v5.4.27

SCANOSS Engine v5.4.27

🚀 Improvements

-P, --purl command — source paths (oss_path)

The file-MD5 lookup now returns, in addition to the purls, url hashes and best KB rank, the source path of each url hash in a new oss_path JSON field.

• New url_hash_t structure that keeps each hash together with its path, so they stay aligned when the list is sorted.
• The path is decrypted from the file table and the leading version-bearing directory is stripped (e.g. libfoo-1.2.3/src/a.c → src/a.c), applying the same rule as fill_component_path.

-C, --url-hash command — multiple components and simplified output

• Now accepts a single url hash or a comma-separated list, returning the details of one or more components.
• Simplified output in this mode: removed the latest field and the enrichment blocks (licenses, health, dependencies, copyrights and vulnerabilities), which don't apply to this direct lookup.
• Removed the workaround that pointed file_md5_ref to url_md5 (no longer needed).

🐛 Fixes

License report fix (osadl_print_license)

Fixes a JSON corruption when printing OSADL licenses:

• Only flat license entries are accepted. If the object contains a nested object (a structural key, such as the top-level "licenses"), it is skipped instead of copied, avoiding the unbalanced braces that broke the JSON.
• More robust handling when the opening { character is not found (prevents a possible null dereference).

🔧 Internal

• look_for_version() is no longer static and is now exposed in component.h for reuse in purl_scan.c.
• Help text (-P and -C) updated to reflect the new behavior.
• Version bumped to 5.4.27.

Changelog: v5.4.26...v5.4.27 (PRs #116, #117)