fosslight-source 2.3.9__tar.gz → 2.3.11__tar.gz

{fosslight_source-2.3.9/src/fosslight_source.egg-info → fosslight_source-2.3.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.9
+Version: 2.3.11
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Requires-Dist: setuptools<=80.10.2
 Requires-Dist: pyparsing
 Requires-Dist: scanoss>=1.45.0
 Requires-Dist: XlsxWriter
-Requires-Dist: fosslight_util>=2.2.8
+Requires-Dist: fosslight_util>=2.2.12
 Requires-Dist: PyYAML
 Requires-Dist: wheel>=0.38.1
 Requires-Dist: intbitset
@@ -32,6 +32,7 @@ Requires-Dist: normality==2.6.1
 Requires-Dist: psycopg2-binary>=2.9.10; python_version >= "3.13"
 Requires-Dist: tomli; python_version < "3.11"
 Requires-Dist: tqdm
+Requires-Dist: truststore
 Dynamic: license-file
 
 <!--

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "fosslight_source"
-version = "2.3.9"
+version = "2.3.11"
 description = "FOSSLight Source Scanner"
 readme = "README.md"
 license = "Apache-2.0"
@@ -29,7 +29,7 @@ dependencies = [
     "pyparsing",
     "scanoss>=1.45.0",
     "XlsxWriter",
-    "fosslight_util>=2.2.8",
+    "fosslight_util>=2.2.12",
     "PyYAML",
     "wheel>=0.38.1",
     "intbitset",
@@ -43,6 +43,7 @@ dependencies = [
     "psycopg2-binary>=2.9.10; python_version >= '3.13'",
     "tomli; python_version < '3.11'",
     "tqdm",
+    "truststore",
 ]
 
 [project.optional-dependencies]

fosslight_source-2.3.11/src/fosslight_source/_exclude.py

@@ -0,0 +1,21 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+"""Source-scanner filename excludes (not applied to dependency discovery)."""
+
+from fosslight_util.exclude import is_excluded_filename
+
+# Build/package config noise for license scans.
+EXCLUDE_FILENAME_SOURCE = frozenset({
+    "changelog", "config.guess", "config.sub", "changes", "ltmain.sh",
+    "configure", "configure.ac", "depcomp", "compile", "missing", "makefile",
+    "makefile.am",
+    "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts",
+    "gradlew", "gradlew.bat",
+    "vite.config.ts", "vite.config.js", "vite.config.mts", "vite.config.mjs",
+    "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml",
+})
+
+
+def is_excluded_source_filename(file_path: str) -> bool:
+    return is_excluded_filename(file_path, EXCLUDE_FILENAME_SOURCE)

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_help.py

@@ -45,6 +45,8 @@ _HELP_MESSAGE_SOURCE_SCANNER = f"""
     --hide_progress        Hide the progress bar during scanning
     --kb_url <url>         KB API URL (priority: parameter > KB_URL env > default)
     --kb_token <token>     KB bearer token (priority: parameter > KB_TOKEN env)
+                           HTTPS uses the OS certificate store. Set KB_SSL_VERIFY=false
+                           only if certificate verification must be skipped.
 
     💡 Examples
     ────────────────────────────────────────────────────────────────────

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_kb_client.py

@@ -5,6 +5,8 @@
 
 import json
 import logging
+import os
+import ssl
 import time
 import urllib.error
 import urllib.request
@@ -19,6 +21,31 @@ _SCAN_JOB_POLL_MAX_INTERVAL_SEC = 10.0
 _SCAN_JOB_REQUEST_TIMEOUT_SEC = 30
 _SCAN_JOB_MIN_WAIT_SEC = 300
 _SCAN_JOB_PER_HASH_SEC = 35
+_KB_SSL_VERIFY_FALSE = {"0", "false", "no", "off"}
+_logged_insecure_kb_ssl = False
+
+
+def kb_ssl_verify_enabled() -> bool:
+    raw = os.environ.get("KB_SSL_VERIFY", "true")
+    return raw.strip().lower() not in _KB_SSL_VERIFY_FALSE
+
+
+def create_kb_ssl_context() -> ssl.SSLContext:
+    """TLS context for KB HTTPS. Uses the OS trust store (Windows store, like the browser)."""
+    global _logged_insecure_kb_ssl
+    if not kb_ssl_verify_enabled():
+        if not _logged_insecure_kb_ssl:
+            logger.warning("KB TLS certificate verification is disabled (KB_SSL_VERIFY)")
+            _logged_insecure_kb_ssl = True
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.check_hostname = False
+        ctx.verify_mode = ssl.CERT_NONE
+        return ctx
+    try:
+        import truststore
+        return truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    except ImportError:
+        return ssl.create_default_context()
 
 
 def _kb_request(
@@ -40,7 +67,7 @@ def _kb_request(
     if kb_token:
         request.add_header("Authorization", f"Bearer {kb_token}")
 
-    with urllib.request.urlopen(request, timeout=timeout) as response:
+    with urllib.request.urlopen(request, timeout=timeout, context=create_kb_ssl_context()) as response:
         body = response.read().decode()
         return json.loads(body) if body else {}
 

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_merge.py

@@ -111,7 +111,8 @@ def _get_top_merge_values(scan_items: list, value_getter) -> list:
             normalized_value = _normalize_merge_text(value)
             if normalized_value:
                 values.append(normalized_value)
-    return [value for value, _ in Counter(values).most_common(3)]
+    ranked = sorted(Counter(values).items(), key=lambda entry: (-entry[1], entry[0]))
+    return [value for value, _ in ranked[:3]]
 
 
 def _can_merge_folder(scan_items: list) -> bool:

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_parsing_scancode_file_item.py

@@ -6,8 +6,9 @@
 import os
 import logging
 import re
+from functools import lru_cache
 import fosslight_util.constant as constant
-from fosslight_util.exclude import is_excluded_filename
+from ._exclude import is_excluded_source_filename
 from ._license_matched import MatchedLicense
 from ._scan_item import SourceItem
 from ._scan_item import replace_word
@@ -34,6 +35,7 @@ KEYWORD_SPDX_ID = r'SPDX-License-Identifier\s*[\S]+'
 KEYWORD_DOWNLOAD_LOC = r'DownloadLocation\s*[\S]+'
 KEYWORD_SCANCODE_UNKNOWN = "unknown-spdx"
 KEYWORD_UNKNOWN_LICENSE_REFERENCE = "unknown-license-reference"
+HTTP_URL_PATTERN = re.compile(r'https?://', re.IGNORECASE)
 SPDX_REPLACE_WORDS = ["(", ")"]
 KEY_AND_OR = re.compile(r"(?<=\s)(?:and|or)(?=\s)", re.IGNORECASE)
 KEY_AND_OR_CAPTURE = re.compile(r"(?<=\s)(and|or)(?=\s)", re.IGNORECASE)
@@ -61,25 +63,41 @@ def filter_fsf_copyright_from_gpl_license_text(
     return [c for c in copyrights if FSF_IN_COPYRIGHT not in c.lower()]
 
 
-def _expression_has_non_unknown_license_reference(license_expression: str) -> bool:
+def _expression_has_other_license(license_expression: str) -> bool:
     if not license_expression:
         return False
     for token in split_spdx_expression(license_expression.lower()):
         token = token.strip()
-        if token and KEYWORD_UNKNOWN_LICENSE_REFERENCE not in token:
+        if (
+            token
+            and KEYWORD_UNKNOWN_LICENSE_REFERENCE not in token
+            and token not in REMOVE_LICENSE
+        ):
             return True
     return False
 
 
-def _matched_texts_with_other_licenses(matches: list) -> set:
-    """matched_text values that also produced a non-unknown-license-reference license."""
-    texts = set()
+def _file_has_other_license(matches: list) -> bool:
+    """Return whether a file has a license other than unknown-license-reference."""
     for matched_lic in matches or []:
-        matched_txt = matched_lic.get("matched_text") or ""
         license_expression = matched_lic.get("license_expression") or ""
-        if matched_txt and _expression_has_non_unknown_license_reference(license_expression):
-            texts.add(matched_txt)
-    return texts
+        if _expression_has_other_license(license_expression):
+            return True
+    return False
+
+
+def _matched_text_has_http_url(matched_text: str) -> bool:
+    """Return whether matched text contains an HTTP or HTTPS URL."""
+    return bool(HTTP_URL_PATTERN.search(matched_text or ""))
+
+
+def _should_keep_unknown_license_reference(
+    matched_text: str, has_other_license_in_file: bool
+) -> bool:
+    return (
+        not has_other_license_in_file
+        and _matched_text_has_http_url(matched_text)
+    )
 
 
 def get_error_from_header(header_item: list) -> Tuple[bool, str]:
@@ -424,23 +442,25 @@ def _build_unknown_spdx_replacement_queue(matches: list) -> list[str]:
 
 
 def _should_suppress_unknown_license_reference(
-    matches: list, matched_texts_with_other_licenses: set
+    matches: list, has_other_license_in_file: bool
 ) -> bool:
+    has_unknown_license_reference = False
     for matched_lic in matches or []:
         expr = (matched_lic.get("license_expression") or "").lower()
-        matched_txt = matched_lic.get("matched_text") or ""
-        if (
-            KEYWORD_UNKNOWN_LICENSE_REFERENCE in expr
-            and matched_txt in matched_texts_with_other_licenses
+        if KEYWORD_UNKNOWN_LICENSE_REFERENCE not in expr:
+            continue
+        has_unknown_license_reference = True
+        if _should_keep_unknown_license_reference(
+            matched_lic.get("matched_text") or "", has_other_license_in_file
         ):
-            return True
-    return False
+            return False
+    return has_unknown_license_reference
 
 
 def build_comment_from_detected_expression(
     detected_expression: str,
     matches: list,
-    matched_texts_with_other_licenses: set,
+    suppress_unknown_license_reference: bool,
 ) -> str:
     """
     Rebuild comment from detected expression.
@@ -470,26 +490,35 @@ def build_comment_from_detected_expression(
         )
 
     replacements = _build_unknown_spdx_replacement_queue(matches)
-    suppress_ulr = _should_suppress_unknown_license_reference(
-        matches, matched_texts_with_other_licenses
-    )
     tree = _parse_license_expression_tokens(_tokenize_license_expression(expr))
     if tree is None:
         return ""
     transformed = _transform_license_expr_node(
-        tree, replacements, [0], suppress_ulr
+        tree, replacements, [0], suppress_unknown_license_reference
     )
     return _omit_parens_for_two_license_expression(
         _serialize_license_expr_node(transformed)
     )
 
 
+@lru_cache(maxsize=65536)
 def get_license_expression_spdx(license_expression: str) -> str:
     if not license_expression or not license_expression.strip():
         return ""
     try:
-        from licensedcode.cache import build_spdx_license_expression
-        result = build_spdx_license_expression(license_expression.strip())
+        from licensedcode.cache import (
+            build_spdx_license_expression,
+            get_licenses_db,
+            get_licensing,
+        )
+        expression = license_expression.strip()
+        # licensedcode re-reads the whole license database from disk for every
+        # key it cannot resolve, and then raises anyway. Screen the keys first
+        # so unknown tokens stay cheap.
+        licenses_db = get_licenses_db()
+        if any(key not in licenses_db for key in get_licensing().license_keys(expression)):
+            return ""
+        result = build_spdx_license_expression(expression)
         if result is None:
             return ""
         if isinstance(result, str) and result.lower().startswith("licenseref-"):
@@ -516,7 +545,7 @@ def parsing_scancode(
                 if (not file_path) or is_binary or is_dir:
                     logger.info(f"Skipping {file_path} because it is binary or directory")
                     continue
-                if is_excluded_filename(file_path):
+                if is_excluded_source_filename(file_path):
                     logger.debug(f"Skipping {file_path} because it is an excluded filename")
                     continue
                 result_item = SourceItem(file_path)
@@ -545,7 +574,12 @@ def parsing_scancode(
                 all_matches = []
                 for lic in licenses or []:
                     all_matches.extend(lic.get("matches") or [])
-                matched_texts_with_other_licenses = _matched_texts_with_other_licenses(all_matches)
+                has_other_license_in_file = _file_has_other_license(all_matches)
+                suppress_unknown_license_reference = (
+                    _should_suppress_unknown_license_reference(
+                        all_matches, has_other_license_in_file
+                    )
+                )
                 for lic in licenses or []:
                     matched_lic_list = lic.get("matches", [])
                     for matched_lic in matched_lic_list:
@@ -565,7 +599,9 @@ def parsing_scancode(
                                         continue
                                     if (
                                         KEYWORD_UNKNOWN_LICENSE_REFERENCE in found_lic.lower()
-                                        and matched_txt in matched_texts_with_other_licenses
+                                        and not _should_keep_unknown_license_reference(
+                                            matched_txt, has_other_license_in_file
+                                        )
                                     ):
                                         continue
                                     if KEYWORD_SCANCODE_UNKNOWN in found_lic.lower():
@@ -592,8 +628,10 @@ def parsing_scancode(
                     file.get("percentage_of_license_text", 0) > 90 and not is_source_file
                 )
 
-                result_item.copyright = filter_fsf_copyright_from_gpl_license_text(
-                    copyright_value_list, license_detected, result_item.is_license_text
+                result_item.copyright = sorted(
+                    filter_fsf_copyright_from_gpl_license_text(
+                        copyright_value_list, license_detected, result_item.is_license_text
+                    )
                 )
 
                 if len(license_detected) > 1:
@@ -603,6 +641,7 @@ def parsing_scancode(
                         resolved_unknown_spdx
                         or KEYWORD_SCANCODE_UNKNOWN in detected_expression.lower()
                         or "licenseref-scancode-unknown-spdx" in detected_expression_spdx.lower()
+                        or suppress_unknown_license_reference
                     ):
                         # Prefer non-SPDX expression so unknown-spdx tokens map cleanly.
                         # Comment only for dual-license style expressions that include OR.
@@ -611,7 +650,7 @@ def parsing_scancode(
                             result_item.comment = build_comment_from_detected_expression(
                                 source_expression,
                                 all_matches,
-                                matched_texts_with_other_licenses,
+                                suppress_unknown_license_reference,
                             )
                     else:
                         license_expression = detected_expression_spdx or detected_expression

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_parsing_scanoss_file.py

@@ -5,6 +5,7 @@
 
 import logging
 import fosslight_util.constant as constant
+from ._exclude import is_excluded_source_filename
 from ._scan_item import SourceItem
 from ._scan_item import replace_word
 from typing import Tuple
@@ -39,7 +40,7 @@ def parsing_scan_result(scanoss_report: dict, excluded_files: set = None) -> Tup
 
     for file_path, findings in scanoss_report.items():
         file_path_normalized = file_path.replace('\\', '/')
-        if file_path_normalized in excluded_files:
+        if file_path_normalized in excluded_files or is_excluded_source_filename(file_path_normalized):
             continue
         result_item = SourceItem(file_path)
 

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_scan_item.py

@@ -7,6 +7,7 @@ import os
 import logging
 import re
 import hashlib
+from bisect import insort
 import fosslight_util.constant as constant
 from fosslight_util.oss_item import FileItem, OssItem, get_checksum_sha1
 
@@ -78,13 +79,13 @@ class SourceItem(FileItem):
     def licenses(self, value: list) -> None:
         if value:
             max_length_exceed = False
-            for new_lic in value:
+            for new_lic in sorted(value):
                 if new_lic:
                     if len(new_lic) > MAX_LICENSE_LENGTH:
                         new_lic = new_lic[:MAX_LICENSE_LENGTH]
                         max_length_exceed = True
                     if new_lic not in self._licenses:
-                        self._licenses.append(new_lic)
+                        insort(self._licenses, new_lic)
                         if len(",".join(self._licenses)) > MAX_LICENSE_TOTAL_LENGTH:
                             self._licenses.remove(new_lic)
                             max_length_exceed = True
@@ -180,10 +181,11 @@ class SourceItem(FileItem):
         kb_origin_urls: dict[str, str] | None = None,
     ) -> None:
         self.oss_items = []
+        copyrights = "\n".join(self.copyright)
         if self.download_location:
             for url in self.download_location:
                 item = OssItem(self.oss_name, self.oss_version, self.licenses, url)
-                item.copyright = "\n".join(self.copyright)
+                item.copyright = copyrights
                 item.comment = self.comment
                 self.oss_items.append(item)
         else:
@@ -198,7 +200,7 @@ class SourceItem(FileItem):
                         oss_name, oss_version, download_url = self._apply_kb_origin_url(origin_url)
                         item = OssItem(oss_name, oss_version, self.licenses, download_url)
 
-            item.copyright = "\n".join(self.copyright)
+            item.copyright = copyrights
             item.comment = self.comment
             self.oss_items.append(item)
 

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/_scancode_ignore_binaries.py

@@ -6,12 +6,22 @@
 # so PyPI installs do not need a GitHub git dependency.
 # SPDX-PackageDownloadLocation: https://github.com/aboutcode-org/scancode-plugins/tree/main/misc/scancode-ignore-binaries
 
+import logging
+import multiprocessing
+
 from plugincode.pre_scan import PreScanPlugin
 from plugincode.pre_scan import pre_scan_impl
 from commoncode.cliutils import PluggableCommandLineOption
 from commoncode.cliutils import PRE_SCAN_GROUP
 from typecode.contenttype import get_type
 
+logger = logging.getLogger(__name__)
+
+# Detection costs one get_type() call per file, which reads from disk. On large
+# trees that dominates the pre-scan stage, so spread it over the scan processes.
+PARALLEL_MIN_FILES = 2000
+CHUNK_SIZE = 256
+
 
 @pre_scan_impl
 class IgnoreBinaries(PreScanPlugin):
@@ -32,22 +42,47 @@ class IgnoreBinaries(PreScanPlugin):
     def is_enabled(self, ignore_binaries, **kwargs):
         return ignore_binaries
 
-    def process_codebase(self, codebase, ignore_binaries, **kwargs):
+    def process_codebase(self, codebase, ignore_binaries, processes=1, **kwargs):
         """
         Remove binary Resources from the resource tree.
         """
         if not ignore_binaries:
             return
 
-        resources_to_remove = []
-        for resource in codebase.walk():
-            if not resource.is_file:
+        # Collect first: removing while walking would invalidate the walk.
+        candidates = [
+            (resource.path, resource.location)
+            for resource in codebase.walk()
+            if resource.is_file
+        ]
+        if not candidates:
+            return
+
+        locations = [location for _path, location in candidates]
+        flags = _detect_binaries(locations, processes)
+
+        for (path, _location), binary in zip(candidates, flags):
+            if not binary:
                 continue
-            if is_binary(resource.location):
-                resources_to_remove.append(resource)
+            resource = codebase.get_resource(path)
+            if resource is not None:
+                resource.remove(codebase)
+
+
+def _detect_binaries(locations, processes):
+    """
+    Return a list of booleans, one per location, telling whether it is binary.
+    """
+    if processes and processes > 1 and len(locations) >= PARALLEL_MIN_FILES:
+        try:
+            pool = multiprocessing.Pool(processes)
+        except Exception as ex:
+            logger.debug(f"Parallel binary detection unavailable, using one process: {ex}")
+        else:
+            with pool:
+                return pool.map(is_binary, locations, chunksize=CHUNK_SIZE)
 
-        for resource in resources_to_remove:
-            resource.remove(codebase)
+    return [is_binary(location) for location in locations]
 
 
 def is_binary(location):

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/cli.py

@@ -22,6 +22,7 @@ from fosslight_util.correct import correct_with_yaml
 from fosslight_util.parsing_yaml import SUPPORT_OSS_INFO_FILES
 from .run_scancode import run_scan
 from fosslight_util.exclude import get_excluded_paths
+from ._exclude import EXCLUDE_FILENAME_SOURCE, is_excluded_source_filename
 from .run_scanoss import run_scanoss_py
 from .run_scanoss import get_scanoss_extra_info
 import yaml
@@ -30,7 +31,7 @@ import argparse
 from .run_spdx_extractor import get_spdx_downloads
 from .run_manifest_extractor import get_manifest_licenses
 from ._scan_item import SourceItem, resolve_kb_config, is_notice_file, is_manifest_file
-from ._kb_client import fetch_origin_urls_via_scan_job
+from ._kb_client import create_kb_ssl_context, fetch_origin_urls_via_scan_job
 from fosslight_util.cover import dump_result_log
 from fosslight_util.time import current_timestamp_utc, format_running_time, timestamp_for_filename
 from fosslight_util.oss_item import ScannerItem
@@ -295,7 +296,7 @@ def check_kb_server_reachable(kb_url: str, kb_token: str = "") -> bool:
             request = urllib.request.Request(f"{kb_url}health", method='GET')
             if kb_token:
                 request.add_header('Authorization', f'Bearer {kb_token}')
-            with urllib.request.urlopen(request, timeout=10) as response:
+            with urllib.request.urlopen(request, timeout=10, context=create_kb_ssl_context()) as response:
                 logger.debug(f"KB server is reachable. Response status: {response.status}")
                 return True
         except urllib.error.HTTPError:
@@ -380,7 +381,8 @@ def _collect_kb_file_hashes(
 
     for file_path in tqdm.tqdm(files_to_scan, desc="KB Hashing", disable=hide_progress):
         rel_path = os.path.relpath(file_path, abs_path_to_scan).replace("\\", "/")
-        if rel_path in scancode_paths or rel_path in excluded_files or is_notice_file(file_path):
+        if (rel_path in scancode_paths or rel_path in excluded_files
+                or is_excluded_source_filename(rel_path) or is_notice_file(file_path)):
             continue
         extra_item = SourceItem(rel_path)
         md5_hash, _wfp = extra_item._get_hash(path_to_scan)
@@ -629,7 +631,9 @@ def run_scanners(
                 (excluded_path_with_default_exclusion,
                  excluded_path_without_dot,
                  excluded_files,
-                 cnt_file_except_skipped) = get_excluded_paths(path_to_scan, path_to_exclude_with_filename)
+                 cnt_file_except_skipped) = get_excluded_paths(
+                    path_to_scan, path_to_exclude_with_filename,
+                    exclude_filenames=EXCLUDE_FILENAME_SOURCE)
                 logger.debug(f"Skipped paths count: {len(excluded_path_with_default_exclusion)}")
 
             if not selected_scanner:
@@ -727,7 +731,7 @@ def metadata_collector(path_to_scan: str, excluded_files: set) -> tuple[dict, di
         for file in files:
             file_path = os.path.join(root, file)
             rel_path_file = os.path.relpath(file_path, abs_path_to_scan).replace('\\', '/')
-            if rel_path_file in excluded_files:
+            if rel_path_file in excluded_files or is_excluded_source_filename(rel_path_file):
                 continue
 
             downloads = get_spdx_downloads(file_path)

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source/run_scancode.py

@@ -26,6 +26,11 @@ logger = logging.getLogger(constant.LOGGER_NAME)
 warnings.filterwarnings("ignore", category=FutureWarning)
 _PKG_NAME = "fosslight_source"
 
+_MAX_IN_MEMORY_ENV = "FOSSLIGHT_SCANCODE_MAX_IN_MEMORY"
+_SCANCODE_DEFAULT_MAX_IN_MEMORY = 10000
+_MEMORY_FRACTION_FOR_CODEBASE = 0.4
+_BYTES_PER_RESOURCE = 4096
+
 try:
     from click.core import UNSET as _CLICK_UNSET  # Click >= 8.3
     _HAS_CLICK_UNSET = True
@@ -165,7 +170,7 @@ def _default_scancode_ignore_patterns(
     Directory names use path-based globs (e.g. **/tests/**) so they do not match
     the scan root directory name itself.
     Binary files are excluded separately via scancode --ignore-binaries.
-    EXCLUDE_FILENAME is not passed to ScanCode --ignore: matching many exact
+    EXCLUDE_FILENAME_SOURCE is not passed to ScanCode --ignore: matching many exact
     names on a large tree is slow. Those files are dropped after parsing.
     """
     patterns = {".*"}
@@ -182,6 +187,39 @@ def _default_scancode_ignore_patterns(
     return tuple(sorted(patterns))
 
 
+def _available_memory_bytes() -> int:
+    try:
+        with open("/proc/meminfo") as meminfo:
+            for line in meminfo:
+                if line.startswith("MemAvailable:"):
+                    return int(line.split()[1]) * 1024
+    except OSError:
+        pass
+    try:
+        return os.sysconf("SC_PAGE_SIZE") * os.sysconf("SC_AVPHYS_PAGES")
+    except (AttributeError, ValueError, OSError):
+        return 0
+
+
+def _resolve_max_in_memory() -> int:
+    """
+    Past --max-in-memory resources, ScanCode caches every Resource in its own
+    file under the temp dir, which makes the inventory and every codebase walk
+    disk bound. Raise the threshold to whatever memory allows and let ScanCode
+    keep spilling beyond that.
+    """
+    override = os.environ.get(_MAX_IN_MEMORY_ENV, "").strip()
+    if override:
+        try:
+            return int(override)
+        except ValueError:
+            logger.warning(f"Ignoring invalid {_MAX_IN_MEMORY_ENV}={override}")
+
+    budget = _available_memory_bytes() * _MEMORY_FRACTION_FOR_CODEBASE
+    resolved = int(budget // _BYTES_PER_RESOURCE)
+    return max(resolved, _SCANCODE_DEFAULT_MAX_IN_MEMORY)
+
+
 def run_scan(
     path_to_scan: str, output_file_name: str = "",
     _write_json_file: bool = False, num_cores: int = -1,
@@ -252,9 +290,12 @@ def run_scan(
                     path_to_exclude, abs_path_to_scan
                 )
                 logger.debug(f"Scancode ignore patterns: {len(ignore_tuple)}")
+                max_in_memory = _resolve_max_in_memory()
+                logger.debug(f"Scancode max_in_memory: {max_in_memory}")
 
                 kwargs = {
                     "max_depth": 100,
+                    "max_in_memory": max_in_memory,
                     "strip_root": True,
                     "license": True,
                     "copyright": True,

{fosslight_source-2.3.9 → fosslight_source-2.3.11/src/fosslight_source.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fosslight_source
-Version: 2.3.9
+Version: 2.3.11
 Summary: FOSSLight Source Scanner
 Author: LG Electronics
 License-Expression: Apache-2.0
@@ -20,7 +20,7 @@ Requires-Dist: setuptools<=80.10.2
 Requires-Dist: pyparsing
 Requires-Dist: scanoss>=1.45.0
 Requires-Dist: XlsxWriter
-Requires-Dist: fosslight_util>=2.2.8
+Requires-Dist: fosslight_util>=2.2.12
 Requires-Dist: PyYAML
 Requires-Dist: wheel>=0.38.1
 Requires-Dist: intbitset
@@ -32,6 +32,7 @@ Requires-Dist: normality==2.6.1
 Requires-Dist: psycopg2-binary>=2.9.10; python_version >= "3.13"
 Requires-Dist: tomli; python_version < "3.11"
 Requires-Dist: tqdm
+Requires-Dist: truststore
 Dynamic: license-file
 
 <!--

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source.egg-info/SOURCES.txt

@@ -3,6 +3,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 src/fosslight_source/__init__.py
+src/fosslight_source/_exclude.py
 src/fosslight_source/_help.py
 src/fosslight_source/_kb_client.py
 src/fosslight_source/_license_matched.py
@@ -22,9 +23,11 @@ src/fosslight_source.egg-info/dependency_links.txt
 src/fosslight_source.egg-info/entry_points.txt
 src/fosslight_source.egg-info/requires.txt
 src/fosslight_source.egg-info/top_level.txt
+tests/test_kb_ssl.py
 tests/test_manifest_android_bp.py
 tests/test_manifest_composer.py
 tests/test_manifest_pyproject.py
 tests/test_manifest_recommended_scenarios.py
+tests/test_multi_value_order.py
 tests/test_parsing_unknown_spdx.py
 tests/test_tox.py

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/src/fosslight_source.egg-info/requires.txt

@@ -2,7 +2,7 @@ setuptools<=80.10.2
 pyparsing
 scanoss>=1.45.0
 XlsxWriter
-fosslight_util>=2.2.8
+fosslight_util>=2.2.12
 PyYAML
 wheel>=0.38.1
 intbitset
@@ -11,6 +11,7 @@ lxml>=6.0.1
 fingerprints==1.2.3
 normality==2.6.1
 tqdm
+truststore
 
 [:platform_system == "Darwin" and platform_machine == "x86_64"]
 cryptography<49

fosslight_source-2.3.11/tests/test_kb_ssl.py

@@ -0,0 +1,52 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for KB HTTPS SSL context selection."""
+
+import ssl
+from unittest.mock import patch
+
+from fosslight_source._kb_client import create_kb_ssl_context, kb_ssl_verify_enabled
+
+
+def test_kb_ssl_verify_enabled_default(monkeypatch):
+    monkeypatch.delenv("KB_SSL_VERIFY", raising=False)
+    assert kb_ssl_verify_enabled() is True
+
+
+def test_kb_ssl_verify_disabled_values(monkeypatch):
+    for value in ("false", "0", "no", "OFF"):
+        monkeypatch.setenv("KB_SSL_VERIFY", value)
+        assert kb_ssl_verify_enabled() is False
+
+
+def test_create_kb_ssl_context_insecure(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "false")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode == ssl.CERT_NONE
+    assert ctx.check_hostname is False
+
+
+def test_create_kb_ssl_context_uses_truststore_when_verify_on(monkeypatch):
+    monkeypatch.setenv("KB_SSL_VERIFY", "true")
+    ctx = create_kb_ssl_context()
+    assert ctx.verify_mode != ssl.CERT_NONE
+    assert ctx.check_hostname is True
+
+
+def test_kb_request_passes_ssl_context():
+    from fosslight_source._kb_client import _kb_request
+
+    class _Resp:
+        def read(self):
+            return b"{}"
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+    with patch("fosslight_source._kb_client.urllib.request.urlopen", return_value=_Resp()) as urlopen:
+        _kb_request("https://kb.example/", "health")
+        assert urlopen.call_args.kwargs["context"] is not None
+        assert isinstance(urlopen.call_args.kwargs["context"], ssl.SSLContext)

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/tests/test_manifest_android_bp.py

@@ -49,7 +49,7 @@ def test_merge_results_sets_manifest_flag_without_overwriting_scancode_licenses(
 
     assert len(merged) == 1
     assert merged[0].is_manifest_file is True
-    assert merged[0].licenses == ["Apache-2.0", "MIT", "BSD"]
+    assert merged[0].licenses == ["Apache-2.0", "BSD", "MIT"]
 
 
 def test_merge_results_skips_android_bp_not_in_scancode_result():

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/tests/test_manifest_recommended_scenarios.py

@@ -18,7 +18,7 @@ def test_scenario1_android_bp_keeps_scancode_licenses():
 
     assert len(merged) == 1
     assert merged[0].is_manifest_file is True
-    assert merged[0].licenses == ["Apache-2.0", "unknown-license-reference", "BSD", "MIT", "OFL"]
+    assert merged[0].licenses == ["Apache-2.0", "BSD", "MIT", "OFL", "unknown-license-reference"]
 
 
 def test_scenario2_package_json_manifest_fail_keeps_scancode_licenses():

fosslight_source-2.3.11/tests/test_multi_value_order.py

@@ -0,0 +1,26 @@
+# Copyright (c) 2026 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+"""Stable order for multi-value License / Copyright cells."""
+
+from fosslight_source._merge import _get_top_merge_values
+from fosslight_source._scan_item import SourceItem
+
+
+def test_licenses_are_stored_sorted():
+    item = SourceItem("dummy.c")
+    item.licenses = ["zlib", "mit", "apache-2.0"]
+    assert item.licenses == ["apache-2.0", "mit", "zlib"]
+
+
+def test_top_merge_copyrights_break_count_ties_alphabetically():
+    items = []
+    for text in ["Copyright Z", "Copyright A", "Copyright Z", "Copyright M"]:
+        item = SourceItem("dummy.c")
+        item.copyright = [text]
+        items.append(item)
+
+    assert _get_top_merge_values(items, lambda i: i.copyright) == [
+        "Copyright Z",
+        "Copyright A",
+        "Copyright M",
+    ]

{fosslight_source-2.3.9 → fosslight_source-2.3.11}/tests/test_parsing_unknown_spdx.py

@@ -9,7 +9,9 @@ from fosslight_source._parsing_scancode_file_item import (
     _declared_licenses_from_matched_text,
     build_comment_from_detected_expression,
     parsing_scancode,
-    _matched_texts_with_other_licenses,
+    _file_has_other_license,
+    _matched_text_has_http_url,
+    _should_suppress_unknown_license_reference,
 )
 
 
@@ -126,7 +128,7 @@ def test_unknown_spdx_comment_preserves_and_or_from_detected_expression():
     success, results, _messages, _ = parsing_scancode(scancode_file_list)
 
     assert success is True
-    assert results[0].licenses == ["NEW", "DApache-2.0", "GPL-2.0"]
+    assert results[0].licenses == ["DApache-2.0", "GPL-2.0", "NEW"]
     assert "unknown-license-reference" not in [lic.lower() for lic in results[0].licenses]
     assert results[0].comment == "NEW OR DApache-2.0 AND GPL-2.0"
 
@@ -157,6 +159,168 @@ def test_unknown_license_reference_suppressed_when_same_matched_text_has_other_l
     assert results[0].licenses == ["GPL-2.0"]
 
 
+@pytest.mark.parametrize(
+    "matched_text",
+    [
+        "License terms: http://example.com/license",
+        "License terms: https://example.com/license",
+        "License terms: HTTPS://example.com/license",
+    ],
+)
+def test_unknown_license_reference_kept_when_it_is_only_license_with_url(matched_text):
+    scancode_file_list = [{
+        "path": "reference.txt",
+        "type": "file",
+        "license_detections": [{
+            "matches": [{
+                "license_expression": "unknown-license-reference",
+                "matched_text": matched_text,
+            }],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, license_list = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["unknown-license-reference"]
+    assert [item.matched_text for item in license_list.values()] == [matched_text]
+
+
+@pytest.mark.parametrize("matched_text", ["See the accompanying license", "", None])
+def test_unknown_license_reference_suppressed_without_url(matched_text):
+    scancode_file_list = [{
+        "path": "reference.txt",
+        "type": "file",
+        "license_detections": [{
+            "matches": [{
+                "license_expression": "unknown-license-reference",
+                "matched_text": matched_text,
+            }],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, license_list = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == []
+    assert license_list == {}
+
+
+def test_unknown_license_reference_suppressed_by_other_license_in_same_file():
+    reference_text = "License terms: https://example.com/license"
+    scancode_file_list = [{
+        "path": "mixed.txt",
+        "type": "file",
+        "detected_license_expression": (
+            "unknown-license-reference OR mit OR apache-2.0"
+        ),
+        "license_detections": [{
+            "matches": [
+                {
+                    "license_expression": "unknown-license-reference",
+                    "matched_text": reference_text,
+                },
+                {
+                    "license_expression": "mit",
+                    "matched_text": "Permission is hereby granted, free of charge...",
+                },
+                {
+                    "license_expression": "apache-2.0",
+                    "matched_text": "Licensed under the Apache License, Version 2.0",
+                },
+            ],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, license_list = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["MIT", "Apache-2.0"]
+    assert results[0].comment == "MIT OR Apache-2.0"
+    assert all(
+        item.license != "unknown-license-reference"
+        for item in license_list.values()
+    )
+
+
+def test_unknown_license_reference_filter_is_scoped_to_each_file():
+    reference_text = "License terms: https://example.com/license"
+    scancode_file_list = [
+        {
+            "path": "reference.txt",
+            "type": "file",
+            "license_detections": [{
+                "matches": [{
+                    "license_expression": "unknown-license-reference",
+                    "matched_text": reference_text,
+                }],
+            }],
+            "copyrights": [],
+        },
+        {
+            "path": "mit.txt",
+            "type": "file",
+            "license_detections": [{
+                "matches": [{
+                    "license_expression": "mit",
+                    "matched_text": "Permission is hereby granted, free of charge...",
+                }],
+            }],
+            "copyrights": [],
+        },
+    ]
+
+    success, results, _messages, _license_list = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["unknown-license-reference"]
+    assert results[1].licenses == ["MIT"]
+
+
+def test_only_url_backed_unknown_license_reference_is_reported():
+    valid_text = "License terms: https://example.com/license"
+    invalid_text = "See the accompanying license"
+    scancode_file_list = [{
+        "path": "references.txt",
+        "type": "file",
+        "license_detections": [{
+            "matches": [
+                {
+                    "license_expression": "unknown-license-reference",
+                    "matched_text": invalid_text,
+                },
+                {
+                    "license_expression": "unknown-license-reference",
+                    "matched_text": valid_text,
+                },
+            ],
+        }],
+        "copyrights": [],
+    }]
+
+    success, results, _messages, license_list = parsing_scancode(scancode_file_list)
+
+    assert success is True
+    assert results[0].licenses == ["unknown-license-reference"]
+    assert [item.matched_text for item in license_list.values()] == [valid_text]
+
+
+@pytest.mark.parametrize(
+    ("matched_text", "expected"),
+    [
+        ("http://example.com/license", True),
+        ("HTTPS://example.com/license", True),
+        ("ftp://example.com/license", False),
+        (None, False),
+    ],
+)
+def test_matched_text_has_http_url(matched_text, expected):
+    assert _matched_text_has_http_url(matched_text) is expected
+
+
 def test_licenseref_tokens_stripped_from_unknown_spdx_and_expression():
     scancode_file_list = [{
         "path": "refs.py",
@@ -196,11 +360,11 @@ def test_build_comment_from_detected_expression_helper():
             "matched_text": matched_same,
         },
     ]
-    other_texts = _matched_texts_with_other_licenses(matches)
+    has_other_license = _file_has_other_license(matches)
     comment = build_comment_from_detected_expression(
         "(unknown-spdx OR unknown-spdx) AND unknown-license-reference AND gpl-2.0",
         matches,
-        other_texts,
+        _should_suppress_unknown_license_reference(matches, has_other_license),
     )
     assert comment == "NEW OR DApache-2.0 AND GPL-2.0"
 
@@ -216,7 +380,7 @@ def test_comment_without_parens_uses_operator_before_kept_token():
     comment = build_comment_from_detected_expression(
         "mit OR unknown-license-reference AND apache-2.0",
         matches,
-        {matched_same},
+        True,
     )
     assert comment == "MIT AND Apache-2.0"
 
@@ -232,7 +396,7 @@ def test_comment_with_parens_preserves_or_group():
     comment = build_comment_from_detected_expression(
         "mit OR (unknown-license-reference AND apache-2.0)",
         matches,
-        {matched_same},
+        True,
     )
     assert comment == "MIT OR Apache-2.0"
 
@@ -248,7 +412,7 @@ def test_comment_with_parens_preserves_and_after_group():
     comment = build_comment_from_detected_expression(
         "(mit OR unknown-license-reference) AND apache-2.0",
         matches,
-        {matched_same},
+        True,
     )
     assert comment == "MIT AND Apache-2.0"
 
@@ -337,10 +501,10 @@ def test_android_bp_soong_license_kinds_without_line_comment_in_license():
     licenses = results[0].licenses
     assert licenses == [
         "Apache-2.0",
-        "unknown-license-reference",
         "BSD",
         "MIT",
         "OFL",
+        "unknown-license-reference",
     ]
     assert all("//" not in lic for lic in results[0].licenses)
     assert all('"' not in lic for lic in results[0].licenses)