Prerequisites¶
Choose a deployment before installing tools. Native and container execution have different host requirements.
Requirement matrix¶
| Component | Native CLI | VS Code | Eclipse | Container | Report Viewer |
|---|---|---|---|---|---|
| Java 11+ | Required | Required | Required for scanner runtime | Included (Java 21) | No |
| OpenGrep 1.26.0 | Required | Required | Required | Included | No |
| VS Code 1.92+ | No | Required | No | No | No |
| Eclipse or Spring Tools | No | No | Required | No | No |
| Docker 24+ or Podman 4.8+ | No | No | No | Required | No |
| Modern desktop browser | No | No | Used by embedded report view | No | Required |
| PostQ trial license | Project/folder scans | Workspace/folder scans | Project scans | Repository scans | Not required |
The distributed prerequisite checker contains the release-specific minimum versions. Its result is authoritative for the artifact you received.
Run the pre-install check¶
Windows:
.\postq-code-scanner-preinstall-check.ps1
If PowerShell blocks the script with an execution-policy error, use the temporary process-only bypass documented in PowerShell blocks the prerequisite checker.
Linux or macOS:
bash ./postq-code-scanner-preinstall-check.sh
The default all profile checks native runtime, IDE host, and container readiness. Use runtime
for CLI/IDE preparation or container for container-only preparation.
READY means the required runtime checks passed. NOT READY means at least one required check
failed. NOT CHECKED means the selected profile did not evaluate every dependency for that
product. IDE command discovery is advisory because a graphical installation may not add a launcher
to PATH.
Pre-installation notes¶
- Use a dedicated output directory that the scanner process can write.
- Give the scanner read access only to the source tree that is in scope.
- Keep
postq.licoutside source control, images, and shared report archives. - For native execution, ensure Java 11 or later and a supported OpenGrep executable resolve for the
same account that runs scans. Supported OpenGrep names are
opengrep.exeandopengrep_windows_x86.exeon Windows;opengrep,opengrep_manylinux_x86, andopengrep_manylinux_aarch64on Linux; andopengrep,opengrep_osx_x86, andopengrep_osx_arm64on macOS. - This release expects OpenGrep
1.26.0. If another OpenGrep version is selected, the IDE configuration check reports a version mismatch before scan execution. - If endpoint protection blocks OpenGrep, follow your organization's software review process. Check the download source and approved binary before allowing it.
- For container execution, ensure source mounts can be read by the image's non-root user and the report mount can be written.
- Review remote installation scripts before running them in an enterprise environment. Approved package mirrors or verified release binaries are preferable where policy requires them.
- Scans can be CPU and memory intensive. Start with a representative service before scanning a large monorepo.
Official installation resources¶
| Tool | Official resource |
|---|---|
| Eclipse Temurin JDK | Adoptium installation guide |
| OpenGrep | OpenGrep installation guide |
| Visual Studio Code | VS Code downloads |
| Eclipse IDE | Eclipse downloads |
| Spring Tools | Spring Tools |
| Docker | Docker Engine installation |
| Podman | Podman installation |
| Cosign, optional | Cosign installation |
Native runtime download references¶
Use the installer package when you have administrator rights. Use the archive/manual-copy package
when you do not have administrator rights and need to place binaries under a user-writable tools
folder. After manual copy, configure the executable path in the CLI, VS Code extension, or Eclipse
plugin instead of relying on system PATH.
OpenGrep 1.26.0¶
| Platform | Architecture | Download |
|---|---|---|
| Windows | x86_64 | opengrep_windows_x86.exe |
| Linux | x86_64 | opengrep_manylinux_x86 |
| Linux | ARM64 | opengrep_manylinux_aarch64 |
| macOS | x86_64 | opengrep_osx_x86 |
| macOS | ARM64 | opengrep_osx_arm64 |
Windows Defender or SmartScreen may block OpenGrep
If Windows Defender flags the copied executable, follow your organization's endpoint-security review process. Do not disable endpoint protection globally to run a scanner.
Microsoft Edge or Defender SmartScreen may also show Make sure you trust opengrep_windows_x86.exe before you open it or Couldn't download - Virus detected. See OpenGrep download is blocked by Microsoft Edge, SmartScreen, or Defender before retrying the download.
Java runtime¶
Java 11 or later is required; Java 21 is recommended. Select an installer or archive based on administrator rights and endpoint policy.
| Platform | Recommended JRE reference |
|---|---|
| Windows x86_64 ZIP | Temurin 21 JRE ZIP |
| Linux x86_64 tar.gz | Temurin 21 JRE tar.gz |
| macOS x86_64 pkg | Temurin 21 JRE pkg |
Continue with Install.