Skip to content

v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jul 20:14
· 59 commits to main since this release
v0.4.0
27d4e05

Changelog

Added

  • config — store api-url, api-key, proxy and ca-cert in
    ~/.scanoss/settings.json instead of repeating flags: config set, get, list, unset,
    path. The API key is never displayed. Every setting resolves as
    flag > SCANOSS_<KEY> > config file > default.
  • --proxy and --ca-cert on every command that reaches the API. --proxy overrides
    HTTP_PROXY/HTTPS_PROXY for one run and honours NO_PROXY; --ca-cert adds a PEM file's
    certificates to the system pool, verification still on. PAC is not supported.
  • scanoss.NewHTTPClient builds an *http.Client with the same proxy and CA settings.
  • --min-size / --max-size on scan and wfp, and --all-hidden to include dotfiles
    (version-control metadata stays excluded).
  • --default-filters, --gitignore and --settings on wfp, so it collects files exactly
    the way scan does. --settings on dependencies likewise.
  • SDK: filter.FingerprintOptions, filter.DependencyOptions, filter.HiddenSource,
    settings.FingerprintFilter(), settings.DependencyFilter().

Changed

  • Files under 100 bytes are no longer skipped.
  • pkg/filter is the single source of filtering rules, applied once during collection. The
    fingerprint layer no longer filters, so GenerateWFP and GenerateFingerprint fingerprint
    whatever they are given — a caller passing a list that did not come from collection now gets
    every file. This is the only change here that fails silently rather than at compile time.
  • SDK, breaking — removed: wfp.ShouldSkipFile, filter.NewMatcher,
    filter.DefaultSkippedDirs, filter.IngestOptions, and filter.Defaults'
    MinSize/MaxSize. Use filter.Build(filter.DefaultSource(filter.StdDefaults())) plus
    manifests.Is to compose rules; filter.CommonSkippedDirs /ScanOnlySkippedDirs
    /DependencyOnlySkippedDirs; filter.DependencyOptions; and filter.Options.MinSize/MaxSize.
    Callers starting from DefaultOptions/ScanOptions need no change.

Fixed

  • Version-control metadata is never collected. .git could be fingerprinted and uploaded when
    the built-in filters and the hidden rule were both off — including .git/config, which can carry
    credentials.
  • License identifiers are validated against the SPDX list. A non-canonical id is normalised;
    an unrecognised one, or a malformed expression, becomes a declared LicenseRef instead of
    producing an SBOM that fails validation.
  • SBOM packages carry the component name, not the full PURL. CycloneDX gained a
    serialNumber, and the tool version moved to its own field.
  • results returns the same inventory as scan, so a resumed scan can be rendered and
    converted. It accepts --format and --include.
  • --default-filters=false really disables them — extension-skipped files were dropped anyway
    by a second, uncounted filter in the fingerprint layer.
  • dependencies honours scanoss.json and reports what it filtered; scan --include deps
    and dependencies no longer disagree over examples/. A skip rule now also overrules the
    manifest exemption, so excluding a manifest by name works.
  • --min-size/--max-size were ignored together with --default-filters=false.
  • Zero-byte files and symbolic links are no longer fingerprinted, and the raw format emits
    "components": [] rather than null when nothing matched.

Install

Prebuilt binary: download the archive for your platform below, extract it,
and move scanoss-cli onto your PATH. On Linux (amd64):

tar xzf scanoss-cli-linux-amd64.tar.gz
sudo mv scanoss-cli /usr/local/bin/

Verify a download against checksums.txt:

sha256sum -c --ignore-missing checksums.txt

Go:

go install github.com/scanoss/scanoss.go/cmd/scanoss-cli@latest

See the README and
CLIENT_HELP.md
to get started.

Assets 21
Loading