fosslight / fosslight_source_scanner

FOSSLight Source Scanner

[Kor]

FOSSLight Hub

FOSSLight Hub helps you use the open source software compliantly and securely by managing open source, license and also vulnerability. Also it can process the OSC (Open Source Compliance) process by managing BOM for each project and track issues on open source license obligations and vulnerabilities.

Features

• Open Source/License
  • Manage of open source information
  • Manage license restrictions and vulnerabilities
  • Register bulk open source and license
• Compliance Process
  • All-in-one open source compliance process
  • Generate open source notice and verify the disclosed source
  • Issue tracking
• Vulnerability
  • Search vulnerability
  • Monitor vulnerabilities of project (Mailing)
• Self-Check
  • Analyze open source
  • Detect automatically license
  • Check license obligations and vulnerabilities
• SBOM
  • Manage open source and proprietary software
  • Search projects by software
  • Support SPDX (ISO standard)
• Supply Chain
  • Manage 3rd party software
  • Register 3rd party agreement
  • Manage as a project

Documentation

• Release Note
• Change Log
• FOSSLight guide We provide the guide for the installation and how to use it.

Demo site

You can experience FOSSLight Hub through the Demo site.
Please visit the Demo site and try out the many features of the FOSSLight Hub first-hand!

• ID and Password for Demo site are described in FOSSLight guide.

Contributing

We always welcome your contributions. Please see the CONTRIBUTING guide for how to contribute.

License

Copyright (c) 2021 LG Electronics
FOSSLight is released under AGPL-3.0-only.

Contributors

fosslight_source_scanner's Issues

fosslight_source 특정 폴더 제외 옵션 추가

Is your feature request related to a problem? Please describe.
fosslight_source 수행 시 불필요한 폴더가 포함되어 있을 때 폴더를 제외할 수 없어서 분석 시간이 오래 걸리는 이슈가 있습니다.

Describe the solution you'd like
가능하다면 분석 폴더 내 분석 제외할 폴더를 정의할 수 있는 옵션이 있었으면 좋겠습니다.

fetch the base-check-commit-message.yml from the .github

Is your feature request related to a problem? Please describe.

• The current workflows have a significant amount of redundancy in checking commit messages.
• I am planning to abstract and refine the workflow by separating the code from repositorys in fosslight ans use separated codes in fosslight repositorys
• Related Issue: fosslight/.github#1

Describe the solution you'd like
I want to fetch the base-check-commit-message.yml file from the .github repository and replace it with the following code.

check-commit-message:
  name: Check Commit Message
  runs-on: ubuntu-latest
  steps:
    - name: Get PR Commits
      id: 'get-pr-commits'
      uses: tim-actions/get-pr-commits@master
      with:
        token: ${{ secrets.GITHUB_TOKEN }}
    - name: Check Subject Line Length
      uses: tim-actions/[email protected]
      with:
        commits: ${{ steps.get-pr-commits.outputs.commits }}
        pattern: '^.{0,50}(\n.*)*$'
        error: 'Subject too long (max 50)'
    - name: Check Body Line Length
      if: ${{ success() || failure() }}
      uses: tim-actions/[email protected]
      with:
        commits: ${{ steps.get-pr-commits.outputs.commits }}
        pattern: '^.+(\n.{0,72})*$'
        error: 'Body line too long (max 72)'

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like
A clear and concise description of what you want to happen.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

If there is no internet, the scanner cannot run.

Describe the bug
If there is no internet, the scanner cannot run.

To Reproduce
After installing the scanner, disconnect the internet connection and run it.

Expected behavior
Please let the scanner run even when there is no internet connection.

System environment (please complete the following information):

• OS: Mac OS
• Python :python3.6

-p (analysis path) does not work when running with Docker.

Describe the bug
When running with Docker, the analysis path is fixed to the tests folder of fosslight_source.

Expected behavior
The path entered with -p should be analyzed.

There is no output with the f option.

Describe the bug
There is no output with the f option.

To Reproduce
fosslight_source -p ~/tests -f opossum

Expected behavior
The result should be in opossum format.

fosslight_source Job 옵션 추가 가능 여부

Is your feature request related to a problem? Please describe.
개발 서버에서 fosslight_source 분석 시 16 Core 서버의 CPU성능을 모두 분석에 적용하는 것을 확인하였습니다.
해당 스캐너가 몇 Jobs로 적용되는지 궁금합니다.
필요에 따라 시간이 오래 걸리더라도 타 인원이 사용 시 문제가 없도록 서버의 성능에 따라 CPU Core Job을 수정하고 싶습니다.

Describe the solution you'd like
--job 옵션을 통해 본인이 원하는 Job 갯수를 적을 수 있도록 옵션에 넣어주셨으면 좋겠습니다.
job 옵션은 Optional 항목으로 적용하여 설정을 안할 경우에는 지금의 Job 갯수로 디폴트로 수행되도록 하였으면 합니다.

Request for improvement of "debconf: delaying package configuration, since apt-utils is not installed" issue when building with docker

Describe the bug
Request for improvement of "debconf: delaying package configuration, since apt-utils is not installed" issue when building with docker.
Add the following to your Dockerfile.

Related Links: https://velog.io/@khh180cm/%EB%8F%84%EC%BB%A4-%EB%B9%8C%EB%93%9C-%EC%97%90%EB%9F%AC

RUN apt-get update && apt-get install -y --no-install-recommends
vim
apt-utils
&& rm -rf /var/lib/apt/lists/*

To Reproduce
Steps to reproduce the behavior:

Expected behavior
A clear and concise description of what you expected to happen.

System environment (please complete the following information):

• OS: [e.g. Ubuntu 16.04, Windows, Mac OS]
• Python : [e.g. python3.7]

Additional context
Please add the part to download the fosslight source code from git to the fosslight docker installation guide.

For beginners, unlike pip installation, in the case of docker, it seems that you may not know which file to receive or where to perform it.

0. Please download the fosslight source scanner source code.
   git clone https://github.com/fosslight/fosslight_source_scanner.git

pip installation error

Describe the bug
An error was observed while installing Fosslight source

ERROR: Could not find a version that satisfies the requirement typecode_libmagic (from fosslight-source) (from versions: none)
ERROR: No matching distribution found for typecode_libmagic

To Reproduce
Install Fosslight source with command following

pip install fosslight-source
or
pip3 install fosslight-source

System environment (please complete the following information):

• OS: Mac OS Big Sur
• Python : 3.9.5

Docker Image Optimization

Is your feature request related to a problem? Please describe.
Docker Image Optimization
Related issue: fosslight/fosslight#601

Describe the solution you'd like

• Change Base Image
• Minimize Layers
• Cleanup Unnecessary Files
• Avoid Installing Unnecessary Packages
• Additional context

Additional context

• Please compare the difference in image size before and after optimization