#Build scanning for C and C++

If the Conan package manager and the corresponding manifests are not used when building a C/C++ project, Johnny can be run in a special mode to analyze the build process output and obtain a list of the libraries in use. In this mode, Johnny analyzes the build process using compiler calls and eBPF technology and identifies the libraries that were used. The system cache is then used to determine the locations of the libraries and their sources.

The version of a local static library can be found in a .pc file containing component metadata.

#Scanning using eBPF

eBPF (extended Berkeley Packet Filter) — a technology that allows user code to run safely at the Linux kernel level in response to system events such as network traffic, system calls, or process activity.

A distinctive feature of running the agent in scan build ebpf mode is that, in addition to executing the command from the JSON configuration, it also captures compiler and linker calls by monitoring launched processes and their parameters through the eBPF mechanism.

Running this mode requires root privileges, Linux kernel version ≥ 5.8 with eBPF support, and access to tracing interfaces, including the syscalls:sys_enter_execve tracepoint. In a container, additional privileges and access to kernel interfaces may be required. root privileges alone may not be sufficient inside a restricted container.

#Example

A build-config.json JSON file describing the sequence of build commands is added to the project. For example:

{
  "commands": [
    {
      "command": "make",
      "flags_and_args": "clean"
    },
    {
      "command": "./configure"
    },
    {
      "command": "make",
      "do_analyze": true
    }
  ]
}

Command fields:

• command — the command to execute;
• flags_and_args — command arguments separated by spaces;
• do_analyze — indicates that the output of this command should be analyzed.

Commands are executed sequentially from the current working directory. The flags_and_args value is not processed by the command shell. If the build requires environment variables, redirections, pipelines, or complex quoting, move them to a separate executable script.

Then run the build analysis command and specify the path to the configuration file:

./johnny scan build ebpf ./build-config.json

The directory containing the input JSON file is used as the source code root. Johnny searches under it for .pc files for local static libraries.

#Command parameters

The scan build ebpf command supports general scan parameters and two additional parameters:

If --unresolved-file is not specified, Johnny generates a filename containing the date and time, for example, UnresolvedLibs20260810_120000.json.

The full list of parameters is available in the help:

./johnny scan build ebpf --help

#Library classification

Libraries detected during build scanning can be automatically classified by resolution type:

• toolchain — libraries explicitly identified as build tool dependencies are marked with the _toolchain suffix in the environment;
• unresolved — libraries whose metadata could not be fully determined are included in the result with the _unresolved suffix in the environment.

An unresolved status may be caused by a local library without a .pc file, a missing package in the system database or an inaccessible library path. An unresolved version does not by itself indicate a vulnerability or a build error.

To specify confirmed versions manually:

1. Save the scan result using --unresolved-file.
2. Copy the required entries to a separate JSON file.
3. Fill in the version field with a value from a verifiable source.
4. Repeat the analysis with the --lib-versions parameter.

./johnny scan build ebpf ./build-config.json \
  --lib-versions ./lib-versions.json \
  --unresolved-file ./unresolved-after.json

If all versions are resolved, a new unresolved-after.json file is not created.

#Exit codes

The agent returns one of the following codes:

• 0 — analysis is complete, and no blocking policies were triggered;
• 1 — analysis is complete, a blocking security policy was triggered, and user action is required;
• 2 — analysis failed;
• 3 — no artifacts were found for analysis. This code is returned if the --block-on-empty-result parameter is set to true.