Need specific file type pattern option and License Version

[gnchalla]

1. I have many file patterns in my scan area, as of now the tool has an option to ignore those.

--ignore README --ignore ".jar" --ignore ".msb" --ignore ".pl" --ignore ".py" --ignore ".log" --ignore ".loc" --ignore ".1" --ignore ".xml" --ignore ".ref" --ignore ".rsf" --ignore ".ini" --ignore ".pom" --ignore ".rar" --ignore ".html" --ignore ".css" --ignore ".png" --ignore ".xml" --ignore ".nlb" --ignore ".htm" --ignore ".image" --ignore ".gif" --ignore ".po" --ignore ".mo" --ignore ".mak" --ignore ".sh" --ignore ".wsdl" --ignore ".pm" --ignore ".h" --ignore ".pod" --ignore ".map" --ignore ".pls" --ignore ".sql" --ignore ".xsd" --ignore ".cmd" --ignore ".jpg" --ignore ".js" --ignore ".LAYOUT" --ignore ".msg" --ignore ".bat" --ignore ".txt" --ignore ".ctl" --ignore ".cfg" --ignore ".lst" --ignore ".ttf" --ignore ".jsp" --ignore ".ini" --ignore ".tif" --ignore ".info" --ignore ".zip" --ignore ".ear" --ignore ".bmp" --ignore ".LIC" --ignore ".ico" --ignore ".keep" --ignore ".db" --ignore ".doc" --ignore ".lnk" --ignore ".cfs" --ignore ".mkelem" --ignore ".bnd" --ignore "..SAVF" --ignore ".xmit" --ignore ".m" --ignore ".xliff" --ignore ".nls" --ignore ".xlf" --ignore "*.properties"

Instead of ignore option, do we have an option to scan only particular pattern files?
for example want to scan only *.c

2. Do we have an option to get the license version of particular scanned file along with license name,score etc?

Please provide the info.

[pombredanne]

Thanks for the report!

Instead of ignore option, do we have an option to scan only particular pattern files? for example want to scan only *.c

You are right there is a way to ignore/exclude but to include (though the underlying code already supports it

Do we have an option to get the license version of particular scanned file along with license name,score etc?

What do you mean there? each returned license has an exact version when the license is versioned. What are you missing there? Any example?

[gnchalla]

Thanks for the quick reply.

1. On the first requirement, could you provide an option to use pattern search (include) similar to --ignore in the commandline?
2. On the second one,

For example libxml2.so file is in my scan area, which returns the license_key as gpl-1.0-plus,

But usually organizations to have compliance with regards to licensing, they try to buy/get licences for the particular version. In case of libxml2.so, latest version is 2.9.7. so, this version info is not returned by the tool. so is there a way to provide the particular version of the file/binary in the scan report?

please let me know if i need to provide more info. Thanks.

[gnchalla]

Could you please prioritize this requirement?

[pombredanne]

@gnchalla sorry for the late reply, but this was the holiday break

On the first requirement, could you provide an option to use pattern search (include) similar to --ignore in the commandline?

The current architecture for plugins does not support this yet, but will soon once we are done with #787
When this is there, some help would be much welcomed to write such a plugin

For example libxml2.so file is in my scan area, which returns the license_key as gpl-1.0-plus,

This sounds unlikely and could be a false positive. Can you provide a download link to this version of libxml2.so? Also what is the score/coverage and license text when you run the detection as JSON with these extra flags --diag -- license-text ?

But usually organizations to have compliance with regards to licensing, they try to buy/get licences for the particular version.

I am not sure where you can buy libxml! Did someone sold it to you?
I get that you use a certain version and that's the version you need scan info for otherwise.

In case of libxml2.so, latest version is 2.9.7. so, this version info is not returned by the tool. so is there a way to provide the particular version of the file/binary in the scan report?

Well to the best of my knowledge, there is neither a universal nor even a common or conventional way to get the version from an ELF binary. What happens at times is that there is a version string that may be baked in the built binary, but even that string has no specific format. The only way to get proper identification of versions is through matching against a large index of known binaries. This is a compex thing and not a job for ScanCode, but a job for an upcoming tool called MatchCode that will be released as part of the AboutCode tool suite.

[pombredanne]

@gnchalla ping? any feedback on my last comment?

[pombredanne]

@chiragmp FYI this may be a feature you want e.g

Instead of ignore option, do we have an option to scan only particular pattern files? for example want to scan only *.c

or this may be the same as in #1104

[pombredanne]

@gnchalla there is a new option in the develop branch called include that works this way --include="*JGroup*" --ignore "*.S" ... and it is also possible to enter multiple paths arguments .
Thank you for your patience!
I am closing now and your feedback here is welcomed.