Getting started with Provenant

[mstykow]

Welcome! This is the quickest path from zero to a first scan, plus the flag combos worth knowing.

Install

# macOS / Linux
brew install getprovenant/tap/provenant

# or, anywhere with a Rust toolchain
cargo install provenant-cli

# or, no install at all — container
docker run -v "$PWD:/src" ghcr.io/getprovenant/provenant scan /src --json-pp -

Prebuilt archives for every platform are on the releases page. For CI, use the GitHub Action.

First scan

provenant scan . --license --package --copyright --json-pp -

Detections are opt-in — the flags decide what a scan actually collects. --json-pp - pretty-prints to stdout; use --json out.json to write a file.

The flag combos worth knowing

• Full pass — license + copyright + packages:
  provenant scan . --license --copyright --package --json-pp -
• SBOM output — for downstream compliance, add one of --spdx-tv, --spdx-rdf, --cyclonedx, or --cyclonedx-xml (each writes that format to a file):
  provenant scan . --license --package --cyclonedx sbom.cdx.json
  Every resolved dependency becomes a real component with a package URL and the dependency graph closes — see real SPDX + CycloneDX examples for four ecosystems.
• CI license gating — fail the build on disallowed licenses, with SARIF for the code-scanning UI:
  provenant scan . --license --license-policy policy.yml --fail-on error

Full reference: the CLI guide.

Learn more

• Website — https://getprovenant.github.io
• How it compares (speed and output quality, reproducible) — https://getprovenant.github.io/compare/
• Real SBOMs — full SPDX + CycloneDX examples for four ecosystems — https://github.com/getprovenant/provenant/tree/main/examples/sbom
• The story & how it was built — https://getprovenant.github.io/blog/

Feedback

Kicking the tires? We'd love to hear what worked and what didn't — reply here or open an issue. If you hit a repository that scans wrong, that's the single most useful thing you can send us.