fosslight-binary 5.1.29__tar.gz → 5.1.31__tar.gz

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_binary
-Version: 5.1.29
+Version: 5.1.31
 Summary: FOSSLight Binary Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -24,13 +24,13 @@ Requires-Dist: defusedxml
 Requires-Dist: numpy
 Requires-Dist: pandas
 Requires-Dist: parmap
-Requires-Dist: psycopg2-binary
 Requires-Dist: python-dateutil
 Requires-Dist: py-tlsh
 Requires-Dist: pytz
 Requires-Dist: XlsxWriter
 Requires-Dist: PyYAML
-Requires-Dist: fosslight_util>=2.2.2
+Requires-Dist: fosslight_util>=2.2.8
+Requires-Dist: truststore
 Requires-Dist: python-magic-bin; sys_platform == "win32"
 Requires-Dist: python-magic; "darwin" in sys_platform
 Requires-Dist: python-magic; "linux" in sys_platform

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_binary"
-version = "5.1.29"
+version = "5.1.31"
 description = "FOSSLight Binary Scanner"
 readme = "README.md"
 license = "Apache-2.0"
@@ -31,13 +31,13 @@ dependencies = [
     "numpy",
     "pandas",
     "parmap",
-    "psycopg2-binary",
     "python-dateutil",
     "py-tlsh",
     "pytz",
     "XlsxWriter",
     "PyYAML",
-    "fosslight_util>=2.2.2",
+    "fosslight_util>=2.2.8",
+    "truststore",
     "python-magic-bin; sys_platform == 'win32'",
     "python-magic; 'darwin' in sys_platform",
     "python-magic; 'linux' in sys_platform",

fosslight_binary-5.1.31/src/fosslight_binary/_binary_dao.py

@@ -0,0 +1,309 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# Copyright (c) 2020 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Binary DB lookup via ldb_service POST /binary/match."""
+
+import json
+import logging
+import os
+import ssl
+import urllib.error
+import urllib.request
+from typing import Dict, List, Optional, Tuple
+from urllib.parse import urlparse
+
+from fosslight_binary._binary import TLSH_CHECKSUM_NULL
+from fosslight_util.oss_item import OssItem
+import fosslight_util.constant as constant
+
+logger = logging.getLogger(constant.LOGGER_NAME)
+
+DEFAULT_KB_URL = "http://fosslight-kb.lge.com/"
+_BINARY_MATCH_PATH = "/binary/match"
+_HTTP_TIMEOUT_SEC = 120
+_PROBE_TIMEOUT_SEC = 10
+_DEFAULT_CHUNK_SIZE = 3000
+
+
+def _get_chunk_size() -> int:
+    raw = os.environ.get("BINARY_MATCH_CHUNK_SIZE", str(_DEFAULT_CHUNK_SIZE))
+    try:
+        chunk_size = int(raw)
+    except ValueError:
+        logger.warning(f"Invalid BINARY_MATCH_CHUNK_SIZE={raw!r}; using {_DEFAULT_CHUNK_SIZE}")
+        return _DEFAULT_CHUNK_SIZE
+    if chunk_size <= 0:
+        logger.warning(
+            f"BINARY_MATCH_CHUNK_SIZE must be > 0 (got {chunk_size}); using {_DEFAULT_CHUNK_SIZE}"
+        )
+        return _DEFAULT_CHUNK_SIZE
+    return chunk_size
+
+
+_CHUNK_SIZE = _get_chunk_size()
+
+MatchKey = Tuple[str, str]
+_KB_SSL_VERIFY_FALSE = {"0", "false", "no", "off"}
+_logged_insecure_kb_ssl = False
+
+
+def kb_ssl_verify_enabled() -> bool:
+    raw = os.environ.get("KB_SSL_VERIFY", "true")
+    return raw.strip().lower() not in _KB_SSL_VERIFY_FALSE
+
+
+def create_kb_ssl_context() -> ssl.SSLContext:
+    """TLS context for KB HTTPS. Uses the OS trust store (Windows store, like the browser)."""
+    global _logged_insecure_kb_ssl
+    if not kb_ssl_verify_enabled():
+        if not _logged_insecure_kb_ssl:
+            logger.warning("KB TLS certificate verification is disabled (KB_SSL_VERIFY)")
+            _logged_insecure_kb_ssl = True
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        return ctx
+    try:
+        import truststore
+        return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    except ImportError:
+        return ssl.create_default_context()
+
+
+def resolve_kb_config(kb_url: str = "", kb_token: str = "") -> Tuple[str, str]:
+    url = (kb_url or os.environ.get("KB_URL", DEFAULT_KB_URL)).strip() or DEFAULT_KB_URL
+    token = (kb_token or "").strip() or (os.environ.get("KB_TOKEN") or "").strip()
+    return f"{url.rstrip('/')}/", token
+
+
+def _is_valid_kb_url_format(kb_url: str) -> bool:
+    parsed = urlparse(kb_url)
+    return parsed.scheme in ("http", "https") and bool(parsed.netloc)
+
+
+def check_binary_match_endpoint(kb_url: str, kb_token: str = "") -> Tuple[bool, str]:
+    """
+    Return (available, cover_comment).
+
+    cover_comment:
+    - ``KB({kb_url}) Unreachable`` when the host cannot be reached
+    - ``KB({kb_url}) Skipped`` when /binary/match is missing (HTTP 404)
+    - empty for other skip cases (invalid URL)
+    """
+    if not _is_valid_kb_url_format(kb_url):
+        logger.warning(f"Invalid KB URL format: {kb_url}")
+        return False, ""
+
+    endpoint = f"{kb_url.rstrip('/')}{_BINARY_MATCH_PATH}"
+    data = json.dumps({"items": []}).encode("utf-8")
+    request = urllib.request.Request(endpoint, data=data, method="POST")
+    request.add_header("Accept", "application/json")
+    request.add_header("Content-Type", "application/json")
+    if kb_token:
+        request.add_header("Authorization", f"Bearer {kb_token}")
+
+    try:
+        with urllib.request.urlopen(
+            request, timeout=_PROBE_TIMEOUT_SEC, context=create_kb_ssl_context()
+        ) as response:
+            response.read()
+            return True, ""
+    except urllib.error.HTTPError as ex:
+        if ex.code == 404:
+            logger.warning(
+                f"KB binary match endpoint not found (HTTP 404): {endpoint}. "
+                "Skipping binary match API."
+            )
+            return False, f"KB({kb_url}) Skipped"
+        logger.debug(
+            f"KB binary match endpoint responded with HTTP {ex.code}; treated as available"
+        )
+        return True, ""
+    except urllib.error.URLError as ex:
+        logger.warning(f"KB binary match endpoint unreachable: {ex}. Skipping binary match API.")
+        return False, f"KB({kb_url}) Unreachable"
+    except Exception as ex:
+        logger.warning(
+            f"Failed to check KB binary match endpoint: {ex}. Skipping binary match API."
+        )
+        return False, f"KB({kb_url}) Unreachable"
+
+
+def _is_unknown_checksum(checksum: str) -> bool:
+    """True when checksum was not computed (empty or TLSH_CHECKSUM_NULL)."""
+    return (not checksum) or checksum == TLSH_CHECKSUM_NULL
+
+
+def _is_unknown_tlsh(tlsh: str) -> bool:
+    """True when tlsh was not computed (empty or TLSH_CHECKSUM_NULL)."""
+    return (not tlsh) or tlsh == TLSH_CHECKSUM_NULL
+
+
+def _match_key(filename: str, checksum: str, index: int) -> MatchKey:
+    """Dedupe key. Unknown checksums stay unique per list index (no filename-only merge)."""
+    if _is_unknown_checksum(checksum):
+        return filename, f"__unknown_{index}"
+    return filename, checksum
+
+
+def _build_deduped_payload(
+    bin_info_list,
+    tlsh_null: str,
+) -> Tuple[List[dict], Dict[MatchKey, str]]:
+    """Deduplicate by filename+checksum; return API payload and key→api_id map.
+
+    Items with empty/\"0\" checksum are not deduped — each keeps its own API entry
+    (and its own tlsh) so distinct files that share a basename are not conflated.
+    Items with both checksum and tlsh unknown are omitted (nothing to match).
+    """
+    key_to_id: Dict[MatchKey, str] = {}
+    items_payload: List[dict] = []
+
+    for index, item in enumerate(bin_info_list):
+        if item.exclude:
+            continue
+        filename = item.binary_name_without_path
+        checksum = item.checksum or ""
+        tlsh = item.tlsh or tlsh_null
+        if _is_unknown_checksum(checksum) and _is_unknown_tlsh(tlsh):
+            continue
+        key = _match_key(filename, checksum, index)
+        if not _is_unknown_checksum(checksum) and key in key_to_id:
+            continue
+        api_id = str(len(items_payload))
+        key_to_id[key] = api_id
+        items_payload.append({
+            "id": api_id,
+            "filename": filename,
+            "checksum": checksum,
+            "tlsh": tlsh,
+        })
+
+    return items_payload, key_to_id
+
+
+def _apply_match_result_to_item(item, result: dict) -> bool:
+    """Apply a /binary/match result to one binary item. Returns True if matched."""
+    if not result or not result.get("matched"):
+        return False
+    oss_rows = result.get("oss_items") or []
+    if not oss_rows:
+        return False
+
+    if not item.found_in_jar_analysis and item.oss_items:
+        item.oss_items = []
+
+    bin_oss_items = []
+    for row in oss_rows:
+        if item.found_in_jar_analysis:
+            break
+        oss_from_db = OssItem(
+            row.get("oss_name") or "",
+            row.get("oss_version") or "",
+            row.get("license") or "",
+        )
+        if bin_oss_items:
+            if not any(
+                oss_item.name == oss_from_db.name
+                and oss_item.version == oss_from_db.version
+                and oss_item.license == oss_from_db.license
+                for oss_item in bin_oss_items
+            ):
+                bin_oss_items.append(oss_from_db)
+        else:
+            bin_oss_items.append(oss_from_db)
+
+    if bin_oss_items:
+        item.set_oss_items(bin_oss_items)
+        item.comment = "Binary DB result"
+        item.found_in_bin_db = True
+        return True
+    return False
+
+
+def get_oss_info_from_db(bin_info_list, kb_url: str = "", kb_token: str = ""):
+    """
+    Call ldb_service /binary/match and attach OSS info to binary items.
+    Deduplicates by filename+checksum before the API call and maps results back.
+    Returns (bin_info_list, matched_count, kb_cover_comment).
+    """
+    _cnt_auto_identified = 0
+    if not bin_info_list:
+        return bin_info_list, _cnt_auto_identified, ""
+
+    base_url, token = resolve_kb_config(kb_url, kb_token)
+    available, kb_cover_comment = check_binary_match_endpoint(base_url, token)
+    if not available:
+        return bin_info_list, _cnt_auto_identified, kb_cover_comment
+
+    items_payload, key_to_id = _build_deduped_payload(bin_info_list, TLSH_CHECKSUM_NULL)
+    if not items_payload:
+        return bin_info_list, _cnt_auto_identified, ""
+
+    results_by_id = {}
+    try:
+        for chunk_start in range(0, len(items_payload), _CHUNK_SIZE):
+            chunk = items_payload[chunk_start: chunk_start + _CHUNK_SIZE]
+            response = _post_binary_match(base_url, token, chunk)
+            if response is None:
+                logger.warning(
+                    f"Binary match chunk failed "
+                    f"({chunk_start}:{chunk_start + len(chunk)}); "
+                    "keeping results so far and continuing with next chunks."
+                )
+                continue
+            for result in response.get("results", []):
+                results_by_id[str(result.get("id"))] = result
+    except Exception as ex:
+        logger.warning(f"Binary match API failed: {ex}")
+
+    for index, item in enumerate(bin_info_list):
+        if item.exclude:
+            continue
+        key = _match_key(item.binary_name_without_path, item.checksum or "", index)
+        api_id = key_to_id.get(key)
+        if api_id is None:
+            continue
+        result = results_by_id.get(api_id)
+        if _apply_match_result_to_item(item, result):
+            _cnt_auto_identified += 1
+
+    return bin_info_list, _cnt_auto_identified, ""
+
+
+def _post_binary_match(kb_url: str, kb_token: str, items: list) -> Optional[dict]:
+    data = json.dumps({"items": items}).encode("utf-8")
+    request = urllib.request.Request(
+        f"{kb_url.rstrip('/')}{_BINARY_MATCH_PATH}",
+        data=data,
+        method="POST",
+    )
+    request.add_header("Accept", "application/json")
+    request.add_header("Content-Type", "application/json")
+    if kb_token:
+        request.add_header("Authorization", f"Bearer {kb_token}")
+
+    try:
+        with urllib.request.urlopen(
+            request, timeout=_HTTP_TIMEOUT_SEC, context=create_kb_ssl_context()
+        ) as response:
+            body = response.read().decode()
+            return json.loads(body) if body else {}
+    except urllib.error.HTTPError as ex:
+        body = ""
+        try:
+            body = ex.read().decode()
+        except Exception:
+            pass
+        if ex.code == 404:
+            logger.warning(
+                f"Binary match endpoint not found (HTTP 404): "
+                f"{kb_url.rstrip('/')}{_BINARY_MATCH_PATH}"
+            )
+        else:
+            logger.warning(f"Binary match HTTP {ex.code}: {body or ex.reason}")
+        return None
+    except urllib.error.URLError as ex:
+        logger.debug(f"Binary match unreachable: {ex}")
+        return None

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary/_help.py

@@ -32,7 +32,10 @@ _HELP_MESSAGE_BINARY = f"""
 
     🔍 Scanner-Specific Options
     ────────────────────────────────────────────────────────────────────
-    -d <db_url>            DB Connection (format: 'postgresql://user:pass@host:port/db')
+    --kb_url <url>         KB API URL (priority: parameter > KB_URL env > default)
+    --kb_token <token>     KB bearer token (priority: parameter > KB_TOKEN env)
+                           HTTPS uses the OS certificate store. Set KB_SSL_VERIFY=false
+                           only if certificate verification must be skipped.
     --notice               Print the open source license notice text
     --no_correction        Skip OSS information correction with sbom-info.yaml
     --correct_fpath <path> Path to custom sbom-info.yaml file
@@ -48,8 +51,8 @@ _HELP_MESSAGE_BINARY = f"""
     # Generate output in specific format
     fosslight_binary -f excel -o results/
 
-    # Connect to Binary DB for OSS information
-    fosslight_binary -d "postgresql://user:pass@localhost:5432/exampledb"
+    # Binary DB lookup via ldb_service
+    fosslight_binary --kb_url http://fosslight-kb.lge.com/ --kb_token <token>
 """
 
 

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary/_jar_analysis.py

@@ -7,21 +7,25 @@
 import hashlib
 import logging
 import os
+import re
 import tempfile
 import zipfile
 import defusedxml.ElementTree as ET
 import requests
 import fosslight_util.constant as constant
+from fosslight_util._get_downloadable_url import _maven_repo_bases_for
 from fosslight_util.get_pom_license import get_license_from_pom
 from fosslight_util.oss_item import OssItem
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
 _CENTRAL_SEARCH_URL = "https://search.maven.org/solrsearch/select"
-_REQUEST_TIMEOUT = 10          # seconds – used for HEAD / POM download
-_CENTRAL_SEARCH_TIMEOUT = 2.5  # seconds – tight timeout for Search API (retried on timeout)
+_REQUEST_TIMEOUT = 10          # seconds - used for HEAD / POM download
+_CENTRAL_SEARCH_TIMEOUT = 2.5  # seconds - tight timeout for Search API (retried on timeout)
+_MAVEN_JAR_HTTP_TIMEOUT = (2, 2)  # match Util probe timeouts for multi-repo jar checks
 _MAX_RETRY = 3                 # maximum Central API retry attempts per JAR
 _central_network_warned = False  # Flag to suppress repeated network-unavailable warnings within one run
+_COORD_TOKEN = re.compile(r'[A-Za-z0-9._+-]+')  # shape of a Maven groupId / artifactId / version
 
 
 def _sha1_of_file(filepath):
@@ -123,13 +127,21 @@ def _search_central_by_sha1(sha1, timeout=None):
         if not docs:
             return {}, False
         doc = docs[0]
+        groupId = doc.get("g", "")
+        artifactId = doc.get("a", "")
+        version = doc.get("v") or doc.get("latestVersion", "")
+
+        if not (groupId and artifactId and version):
+            logger.debug(f"Maven Central returned an incomplete document for {sha1}: {doc}")
+            return {}, False
+
         return {
-            "groupId": doc.get("g", ""),
-            "artifactId": doc.get("a", ""),
-            "version": doc.get("v") or doc.get("latestVersion", ""),
+            "groupId": groupId,
+            "artifactId": artifactId,
+            "version": version,
         }, False
     except requests.exceptions.Timeout:
-        logger.debug(f"Maven Central SHA-1 search timed out ({sha1}) – will retry")
+        logger.debug(f"Maven Central SHA-1 search timed out ({sha1}) - will retry")
         return {}, True
     except Exception as ex:
         if _is_network_error(ex):
@@ -157,7 +169,7 @@ def _download_pom_to_tempfile(group_id, artifact_id, version, timeout=None):
                 logger.debug(f"POM downloaded to {tmp.name} from {url}")
                 return tmp.name, False
         except requests.exceptions.Timeout:
-            logger.debug(f"POM download timed out from {url} – will retry")
+            logger.debug(f"POM download timed out from {url} - will retry")
             any_timeout = True
         except Exception as ex:
             if _is_network_error(ex):
@@ -167,40 +179,69 @@ def _download_pom_to_tempfile(group_id, artifact_id, version, timeout=None):
     return None, any_timeout
 
 
-def _build_central_jar_url(group_id, artifact_id, version):
-    if not (group_id and artifact_id and version):
-        return ""
-    group_path = group_id.replace('.', '/')
-    return f"https://repo1.maven.org/maven2/{group_path}/{artifact_id}/{version}/{artifact_id}-{version}.jar"
+def _is_maven_coordinate(*parts):
+    """True only if every part could be a Maven coordinate token.
+
+    MANIFEST.MF vendor fields are display names ("The Apache Software
+    Foundation", "Google, Inc.", "%bundleVendor"), not groupIds. Rejecting them
+    keeps bogus URLs out of the report and avoids HEAD requests that can only 404.
+    """
+    return all(p and _COORD_TOKEN.fullmatch(p) for p in parts)
 
 
-def _exists_in_central(group_id, artifact_id, version):
-    if not (group_id and artifact_id and version):
-        return False
-    url = _build_central_jar_url(group_id, artifact_id, version)
+def _maven_jar_url_exists(url, timeout=None):
+    """True if a Maven host serves this jar URL (HEAD, with GET fallback)."""
+    _timeout = timeout if timeout is not None else _MAVEN_JAR_HTTP_TIMEOUT
     try:
-        resp = requests.head(url, timeout=_REQUEST_TIMEOUT, allow_redirects=True)
-        return resp.status_code == 200
+        resp = requests.head(url, timeout=_timeout, allow_redirects=True)
+        if resp.status_code == 200:
+            return True
+        # Some Maven hosts reject HEAD; fall back to a streamed GET (Util pattern).
+        if resp.status_code in (403, 405, 501):
+            resp = requests.get(url, stream=True, allow_redirects=True, timeout=_timeout)
+            try:
+                return resp.status_code == 200
+            finally:
+                resp.close()
     except Exception as ex:
         if _is_network_error(ex):
-            _warn_network_once(f"existence check: {group_id}:{artifact_id}:{version}")
+            _warn_network_once(f"jar existence check: {url}")
         else:
-            logger.debug(f"Central existence check failed ({group_id}:{artifact_id}:{version}): {ex}")
-        return False
+            logger.debug(f"Maven jar existence check failed ({url}): {ex}")
+    return False
+
 
+def _find_jar_download_url(group_id, artifact_id, version):
+    """Return the first known-repo URL that hosts ``{artifact}-{version}.jar``.
+    Uses FOSSLight Util's repository order (group hints + MAVEN_REPOSITORY_BASES)
+    so non-Central artifacts (Google, Confluent, Spring, …) can still fill
+    Download Location.
+    """
+    if not _is_maven_coordinate(group_id, artifact_id, version):
+        return ""
+    group_path = group_id.replace('.', '/')
+    jar_name = f"{artifact_id}-{version}.jar"
+    for repo_base in _maven_repo_bases_for(group_path):
+        url = f"{repo_base}/{group_path}/{artifact_id}/{version}/{jar_name}"
+        if _maven_jar_url_exists(url):
+            logger.debug(f"Maven jar found: {url}")
+            return url
+    return ""
 
-def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central=False):
+
+def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central_search=False):
     groupId = artifactId = version = project_url = license_str = ''
     confirmed_in_central = False
+    trusted_coordinates = False
     source = ''
 
-    if skip_central:
+    if skip_central_search:
         central_info = {}
         timed_out = False
     else:
         central_info, timed_out = _search_central_by_sha1(sha1, timeout=search_timeout)
         if timed_out:
-            logger.debug(f"{rel_path}: Central SHA-1 search timed out – will retry")
+            logger.debug(f"{rel_path}: Central SHA-1 search timed out - will retry")
             return None, True
 
     g2, a2, v2, url2, pom_tmp_path = _read_pom_from_jar(jar_path)
@@ -215,10 +256,11 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
         names_match = (central_oss_name == jar_oss_name and c_version == v2)
 
         if names_match:
-            logger.debug(f"{rel_path}: Central and JAR pom.xml match ({central_oss_name} {c_version}) – using JAR pom.xml for license")
+            logger.debug(f"{rel_path}: Central and JAR pom.xml match ({central_oss_name} {c_version}) - using JAR pom.xml for license")
             groupId, artifactId, version, project_url = g2, a2, v2, url2
             source = 'pom.xml'
             confirmed_in_central = True
+            trusted_coordinates = True
 
             if pom_tmp_path:
                 try:
@@ -239,11 +281,12 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
             groupId, artifactId, version = c_groupId, c_artifactId, c_version
             source = 'Maven Central'
             confirmed_in_central = True
+            trusted_coordinates = True
 
             tmp_path, timed_out = _download_pom_to_tempfile(
                 groupId, artifactId, version, timeout=search_timeout)
             if timed_out:
-                logger.debug(f"{rel_path}: POM download timed out – will retry")
+                logger.debug(f"{rel_path}: POM download timed out - will retry")
                 if pom_tmp_path:
                     try:
                         os.remove(pom_tmp_path)
@@ -271,11 +314,12 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
                 pass
 
     else:
-        logger.debug(f"{rel_path}: not found in Maven Central – falling back to JAR internals")
+        logger.debug(f"{rel_path}: not found in Maven Central - falling back to JAR internals")
 
         if g2 or a2:
             groupId, artifactId, version, project_url = g2, a2, v2, url2
             source = 'pom.xml'
+            trusted_coordinates = True
 
         if pom_tmp_path:
             try:
@@ -291,8 +335,6 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
                     os.remove(pom_tmp_path)
                 except Exception:
                     pass
-            if not confirmed_in_central and not skip_central:
-                confirmed_in_central = _exists_in_central(groupId, artifactId, version)
 
     if not (groupId and artifactId):
         g3, a3, v3, url3 = _read_manifest_from_jar(jar_path)
@@ -300,14 +342,20 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
             groupId = g3
             artifactId = a3
             version = version or v3
+            confirmed_in_central = False
             project_url = project_url or url3
             source = 'MANIFEST.MF'
+            trusted_coordinates = False
 
     if not (groupId or artifactId):
         return None, False
 
+    if confirmed_in_central or trusted_coordinates:
+        dl_url = _find_jar_download_url(groupId, artifactId, version)
+    else:
+        dl_url = ""
+
     oss_name = f"{groupId}:{artifactId}" if groupId and artifactId else (artifactId or groupId)
-    dl_url = _build_central_jar_url(groupId, artifactId, version) if confirmed_in_central else ""
 
     oss = OssItem(oss_name, version, license_str, dl_url)
     oss.comment = source
@@ -345,7 +393,7 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
                 jar_files.append(os.path.join(root_dir, fname))
 
     if not jar_files:
-        logger.info("No .jar files found – skipping JAR OSS analysis.")
+        logger.info("No .jar files found - skipping JAR OSS analysis.")
         return jar_items, success
 
     for jar_path in jar_files:
@@ -361,7 +409,7 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
             jar_path, rel_path, sha1, search_timeout=_CENTRAL_SEARCH_TIMEOUT)
 
         if needs_retry:
-            logger.debug(f"{rel_path}: Central API timed out – queued for retry (attempt 1/{_MAX_RETRY})")
+            logger.debug(f"{rel_path}: Central API timed out - queued for retry (attempt 1/{_MAX_RETRY})")
             pending_sha1s.add(sha1)
             retry_queue.append((jar_path, rel_path, sha1, 1))
         elif result is not None:
@@ -373,8 +421,8 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
             if attempt >= _MAX_RETRY:
                 logger.warning(
                     f"{rel_path}: Maven Central API timed out after {_MAX_RETRY} attempts"
-                    " – falling back to JAR internals")
-                result, _ = _process_one_jar(jar_path, rel_path, sha1, skip_central=True)
+                    " - falling back to JAR internals")
+                result, _ = _process_one_jar(jar_path, rel_path, sha1, skip_central_search=True)
                 if result is not None:
                     _store_jar_result(jar_items, sha1, result)
                 continue

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary/binary_analysis.py

@@ -169,7 +169,7 @@ def get_file_list(path_to_find, excluded_files):
     return file_cnt, bin_list, found_jar
 
 
-def find_binaries(path_to_find_bin, output_dir, formats, dburl="", simple_mode=False,
+def find_binaries(path_to_find_bin, output_dir, formats, kb_url="", kb_token="", simple_mode=False,
                   correct_mode=True, correct_filepath="", path_to_exclude=[],
                   all_exclude_mode=()):
     global start_time, finish_time, _root_path, _result_log
@@ -254,7 +254,7 @@ def find_binaries(path_to_find_bin, output_dir, formats, dburl="", simple_mode=F
                 else:
                     logger.warning("Could not find OSS information for some jar files.")
 
-            return_list, db_loaded_cnt = get_oss_info_from_db(return_list, dburl)
+            return_list, db_loaded_cnt, kb_cover_msg = get_oss_info_from_db(return_list, kb_url, kb_token)
             return_list = sorted(return_list, key=lambda row: (row.bin_name_with_path))
             scan_item.append_file_items(return_list, PKG_NAME)
             if correct_mode:
@@ -267,6 +267,8 @@ def find_binaries(path_to_find_bin, output_dir, formats, dburl="", simple_mode=F
 
             finish_time = current_timestamp_utc()
             scan_item.set_cover_comment(f"Detected binaries: {len(return_list)} (Scanned Files : {cnt_file_except_skipped})")
+            if kb_cover_msg:
+                scan_item.set_cover_comment(kb_cover_msg)
             scan_item.set_cover_finish_time(finish_time)
 
             for combined_path_and_file, output_extension, output_format in zip(result_reports, output_extensions, formats):

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary/cli.py

@@ -36,7 +36,8 @@ def main():
     path_to_exclude = []
     output_dir = ""
     format = []
-    db_url = ""
+    kb_url = ""
+    kb_token = ""
     simple_mode = False
     correct_mode = True
 
@@ -46,9 +47,10 @@ def main():
     parser.add_argument('-s', '--simple', action='store_true', required=False, help=argparse.SUPPRESS)
     parser.add_argument('-p', '--path', type=str, required=False)
     parser.add_argument('-o', '--output', type=str, required=False)
-    parser.add_argument('-d', '--dburl', type=str, default='', required=False)
     parser.add_argument('-f', '--formats', type=str, required=False, nargs="*")
     parser.add_argument('-e', '--exclude', nargs="*", required=False, default=[])
+    parser.add_argument('--kb_url', type=str, required=False, default="")
+    parser.add_argument('--kb_token', type=str, required=False, default="")
     parser.add_argument('--notice', action='store_true', required=False)
     parser.add_argument('--no_correction', action='store_true', required=False)
     parser.add_argument('--correct_fpath', nargs=1, type=str, required=False)
@@ -81,8 +83,11 @@ def main():
     if args.output:  # -o option
         output_dir = args.output
 
-    if args.dburl:  # -d option
-        db_url = args.dburl
+    if args.kb_url:
+        kb_url = args.kb_url
+
+    if args.kb_token:
+        kb_token = args.kb_token
 
     if args.formats:  # -f option
         format = list(args.formats)
@@ -113,7 +118,10 @@ def main():
     timer.setDaemon(True)
     timer.start()
 
-    find_binaries(path_to_find_bin, output_dir, format, db_url, simple_mode, correct_mode, correct_filepath, path_to_exclude)
+    find_binaries(
+        path_to_find_bin, output_dir, format, kb_url, kb_token,
+        simple_mode, correct_mode, correct_filepath, path_to_exclude,
+    )
 
 
 if __name__ == '__main__':

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_binary
-Version: 5.1.29
+Version: 5.1.31
 Summary: FOSSLight Binary Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -24,13 +24,13 @@ Requires-Dist: defusedxml
 Requires-Dist: numpy
 Requires-Dist: pandas
 Requires-Dist: parmap
-Requires-Dist: psycopg2-binary
 Requires-Dist: python-dateutil
 Requires-Dist: py-tlsh
 Requires-Dist: pytz
 Requires-Dist: XlsxWriter
 Requires-Dist: PyYAML
-Requires-Dist: fosslight_util>=2.2.2
+Requires-Dist: fosslight_util>=2.2.8
+Requires-Dist: truststore
 Requires-Dist: python-magic-bin; sys_platform == "win32"
 Requires-Dist: python-magic; "darwin" in sys_platform
 Requires-Dist: python-magic; "linux" in sys_platform

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary.egg-info/SOURCES.txt

@@ -19,4 +19,5 @@ src/fosslight_binary.egg-info/dependency_links.txt
 src/fosslight_binary.egg-info/entry_points.txt
 src/fosslight_binary.egg-info/requires.txt
 src/fosslight_binary.egg-info/top_level.txt
-tests/test_fosslight_binary.py
+tests/test_fosslight_binary.py
+tests/test_kb_ssl.py

{fosslight_binary-5.1.29 → fosslight_binary-5.1.31}/src/fosslight_binary.egg-info/requires.txt

@@ -4,13 +4,13 @@ defusedxml
 numpy
 pandas
 parmap
-psycopg2-binary
 python-dateutil
 py-tlsh
 pytz
 XlsxWriter
 PyYAML
-fosslight_util>=2.2.2
+fosslight_util>=2.2.8
+truststore
 
 [:"darwin" in sys_platform]
 python-magic

fosslight_binary-5.1.31/tests/test_kb_ssl.py

@@ -0,0 +1,54 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for KB HTTPS SSL context selection."""
+
+import ssl
+from unittest.mock import patch
+
+from fosslight_binary._binary_dao import create_kb_ssl_context, kb_ssl_verify_enabled
+
+
+def test_kb_ssl_verify_enabled_default(monkeypatch):
+    monkeypatch.delenv("KB_SSL_VERIFY", raising=False)
+    assert kb_ssl_verify_enabled() is True
+
+
+def test_kb_ssl_verify_disabled_values(monkeypatch):
+    for value in ("false", "0", "no", "OFF"):
+        monkeypatch.setenv("KB_SSL_VERIFY", value)
+        assert kb_ssl_verify_enabled() is False
+
+
+def test_create_kb_ssl_context_insecure(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "false")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode == ssl.CERT_NONE
+    assert ctx.check_hostname is False
+
+
+def test_create_kb_ssl_context_uses_truststore_when_verify_on(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "true")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode != ssl.CERT_NONE
+    assert ctx.check_hostname is True
+
+
+def test_probe_passes_ssl_context():
+    from fosslight_binary._binary_dao import check_binary_match_endpoint
+
+    class _Resp:
+        def read(self):
+            return b"{}"
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+    with patch("fosslight_binary._binary_dao.urllib.request.urlopen", return_value=_Resp()) as urlopen:
+        available, comment = check_binary_match_endpoint("https://kb.example/", "")
+        assert available is True
+        assert comment == ""
+        assert urlopen.call_args.kwargs["context"] is not None
+        assert isinstance(urlopen.call_args.kwargs["context"], ssl.SSLContext)

fosslight_binary-5.1.29/src/fosslight_binary/_binary_dao.py

@@ -1,186 +0,0 @@
-#!/usr/bin/env python
-# -*- coding: utf-8 -*-
-# Copyright (c) 2020 LG Electronics Inc.
-# SPDX-License-Identifier: Apache-2.0
-
-import tlsh
-import logging
-import psycopg2
-import pandas as pd
-import socket
-from urllib.parse import urlparse
-from fosslight_binary._binary import TLSH_CHECKSUM_NULL
-from fosslight_util.oss_item import OssItem
-import fosslight_util.constant as constant
-
-columns = ['filename', 'pathname', 'checksum', 'tlshchecksum', 'ossname',
-           'ossversion', 'license', 'platformname',
-           'platformversion']
-conn = ""
-cur = ""
-logger = logging.getLogger(constant.LOGGER_NAME)
-DB_URL_DEFAULT = "postgresql://bin_analysis_script_user:script_123@bat.lge.com:5432/bat"
-
-
-def get_oss_info_from_db(bin_info_list, dburl=""):
-    _cnt_auto_identified = 0
-    conn_str, dbc = get_connection_string(dburl)
-    # DB URL에서 host 추출
-    try:
-        db_host = dbc.hostname
-    except Exception as ex:
-        logger.warning(f"Failed to parse DB URL for host: {ex}")
-        db_host = None
-
-    is_internal = False
-    if db_host:
-        try:
-            # DNS lookup 시도
-            socket.gethostbyname(db_host)
-            is_internal = True
-        except Exception:
-            is_internal = False
-
-    if is_internal:
-        connect_to_lge_bin_db(conn_str)
-        if conn != "" and cur != "":
-            for item in bin_info_list:
-                bin_oss_items = []
-                tlsh_value = item.tlsh
-                checksum_value = item.checksum
-                bin_file_name = item.binary_name_without_path
-
-                df_result = get_oss_info_by_tlsh_and_filename(
-                    bin_file_name, checksum_value, tlsh_value)
-                if df_result is not None and len(df_result) > 0:
-                    _cnt_auto_identified += 1
-                    # Initialize the saved contents at .jar analyzing only once
-                    if not item.found_in_jar_analysis and item.oss_items:
-                        item.oss_items = []
-
-                    for idx, row in df_result.iterrows():
-                        if not item.found_in_jar_analysis:
-                            oss_from_db = OssItem(row['ossname'], row['ossversion'], row['license'])
-
-                            if bin_oss_items:
-                                if not any(oss_item.name == oss_from_db.name
-                                           and oss_item.version == oss_from_db.version
-                                           and oss_item.license == oss_from_db.license
-                                           for oss_item in bin_oss_items):
-                                    bin_oss_items.append(oss_from_db)
-                            else:
-                                bin_oss_items.append(oss_from_db)
-
-                    if bin_oss_items:
-                        item.set_oss_items(bin_oss_items)
-                        item.comment = "Binary DB result"
-                        item.found_in_binary = True
-        else:
-            logger.warning(f"Internal network detected, but DB connection to '{db_host}' failed. Skipping DB query.")
-        disconnect_lge_bin_db()
-    else:
-        logger.debug(f"Binary DB host '{db_host}' is not reachable. Skipping DB query.")
-    return bin_info_list, _cnt_auto_identified
-
-
-def get_connection_string(dburl):
-    # dburl format : 'postgresql://username:password@host:port/database_name'
-    connection_string = ""
-    user_dburl = True
-    dbc = ""
-    if dburl == "" or dburl is None:
-        user_dburl = False
-        dburl = DB_URL_DEFAULT
-    try:
-        if user_dburl:
-            logger.debug("DB URL:" + dburl)
-        dbc = urlparse(dburl)
-        connection_string = "dbname={dbname} user={user} host={host} password={password} port={port}" \
-            .format(dbname=dbc.path.lstrip('/'),
-                    user=dbc.username,
-                    host=dbc.hostname,
-                    password=dbc.password,
-                    port=dbc.port)
-    except Exception as ex:
-        if user_dburl:
-            logger.warning(f"(Minor) Failed to parsing db url : {ex}")
-
-    return connection_string, dbc
-
-
-def get_oss_info_by_tlsh_and_filename(file_name, checksum_value, tlsh_value):
-    sql_statement = "SELECT filename,pathname,checksum,tlshchecksum,ossname,ossversion,\
-                    license,platformname,platformversion FROM lgematching "
-    sql_statement_checksum = " WHERE filename=%s AND checksum=%s;"  # Using parameterized query
-    sql_statement_filename = "SELECT DISTINCT ON (tlshchecksum) tlshchecksum FROM lgematching WHERE filename=%s;"  # Using parameterized query
-
-    final_result_item = ""
-
-    df_result = get_list_by_using_query(
-        sql_statement + sql_statement_checksum, columns, (file_name, checksum_value))
-    # Found a file with the same checksum.
-    if df_result is not None and len(df_result) > 0:
-        final_result_item = df_result
-    else:
-        # Match tlsh and fileName
-        df_result = get_list_by_using_query(
-            sql_statement_filename, ['tlshchecksum'], (file_name,))
-        if df_result is None or len(df_result) <= 0:
-            final_result_item = ""
-        elif tlsh_value == TLSH_CHECKSUM_NULL:  # Couldn't get the tlsh of a file.
-            final_result_item = ""
-        else:
-            matched_tlsh = ""
-            matched_tlsh_diff = -1
-            for row in df_result.tlshchecksum:
-                try:
-                    if row != TLSH_CHECKSUM_NULL:
-                        tlsh_diff = tlsh.diff(row, tlsh_value)
-                        if tlsh_diff <= 120:  # MATCHED
-                            if (matched_tlsh_diff < 0) or (tlsh_diff < matched_tlsh_diff):
-                                matched_tlsh_diff = tlsh_diff
-                                matched_tlsh = row
-                except Exception as ex:
-                    logger.warning(f"* (Minor) Error_tlsh_comparison: {ex}")
-            if matched_tlsh != "":
-                final_result_item = get_list_by_using_query(
-                    sql_statement + " WHERE filename=%s AND tlshchecksum=%s;", columns, (file_name, matched_tlsh))
-
-    return final_result_item
-
-
-def get_list_by_using_query(sql_query, columns, params=None):
-    result_rows = ""  # DataFrame
-    try:
-        if params:
-            cur.execute(sql_query, params)
-        else:
-            cur.execute(sql_query)
-        rows = cur.fetchall()
-
-        if rows is not None and len(rows) > 0:
-            result_rows = pd.DataFrame(data=rows, columns=columns)
-    except Exception as ex:
-        logger.error(f"Database query error: {ex}")
-        result_rows = ""
-    return result_rows
-
-
-def disconnect_lge_bin_db():
-    try:
-        cur.close()
-        conn.close()
-    except:
-        pass
-
-
-def connect_to_lge_bin_db(connection_string):
-    global conn, cur
-
-    try:
-        conn = psycopg2.connect(connection_string)
-        cur = conn.cursor()
-    except Exception as ex:
-        logger.debug(f"(Minor) Can't connect to Binary DB. : {ex}")
-        conn = ""
-        cur = ""