless of whether or not you use the \fB\-\-sarif\fR option\. This is especially useful if you want to display the human\-readable test output via stdout and at the same time save the SARIF format output to a file\.
.TP
\fB\-\-severity\-threshold\fR=low|medium|high|critical
Only report vulnerabilities of provided level or higher\.
.TP
\fB\-\-fail\-on\fR=all|upgradable|patchable
Only fail when there are vulnerabilities that can be fixed\.
.IP
\fIall\fR fails when there is at least one vulnerability that can be either upgraded or patched\. \fIupgradable\fR fails when there is at least one vulnerability that can be upgraded\. \fIpatchable\fR fails when there is at least one vulnerability that can be patched\.
.IP
If vulnerabilities do not have a fix and this option is being used, tests will pass\.
.TP
\fB\-\-dry\-run\fR
(only in \fBprotect\fR command) Don\'t apply updates or patches during \fBprotect\fR command run\.
.TP
\fB\-\-\fR [\fICOMPILER_OPTIONS\fR]
Pass extra arguments directly to Gradle or Maven\. E\.g\. \fBsnyk test \-\- \-\-build\-cache\fR
.P
Below are flags that are influencing CLI behavior for specific projects, languages and contexts:
.SS "Maven options"
.TP
\fB\-\-scan\-all\-unmanaged\fR
Auto detects maven jars, aars, and wars in given directory\. Individual testing can be done with \fB\-\-file\fR=\fIJAR_FILE_NAME\fR
.TP
\fB\-\-reachable\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Analyze your source code to find which vulnerable functions and packages are called\.
.TP
\fB\-\-reachable\-timeout\fR=\fITIMEOUT\fR
The amount of time (in seconds) to wait for Snyk to gather reachability data\. If it takes longer than \fITIMEOUT\fR, Reachable Vulnerabilities are not reported\. This does not affect regular test or monitor output\.
.IP
Default: 300 (5 minutes)\.
.SS "Gradle options"
More information about Gradle CLI options \fIhttps://snyk\.co/ucT6P\fR
.IP "\[ci]" 4
\fB\-\-sub\-project\fR=\fINAME\fR, \fB\-\-gradle\-sub\-project\fR=\fINAME\fR: For Gradle "multi project" configurations, test a specific sub\-project\.
.IP "\[ci]" 4
\fB\-\-all\-sub\-projects\fR: For "multi project" configurations, test all sub\-projects\.
.IP "\[ci]" 4
\fB\-\-configuration\-matching\fR=\fICONFIGURATION_REGEX\fR: Resolve dependencies using only configuration(s) that match the provided Java regular expression, e\.g\. \fB^releaseRuntimeClasspath$\fR\.
.IP "\[ci]" 4
\fB\-\-configuration\-attributes\fR=\fIATTRIBUTE\fR[,\fIATTRIBUTE\fR]\|\.\|\.\|\.: Select certain values of configuration attributes to resolve the dependencies\. E\.g\. \fBbuildtype:release,usage:java\-runtime\fR
.IP "\[ci]" 4
\fB\-\-reachable\fR: (only in \fBtest\fR and \fBmonitor\fR commands) Analyze your source code to find which vulnerable functions and packages are called\.
.IP "\[ci]" 4
\fB\-\-reachable\-timeout\fR=\fITIMEOUT\fR: The amount of time (in seconds) to wait for Snyk to gather reachability data\. If it takes longer than \fITIMEOUT\fR, Reachable Vulnerabilities are not reported\. This does not affect regular test or monitor output\.
.IP
Default: 300 (5 minutes)\.
.IP "\[ci]" 4
\fB\-\-init\-script\fR=\fIFILE\fR For projects that contain a gradle initialization script\.
.IP "" 0
.SS "\.Net & NuGet options"
.TP
\fB\-\-assets\-project\-name\fR
When monitoring a \.NET project using NuGet \fBPackageReference\fR use the project name in project\.assets\.json, if found\.
.TP
\fB\-\-packages\-folder\fR
Custom path to packages folder
.TP
\fB\-\-project\-name\-prefix\fR=\fIPREFIX_STRING\fR
When monitoring a \.NET project, use this flag to add a custom prefix to the name of files inside a project along with any desired separators, e\.g\. \fBsnyk monitor \-\-file=my\-project\.sln \-\-project\-name\-prefix=my\-group/\fR\. This is useful when you have multiple projects with the same name in other sln files\.
.SS "npm options"
.TP
\fB\-\-strict\-out\-of\-sync\fR=true|false
Control testing out of sync lockfiles\.
.IP
Default: true
.SS "Yarn options"
.TP
\fB\-\-strict\-out\-of\-sync\fR=true|false
Control testing out of sync lockfiles\.
.IP
Default: true
.TP
\fB\-\-yarn\-workspaces\fR
(only in \fBtest\fR and \fBmonitor\fR commands) Detect and scan yarn workspaces\. You can specify how many sub\-directories to search using \fB\-\-detection\-depth\fR and exclude directories and files using \fB\-\-exclude\fR\.
.SS "CocoaPods options"
.TP
\fB\-\-strict\-out\-of\-sync\fR=true|false
Control testing out of sync lockfiles\.
.IP
Default: false
.SS "Python options"
.TP
\fB\-\-command\fR=\fICOMMAND\fR
Indicate which specific Python commands to use based on Python version\. The default is \fBpython\fR which executes your systems default python version\. Run \'python \-V\' to find out what version is it\. If you are using multiple Python versions, use this parameter to specify the correct Python command for execution\.
.IP
Default: \fBpython\fR Example: \fB\-\-command=python3\fR
.TP
\fB\-\-skip\-unresolved\fR=true|false
Allow skipping packages that are not found in the environment\.
.SS "Flags available accross all commands"
.TP
\fB\-\-insecure\fR
Ignore unknown certificate authorities\.
.TP
\fB\-d\fR
Output debug logs\.
.TP
\fB\-\-quiet\fR, \fB\-q\fR
Silence all output\.
.TP
\fB\-\-version\fR, \fB\-v\fR
Prints versions\.
.TP
[\fICOMMAND\fR] \fB\-\-help\fR, \fB\-\-help\fR [\fICOMMAND\fR], \fB\-h\fR
Prints a help text\. You may specify a \fICOMMAND\fR to get more details\.
.SH "EXAMPLES"
.TP
\fBAuthenticate in your CI without user interaction\fR
$ snyk auth MY_API_TOKEN
.TP
\fBTest a project in current folder for known vulnerabilities\fR
$ snyk test
.TP
\fBTest a specific dependency for vulnerabilities\fR
$ snyk test ionic@1\.6\.5
.P
More examples:
.IP "" 4
.nf
$ snyk test \-\-show\-vulnerable\-paths=false
$ snyk monitor \-\-org=my\-team
$ snyk monitor \-\-project\-name=my\-project
.fi
.IP "" 0
.SS "Container scanning"
See \fBsnyk container \-\-help\fR for more details and examples:
.IP "" 4
.nf
$ snyk container test ubuntu:18\.04 \-\-org=my\-team
$ snyk container test app:latest \-\-file=Dockerfile \-\-policy\-path=path/to/\.snyk
.fi
.IP "" 0
.SS "Infrastructure as Code (IAC) scanning"
See \fBsnyk iac \-\-help\fR for more details and examples:
.IP "" 4
.nf
$ snyk iac test /path/to/cloudformation_file\.yaml
$ snyk iac test /path/to/kubernetes_file\.yaml
$ snyk iac test /path/to/terraform_file\.tf
$ snyk iac test /path/to/tf\-plan\.json
.fi
.IP "" 0
.SH "EXIT CODES"
Possible exit codes and their meaning:
.P
\fB0\fR: success, no vulns found
.br
\fB1\fR: action_needed, vulns found
.br
\fB2\fR: failure, try to re\-run command
.br
\fB3\fR: failure, no supported projects detected
.br
.SH "ENVIRONMENT"
You can set these environment variables to change CLI run settings\.
.TP
\fBSNYK_TOKEN\fR
Snyk authorization token\. Setting this envvar will override the token that may be available in your \fBsnyk config\fR settings\.
.IP
How to get your account token \fIhttps://snyk\.co/ucT6J\fR
.br
How to use Service Accounts \fIhttps://snyk\.co/ucT6L\fR
.br
.TP
\fBSNYK_CFG_KEY\fR
Allows you to override any key that\'s also available as \fBsnyk config\fR option\.
.IP
E\.g\. \fBSNYK_CFG_ORG\fR=myorg will override default org option in \fBconfig\fR with "myorg"\.
.TP
\fBSNYK_REGISTRY_USERNAME\fR
Specify a username to use when connecting to a container registry\. Note that using the \fB\-\-username\fR flag will override this value\. This will be ignored in favour of local Docker binary credentials when Docker is present\.
.TP
\fBSNYK_REGISTRY_PASSWORD\fR
Specify a password to use when connecting to a container registry\. Note that using the \fB\-\-password\fR flag will override this value\. This will be ignored in favour of local Docker binary credentials when Docker is present\.
.SH "Connecting to Snyk API"
By default Snyk CLI will connect to \fBhttps://snyk\.io/api/v1\fR\.
.TP
\fBSNYK_API\fR
Sets API host to use for Snyk requests\. Useful for on\-premise instances and configuring proxies\. If set with \fBhttp\fR protocol CLI will upgrade the requests to \fBhttps\fR\. Unless \fBSNYK_HTTP_PROTOCOL_UPGRADE\fR is set to \fB0\fR\.
.TP
\fBSNYK_HTTP_PROTOCOL_UPGRADE\fR=0
If set to the value of \fB0\fR, API requests aimed at \fBhttp\fR URLs will not be upgraded to \fBhttps\fR\. If not set, the default behavior will be to upgrade these requests from \fBhttp\fR to \fBhttps\fR\. Useful e\.g\., for reverse proxies\.
.TP
\fBHTTPS_PROXY\fR and \fBHTTP_PROXY\fR
Allows you to specify a proxy to use for \fBhttps\fR and \fBhttp\fR calls\. The \fBhttps\fR in the \fBHTTPS_PROXY\fR means that \fIrequests using \fBhttps\fR protocol\fR will use this proxy\. The proxy itself doesn\'t need to use \fBhttps\fR\.
.SH "NOTICES"
.SS "Snyk API usage policy"
The use of Snyk\'s API, whether through the use of the \'snyk\' npm package or otherwise, is subject to the terms & conditions \fIhttps://snyk\.co/ucT6N\fR