v5.4.28

SCANOSS Engine v5.4.28

🐛 Fixes

Ignoring a related PURL now suppresses the component (#120)

The ignore list (-b SBOM.json) was only compared against the primary purl of each url record. A project published under several purls (e.g. a GitHub repo also indexed as a golang, nuget or conda package) gets its sibling identities only at report time, so ignoring one of its related purls had no effect: the match survived under its primary identity and the ignored purl reappeared in the reported "purl" array.

• After load_matches() builds the candidate list and before best-match selection, every component whose primary or related purl is in the ignore list is dropped. A non-ignored candidate then wins, or the finding is suppressed when none survive.
• New helpers ignored_purl(), component_ignored_by_purl() and component_list_remove_ignored().
• Only runs when -b is used: zero overhead otherwise.

Snippet fallback when a full-file match is fully ignored

When a file produced a full-file match but every candidate component was removed by the ignore list, the result collapsed to "none", because the snippet pass is skipped for file matches.

• The engine now detects that case and retries once as a snippet scan over the same file, honoring the same ignore/include lists, so a legitimate snippet match can still surface.
• New scan_data_reset() discards the scan results while keeping the scan identity, config and reusable buffers.
• No behavior change unless -b is used and a full-file match is fully filtered.

License normalization buffer overflow (normalize_license)

normalize_license() rewrites a license string in place with its canonical SPDX id (e.g. Apache → Apache-2.0, GPLv2 → GPL-2.0-only), which can be longer than the original text. The buffer was sized to the original length, so normalizing a short alias wrote past its end (heap overflow under valgrind).

• License buffers now reserve at least MAX_NORMALIZED_LICENSE_LN (32) bytes, and the in-place copy is skipped if a canonical id would not fit.

Debian package dependency

The .deb declared libgcrypt20-dev, a build-time package, as a runtime dependency, so dpkg -i failed on hosts without it. It now depends on the runtime library libgcrypt20 (>= 1.9.0).

🔧 Internal

• Regression tests tests/ignore_related_purl/ and tests/snippet_fallback_on_ignore/ (data-driven; they skip without a KB).
• Still requires LDB 4.1 or newer (LDB_TARGET_VERSION unchanged).
• Version bumped to 5.4.28.

Changelog: v5.4.27...v5.4.28 (PRs #126, #127)