bibliothecary 7.2.1 → 7.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ba740dd30abb75fb073f3160d963a970ffa41099966e86a38558fc50c515c9bf
-  data.tar.gz: 19de22f64f4390acd0c15781283d1089c85459aa989393485ab25337e246ef01
+  metadata.gz: bb1338bc28ebb3dde8a6bdb5037f000176b9d759aa391319e74cbc85a35bd0ad
+  data.tar.gz: 8acc8a5acddd673c79680cefe8f0af6e325fd21905eb82da8751a01df81dac2c
 SHA512:
-  metadata.gz: 9f7f301227e79af9a7f3bafc5484e39426c9d5faee1ee1c6a97f4173d6b438def08cf36ea3a8eedaa06d9ce0741ee6bf012b7aba1a972680c79b397ac57a1ac9
-  data.tar.gz: 11bbaf66d5dcb32b042923abf85be353d96a6d1f09c1e641e0c40df215d9f70347e56b4d7afe81b5bb27a685318667c7c53d2ba24a2961e2a4dad72ad1c90273
+  metadata.gz: b078d0d7b486f79911d2f4426c431fc61353d6f326e173faaa7b3a6154cbb8dd77f1d0e0e0ceca50e78ed646cded4490e22a2dc7f324d8d041276b41e430952d
+  data.tar.gz: e6bb42ee137c6e9a5eeeee0f375c2a6362e822af1011ad6f92d101d7f1b4d7c9ea8dee04925846e5efd3ea553d0e57f6fde4c1e678d7cb8aaa07eab458d00fed

data/.gitignore

@@ -7,3 +7,4 @@
 /pkg/
 /spec/reports/
 /tmp/
+*.gem

data/lib/bibliothecary/analyser.rb

@@ -25,6 +25,10 @@ module Bibliothecary
       base.extend(ClassMethods)
     end
     module ClassMethods
+      def generic?
+        platform_name == "generic"
+      end
+
       def mapping_entry_match?(matcher, details, info)
         if matcher.call(info.relative_path)
           # we only want to load contents if we don't have them already
@@ -119,13 +123,32 @@ module Bibliothecary
       end
       alias analyze_contents analyse_contents
 
+      def dependencies_to_analysis(info, kind, dependencies)
+        dependencies = dependencies || [] # work around any legacy parsers that return nil
+        if generic?
+          analyses = []
+          grouped = dependencies.group_by { |dep| dep[:platform] }
+          all_analyses = grouped.keys.map do |platform|
+            deplatformed_dependencies = grouped[platform].map { |d| d.delete(:platform); d }
+            Bibliothecary::Analyser::create_analysis(platform, info.relative_path, kind, deplatformed_dependencies)
+          end
+          # this is to avoid a larger refactor for the time being. The larger refactor
+          # needs to make analyse_contents return multiple analysis, or add another
+          # method that can return multiple and deprecate analyse_contents, perhaps.
+          raise "File contains zero or multiple platforms, currently must have exactly one" if all_analyses.length != 1
+          all_analyses.first
+        else
+          Bibliothecary::Analyser::create_analysis(platform_name, info.relative_path, kind, dependencies)
+        end
+      end
+
       def analyse_contents_from_info(info)
         # If your Parser needs to return multiple responses for one file, please override this method
         # For example see conda.rb
         kind = determine_kind_from_info(info)
         dependencies = parse_file(info.relative_path, info.contents)
 
-        Bibliothecary::Analyser::create_analysis(platform_name, info.relative_path, kind, dependencies || [])
+        dependencies_to_analysis(info, kind, dependencies)
       rescue Bibliothecary::FileParsingError => e
         Bibliothecary::Analyser::create_error_analysis(platform_name, info.relative_path, kind, e.message)
       end

data/lib/bibliothecary/parsers/generic.rb

@@ -0,0 +1,39 @@
+require 'csv'
+
+module Bibliothecary
+  module Parsers
+    class Generic
+      include Bibliothecary::Analyser
+
+      def self.mapping
+        {
+          match_filename("dependencies.csv") => {
+            kind: 'lockfile',
+            parser: :parse_lockfile
+          }
+        }
+      end
+
+      def self.parse_lockfile(file_contents)
+        table = CSV.parse(file_contents, headers: true)
+
+        required_headers = ["platform", "name", "requirement"]
+        missing_headers = required_headers - table.headers
+        raise "Missing headers #{missing_headers} in CSV" unless missing_headers.empty?
+
+        table.map.with_index do |row, idx|
+          line = idx + 1
+          required_headers.each do |h|
+            raise "missing field '#{h}' on line #{line}" if row[h].empty?
+          end
+          {
+            platform: row['platform'],
+            name: row['name'],
+            requirement: row['requirement'],
+            type: row.fetch('type', 'runtime'),
+          }
+        end
+      end
+    end
+  end
+end

data/lib/bibliothecary/parsers/maven.rb

@@ -127,10 +127,12 @@ module Bibliothecary
 
           split = gradle_dep_match.captures[0]
 
-          # org.springframework.boot:spring-boot-starter-web:2.1.0.M3 (*)
-          # Lines can end with (c), (n), or (*)
-          # to indicate that something was a dependency constraint (c), not resolved (n), or resolved previously (*).
-          dep = line.split(split)[1].sub(/(\((c|n|\*)\))$/, "").sub(" -> ", ":").strip.split(":")
+
+          dep = line
+            .split(split)[1].sub(/(\((c|n|\*)\))$/, "") # line ending legend: (c) means a dependency constraint, (n) means not resolved, or (*) means resolved previously, e.g. org.springframework.boot:spring-boot-starter-web:2.1.0.M3 (*)
+            .sub(/ FAILED$/, "") # dependency could not be resolved (but still may have a version)
+            .sub(" -> ", ":") # handle version arrow syntax
+            .strip.split(":")
 
           # A testImplementation line can look like this so just skip those
           # \--- org.springframework.security:spring-security-test (n)

data/lib/bibliothecary/parsers/npm.rb

@@ -5,6 +5,9 @@ module Bibliothecary
     class NPM
       include Bibliothecary::Analyser
 
+      # Max depth to recurse into the "dependencies" property of package-lock.json
+      PACKAGE_LOCK_JSON_MAX_DEPTH = 10
+
       def self.mapping
         {
           match_filename("package.json") => {
@@ -43,26 +46,25 @@ module Bibliothecary
 
       def self.parse_package_lock(file_contents)
         manifest = JSON.parse(file_contents)
-        manifest.fetch('dependencies',[]).map do |name, requirement|
-          if requirement.fetch("dev", false)
-            type = 'development'
-          else
-            type = 'runtime'
-          end
-
-          version = nil
-
-          if requirement.key?("from")
-            version = requirement["from"][/#(?:semver:)?v?(.*)/, 1]
-          end
+        parse_package_lock_deps_recursively(manifest.fetch('dependencies', []))
+      end
 
+      def self.parse_package_lock_deps_recursively(dependencies, depth=1)
+        dependencies.flat_map do |name, requirement|
+          type = requirement.fetch("dev", false) ? 'development' : 'runtime'
+          version = requirement.key?("from") ? requirement["from"][/#(?:semver:)?v?(.*)/, 1] : nil
           version ||= requirement["version"].split("#").last
+          child_dependencies = if depth >= PACKAGE_LOCK_JSON_MAX_DEPTH
+            []
+          else
+            parse_package_lock_deps_recursively(requirement.fetch('dependencies', []), depth + 1)
+          end
 
-          {
+          [{
             name: name,
             requirement: version,
             type: type
-          }
+          }] + child_dependencies
         end
       end
 
@@ -95,6 +97,18 @@ module Bibliothecary
         transform_tree_to_array(manifest.fetch('dependencies', {}))
       end
 
+      def self.lockfile_preference_order(file_infos)
+        files = file_infos.each_with_object({}) do |file_info, obj|
+          obj[File.basename(file_info.full_path)] = file_info
+        end
+
+        if files["npm-shrinkwrap.json"]
+          [files["npm-shrinkwrap.json"]] + files.values.reject { |fi| File.basename(fi.full_path) == "npm-shrinkwrap.json" }
+        else
+          files.values
+        end
+      end
+
       private_class_method def self.transform_tree_to_array(deps_by_name)
         deps_by_name.map do |name, metadata|
           [

data/lib/bibliothecary/related_files_info.rb

@@ -19,6 +19,9 @@ module Bibliothecary
 
     def initialize(file_infos)
       package_manager = file_infos.first.package_manager
+      if package_manager.respond_to?(:lockfile_preference_order)
+        file_infos = package_manager.lockfile_preference_order(file_infos)
+      end
       @platform = package_manager.platform_name
       @path = Pathname.new(File.dirname(file_infos.first.relative_path)).cleanpath.to_path
       # `package_manager.determine_kind_from_info(info)` can be an Array, so use include? which also works for string

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "7.2.1"
+  VERSION = "7.3.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 7.2.1
+  version: 7.3.3
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-10-15 00:00:00.000000000 Z
+date: 2021-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb
@@ -251,6 +251,7 @@ files:
 - lib/bibliothecary/parsers/cran.rb
 - lib/bibliothecary/parsers/dub.rb
 - lib/bibliothecary/parsers/elm.rb
+- lib/bibliothecary/parsers/generic.rb
 - lib/bibliothecary/parsers/go.rb
 - lib/bibliothecary/parsers/hackage.rb
 - lib/bibliothecary/parsers/haxelib.rb