---
id: wiki-2026-0508-software-composition-analysis-sc
title: Software Composition Analysis (SCA)
category: 10_Wiki/Topics
status: verified
canonical_id: self
aliases: [SCA, Dependency Scanning, Open Source Security, OSS Risk Analysis]
duplicate_of: none
source_trust_level: A
confidence_score: 0.95
verification_status: applied
tags: [security, devsecops, sca, dependency-management, sbom]
raw_sources: []
last_reinforced: 2026-05-10
github_commit: pending
tech_stack:
  language: multi
  framework: Snyk/Dependabot/OWASP-Dep-Check/Trivy
---

# Software Composition Analysis (SCA)

## 매 한 줄
> **"매 dep tree 의 X-ray 의 vuln + license risk 매 surface"**. SCA 매 transitive dependencies + OSS components 의 scan, 매 CVE/CVSS DB 의 cross-ref + license compliance check. 매 2026 매 SBOM (CycloneDX/SPDX) + supply-chain (SLSA L3) integration 의 default.

## 매 핵심

### 매 SCA vs SAST/DAST
- **SCA**: 매 OSS dep risk (CVE, license). 매 transitive 의 main concern.
- **SAST**: 매 own source code 의 static flaw.
- **DAST**: 매 running app 의 runtime probe.
- 매 셋 의 complementary. SCA 매 modern stack 의 60-90% deps 의 OSS 라서 critical.

### 매 SCA tool 의 axes
1. **Vuln DB**: NVD, GitHub Advisory, OSV, Snyk DB (custom curation).
2. **Coverage**: language ecosystems (npm, pip, Maven, Go, Cargo, NuGet).
3. **License**: SPDX 표준, copyleft (GPL/AGPL) flagging.
4. **Reachability**: 매 CVE 의 actually-called-code 의 trace (Endor, Snyk).
5. **SBOM gen**: CycloneDX, SPDX 2.3 emit.

### 매 modern leaders (2026)
- **Snyk Open Source** — best vuln curation + reachability.
- **GitHub Dependabot + Advisory DB** — free, native.
- **OWASP Dependency-Check** — OSS, NVD-based.
- **Trivy** (Aqua) — OSS, container + IaC + SCA combined.
- **Endor Labs** — reachability-first, modern.
- **Socket.dev** — supply-chain (typosquat, malicious pkg) focus.

### 매 응용
1. CI gate (PR-block on critical CVE).
2. SBOM artifact generation.
3. License compliance audit.
4. Supply-chain incident response.

## 💻 패턴

### Trivy CI scan (GitHub Actions)
```yaml
# .github/workflows/sca.yml
name: SCA
on: [pull_request]
jobs:
  trivy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Trivy fs scan
        uses: aquasecurity/trivy-action@0.20.0
        with:
          scan-type: fs
          scan-ref: .
          severity: CRITICAL,HIGH
          exit-code: 1
          ignore-unfixed: true
          format: sarif
          output: trivy.sarif
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy.sarif
```

### Dependabot config
```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    groups:
      prod-deps:
        dependency-type: production
        update-types: [minor, patch]
    open-pull-requests-limit: 10
  - package-ecosystem: docker
    directory: /
    schedule:
      interval: monthly
```

### Snyk CLI policy gate
```bash
# pre-deploy.sh
snyk test --severity-threshold=high \
          --fail-on=upgradable \
          --policy-path=.snyk \
          --json > snyk-report.json

# SBOM emit
snyk sbom --format=cyclonedx1.5+json \
          --json-file-output=sbom.json
```

### OWASP Dependency-Check (Maven)
```xml
<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>10.0.4</version>
  <configuration>
    <failBuildOnCVSS>7.0</failBuildOnCVSS>
    <suppressionFiles>
      <suppressionFile>owasp-suppressions.xml</suppressionFile>
    </suppressionFiles>
    <nvdApiKey>${env.NVD_API_KEY}</nvdApiKey>
  </configuration>
</plugin>
```

### CycloneDX SBOM (Python)
```bash
pip install cyclonedx-bom
cyclonedx-py requirements -i requirements.txt -o bom.json --schema-version 1.6

# Validate
cyclonedx validate --input-file bom.json
```

### License compliance check
```bash
# Check forbidden licenses (GPL/AGPL in proprietary product)
license-checker --production \
                --excludePackages "internal-pkg" \
                --failOn "GPL-3.0;AGPL-3.0;LGPL-3.0" \
                --json > licenses.json
```

### Reachability-aware triage
```python
# triage.py — only fail on reachable CVEs
import json

with open("snyk-report.json") as f:
    report = json.load(f)

reachable_critical = [
    v for v in report["vulnerabilities"]
    if v["severity"] == "critical"
    and v.get("reachability") == "reachable"
]

if reachable_critical:
    print(f"BLOCK: {len(reachable_critical)} reachable critical CVEs")
    exit(1)
print("PASS")
```

## 매 결정 기준
| 상황 | Tool |
|---|---|
| GitHub-native, free | Dependabot + CodeQL |
| Polyglot, container, IaC | Trivy |
| Reachability + curated DB | Snyk / Endor |
| Air-gapped, OSS-only | OWASP Dep-Check |
| Supply-chain attack risk | Socket.dev |
| Enterprise compliance | Snyk + Black Duck |

**기본값**: Dependabot + Trivy in CI; 매 enterprise 면 Snyk add.

## 🔗 Graph
- 부모: [[DevSecOps]] · [[Application-Security]]
- 변형: [[SAST]] · [[DAST]] · [[Container-Scanning]]
- 응용: [[SBOM]] · [[Supply-Chain-Security]] · [[SLSA]]
- Adjacent: [[Vulnerability-Management]] · [[License-Compliance]] · [[CVE]] · [[CVSS]]

## 🤖 LLM 활용
**언제**: 매 CVE triage summary, 매 upgrade-path planning, 매 SBOM diff explanation, 매 license risk written assessment.
**언제 X**: 매 vuln DB lookup (deterministic tool), 매 patch generation 매 production-grade (manual review still needed).

## ❌ 안티패턴
- **Severity-only gate**: 매 CVSS 9 매 unreachable code 의 false-block.
- **No SBOM**: 매 incident 시 매 affected version 의 unknown.
- **Transitive ignored**: 매 direct deps 만 scan. 매 90% risk 매 transitive.
- **Daily CI fail = ignored**: 매 alert fatigue. 매 group + auto-PR (Dependabot).
- **License = afterthought**: 매 GPL-3 leak 매 product 매 proprietary 의 legal exposure.

## 🧪 검증 / 중복
- Verified (OWASP SCA Guide 2026; CISA SBOM Minimum Elements; SLSA Framework v1.1).
- Canonical for SCA topic; redirect target of Software_Composition_Analysis.md.
- 신뢰도 A.

## 🕓 Changelog
| 날짜 | 변경 |
|---|---|
| 2026-05-08 | Phase 1 |
| 2026-05-10 | Manual cleanup — full canonical content (Trivy/Snyk/Dependabot/OWASP DC patterns + reachability) |
