Skip to content

Commit 3a00319

Browse files
JeffreyHuynh1JeffreyHuynh1
authored
Strict mode (#1463)
* Strict mode
1 parent 968ed2d commit 3a00319

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+284
-150
lines changed

‎Changelog.md

+3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
# FOSSA CLI Changelog
22

3+
## 3.9.34
4+
5+
- `--strict`: Users can now enable strict mode for analysis. ([#1463](https://github.com/fossas/fossa-cli/pull/1463))
36

47
## 3.9.33
58

‎docs/references/strategies/README.md

+15-1
Original file line numberDiff line numberDiff line change
@@ -129,12 +129,26 @@ With this option enabled, strategies that don't offer a way to analyze staticall
129129

130130
It is important to note that neither type of strategy has an inherent benefit when detecting dependencies. If a supported language has only a static or only a dynamic strategy, this does not mean it is less supported than a language that has both.
131131

132+
## Strict Analysis
133+
134+
Strict analysis enforces the use of the most accurate strategy for detecting dependencies, ensuring precise and consistent results by rejecting fallback methods that may offer less reliable detection.
135+
136+
For example, in Maven projects, FOSSA CLI attempts analysis with the following strategy order:
137+
138+
1. Run the [mavenplugin](../strategies/languages/maven/mavenplugin.md) strategy, which provides the most accurate dependency information.
139+
2. If that fails, it attempts the [treecmd](../strategies/languages/maven/treecmd.md) strategy, which parses the output of the `mvn dependency:tree` command.
140+
3. Finally, it falls back to the [pomxml](../strategies/languages/maven/pomxml.md) strategy, scanning pom.xml files for dependencies.
141+
142+
However, with the `--strict` flag, only the `mavenplugin` strategy will be used. If the `mavenplugin` command fails, FOSSA will not attempt the `treecmd` or `pomxml` methods. This ensures that your Maven analysis relies solely on the most precise and validated strategy.
143+
144+
Invoke strict analysis with the `--strict` flag when running `fossa analyze`.
145+
132146
### Strategies by type
133147

134148
> If the FOSSA CLI is forced to utilize a fallback strategy, meaning it did not detect ideal results, a warning is emitted in the scan summary after running `fossa analyze`.
135149
136150
| Language/Package Manager | Dynamic | Static | Detect Vendored Code | Primary Strategy |
137-
| ----------------------------------------------------------------------------------------------------------------------------------------------- | --------- | --------- | -------------------- | ---------------- |
151+
|-------------------------------------------------------------------------------------------------------------------------------------------------|-----------|-----------|----------------------|------------------|
138152
| [C#](https://github.com/fossas/fossa-cli/tree/master/docs/references/strategies/languages/dotnet) | ✅ | ✅ | ❌ | Dynamic |
139153
| [C](https://github.com/fossas/fossa-cli/tree/master/docs/references/strategies/languages/c-cpp/c-cpp.md) | :warning: | :warning: | ✅ | None |
140154
| [C++](https://github.com/fossas/fossa-cli/tree/master/docs/references/strategies/languages/c-cpp/c-cpp.md) | :warning: | :warning: | ✅ | None |

‎docs/references/subcommands/analyze.md

+23-22
Original file line numberDiff line numberDiff line change
@@ -13,26 +13,26 @@ For supported command-line flags, use `fossa analyze --help`
1313

1414
In addition to the [usual FOSSA project flags](#common-fossa-project-flags) supported by all commands, the analyze command supports the following FOSSA-project-related flags:
1515

16-
| Name | Short | Description |
17-
| ------------------------------------- | ----- | ----------------------------------------------------------------------------------- |
18-
| `--title 'some title'` | `-t` | Set the title of the FOSSA project |
19-
| `--branch 'some branch'` | `-b` | Override the detected FOSSA project branch |
20-
| `--project-url 'https://example.com'` | `-P` | Add a URL to the FOSSA project |
21-
| `--jira-project-key 'some-key'` | `-j` | Add a Jira project key to the FOSSA project |
22-
| `--link 'https://example.com'` | `-L` | Attach a link to the current FOSSA build |
23-
| `--team 'some team'` | `-T` | Specify a team within your FOSSA organization |
24-
| `--policy 'some policy'` | | Assign a specific FOSSA policy to this project. Mutually excludes `--policy-id`. |
25-
| `--policy-id 'some policy id'` | | Assign a specific FOSSA policy to this project by id. Mutually excludes `--policy`. |
26-
| `--project-label` | | assign up to 5 labels to the project |
27-
| `--release-group-name 'MY_RG'` | | add the project to this release group (also requires `--release-group-release`) |
28-
| `--release-group-release 'MY_RELEASE'`| | add the project to this release version within the release group |
16+
| Name | Short | Description |
17+
|----------------------------------------|-------|-------------------------------------------------------------------------------------|
18+
| `--title 'some title'` | `-t` | Set the title of the FOSSA project |
19+
| `--branch 'some branch'` | `-b` | Override the detected FOSSA project branch |
20+
| `--project-url 'https://example.com'` | `-P` | Add a URL to the FOSSA project |
21+
| `--jira-project-key 'some-key'` | `-j` | Add a Jira project key to the FOSSA project |
22+
| `--link 'https://example.com'` | `-L` | Attach a link to the current FOSSA build |
23+
| `--team 'some team'` | `-T` | Specify a team within your FOSSA organization |
24+
| `--policy 'some policy'` | | Assign a specific FOSSA policy to this project. Mutually excludes `--policy-id`. |
25+
| `--policy-id 'some policy id'` | | Assign a specific FOSSA policy to this project by id. Mutually excludes `--policy`. |
26+
| `--project-label` | | assign up to 5 labels to the project |
27+
| `--release-group-name 'MY_RG'` | | add the project to this release group (also requires `--release-group-release`) |
28+
| `--release-group-release 'MY_RELEASE'` | | add the project to this release version within the release group |
2929

3030
### Filtering Paths and Targets
3131

3232
The paths and targets filtering options allow you to specify the exact targets which be should be scanned.
3333

3434
| Name | Description |
35-
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
35+
|----------------------------------|--------------------------------------------------------------------------------------------------------------------------|
3636
| `--only-target` | Only scan these targets. See [targets.only](../files/fossa-yml.md#targets.only) in the fossa.yml spec. |
3737
| `--exclude-target` | Exclude these targets from scanning. See [targets.exclude](../files/fossa-yml.md#targets.exclude) in the fossa.yml spec. |
3838
| `--only-path` | Only scan these paths. See [paths.only](../files/fossa-yml.md#paths.only) in the fossa.yml spec. |
@@ -77,7 +77,7 @@ fossa analyze --fossa-deps-file /path/to/file
7777
The Vendored Dependencies feature allows you to scan for licenses directly in your code. For more information, please see the [Vendored Dependencies documentation](../../features/vendored-dependencies.md).
7878

7979
| Name | Description |
80-
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
80+
|-------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
8181
| `--force-vendored-dependency-scan-method` | Force the vendored dependency scan method. The options are 'CLILicenseScan' or 'ArchiveUpload'. 'CLILicenseScan' is usually the default unless your organization has overridden this. |
8282
| `--force-vendored-dependency-rescans` | Force vendored dependencies to be rescanned even if the revision has been previously analyzed by FOSSA. This currently only works for CLI-side license scans. |
8383

@@ -128,11 +128,12 @@ We support the following archive formats:
128128

129129
In addition to the [standard flags](#specifying-fossa-project-details), the analyze command supports the following additional strategy flags:
130130

131-
| Name | Description |
132-
| --------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
133-
| [`--detect-vendored`](./analyze/detect-vendored.md) | Enable the vendored source identification engine. For more information, see the [C and C++ overview](../strategies/languages/c-cpp/c-cpp.md). |
134-
| [`--detect-dynamic './some-binary`](./analyze/detect-dynamic.md) | Analyze the binary at the provided path for dynamically linked dependencies. For more information, see the [C and C++ overview](../strategies/languages/c-cpp/c-cpp.md). |
135-
| [`--static-only-analysis`](../strategies/README.md#static-and-dynamic-strategies) | Do not use third-party tools when analyzing projects. |
131+
| Name | Description |
132+
|-----------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
133+
| [`--detect-vendored`](./analyze/detect-vendored.md) | Enable the vendored source identification engine. For more information, see the [C and C++ overview](../strategies/languages/c-cpp/c-cpp.md). |
134+
| [`--detect-dynamic './some-binary`](./analyze/detect-dynamic.md) | Analyze the binary at the provided path for dynamically linked dependencies. For more information, see the [C and C++ overview](../strategies/languages/c-cpp/c-cpp.md). |
135+
| [`--static-only-analysis`](../strategies/README.md#static-and-dynamic-strategies) | Do not use third-party tools when analyzing projects. |
136+
| `--strict` | Enforces strict analysis to ensure the most accurate results by rejecting fallbacks. When run with `--static-only-analysis`, the most optimal static strategy will be applied without fallbacks. |
136137

137138

138139
### Experimental Options
@@ -142,7 +143,7 @@ _Important: For support and other general information, refer to the [experimenta
142143
In addition to the [standard flags](#specifying-fossa-project-details), the analyze command supports the following experimental flags:
143144

144145
| Name | Description |
145-
| ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
146+
|------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
146147
| [`--experimental-enable-binary-discovery`](../experimental/binary-discovery/README.md) | Enable reporting binary files as unlicensed dependencies. For more information, see the [binary discovery overview](../experimental/binary-discovery/README.md). |
147148
| [`--experimental-link-project-binary './some-dir'`](../experimental/msb/README.md) | Link the provided binary files to the project being analyzed. For more information, see the [multi stage builds overview](../experimental/msb/README.md). |
148149
| [`--experimental-skip-vsi-graph 'custom+1/some$locator'`](../experimental/msb/README.md) | Skip resolving the dependencies of the given project that was previously linked via `--experimental-link-project-binary`. |
@@ -258,7 +259,7 @@ touch reqs.txt && fossa analyze && rm reqs.txt && fossa test
258259
All `fossa` commands support the following FOSSA-project-related flags:
259260

260261
| Name | Short | Description |
261-
| ---------------------------------- | ----- | ---------------------------------------------------------------------------------------------------------------------------------------- |
262+
|------------------------------------|-------|------------------------------------------------------------------------------------------------------------------------------------------|
262263
| `--project 'some project'` | `-p` | Override the detected project name |
263264
| `--revision 'some revision'` | `-r` | -Override the detected project revision |
264265
| `--fossa-api-key 'my-api-key'` | | An alternative to using the `FOSSA_API_KEY` environment variable to specify a FOSSA API key |

‎integration-test/Analysis/CarthageSpec.hs

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Analysis.CarthageSpec (spec) where
55

66
import Analysis.FixtureExpectationUtils
77
import Analysis.FixtureUtils
8+
import App.Types (Mode (NonStrict))
89
import Path
910
import Strategy.Carthage qualified as Carthage
1011
import Test.Hspec
@@ -24,4 +25,4 @@ swiftQueue =
2425

2526
spec :: Spec
2627
spec = do
27-
testSuiteDepResultSummary swiftQueue CarthageProjectType (DependencyResultsSummary 1 1 0 1 Complete)
28+
testSuiteDepResultSummary NonStrict swiftQueue CarthageProjectType (DependencyResultsSummary 1 1 0 1 Complete)

‎integration-test/Analysis/ClojureSpec.hs

+3-2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Analysis.ClojureSpec (spec) where
55

66
import Analysis.FixtureExpectationUtils
77
import Analysis.FixtureUtils
8+
import App.Types (Mode (NonStrict))
89
import Path
910
import Strategy.Leiningen qualified as Leiningen
1011
import Test.Hspec
@@ -39,5 +40,5 @@ ring =
3940

4041
spec :: Spec
4142
spec = do
42-
testSuiteDepResultSummary eastwood LeiningenProjectType (DependencyResultsSummary 10 7 3 1 Complete)
43-
testSuiteDepResultSummary ring LeiningenProjectType (DependencyResultsSummary 23 6 17 1 Complete)
43+
testSuiteDepResultSummary NonStrict eastwood LeiningenProjectType (DependencyResultsSummary 10 7 3 1 Complete)
44+
testSuiteDepResultSummary NonStrict ring LeiningenProjectType (DependencyResultsSummary 23 6 17 1 Complete)

‎integration-test/Analysis/CocoapodsSpec.hs

+4-2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Analysis.CocoapodsSpec (spec) where
55

66
import Analysis.FixtureExpectationUtils
77
import Analysis.FixtureUtils
8+
import App.Types (Mode (..))
89
import Path
910
import Strategy.Cocoapods qualified as Cocoapods
1011
import Test.Hspec
@@ -36,5 +37,6 @@ sDWebImage =
3637

3738
spec :: Spec
3839
spec = do
39-
testSuiteDepResultSummary shadowsocksXNG CocoapodsProjectType (DependencyResultsSummary 7 6 2 1 Complete)
40-
testSuiteDepResultSummary sDWebImage CocoapodsProjectType (DependencyResultsSummary 4 4 0 1 Partial)
40+
testSuiteDepResultSummary NonStrict shadowsocksXNG CocoapodsProjectType (DependencyResultsSummary 7 6 2 1 Complete)
41+
testSuiteDepResultSummary Strict shadowsocksXNG CocoapodsProjectType (DependencyResultsSummary 7 6 2 1 Complete)
42+
testSuiteDepResultSummary NonStrict sDWebImage CocoapodsProjectType (DependencyResultsSummary 4 4 0 1 Partial)

‎integration-test/Analysis/ElixirSpec.hs

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Analysis.ElixirSpec (spec) where
55

66
import Analysis.FixtureExpectationUtils
77
import Analysis.FixtureUtils
8+
import App.Types (Mode (NonStrict))
89
import Effect.Exec (AllowErr (Never), Command (Command))
910
import Path
1011
import Strategy.Mix qualified as Mix
@@ -42,4 +43,4 @@ absinthe =
4243

4344
spec :: Spec
4445
spec = do
45-
testSuiteDepResultSummary absinthe MixProjectType (DependencyResultsSummary 4 4 1 1 Complete)
46+
testSuiteDepResultSummary NonStrict absinthe MixProjectType (DependencyResultsSummary 4 4 1 1 Complete)

‎integration-test/Analysis/ErlangSpec.hs

+3-2
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module Analysis.ErlangSpec (spec) where
55

66
import Analysis.FixtureExpectationUtils
77
import Analysis.FixtureUtils
8+
import App.Types (Mode (NonStrict))
89
import Path
910
import Strategy.Rebar3 qualified as Rebar3
1011
import Test.Hspec
@@ -39,5 +40,5 @@ emqx =
3940

4041
spec :: Spec
4142
spec = do
42-
testSuiteDepResultSummary cowboy Rebar3ProjectType (DependencyResultsSummary 2 2 0 1 Complete)
43-
testSuiteDepResultSummary emqx Rebar3ProjectType (DependencyResultsSummary 0 0 0 1 Complete)
43+
testSuiteDepResultSummary NonStrict cowboy Rebar3ProjectType (DependencyResultsSummary 2 2 0 1 Complete)
44+
testSuiteDepResultSummary NonStrict emqx Rebar3ProjectType (DependencyResultsSummary 0 0 0 1 Complete)

0 commit comments

Comments
 (0)