fosslight-source 2.3.13__tar.gz → 2.3.15__tar.gz

{fosslight_source-2.3.13/src/fosslight_source.egg-info → fosslight_source-2.3.15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.13
+Version: 2.3.15
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -55,7 +55,7 @@ Detect the license for the source code.
 Use Source Code Scanner and process the scanner results.
 ```
 
-**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. And removes words such as "-only" and "-old-style" from the license name to be printed. The output result is generated in spreadsheet format.
+**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. The output result is generated in spreadsheet format.
 
 
 [sc]: https://github.com/nexB/scancode-toolkit

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/README.md

@@ -18,7 +18,7 @@ Detect the license for the source code.
 Use Source Code Scanner and process the scanner results.
 ```
 
-**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. And removes words such as "-only" and "-old-style" from the license name to be printed. The output result is generated in spreadsheet format.
+**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. The output result is generated in spreadsheet format.
 
 
 [sc]: https://github.com/nexB/scancode-toolkit

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_source"
-version = "2.3.13"
+version = "2.3.15"
 description = "FOSSLight Source Scanner"
 readme = "README.md"
 license = "Apache-2.0"

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/src/fosslight_source/_exclude.py

@@ -1,10 +1,14 @@
 # Copyright (c) 2026 LG Electronics Inc.
 # SPDX-License-Identifier: Apache-2.0
 
-"""Source-scanner filename excludes (not applied to dependency discovery)."""
+"""Source-scanner exclusion helpers (not applied to dependency discovery)."""
+
+import os
 
 from fosslight_util.exclude import is_excluded_filename
 
+DEFAULT_SKIP_SMALL_FILE_SIZE = 150
+
 # Build/package config noise for license scans.
 EXCLUDE_FILENAME_SOURCE = frozenset({
     "changelog", "config.guess", "config.sub", "changes", "ltmain.sh",
@@ -19,3 +23,11 @@ EXCLUDE_FILENAME_SOURCE = frozenset({
 
 def is_excluded_source_filename(file_path: str) -> bool:
     return is_excluded_filename(file_path, EXCLUDE_FILENAME_SOURCE)
+
+
+def is_small_file(file_path: str) -> bool:
+    """Return whether a file is at or below the KB/SCANOSS size threshold."""
+    try:
+        return os.path.getsize(file_path) <= DEFAULT_SKIP_SMALL_FILE_SIZE
+    except OSError:
+        return False

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/src/fosslight_source/_help.py

@@ -47,7 +47,6 @@ _HELP_MESSAGE_SOURCE_SCANNER = f"""
     --kb_token <token>     KB bearer token (priority: parameter > KB_TOKEN env)
                            HTTPS uses the OS certificate store. Set KB_SSL_VERIFY=false
                            only if certificate verification must be skipped.
-
     💡 Examples
     ────────────────────────────────────────────────────────────────────
     # Scan current directory

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/src/fosslight_source/_scan_item.py

@@ -12,7 +12,7 @@ import fosslight_util.constant as constant
 from fosslight_util.oss_item import FileItem, OssItem, get_checksum_sha1
 
 logger = logging.getLogger(constant.LOGGER_NAME)
-replace_word = ["-only", "-old-style", "-or-later", "licenseref-scancode-", "licenseref-"]
+replace_word = ["licenseref-scancode-", "licenseref-"]
 _notice_filename = ['licen[cs]e[s]?', 'notice[s]?', 'legal', 'copyright[s]?', 'copying*', 'patent[s]?', 'unlicen[cs]e', 'eula',
                     '[a,l]?gpl[-]?[1-3]?[.,-,_]?[0-1]?', 'mit', 'bsd[-]?[0-4]?', 'bsd[-]?[0-4][-]?clause[s]?',
                     'apache[-,_]?[1-2]?[.,-,_]?[0-2]?']
@@ -63,7 +63,7 @@ class SourceItem(FileItem):
         self.checksum = get_checksum_sha1(value)
         self.kb_origin_url = ""  # URL from OSS KB
         self.kb_evidence = ""   # Evidence from KB API (exact_match or code snippet)
-        self._cached_kb_md5 = ""  # MD5 precomputed for KB lookup (set by _collect_kb_file_hashes)
+        self._cached_kb_md5: str | None = None  # None: not checked; empty: checked but no KB hash
 
     def __del__(self) -> None:
         pass
@@ -192,8 +192,9 @@ class SourceItem(FileItem):
             item = OssItem(self.oss_name, self.oss_version, self.licenses)
             if kb_origin_urls and not self.is_license_text:
                 md5_hash = self._cached_kb_md5
-                if not md5_hash:
+                if md5_hash is None:
                     md5_hash, _wfp = self._get_hash(path_to_scan)
+                    self._cached_kb_md5 = md5_hash
                 if md5_hash:
                     origin_url = kb_origin_urls.get(md5_hash, "")
                     if origin_url:

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/src/fosslight_source/cli.py

@@ -22,7 +22,7 @@ from fosslight_util.correct import correct_with_yaml
 from fosslight_util.parsing_yaml import SUPPORT_OSS_INFO_FILES
 from .run_scancode import run_scan
 from fosslight_util.exclude import get_excluded_paths
-from ._exclude import EXCLUDE_FILENAME_SOURCE, is_excluded_source_filename
+from ._exclude import EXCLUDE_FILENAME_SOURCE, is_excluded_source_filename, is_small_file
 from .run_scanoss import run_scanoss_py
 from .run_scanoss import get_scanoss_extra_info
 import yaml
@@ -93,7 +93,6 @@ def main() -> None:
     parser.add_argument('--ui', action='store_true', required=False)
 
     args = parser.parse_args()
-
     if args.help:
         print_help_msg_source_scanner()
     if args.version:
@@ -362,9 +361,15 @@ def _collect_kb_file_hashes(
     extra_candidates: list[tuple[SourceItem, str]] = []
 
     for item in scancode_result:
-        if item.is_license_text or is_notice_file(item.source_name_or_path):
+        if item.is_license_text or item.download_location or is_notice_file(item.source_name_or_path):
+            item._cached_kb_md5 = ""
             continue
-        if item.download_location:
+        item_path = item.source_name_or_path
+        if not os.path.isabs(item_path):
+            item_path = os.path.join(path_to_scan, item_path)
+        if is_small_file(item_path):
+            # An empty cached hash means this item is checked and not KB-eligible.
+            item._cached_kb_md5 = ""
             continue
         md5_hash, _wfp = item._get_hash(path_to_scan)
         if md5_hash:
@@ -384,6 +389,8 @@ def _collect_kb_file_hashes(
         if (rel_path in scancode_paths or rel_path in excluded_files
                 or is_excluded_source_filename(rel_path) or is_notice_file(file_path)):
             continue
+        if is_small_file(file_path):
+            continue
         extra_item = SourceItem(rel_path)
         md5_hash, _wfp = extra_item._get_hash(path_to_scan)
         if md5_hash:

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/src/fosslight_source/run_scanoss.py

@@ -10,6 +10,7 @@ import logging
 import json
 from typing import Tuple
 import fosslight_util.constant as constant
+from ._exclude import DEFAULT_SKIP_SMALL_FILE_SIZE
 from ._parsing_scanoss_file import parsing_scan_result  # scanoss
 from ._parsing_scanoss_file import parsing_extra_info  # scanoss
 from scanoss.scanner import Scanner, ScanType
@@ -66,6 +67,7 @@ def run_scanoss_py(path_to_scan: str, output_path: str = "", format: list = [],
         scanner = Scanner(
             ignore_cert_errors=True,
             skip_folders=list(path_to_exclude) if path_to_exclude else [],
+            skip_size=DEFAULT_SKIP_SMALL_FILE_SIZE + 1,
             scan_output=output_json_file,
             scan_options=ScanType.SCAN_SNIPPETS.value,
             nb_threads=num_threads if num_threads > 0 else 10,

{fosslight_source-2.3.13 → fosslight_source-2.3.15/src/fosslight_source.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.13
+Version: 2.3.15
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -55,7 +55,7 @@ Detect the license for the source code.
 Use Source Code Scanner and process the scanner results.
 ```
 
-**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. And removes words such as "-only" and "-old-style" from the license name to be printed. The output result is generated in spreadsheet format.
+**FOSSLight Source Scanner** uses source code scanners, [ScanCode][sc] and [SCANOSS][scanoss]. [ScanCode][sc] detects copyright and license phrases contained in the file and [SCANOSS][scanoss] searches OSS Name, OSS Version, download location, copyright and license information from [OSSKB][osskb]. Some files (ex- build script), binary files, directory and files in specific directories (ex-test) are excluded from the result. The output result is generated in spreadsheet format.
 
 
 [sc]: https://github.com/nexB/scancode-toolkit

{fosslight_source-2.3.13 → fosslight_source-2.3.15}/tests/test_parsing_unknown_spdx.py

@@ -107,8 +107,8 @@ def test_unknown_spdx_in_compound_expression_splits_and_or():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["GPL-2.0", "MIT-like"]
-    assert results[0].comment == "GPL-2.0 OR MIT-like"
+    assert results[0].licenses == ["GPL-2.0-only", "MIT-like"]
+    assert results[0].comment == "GPL-2.0-only OR MIT-like"
 
 
 def test_unknown_spdx_comment_preserves_and_or_from_detected_expression():
@@ -171,7 +171,7 @@ def test_unknown_license_reference_suppressed_when_same_matched_text_has_other_l
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["GPL-2.0"]
+    assert results[0].licenses == ["GPL-2.0-only"]
 
 
 @pytest.mark.parametrize(
@@ -381,7 +381,7 @@ def test_build_comment_from_detected_expression_helper():
         matches,
         _should_suppress_unknown_license_reference(matches, has_other_license),
     )
-    assert comment == "NEW OR DApache-2.0 AND GPL-2.0"
+    assert comment == "NEW OR DApache-2.0 AND GPL-2.0-only"
 
 
 def test_comment_without_parens_uses_operator_before_kept_token():
@@ -554,7 +554,7 @@ def test_ignore_unknown_spdx_when_file_has_spdx_declaration():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["GPL-2.0"]
+    assert results[0].licenses == ["GPL-2.0-only"]
     assert all("unknown" not in lic.lower() for lic in results[0].licenses)
     assert all("tag" not in lic.lower() for lic in results[0].licenses)
 
@@ -604,7 +604,7 @@ def test_spdx_priority_drops_body_rule_matches():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["GPL-2.0"]
+    assert results[0].licenses == ["GPL-2.0-only"]
     # Body singles covered by OR expression are dropped; Detected keeps the OR form.
     assert results[0].comment == "Detected: gpl-2.0 OR bsd-simplified"
 
@@ -852,7 +852,7 @@ def test_spdx_priority_detected_comment_uses_spdx_ids():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["GPL-2.0"]
+    assert results[0].licenses == ["GPL-2.0-only"]
     assert results[0].comment == (
         "Detected: GPL-2.0-only OR BSD-2-Clause, unknown-spdx"
     )