FOSSLight Scanner

Analyze at once for Open Source Compliance.

FOSSLight Scanner license: Apache-2.0 Current python package version

FOSSLight Scanner performs open source analysis after downloading the source by passing a link that can be cloned by wget or git. Instead, open source analysis can be performed for the local source path. The output result is generated in FOSSLight Report format.

FOSSLight Source Scanner Extract license and copyright in the source code using ScanCode.
FOSSLight Dependency Scanner Extract dependency and OSS information from the package manager's manifest file.
FOSSLight Binary Scanner Find binary and print OSS information.

Please refer to https://fosslight.org/fosslight-guide/scanner/ for the FOSSLight Scanner User Guide.

FOSSLight Scanner

📋 Prerequisite

FOSSLight Scanner needs a Python 3.10+.

🎉 How to install

It can be installed using pip3. It is recommended to install it in a virtualenv environment.

pip3 install fosslight_scanner

🚀 How to run

FOSSLight Scanner is run with the fosslight command.

fosslight [Mode] [option1] <arg1> [option2] <arg2>...

Parameters

Mode

        all                     Run all scanners(Default)
        source                  Run FOSSLight Source
        dependency              Run FOSSLight Dependency
        binary                  Run FOSSLight Binary
        compare                 Compare two FOSSLight reports

Options:

        -h                      Print help message
        -p <path>               Path to analyze (ex, -p {input_path})
                                 * Compare mode input file: Two FOSSLight reports (supports excel, yaml)
                                   (ex, -p {before_name}.xlsx {after_name}.xlsx)
        -w <link>               Link to be analyzed can be downloaded by wget or git clone
        -f <format>             FOSSLight Report file format (excel, yaml)
                                 * Compare mode result file: supports excel, json, yaml, html
        -o <output>             Output directory or file
        -c <number>             Number of processes to analyze source
        -e <path>               Path to exclude from analysis (files and directories, pattern matching is available)
                                 * IMPORTANT: Always wrap patterns in quotes("") to avoid shell expansion.
                                   Example) fosslight -e "test/abc.py" "*.jar" "test/"
        -r                      Keep raw data
        -t                      Hide the progress bar
        -v                      Print FOSSLight Scanner version
        -s <path>               Path to apply setting from json file (check format with 'tests/fixtures/setting.json' in this repository)
                                 * Direct cli flags have higher priority than setting file
                                   (ex, '-f yaml -s tests/fixtures/setting.json' - result file extension is .yaml)

Refs.
- Additional arguments for running dependency analysis. See the FOSSLight Dependency Guide for instructions.
- In the case of DB URL, it is the DB connection information to be used in FOSSLight Binary.
Pattern matching guide for the -e option
- ⚠️ Make sure to use double quotes ("") when entering values.
  - Example) fosslight -e "test/abc.py" "*.jar" "test/"
- ⚠️ File names and extensions are case-sensitive, so please enter them exactly as intended.

Ex 1. Local Source Analysis

fosslight all -p /home/source_path -d "-a 'source /test/Projects/venv/bin/activate' -d 'deactivate'"

If using additional flags like -d, document them in Options section or link to related guide.

Ex 2. Local Source Analysis with Path to Exclude

fosslight all -p /home/source_path -e "temp_dir" "src/temp.py"

Ex 3. Download Link and analyze

fosslight all -o test_result_wget -w "https://github.com/LGE-OSS/example.git"

If you want to analyze private repository, set your GitHub token like below.

fosslight all -w "https://my_github_token@github.com/Foo/private_repo"

Ex 4. Compare the BOM of two FOSSLight reports

fosslight compare -p FOSSLight_before_proj.yaml FOSSLight_after_proj.yaml -f excel

📁 Result

$ tree
.
├── fosslight_log
│   ├── fosslight_log_20210924_022422.txt
└── FOSSLight-Report_20210924_022422.xlsx

FOSSLight_Report-[datetime].xlsx: OSS Report format file that outputs source code analysis, binary analysis, and dependency analysis results.
fosslight_raw_data_[datetime] directory: Directory in which raw data files are created as a result of analysis

🐳 How to run using Docker

Build image using Dockerfile.

docker build -t fosslight .

Run with the image you built.
ex. Output: /Users/fosslight_source_scanner/test_output, Path to be analyzed: tests/test_files

docker run -it -v /Users/fosslight_source_scanner/test_output:/app/output fosslight -p tests/test_files -o output

👏 How to report issue

Please report any ideas or bugs to improve by creating an issue in fosslight_scanner repository. Then there will be quick bug fixes and upgrades. Ideas to improve are always welcome.

👏 Contributing Guide

We always welcome your contributions. Please see the CONTRIBUTING guide for how to contribute.

📄 License

FOSSLight Scanner is released under Apache-2.0.

Metadata

Release files for fosslight-scanner 2.1.31

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for fosslight-scanner 2.1.31
File	Size	Uploaded
fosslight_scanner-2.1.31.tar.gz	33.3 kB	Sep 17, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for fosslight-scanner 2.1.31
File	Interpreter	ABI	Platform	Reset
fosslight_scanner-2.1.31-py3-none-any.whl 27.1 kB Sep 17, 2026	Python 3	none	any	Details

Total release size: 60.5 kB

Release files / fosslight_scanner-2.1.31.tar.gz

Download URL	fosslight_scanner-2.1.31.tar.gz
Size	33.3 kB
Tags	Source
SHA-256 checksum How to use checksums	`293479276ff4f529ac3c7208765d304c191dcb9c09fe6cbb41cd343be68f32c3`
BLAKE2b-256 checksum How to use checksums	`f9f427a5ac7bddeadad72e686a0a75d3f037e4666a89eac110cecd725dc2fe0d`
Upload date	Sep 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.12.14`

Release files / fosslight_scanner-2.1.31-py3-none-any.whl

Download URL	fosslight_scanner-2.1.31-py3-none-any.whl
Size	27.1 kB
Tags	Python 3
SHA-256 checksum How to use checksums	`5ece16bec0f6ad4ffe49a58e2e8047d2dcf347ad10d116b76f0145b714ea3f62`
BLAKE2b-256 checksum How to use checksums	`7a490c9880a346f2ca6c6e65b0aa9a010c6e9e0dfdb177008c04fdf01c724440`
Upload date	Sep 17, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	No
Uploaded via	`twine/7.0.0 CPython/3.12.14`