fosslight-binary 5.1.30__tar.gz → 5.1.32__tar.gz

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_binary
-Version: 5.1.30
+Version: 5.1.32
 Summary: FOSSLight Binary Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -29,7 +29,8 @@ Requires-Dist: py-tlsh
 Requires-Dist: pytz
 Requires-Dist: XlsxWriter
 Requires-Dist: PyYAML
-Requires-Dist: fosslight_util>=2.2.2
+Requires-Dist: fosslight_util>=2.2.14
+Requires-Dist: truststore
 Requires-Dist: python-magic-bin; sys_platform == "win32"
 Requires-Dist: python-magic; "darwin" in sys_platform
 Requires-Dist: python-magic; "linux" in sys_platform

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_binary"
-version = "5.1.30"
+version = "5.1.32"
 description = "FOSSLight Binary Scanner"
 readme = "README.md"
 license = "Apache-2.0"
@@ -36,7 +36,8 @@ dependencies = [
     "pytz",
     "XlsxWriter",
     "PyYAML",
-    "fosslight_util>=2.2.2",
+    "fosslight_util>=2.2.14",
+    "truststore",
     "python-magic-bin; sys_platform == 'win32'",
     "python-magic; 'darwin' in sys_platform",
     "python-magic; 'linux' in sys_platform",

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary/_binary_dao.py

@@ -7,6 +7,7 @@
 import json
 import logging
 import os
+import ssl
 import urllib.error
 import urllib.request
 from typing import Dict, List, Optional, Tuple
@@ -43,6 +44,31 @@ def _get_chunk_size() -> int:
 _CHUNK_SIZE = _get_chunk_size()
 
 MatchKey = Tuple[str, str]
+_KB_SSL_VERIFY_FALSE = {"0", "false", "no", "off"}
+_logged_insecure_kb_ssl = False
+
+
+def kb_ssl_verify_enabled() -> bool:
+    raw = os.environ.get("KB_SSL_VERIFY", "true")
+    return raw.strip().lower() not in _KB_SSL_VERIFY_FALSE
+
+
+def create_kb_ssl_context() -> ssl.SSLContext:
+    """TLS context for KB HTTPS. Uses the OS trust store (Windows store, like the browser)."""
+    global _logged_insecure_kb_ssl
+    if not kb_ssl_verify_enabled():
+        if not _logged_insecure_kb_ssl:
+            logger.warning("KB TLS certificate verification is disabled (KB_SSL_VERIFY)")
+            _logged_insecure_kb_ssl = True
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        return ctx
+    try:
+        import truststore
+        return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    except ImportError:
+        return ssl.create_default_context()
 
 
 def resolve_kb_config(kb_url: str = "", kb_token: str = "") -> Tuple[str, str]:
@@ -78,7 +104,9 @@ def check_binary_match_endpoint(kb_url: str, kb_token: str = "") -> Tuple[bool,
         request.add_header("Authorization", f"Bearer {kb_token}")
 
     try:
-        with urllib.request.urlopen(request, timeout=_PROBE_TIMEOUT_SEC) as response:
+        with urllib.request.urlopen(
+            request, timeout=_PROBE_TIMEOUT_SEC, context=create_kb_ssl_context()
+        ) as response:
             response.read()
             return True, ""
     except urllib.error.HTTPError as ex:
@@ -257,7 +285,9 @@ def _post_binary_match(kb_url: str, kb_token: str, items: list) -> Optional[dict
         request.add_header("Authorization", f"Bearer {kb_token}")
 
     try:
-        with urllib.request.urlopen(request, timeout=_HTTP_TIMEOUT_SEC) as response:
+        with urllib.request.urlopen(
+            request, timeout=_HTTP_TIMEOUT_SEC, context=create_kb_ssl_context()
+        ) as response:
             body = response.read().decode()
             return json.loads(body) if body else {}
     except urllib.error.HTTPError as ex:

fosslight_binary-5.1.32/src/fosslight_binary/_exclude.py

@@ -0,0 +1,15 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Binary-scanner filename excludes."""
+
+from fosslight_util.exclude import is_excluded_filename
+
+# Scanner output binaries that should not be re-analyzed.
+EXCLUDE_FILENAME_BINARY = frozenset({
+    "fosslight_bin", "fosslight_bin.exe",
+})
+
+
+def is_excluded_binary_filename(file_path: str) -> bool:
+    return is_excluded_filename(file_path, EXCLUDE_FILENAME_BINARY)

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary/_help.py

@@ -34,6 +34,8 @@ _HELP_MESSAGE_BINARY = f"""
     ────────────────────────────────────────────────────────────────────
     --kb_url <url>         KB API URL (priority: parameter > KB_URL env > default)
     --kb_token <token>     KB bearer token (priority: parameter > KB_TOKEN env)
+                           HTTPS uses the OS certificate store. Set KB_SSL_VERIFY=false
+                           only if certificate verification must be skipped.
     --notice               Print the open source license notice text
     --no_correction        Skip OSS information correction with sbom-info.yaml
     --correct_fpath <path> Path to custom sbom-info.yaml file

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary/_jar_analysis.py

@@ -7,21 +7,32 @@
 import hashlib
 import logging
 import os
+import re
 import tempfile
 import zipfile
 import defusedxml.ElementTree as ET
 import requests
 import fosslight_util.constant as constant
+from fosslight_util._get_downloadable_url import _maven_repo_bases_for
 from fosslight_util.get_pom_license import get_license_from_pom
 from fosslight_util.oss_item import OssItem
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
-_CENTRAL_SEARCH_URL = "https://search.maven.org/solrsearch/select"
-_REQUEST_TIMEOUT = 10          # seconds – used for HEAD / POM download
-_CENTRAL_SEARCH_TIMEOUT = 2.5  # seconds – tight timeout for Search API (retried on timeout)
+# Both hosts serve the same Central Solr index and the same g/a/v fields, but
+# search.maven.org answers only about one query in six: the TCP connect always
+# succeeds and then the response never starts, so no timeout budget rescues it.
+# The Portal host answers every query in about half a second, so it goes first.
+_CENTRAL_SEARCH_URLS = (
+    "https://central.sonatype.com/solrsearch/select",
+    "https://search.maven.org/solrsearch/select",
+)
+_REQUEST_TIMEOUT = 10          # seconds - used for HEAD / POM download
+_CENTRAL_SEARCH_TIMEOUT = 2.5  # seconds - per-host budget, retried on timeout
+_MAVEN_JAR_HTTP_TIMEOUT = (2, 2)  # match Util probe timeouts for multi-repo jar checks
 _MAX_RETRY = 3                 # maximum Central API retry attempts per JAR
 _central_network_warned = False  # Flag to suppress repeated network-unavailable warnings within one run
+_COORD_TOKEN = re.compile(r'[A-Za-z0-9._+-]+')  # shape of a Maven groupId / artifactId / version
 
 
 def _sha1_of_file(filepath):
@@ -112,31 +123,56 @@ def _warn_network_once(context=""):
 
 
 def _search_central_by_sha1(sha1, timeout=None):
+    """Look up Maven coordinates by JAR checksum, trying each Central host in turn.
+
+    An answer from any host is authoritative for the whole index, so a miss ends
+    the search. ``timed_out`` is reported only when no host answered at all.
+    """
     if not sha1:
         return {}, False
     _timeout = timeout if timeout is not None else _CENTRAL_SEARCH_TIMEOUT
-    try:
-        params = {"q": f"1:{sha1}", "rows": 1, "wt": "json"}
-        resp = requests.get(_CENTRAL_SEARCH_URL, params=params, timeout=_timeout)
-        resp.raise_for_status()
-        docs = resp.json().get("response", {}).get("docs", [])
+    params = {"q": f"1:{sha1}", "rows": 1, "wt": "json"}
+    any_timeout = False
+    unreachable = False
+
+    for url in _CENTRAL_SEARCH_URLS:
+        try:
+            resp = requests.get(url, params=params, timeout=_timeout)
+            resp.raise_for_status()
+            docs = resp.json().get("response", {}).get("docs", [])
+        except requests.exceptions.Timeout:
+            logger.debug(f"Maven Central SHA-1 search timed out ({sha1}) at {url} - will retry")
+            any_timeout = True
+            continue
+        except Exception as ex:
+            if _is_network_error(ex):
+                unreachable = True
+            else:
+                logger.debug(f"Maven Central SHA-1 search failed ({sha1}) at {url}: {ex}")
+            continue
+
         if not docs:
             return {}, False
+
         doc = docs[0]
+        groupId = doc.get("g", "")
+        artifactId = doc.get("a", "")
+        version = doc.get("v") or doc.get("latestVersion", "")
+
+        if not (groupId and artifactId and version):
+            logger.debug(f"Maven Central returned an incomplete document for {sha1}: {doc}")
+            return {}, False
+
         return {
-            "groupId": doc.get("g", ""),
-            "artifactId": doc.get("a", ""),
-            "version": doc.get("v") or doc.get("latestVersion", ""),
+            "groupId": groupId,
+            "artifactId": artifactId,
+            "version": version,
         }, False
-    except requests.exceptions.Timeout:
-        logger.debug(f"Maven Central SHA-1 search timed out ({sha1}) – will retry")
-        return {}, True
-    except Exception as ex:
-        if _is_network_error(ex):
-            _warn_network_once(f"SHA-1 search: {sha1[:10]}...")
-        else:
-            logger.debug(f"Maven Central SHA-1 search failed ({sha1}): {ex}")
-        return {}, False
+
+    # Warn only once every host has failed: a fallback answer is not a failure.
+    if unreachable:
+        _warn_network_once(f"SHA-1 search: {sha1[:10]}...")
+    return {}, any_timeout
 
 
 def _download_pom_to_tempfile(group_id, artifact_id, version, timeout=None):
@@ -157,7 +193,7 @@ def _download_pom_to_tempfile(group_id, artifact_id, version, timeout=None):
                 logger.debug(f"POM downloaded to {tmp.name} from {url}")
                 return tmp.name, False
         except requests.exceptions.Timeout:
-            logger.debug(f"POM download timed out from {url} – will retry")
+            logger.debug(f"POM download timed out from {url} - will retry")
             any_timeout = True
         except Exception as ex:
             if _is_network_error(ex):
@@ -167,40 +203,69 @@ def _download_pom_to_tempfile(group_id, artifact_id, version, timeout=None):
     return None, any_timeout
 
 
-def _build_central_jar_url(group_id, artifact_id, version):
-    if not (group_id and artifact_id and version):
-        return ""
-    group_path = group_id.replace('.', '/')
-    return f"https://repo1.maven.org/maven2/{group_path}/{artifact_id}/{version}/{artifact_id}-{version}.jar"
+def _is_maven_coordinate(*parts):
+    """True only if every part could be a Maven coordinate token.
+
+    MANIFEST.MF vendor fields are display names ("The Apache Software
+    Foundation", "Google, Inc.", "%bundleVendor"), not groupIds. Rejecting them
+    keeps bogus URLs out of the report and avoids HEAD requests that can only 404.
+    """
+    return all(p and _COORD_TOKEN.fullmatch(p) for p in parts)
 
 
-def _exists_in_central(group_id, artifact_id, version):
-    if not (group_id and artifact_id and version):
-        return False
-    url = _build_central_jar_url(group_id, artifact_id, version)
+def _maven_jar_url_exists(url, timeout=None):
+    """True if a Maven host serves this jar URL (HEAD, with GET fallback)."""
+    _timeout = timeout if timeout is not None else _MAVEN_JAR_HTTP_TIMEOUT
     try:
-        resp = requests.head(url, timeout=_REQUEST_TIMEOUT, allow_redirects=True)
-        return resp.status_code == 200
+        resp = requests.head(url, timeout=_timeout, allow_redirects=True)
+        if resp.status_code == 200:
+            return True
+        # Some Maven hosts reject HEAD; fall back to a streamed GET (Util pattern).
+        if resp.status_code in (403, 405, 501):
+            resp = requests.get(url, stream=True, allow_redirects=True, timeout=_timeout)
+            try:
+                return resp.status_code == 200
+            finally:
+                resp.close()
     except Exception as ex:
         if _is_network_error(ex):
-            _warn_network_once(f"existence check: {group_id}:{artifact_id}:{version}")
+            _warn_network_once(f"jar existence check: {url}")
         else:
-            logger.debug(f"Central existence check failed ({group_id}:{artifact_id}:{version}): {ex}")
-        return False
+            logger.debug(f"Maven jar existence check failed ({url}): {ex}")
+    return False
+
+
+def _find_jar_download_url(group_id, artifact_id, version):
+    """Return the first known-repo URL that hosts ``{artifact}-{version}.jar``.
+    Uses FOSSLight Util's repository order (group hints + MAVEN_REPOSITORY_BASES)
+    so non-Central artifacts (Google, Confluent, Spring, …) can still fill
+    Download Location.
+    """
+    if not _is_maven_coordinate(group_id, artifact_id, version):
+        return ""
+    group_path = group_id.replace('.', '/')
+    jar_name = f"{artifact_id}-{version}.jar"
+    for repo_base in _maven_repo_bases_for(group_path):
+        url = f"{repo_base}/{group_path}/{artifact_id}/{version}/{jar_name}"
+        if _maven_jar_url_exists(url):
+            logger.debug(f"Maven jar found: {url}")
+            return url
+    return ""
 
 
-def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central=False):
+def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central_search=False):
     groupId = artifactId = version = project_url = license_str = ''
     confirmed_in_central = False
+    trusted_coordinates = False
     source = ''
 
-    if skip_central:
+    if skip_central_search:
         central_info = {}
         timed_out = False
     else:
         central_info, timed_out = _search_central_by_sha1(sha1, timeout=search_timeout)
         if timed_out:
-            logger.debug(f"{rel_path}: Central SHA-1 search timed out – will retry")
+            logger.debug(f"{rel_path}: Central SHA-1 search timed out - will retry")
             return None, True
 
     g2, a2, v2, url2, pom_tmp_path = _read_pom_from_jar(jar_path)
@@ -215,10 +280,11 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
         names_match = (central_oss_name == jar_oss_name and c_version == v2)
 
         if names_match:
-            logger.debug(f"{rel_path}: Central and JAR pom.xml match ({central_oss_name} {c_version}) – using JAR pom.xml for license")
+            logger.debug(f"{rel_path}: Central and JAR pom.xml match ({central_oss_name} {c_version}) - using JAR pom.xml for license")
             groupId, artifactId, version, project_url = g2, a2, v2, url2
             source = 'pom.xml'
             confirmed_in_central = True
+            trusted_coordinates = True
 
             if pom_tmp_path:
                 try:
@@ -239,11 +305,12 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
             groupId, artifactId, version = c_groupId, c_artifactId, c_version
             source = 'Maven Central'
             confirmed_in_central = True
+            trusted_coordinates = True
 
             tmp_path, timed_out = _download_pom_to_tempfile(
                 groupId, artifactId, version, timeout=search_timeout)
             if timed_out:
-                logger.debug(f"{rel_path}: POM download timed out – will retry")
+                logger.debug(f"{rel_path}: POM download timed out - will retry")
                 if pom_tmp_path:
                     try:
                         os.remove(pom_tmp_path)
@@ -271,11 +338,12 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
                 pass
 
     else:
-        logger.debug(f"{rel_path}: not found in Maven Central – falling back to JAR internals")
+        logger.debug(f"{rel_path}: not found in Maven Central - falling back to JAR internals")
 
         if g2 or a2:
             groupId, artifactId, version, project_url = g2, a2, v2, url2
             source = 'pom.xml'
+            trusted_coordinates = True
 
         if pom_tmp_path:
             try:
@@ -291,8 +359,6 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
                     os.remove(pom_tmp_path)
                 except Exception:
                     pass
-            if not confirmed_in_central and not skip_central:
-                confirmed_in_central = _exists_in_central(groupId, artifactId, version)
 
     if not (groupId and artifactId):
         g3, a3, v3, url3 = _read_manifest_from_jar(jar_path)
@@ -300,14 +366,20 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
             groupId = g3
             artifactId = a3
             version = version or v3
+            confirmed_in_central = False
             project_url = project_url or url3
             source = 'MANIFEST.MF'
+            trusted_coordinates = False
 
     if not (groupId or artifactId):
         return None, False
 
+    if confirmed_in_central or trusted_coordinates:
+        dl_url = _find_jar_download_url(groupId, artifactId, version)
+    else:
+        dl_url = ""
+
     oss_name = f"{groupId}:{artifactId}" if groupId and artifactId else (artifactId or groupId)
-    dl_url = _build_central_jar_url(groupId, artifactId, version) if confirmed_in_central else ""
 
     oss = OssItem(oss_name, version, license_str, dl_url)
     oss.comment = source
@@ -319,7 +391,8 @@ def _process_one_jar(jar_path, rel_path, sha1, search_timeout=None, skip_central
 
 
 def _has_valid_jar_oss(oss_list):
-    return any(oss.name and oss.license for oss in oss_list)
+    """True if any entry is identified. A missing license is reported as empty."""
+    return any(oss.name for oss in oss_list)
 
 
 def _store_jar_result(jar_items, sha1, result):
@@ -345,7 +418,7 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
                 jar_files.append(os.path.join(root_dir, fname))
 
     if not jar_files:
-        logger.info("No .jar files found – skipping JAR OSS analysis.")
+        logger.info("No .jar files found - skipping JAR OSS analysis.")
         return jar_items, success
 
     for jar_path in jar_files:
@@ -361,7 +434,7 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
             jar_path, rel_path, sha1, search_timeout=_CENTRAL_SEARCH_TIMEOUT)
 
         if needs_retry:
-            logger.debug(f"{rel_path}: Central API timed out – queued for retry (attempt 1/{_MAX_RETRY})")
+            logger.debug(f"{rel_path}: Central API timed out - queued for retry (attempt 1/{_MAX_RETRY})")
             pending_sha1s.add(sha1)
             retry_queue.append((jar_path, rel_path, sha1, 1))
         elif result is not None:
@@ -373,8 +446,8 @@ def analyze_jar_file(path_to_find_bin, path_to_exclude):
             if attempt >= _MAX_RETRY:
                 logger.warning(
                     f"{rel_path}: Maven Central API timed out after {_MAX_RETRY} attempts"
-                    " – falling back to JAR internals")
-                result, _ = _process_one_jar(jar_path, rel_path, sha1, skip_central=True)
+                    " - falling back to JAR internals")
+                result, _ = _process_one_jar(jar_path, rel_path, sha1, skip_central_search=True)
                 if result is not None:
                     _store_jar_result(jar_items, sha1, result)
                 continue

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary/_simple_mode.py

@@ -4,10 +4,10 @@
 # Copyright (c) 2024 LG Electronics Inc.
 # SPDX-License-Identifier: Apache-2.0
 import os
-import re
 import logging
 import zipfile
 import tarfile
+import magic
 import yaml
 import fosslight_util.constant as constant
 from fosslight_util.set_log import init_log
@@ -18,7 +18,14 @@ logger = logging.getLogger(constant.LOGGER_NAME)
 
 
 def is_compressed_file(filename):
-    return zipfile.is_zipfile(filename) or tarfile.is_tarfile(filename)
+    if zipfile.is_zipfile(filename) or tarfile.is_tarfile(filename):
+        return True
+
+    try:
+        file_type = magic.from_file(filename).lower()
+        return 'archive' in file_type or 'compressed' in file_type
+    except Exception:
+        return False
 
 
 def is_jar_file(filename):
@@ -35,9 +42,9 @@ def exclude_bin_for_simple_mode(binary_list):
 
         path = bin.bin_name_with_path
 
-        if is_jar_file(path) and not re.search(r".*sources\.jar", path.lower()):
+        if is_jar_file(path) and not path.lower().endswith('-sources.jar'):
             bin_list_exclude_compressed.append(path)
-        elif re.search(r".*sources\.jar", path.lower()) or is_compressed_file(path):
+        elif path.lower().endswith('-sources.jar') or is_compressed_file(path):
             compressed_list.append(path)
         else:
             bin_list_exclude_compressed.append(path)

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary/binary_analysis.py

@@ -22,6 +22,7 @@ from fosslight_util.time import current_timestamp_utc, format_running_time, time
 from fosslight_util.correct import correct_with_yaml
 from fosslight_util.oss_item import ScannerItem
 from fosslight_util.exclude import get_excluded_paths
+from ._exclude import EXCLUDE_FILENAME_BINARY, is_excluded_binary_filename
 import hashlib
 import tlsh
 from io import open
@@ -93,15 +94,14 @@ def init(path_to_find_bin, output_file_name, formats, path_to_exclude=[]):
         for i, output_extension in enumerate(output_extensions):
             if output_files[i] is None or output_files[i] == "":
                 if formats:
-                    if formats[i].startswith('spdx') or formats[i].startswith('cyclonedx'):
+                    if formats[i].startswith('spdx'):
                         if platform.system() == 'Windows':
                             logger.warning(f'{formats[i]} is not supported on Windows. Please remove {formats[i]} from format.')
                             to_remove.append(i)
                         else:
-                            if formats[i].startswith('spdx'):
-                                output_files[i] = f"fosslight_spdx_bin_{file_time}"
-                            elif formats[i].startswith('cyclonedx'):
-                                output_files[i] = f'fosslight_cyclonedx_bin_{file_time}'
+                            output_files[i] = f"fosslight_spdx_bin_{file_time}"
+                    elif formats[i].startswith('cyclonedx'):
+                        output_files[i] = f'fosslight_cyclonedx_bin_{file_time}'
                     else:
                         if output_extension == _json_ext:
                             output_files[i] = f"fosslight_opossum_bin_{file_time}"
@@ -147,7 +147,7 @@ def get_file_list(path_to_find, excluded_files):
         for file in files:
             bin_with_path = os.path.join(root, file)
             rel_path_file = os.path.relpath(bin_with_path, path_to_find).replace('\\', '/')
-            if rel_path_file in excluded_files:
+            if rel_path_file in excluded_files or is_excluded_binary_filename(rel_path_file):
                 continue
             file_lower_case = file.lower()
             extension = os.path.splitext(file_lower_case)[1][1:].strip()
@@ -200,10 +200,14 @@ def find_binaries(path_to_find_bin, output_dir, formats, kb_url="", kb_token="",
         excluded_path_with_default_exclusion, excluded_path_without_dot, excluded_files, cnt_file_except_skipped = all_exclude_mode
     elif simple_mode:
         excluded_path_with_default_exclusion, excluded_path_without_dot, excluded_files, cnt_file_except_skipped \
-            = get_excluded_paths(path_to_find_bin, path_to_exclude, REMOVE_FILE_EXTENSION_SIMPLE)
+            = get_excluded_paths(
+                path_to_find_bin, path_to_exclude, REMOVE_FILE_EXTENSION_SIMPLE,
+                exclude_filenames=EXCLUDE_FILENAME_BINARY)
     else:
         excluded_path_with_default_exclusion, excluded_path_without_dot, excluded_files, cnt_file_except_skipped \
-            = get_excluded_paths(path_to_find_bin, path_to_exclude)
+            = get_excluded_paths(
+                path_to_find_bin, path_to_exclude,
+                exclude_filenames=EXCLUDE_FILENAME_BINARY)
     logger.debug(f"Skipped paths: {excluded_path_with_default_exclusion}")
 
     if not os.path.isdir(path_to_find_bin):
@@ -273,7 +277,8 @@ def find_binaries(path_to_find_bin, output_dir, formats, kb_url="", kb_token="",
 
             for combined_path_and_file, output_extension, output_format in zip(result_reports, output_extensions, formats):
                 results.append(write_output_file(combined_path_and_file, output_extension, scan_item,
-                                                 BIN_EXT_HEADER, HIDE_HEADER, output_format))
+                                                 BIN_EXT_HEADER, HIDE_HEADER, output_format,
+                                                 scanner_covers=[scan_item.cover]))
 
         except Exception as ex:
             error_occured(error_msg=str(ex), exit=False)

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_binary
-Version: 5.1.30
+Version: 5.1.32
 Summary: FOSSLight Binary Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -29,7 +29,8 @@ Requires-Dist: py-tlsh
 Requires-Dist: pytz
 Requires-Dist: XlsxWriter
 Requires-Dist: PyYAML
-Requires-Dist: fosslight_util>=2.2.2
+Requires-Dist: fosslight_util>=2.2.14
+Requires-Dist: truststore
 Requires-Dist: python-magic-bin; sys_platform == "win32"
 Requires-Dist: python-magic; "darwin" in sys_platform
 Requires-Dist: python-magic; "linux" in sys_platform

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary.egg-info/SOURCES.txt

@@ -8,6 +8,7 @@ LICENSES/LicenseRef-3rd-party-licenses.txt
 src/fosslight_binary/__init__.py
 src/fosslight_binary/_binary.py
 src/fosslight_binary/_binary_dao.py
+src/fosslight_binary/_exclude.py
 src/fosslight_binary/_help.py
 src/fosslight_binary/_jar_analysis.py
 src/fosslight_binary/_simple_mode.py
@@ -19,4 +20,5 @@ src/fosslight_binary.egg-info/dependency_links.txt
 src/fosslight_binary.egg-info/entry_points.txt
 src/fosslight_binary.egg-info/requires.txt
 src/fosslight_binary.egg-info/top_level.txt
-tests/test_fosslight_binary.py
+tests/test_fosslight_binary.py
+tests/test_kb_ssl.py

{fosslight_binary-5.1.30 → fosslight_binary-5.1.32}/src/fosslight_binary.egg-info/requires.txt

@@ -9,7 +9,8 @@ py-tlsh
 pytz
 XlsxWriter
 PyYAML
-fosslight_util>=2.2.2
+fosslight_util>=2.2.14
+truststore
 
 [:"darwin" in sys_platform]
 python-magic

fosslight_binary-5.1.32/tests/test_kb_ssl.py

@@ -0,0 +1,54 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for KB HTTPS SSL context selection."""
+
+import ssl
+from unittest.mock import patch
+
+from fosslight_binary._binary_dao import create_kb_ssl_context, kb_ssl_verify_enabled
+
+
+def test_kb_ssl_verify_enabled_default(monkeypatch):
+    monkeypatch.delenv("KB_SSL_VERIFY", raising=False)
+    assert kb_ssl_verify_enabled() is True
+
+
+def test_kb_ssl_verify_disabled_values(monkeypatch):
+    for value in ("false", "0", "no", "OFF"):
+        monkeypatch.setenv("KB_SSL_VERIFY", value)
+        assert kb_ssl_verify_enabled() is False
+
+
+def test_create_kb_ssl_context_insecure(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "false")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode == ssl.CERT_NONE
+    assert ctx.check_hostname is False
+
+
+def test_create_kb_ssl_context_uses_truststore_when_verify_on(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "true")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode != ssl.CERT_NONE
+    assert ctx.check_hostname is True
+
+
+def test_probe_passes_ssl_context():
+    from fosslight_binary._binary_dao import check_binary_match_endpoint
+
+    class _Resp:
+        def read(self):
+            return b"{}"
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+    with patch("fosslight_binary._binary_dao.urllib.request.urlopen", return_value=_Resp()) as urlopen:
+        available, comment = check_binary_match_endpoint("https://kb.example/", "")
+        assert available is True
+        assert comment == ""
+        assert urlopen.call_args.kwargs["context"] is not None
+        assert isinstance(urlopen.call_args.kwargs["context"], ssl.SSLContext)