Contributor
Rajul Jha

Improving Fossology CI Scanner


Mentors
Gaurav Mishra, Shaheem Azmal M MD, Avinal Kumar, Kaushlendra
Organization
FOSSology
Technologies
python, docker, ci, CycloneDX, ORT
Topics
automation, license compliance, copyright scanning
To be able to easily and continuously scan packages with fossology checks in CI pipelines, a docker image (fossology/fossology:scanner) capable of running license checks (using nomos or ojo) and keyword and copyright scans is available. The motivation for this proposal is to improve the CI Scanner Image in various aspects and numerous quality of life improvements, like highlighting the exact location of violation, ability to customize the keywords used by the scanner, and improving user experience – allow whitelisting from a custom location and ability to download and scan dependencies. The major goals of the project are: 1. Ability to highlight the exact location (line number) of a violation during reporting 2. Allow users to customize keyword scanning using their own keyword.conf 3. Allow users to store allowlist.json file elsewhere (currently, it is required to be present at the root of the project) 4. Allow users to download and scan dependencies by providing a path at CI/CD pipeline trigger.