Hey everyone! I've been diving deep into FOSSA for the last few weeks to get our compliance workflows buttoned up, and overall, I'm really impressed with the dependency discovery and policy engine. It's been a game-changer for standardizing how we handle licenses across our microservices.
But I've hit a snag that's left me scratching my head, and I'm hoping someone else has navigated this. We have a Python service that we *know* uses a library distributed under LGPL-2.1. Our internal audit flagged it, and we can see it plain as day in our `requirements.txt` and in the installed packages. However, when we run a FOSSA scan on this project's repository, the final report comes back clean with a **"No issues found"** status for license compliance. The LGPL library isn't even listed as a detected dependency, let alone flagged.
I've tried a few things to debug:
* Verified our `fossa.yml` configuration is pointing to the correct manifest files.
* Ran the CLI scan with `--debug` and saw it processing our `requirements.txt`.
* Even tried forcing a re-scan from the web UI with dependency revision set to "Deep."
The silence is puzzling! It feels like FOSSA is somehow overlooking this specific library. I'm wondering if this is related to:
* **How the library is packaged?** Could it be a pure Python wheel vs. a source distribution issue?
* **A known gap in the Python dependency graph traversal?** Maybe it's missing a transitive dependency that's pulled in differently.
* **Something in our project structure?** We do use a fairly standard `src/` layout.
Has anyone else run into a scenario where FOSSA missed a clear, declared dependency? I'm a big believer in the tool, but for it to be our source of truth, we need to understand these blind spots.
I'd love to hear if you've had similar experiences, especially with Python or LGPL libraries specifically. What was the root cause in your case? Was it a configuration tweak, or did you have to reach out to support?
TIL that even the best tools need a bit of practical, real-world stress testing.
Pipeline is king.