fosslight-source 2.3.5__tar.gz → 2.3.7__tar.gz

{fosslight_source-2.3.5/src/fosslight_source.egg-info → fosslight_source-2.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.5
+Version: 2.3.7
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_source"
-version = "2.3.5"
+version = "2.3.7"
 description = "FOSSLight Source Scanner"
 readme = "README.md"
 license = "Apache-2.0"

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/src/fosslight_source/_scan_item.py

@@ -18,6 +18,7 @@ _notice_filename = ['licen[cs]e[s]?', 'notice[s]?', 'legal', 'copyright[s]?', 'c
 _manifest_filename = [
     r'.*\.pom$',
     r'package\.json$',
+    r'composer\.json$',
     r'setup\.py$',
     r'setup\.cfg$',
     r'pyproject\.toml$',

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/src/fosslight_source/cli.py

@@ -219,13 +219,13 @@ def create_report_file(
             scan_item.set_cover_comment("(No OSS detected.)")
 
     if scanoss_skipped:
-        is_kb_success = run_kb_msg != "" and "Completed" in run_kb_msg
+        is_kb_success = run_kb_msg != "" and run_kb_msg.endswith("Completed")
         if is_kb_success:
             scan_item.set_cover_comment("SCANOSS replaced with KB")
         else:
             scan_item.set_cover_comment("SCANOSS skipped")
 
-    if run_kb_msg:
+    if run_kb_msg and not run_kb_msg.endswith("Completed"):
         scan_item.set_cover_comment(run_kb_msg)
     display_mode = selected_scanner
     if selected_scanner == ALL_MODE:

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/src/fosslight_source/run_manifest_extractor.py

@@ -74,6 +74,43 @@ def get_licenses_from_package_json(file_path: str) -> list[str]:
     return unique
 
 
+def get_licenses_from_composer_json(file_path: str) -> list[str]:
+    """Extract licenses from Composer ``composer.json`` ``license`` field.
+
+    Composer schema allows a string or an array of strings
+    (SPDX identifiers / expressions).
+    """
+    try:
+        with open(file_path, 'r', encoding='utf-8') as f:
+            data = json.load(f)
+    except Exception as ex:
+        logger.info(f"Failed to read composer.json {file_path}: {ex}")
+        return []
+
+    if not isinstance(data, dict):
+        return []
+
+    licenses: list[str] = []
+    license_field = data.get('license')
+
+    def append_license_value(value) -> None:
+        if isinstance(value, str):
+            token = value.strip()
+            if token:
+                licenses.extend(_split_spdx_expression(token))
+        elif isinstance(value, list):
+            for item in value:
+                append_license_value(item)
+
+    append_license_value(license_field)
+
+    unique: list[str] = []
+    for lic in licenses:
+        if lic not in unique:
+            unique.append(lic)
+    return unique
+
+
 def get_licenses_from_setup_cfg(file_path: str) -> list[str]:
     try:
         import configparser
@@ -323,6 +360,12 @@ def get_manifest_licenses(file_path: str) -> list[str]:
         except Exception as ex:
             logger.info(f"Failed to extract license from package.json {file_path}: {ex}")
             return []
+    elif os.path.basename(file_path).lower() == 'composer.json':
+        try:
+            return get_licenses_from_composer_json(file_path)
+        except Exception as ex:
+            logger.info(f"Failed to extract license from composer.json {file_path}: {ex}")
+            return []
     elif os.path.basename(file_path).lower() == 'setup.cfg':
         try:
             return get_licenses_from_setup_cfg(file_path)

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/src/fosslight_source/run_scanoss.py

@@ -59,6 +59,7 @@ def run_scanoss_py(path_to_scan: str, output_path: str = "", format: list = [],
     if os.path.exists(output_json_file):
         os.remove(output_json_file)
 
+    output_buffer = io.StringIO()
     try:
         logger.debug(f"|---Running SCANOSS on {path_to_scan}")
         scanoss_settings = ScanossSettings()
@@ -69,22 +70,76 @@ def run_scanoss_py(path_to_scan: str, output_path: str = "", format: list = [],
             scan_options=ScanType.SCAN_SNIPPETS.value,
             nb_threads=num_threads if num_threads > 0 else 10,
             scanoss_settings=scanoss_settings,
-            timeout=timeout
+            timeout=timeout,
+            retry=0
         )
-        output_buffer = io.StringIO()
+
+        # Check API connectivity & API Limit using dummy WFP POST
+        try:
+            logger.debug(f"|---Checking SCANOSS API connectivity to {scanner.scanoss_api.url}")
+            dummy_wfp = "file=72214db4e1e543018d1bafe86ea3b444,21,dummy.txt\nfh2=b200cd2eff5d535886e598b3a833aab5\n"
+            ping_response = scanner.scanoss_api.session.post(
+                scanner.scanoss_api.url,
+                files={'file': ('dummy.wfp', dummy_wfp)},
+                headers=scanner.scanoss_api.headers,
+                timeout=5
+            )
+            if ping_response.status_code != 200:
+                response_text = ping_response.text.lower()
+                is_limit = ping_response.status_code in [429, 503]
+                is_limit = is_limit or "rate limit" in response_text
+                is_limit = is_limit or "limits being exceeded" in response_text
+                if is_limit:
+                    logger.debug(f"[SCANOSS] API Limit Exceeded: HTTP {ping_response.status_code}")
+                elif ping_response.status_code in [401, 403]:
+                    logger.debug(f"[SCANOSS] Authentication Failed: HTTP {ping_response.status_code}")
+                else:
+                    logger.debug(f"[SCANOSS] API is not ready: HTTP {ping_response.status_code}")
+                scanoss_skipped = True
+                return scanoss_file_list, scanoss_skipped
+        except Exception as ping_error:
+            logger.debug(f"[SCANOSS] Connection failed to {scanner.scanoss_api.url}: {ping_error}")
+            scanoss_skipped = True
+            return scanoss_file_list, scanoss_skipped
+
         with contextlib.redirect_stdout(output_buffer), contextlib.redirect_stderr(output_buffer):
             scanner.scan_folder_with_options(scan_dir=path_to_scan)
-        captured_output = output_buffer.getvalue()
-        api_limit_exceed = "due to service limits being exceeded" in captured_output
-        timeout_occurred = "The SCANOSS API request timed out" in captured_output
+    except Exception as error:
+        logger.debug(f"SCANOSS execution failed: {error}")
+
+    captured_output = output_buffer.getvalue()
+    if captured_output:
+        for line in captured_output.splitlines():
+            line_strip = line.strip()
+            if line_strip.startswith("ERROR:") or "rejected" in line_strip:
+                logger.debug(f"[SCANOSS] {line_strip}")
+
+        api_limit_patterns = [
+            "due to service limits being exceeded",
+            "service limits/rate limit being exceeded",
+            "Rate limit exceeded",
+            "HTTP 429"
+        ]
+        timeout_patterns = [
+            "The SCANOSS API request timed out",
+            "Service unavailable (HTTP 503)",
+            "The SCANOSS API is currently unavailable",
+            "ConnectionError communicating with",
+            "The SCANOSS API request failed",
+            "Connection aborted",
+            "RemoteDisconnected"
+        ]
+        api_limit_exceed = any(p in captured_output for p in api_limit_patterns)
+        timeout_occurred = any(p in captured_output for p in timeout_patterns)
         if timeout_occurred or api_limit_exceed:
             scanoss_skipped = True
-            if timeout_occurred:
-                logger.debug("SCANOSS skipped (Timeout)")
-            elif api_limit_exceed:
+            if api_limit_exceed:
                 logger.debug("SCANOSS skipped (API Limit Exceeded)")
+            elif timeout_occurred:
+                logger.debug("SCANOSS skipped (Timeout)")
 
-        if os.path.isfile(output_json_file):
+    if os.path.isfile(output_json_file):
+        try:
             logger.debug("|---SCANOSS Parsing")
             with open(output_json_file, "r") as st_json:
                 st_python = json.load(st_json)
@@ -96,8 +151,8 @@ def run_scanoss_py(path_to_scan: str, output_path: str = "", format: list = [],
             with open(output_json_file, "r") as st_json:
                 st_python = json.load(st_json)
                 scanoss_file_list = parsing_scan_result(st_python, excluded_files)
-    except Exception as error:
-        logger.debug(f"SCANOSS Parsing {path_to_scan}: {error}")
+        except Exception as error:
+            logger.debug(f"SCANOSS Parsing {path_to_scan}: {error}")
 
     if not write_json_file:
         if os.path.isfile(output_json_file):

{fosslight_source-2.3.5 → fosslight_source-2.3.7/src/fosslight_source.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.5
+Version: 2.3.7
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0

{fosslight_source-2.3.5 → fosslight_source-2.3.7}/src/fosslight_source.egg-info/SOURCES.txt

@@ -22,4 +22,5 @@ src/fosslight_source.egg-info/dependency_links.txt
 src/fosslight_source.egg-info/entry_points.txt
 src/fosslight_source.egg-info/requires.txt
 src/fosslight_source.egg-info/top_level.txt
+tests/test_manifest_composer.py
 tests/test_tox.py

fosslight_source-2.3.7/tests/test_manifest_composer.py

@@ -0,0 +1,53 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for composer.json manifest license extraction."""
+
+from fosslight_source._scan_item import is_manifest_file
+from fosslight_source.run_manifest_extractor import (
+    get_licenses_from_composer_json,
+    get_manifest_licenses,
+)
+
+
+def test_is_manifest_file_recognizes_composer_json():
+    assert is_manifest_file("/tmp/project/composer.json") is True
+    assert is_manifest_file("/tmp/project/Composer.JSON") is True
+
+
+def test_get_licenses_from_composer_json_string(tmp_path):
+    path = tmp_path / "composer.json"
+    path.write_text('{"name": "acme/demo", "license": "MIT"}', encoding="utf-8")
+    assert get_licenses_from_composer_json(str(path)) == ["MIT"]
+
+
+def test_get_licenses_from_composer_json_array(tmp_path):
+    path = tmp_path / "composer.json"
+    path.write_text(
+        '{"name": "acme/demo", "license": ["LGPL-2.1-only", "GPL-3.0-or-later"]}',
+        encoding="utf-8",
+    )
+    assert get_licenses_from_composer_json(str(path)) == [
+        "LGPL-2.1-only",
+        "GPL-3.0-or-later",
+    ]
+
+
+def test_get_licenses_from_composer_json_spdx_expression(tmp_path):
+    path = tmp_path / "composer.json"
+    path.write_text(
+        '{"name": "acme/demo", "license": "(MIT OR Apache-2.0)"}',
+        encoding="utf-8",
+    )
+    assert get_licenses_from_composer_json(str(path)) == ["MIT", "Apache-2.0"]
+
+
+def test_get_manifest_licenses_dispatches_composer_json(tmp_path):
+    path = tmp_path / "composer.json"
+    path.write_text('{"license": "BSD-3-Clause"}', encoding="utf-8")
+    assert get_manifest_licenses(str(path)) == ["BSD-3-Clause"]
+
+
+def test_get_licenses_from_composer_json_missing_license(tmp_path):
+    path = tmp_path / "composer.json"
+    path.write_text('{"name": "acme/demo"}', encoding="utf-8")
+    assert get_licenses_from_composer_json(str(path)) == []