archsight 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 750620aa30b68f0a3cfa0f53be2d717ae0496b829e5ecc588a904b3bf39dbd10
-  data.tar.gz: 8ddf46b557c7830212d0e699149ce2b53b9476c7748fc90c82480f22be226047
+  metadata.gz: 8ee7007a0546772a62713bcb356817a70693a69443b3e45644067fa56826244a
+  data.tar.gz: f17a4768edefc81a92c362007519abf811d9cecf02bdf33efbc66dcd94068abb
 SHA512:
-  metadata.gz: 39b0cc9b3b321c1e2627197a8f2edb13bdb8fe78273e315b70c886d05d64da534769850f5991e70d6c38d549f7229988d3d2e03bbd075f01e9aad0b4b4aad802
-  data.tar.gz: 69c4784e97d7c2aa01bf1030109a621f1eacdf4d7fe131d2e7c56eb29b42524ed3a68c69f97003ef804a7e38cedf118dc186157a948e5c81479191927955fa94
+  metadata.gz: 1f2180f2b82c024371d5dd2e448fbbfbe9face5e7501eaec3849ba19905aa1447bfd8acf6243fb80aaa079054ba02b1703a9261c53bb892a0fa42bf784df28d2
+  data.tar.gz: '049e2460736eab50bf6fdd881e8a25d99ac486d64e4988f938b82615e57a1061d26c73355c20af5981cc0f3d753767aabe4232d43fecb3c4269358e502bf4611'

data/lib/archsight/annotations/annotation.rb

@@ -12,6 +12,7 @@ class Archsight::Annotations::Annotation
     @explicit_title = options[:title]
     @filter = options[:filter]
     @enum = options[:enum]
+    @validator = options[:validator]
     @sidebar = options.fetch(:sidebar, true)
     @list = options.fetch(:list, false)
     @editor = options.fetch(:editor, true)
@@ -54,7 +55,7 @@ class Archsight::Annotations::Annotation
   end
 
   def has_validation?
-    @enum || @type.is_a?(Class)
+    @enum || @validator || @type.is_a?(Class)
   end
 
   # === Value Methods (for instance values) ===
@@ -85,6 +86,7 @@ class Archsight::Annotations::Annotation
     return errors if value.nil?
 
     validate_enum(value, errors)
+    validate_custom(value, errors) if errors.empty?
     validate_type(value, errors) if errors.empty?
     validate_code(value, errors) if errors.empty?
 
@@ -147,6 +149,16 @@ class Archsight::Annotations::Annotation
     end
   end
 
+  def validate_custom(value, errors)
+    return unless @validator
+
+    values = list? ? value.to_s.split(",").map(&:strip) : [value.to_s]
+    values.each do |v|
+      message = @validator.call(v) # steep:ignore
+      errors << message if message
+    end
+  end
+
   def validate_type(value, errors)
     return unless @type.is_a?(Class)
 

data/lib/archsight/import/license_analyzer.rb

@@ -2,6 +2,7 @@
 
 require "open3"
 require "json"
+require "spdx-licenses"
 require "archsight/import"
 
 # License detection and dependency license scanning for repositories
@@ -32,6 +33,7 @@ class Archsight::Import::LicenseAnalyzer
     { id: "Unlicense",    re: /\bThis is free and unencumbered software\b/mi },
     { id: "CC0-1.0",      re: /Creative Commons.*CC0|CC0 1\.0 Universal/mi },
     { id: "BSL-1.0",      re: /Boost Software License/mi },
+    { id: "BUSL-1.1",     re: /Business Source License.*1\.1/mi },
     { id: "EUPL-1.2",     re: /European Union Public Licen[cs]e.*1\.2/mi }
   ].freeze
 
@@ -40,6 +42,7 @@ class Archsight::Import::LicenseAnalyzer
     "permissive" => %w[Apache-2.0 MIT BSD-3-Clause BSD-2-Clause ISC Unlicense CC0-1.0 BSL-1.0 0BSD Ruby],
     "copyleft" => %w[GPL-3.0 GPL-2.0 AGPL-3.0],
     "weak-copyleft" => %w[LGPL-3.0 LGPL-2.1 MPL-2.0 EUPL-1.2 CDDL-1.0],
+    "source-available" => %w[BUSL-1.1],
     "proprietary" => %w[proprietary]
   }.freeze
 
@@ -56,10 +59,8 @@ class Archsight::Import::LicenseAnalyzer
     \(c\)\s
   /xi
 
-  # Known SPDX IDs for dual-license splitting
-  KNOWN_SPDX = Set.new(
-    CATEGORIES.values.flatten + %w[NOASSERTION unknown]
-  ).freeze
+  # Custom non-SPDX values we accept
+  CUSTOM_LICENSE_VALUES = Set.new(%w[NOASSERTION proprietary unknown]).freeze
 
   # License file names to search (in order of priority)
   LICENSE_FILES = %w[
@@ -289,7 +290,7 @@ class Archsight::Import::LicenseAnalyzer
       parts = cleaned.split(%r{\s*/\s*|\s+OR\s+}i)
       parts.each do |part|
         normalized = normalize_spdx_single(part.strip)
-        return normalized if KNOWN_SPDX.include?(normalized)
+        return normalized if known_spdx?(normalized)
       end
     end
 
@@ -322,6 +323,11 @@ class Archsight::Import::LicenseAnalyzer
     end
   end
 
+  # Check if a value is a known SPDX ID or one of our custom values
+  def known_spdx?(value)
+    CUSTOM_LICENSE_VALUES.include?(value) || SpdxLicenses.exist?(value)
+  end
+
   # Categorize a license SPDX identifier
   def categorize(spdx)
     CATEGORY_LOOKUP[spdx] || "unknown"
@@ -633,13 +639,15 @@ class Archsight::Import::LicenseAnalyzer
 
     strong_copyleft = CATEGORIES["copyleft"]
     weak_copyleft = CATEGORIES["weak-copyleft"]
+    source_available = CATEGORIES["source-available"]
 
     has_strong = license_names.any? { |l| strong_copyleft.include?(l) }
     has_weak = license_names.any? { |l| weak_copyleft.include?(l) }
+    has_source_available = license_names.any? { |l| source_available.include?(l) }
     unknown_count = license_names.count { |l| l == "unknown" }
     many_unknown = unknown_count.positive? && (unknown_count.to_f / license_names.size) > 0.5
 
-    if has_strong || many_unknown
+    if has_strong || many_unknown || has_source_available
       "copyleft"
     elsif has_weak
       "weak-copyleft"

data/lib/archsight/resources/base.rb

@@ -25,10 +25,10 @@ module Archsight
 
       # Define an annotation using the Annotation class
       def self.annotation(key, description: nil, filter: nil, title: nil, format: nil, enum: nil, sidebar: true,
-                          type: nil, list: false, editor: true)
+                          type: nil, list: false, editor: true, validator: nil)
         @annotations ||= [] #: Array[Archsight::Annotations::Annotation]
         options = { description: description, filter: filter, title: title, format: format, enum: enum,
-                    sidebar: sidebar, type: type, list: list, editor: editor }
+                    sidebar: sidebar, type: type, list: list, editor: editor, validator: validator }
         @annotations << Archsight::Annotations::Annotation.new(key, options)
       end
 

data/lib/archsight/resources/technology_artifact.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "uri"
+require "spdx-licenses"
 
 # TechnologyArtifact usually a source code repository or container
 class Archsight::Resources::TechnologyArtifact < Archsight::Resources::Base
@@ -159,14 +160,17 @@ class Archsight::Resources::TechnologyArtifact < Archsight::Resources::Base
              enum: %w[unprivileged privileged]
 
   # License information
+  SPDX_CUSTOM_VALUES = Set.new(%w[NOASSERTION proprietary unknown]).freeze
+  SPDX_VALIDATOR = lambda { |v|
+    "invalid SPDX license identifier '#{v}'" unless SPDX_CUSTOM_VALUES.include?(v) || SpdxLicenses.exist?(v)
+  }
+
   annotation "license/spdx",
              description: "SPDX license identifier",
              title: "License",
              filter: :word,
              sidebar: false,
-             enum: %w[Apache-2.0 MIT BSD-3-Clause BSD-2-Clause GPL-3.0 GPL-2.0 LGPL-3.0
-                      LGPL-2.1 MPL-2.0 ISC AGPL-3.0 Unlicense CC0-1.0 BSL-1.0 EUPL-1.2
-                      0BSD CDDL-1.0 Ruby NOASSERTION proprietary unknown]
+             validator: SPDX_VALIDATOR
   annotation "license/file",
              description: "License file path",
              title: "License File",

data/lib/archsight/version.rb

@@ -4,5 +4,5 @@
 # Do not edit manually.
 
 module Archsight
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: archsight
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Vincent Landgraf
@@ -149,6 +149,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: spdx-licenses
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement