fosslight / fosslight_dependency_scanner

FOSSLight Dependency Scanner

[Kor]

FOSSLight Hub

FOSSLight Hub helps you use the open source software compliantly and securely by managing open source, license and also vulnerability. Also it can process the OSC (Open Source Compliance) process by managing BOM for each project and track issues on open source license obligations and vulnerabilities.

Features

• Open Source/License
  • Manage of open source information
  • Manage license restrictions and vulnerabilities
  • Register bulk open source and license
• Compliance Process
  • All-in-one open source compliance process
  • Generate open source notice and verify the disclosed source
  • Issue tracking
• Vulnerability
  • Search vulnerability
  • Monitor vulnerabilities of project (Mailing)
• Self-Check
  • Analyze open source
  • Detect automatically license
  • Check license obligations and vulnerabilities
• SBOM
  • Manage open source and proprietary software
  • Search projects by software
  • Support SPDX (ISO standard)
• Supply Chain
  • Manage 3rd party software
  • Register 3rd party agreement
  • Manage as a project

Documentation

• Release Note
• Change Log
• FOSSLight guide We provide the guide for the installation and how to use it.

Demo site

You can experience FOSSLight Hub through the Demo site.
Please visit the Demo site and try out the many features of the FOSSLight Hub first-hand!

• ID and Password for Demo site are described in FOSSLight guide.

Contributing

We always welcome your contributions. Please see the CONTRIBUTING guide for how to contribute.

License

Copyright (c) 2021 LG Electronics
FOSSLight is released under AGPL-3.0-only.

Contributors

fosslight_dependency_scanner's Issues

Dependency scanner for Gradle doesn't work

Describe the bug
Dependency scanning for the Gradle package manager doesn't work. I have completed all the necessary prerequisites written on https://fosslight.org/fosslight-guide/scanner/2_dependency.html#android-gradle. However when I try to scan a directory containing a build.gradle file, it outputs the error

--- Logging error ---
Traceback (most recent call last):
  File "/usr/lib/python3.8/logging/__init__.py", line 1085, in emit
    msg = self.format(record)
  File "/usr/lib/python3.8/logging/__init__.py", line 929, in format
    return fmt.format(record)
  File "/usr/local/lib/python3.8/dist-packages/coloredlogs/__init__.py", line 1140, in format
    return logging.Formatter.format(self, record)
  File "/usr/lib/python3.8/logging/__init__.py", line 668, in format
    record.message = record.getMessage()
  File "/usr/lib/python3.8/logging/__init__.py", line 373, in getMessage
    msg = msg % self.args
TypeError: not all arguments converted during string formatting
Call stack:
  File "/usr/local/bin/fosslight_dependency", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.8/dist-packages/fosslight_dependency/analyze_dependency.py", line 1098, in main
    logger.error("Fail to generate result file. msg:()", msg)
Message: 'Fail to generate result file. msg:()'
Arguments: ('* There is no item to print in FOSSLight-Report.\n',)
--- Logging error ---
Traceback (most recent call last):
  File "/usr/lib/python3.8/logging/__init__.py", line 1085, in emit
    msg = self.format(record)
  File "/usr/lib/python3.8/logging/__init__.py", line 929, in format
    return fmt.format(record)
  File "/usr/lib/python3.8/logging/__init__.py", line 668, in format
    record.message = record.getMessage()
  File "/usr/lib/python3.8/logging/__init__.py", line 373, in getMessage
    msg = msg % self.args
TypeError: not all arguments converted during string formatting
Call stack:
  File "/usr/local/bin/fosslight_dependency", line 8, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.8/dist-packages/fosslight_dependency/analyze_dependency.py", line 1098, in main
    logger.error("Fail to generate result file. msg:()", msg)
Message: 'Fail to generate result file. msg:()'
Arguments: ('* There is no item to print in FOSSLight-Report.\n',)
### FINISH!! ###

To Reproduce
I'm not sure if I'm getting it right, but dependency-license.* files and license-dependency.* files are all empty in the build/reports/license directory. This seems to be causing the error.

System environment (please complete the following information):

• OS: Ubuntu 20.04
• Python : 3.8

Error while using Android Gradle plugin for dependency scanner

First of all, the official guide page doesn't specify which option one should use in the command line ("-m") for Android Gradle. The guide only shows the option "-m gradle", but it seems like one should use "-m android" in order to properly use the Android Gradle plugin for FOSSLight Dependency Scanner.

Secondly, when I try to scan the dependencies for Android gradle using the command fosslight_dependency -m android, it outputs the error:

### Error Message ###
app/android_dependency_output.txt doesn't exist in this directory.
Please check the below thing first.
  1.Did you run the license-maven-plugin?
  2.Or if your project has the customized build output directory,                     then use '-c' option with your customized build output directory name
    $ fosslight_dependency -c output

The above error occurs even though I completed the plugin setup step for Android Gradle in the following link: https://fosslight.org/fosslight-guide/scanner/2_dependency.html#android-gradle

android gradle 플러그인 링크가 깨진 것 같습니다

https://jcenter.bintray.com/ 링크가 403 에러 뜨는데 레포지토리 확인 부탁 드립니다...!

Support Go package management

Is your feature request related to a problem? Please describe.

Describe the solution you'd like
Would be great if fosslight dependency scanner also supports Go platform as well.

Describe alternatives you've considered
I searched online, and found these two libraries for Go.

• https://github.com/tawesoft/gocomply
• https://github.com/google/go-licenses

Even if I adopt one of these, I have to re-organize the result to import them to Fosslight anyway.

Additional context

Dependency scanner for pub can't load Copyright Text

Describe the bug
I'm using dependency_scanner for my flutter project. I 'm generate oss license file like below

When i run fosslight_dependency_scanner, this software generate file without copyright text. I don't know why because my dart file have license text. Is there any other reason?

NPM ls returns an error, breaking the script

Describe the bug
The package fails, because npm ls -a will return a non-zero code if any dependencies are missing or misaligned. I currently use Yarn, and license-checker works fine without issue. However, this package seems to use npm ls to get a list of all packages, to build the output. Even though my software works fine, while some packages are still outdated, npm ls willl error, making this package unusable.

To Reproduce
Currently my packages having issues, is google-maps-react which is running at a lower version than the react version its attached to, react 18.
So install

• google-map-react@^1.1.7
• react@^17.0.2

Expected behavior
Intended usage of npm ls aside, for the usage it has in this package, the error doesnt mean anything. The list is there, it is complete, and thus the error should not impact this package.

System environment (please complete the following information):

• OS: Ubuntu 22
• Python : python3.8

Allow to output the SPDX identifier

Describe the solution you'd like
Can we have some sort of a lookup to make sure that license output matches SPDX codes?
As this is the standard, I assume that a lot of people will be wanting to use this

Describe alternatives you've considered
Writing my own lookup, but that seems redundant

Additional context
Add any other context or screenshots about the feature request here.