ecosystems-bibliothecary 15.1.1 → 15.3.0

data/lib/bibliothecary/parsers/hex.rb

@@ -5,11 +5,20 @@ module Bibliothecary
     class Hex
       include Bibliothecary::Analyser
 
-      # Matches mix.lock entries: "name": {:hex, :name, "version", ...
+      # Matches mix.lock entries: "name": {:hex, :name, "version", "hash", ...
       # or "name": {:git, "url", "ref", ...
-      HEX_LOCK_REGEXP = /"([^"]+)":\s*\{:hex,\s*:[^,]+,\s*"([^"]+)"/
+      HEX_LOCK_REGEXP = /"([^"]+)":\s*\{:hex,\s*:[^,]+,\s*"([^"]+)",\s*"([^"]+)"/
       GIT_LOCK_REGEXP = /"([^"]+)":\s*\{:git,\s*"([^"]+)",\s*"([^"]+)"/
 
+      # Matches rebar.lock entries: {<<"name">>,{pkg,<<"name">>,<<"version">>},N}
+      REBAR_LOCK_REGEXP = /\{<<"([^"]+)">>,\{pkg,<<"[^"]+">>,<<"([^"]+)">>},\d+\}/
+      # Matches rebar.lock pkg_hash entries: {<<"name">>, <<"HASH">>}
+      REBAR_PKG_HASH_REGEXP = /\{<<"([^"]+)">>,\s*<<"([A-F0-9]+)">>}/
+
+      def self.file_patterns
+        ["mix.exs", "mix.lock", "gleam.toml", "manifest.toml", "rebar.lock"]
+      end
+
       def self.mapping
         {
           match_filename("mix.exs") => {
@@ -20,9 +29,26 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_mix_lock,
           },
+          match_filename("gleam.toml") => {
+            kind: "manifest",
+            parser: :parse_gleam_toml,
+          },
+          match_filename("manifest.toml") => {
+            kind: "lockfile",
+            parser: :parse_gleam_manifest,
+            content_matcher: :gleam_manifest?,
+          },
+          match_filename("rebar.lock") => {
+            kind: "lockfile",
+            parser: :parse_rebar_lock,
+          },
         }
       end
 
+      def self.gleam_manifest?(file_contents)
+        file_contents.include?("# This file was generated by Gleam")
+      end
+
 
       def self.parse_mix(file_contents, options: {})
         source = options.fetch(:filename, "mix.exs")
@@ -50,14 +76,15 @@ module Bibliothecary
         source = options.fetch(:filename, "mix.lock")
         deps = []
 
-        # Match hex packages: "name": {:hex, :name, "version", ...
-        file_contents.scan(HEX_LOCK_REGEXP) do |name, version|
+        # Match hex packages: "name": {:hex, :name, "version", "hash", ...
+        file_contents.scan(HEX_LOCK_REGEXP) do |name, version, hash|
           deps << Dependency.new(
             platform: platform_name,
             name: name,
             requirement: version,
             type: "runtime",
-            source: source
+            source: source,
+            integrity: "sha256=#{hash}"
           )
         end
 
@@ -74,6 +101,83 @@ module Bibliothecary
 
         ParserResult.new(dependencies: deps)
       end
+
+      def self.parse_gleam_toml(file_contents, options: {})
+        source = options.fetch(:filename, "gleam.toml")
+        manifest = Tomlrb.parse(file_contents)
+        deps = []
+
+        manifest.fetch("dependencies", {}).each do |name, requirement|
+          deps << Dependency.new(
+            platform: platform_name,
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source
+          )
+        end
+
+        manifest.fetch("dev-dependencies", {}).each do |name, requirement|
+          deps << Dependency.new(
+            platform: platform_name,
+            name: name,
+            requirement: requirement,
+            type: "development",
+            source: source
+          )
+        end
+
+        ParserResult.new(dependencies: deps)
+      end
+
+      def self.parse_gleam_manifest(file_contents, options: {})
+        source = options.fetch(:filename, "manifest.toml")
+        manifest = Tomlrb.parse(file_contents)
+        deps = []
+
+        manifest.fetch("packages", []).each do |pkg|
+          next unless pkg["source"] == "hex"
+
+          checksum = pkg["outer_checksum"]
+          deps << Dependency.new(
+            platform: platform_name,
+            name: pkg["name"],
+            requirement: pkg["version"],
+            type: "runtime",
+            source: source,
+            integrity: checksum ? "sha256=#{checksum.downcase}" : nil
+          )
+        end
+
+        ParserResult.new(dependencies: deps)
+      end
+
+      def self.parse_rebar_lock(file_contents, options: {})
+        source = options.fetch(:filename, "rebar.lock")
+        deps = []
+
+        # Parse pkg_hash section to build lookup table
+        pkg_hashes = {}
+        pkg_hash_section = file_contents[/\{pkg_hash,\s*\[(.*?)\]\}/m, 1]
+        if pkg_hash_section
+          pkg_hash_section.scan(REBAR_PKG_HASH_REGEXP) do |name, hash|
+            pkg_hashes[name] = "sha256=#{hash.downcase}"
+          end
+        end
+
+        file_contents.scan(REBAR_LOCK_REGEXP) do |name, version|
+          deps << Dependency.new(
+            platform: platform_name,
+            name: name,
+            requirement: version,
+            type: "runtime",
+            source: source,
+            integrity: pkg_hashes[name]
+          )
+        end
+
+        ParserResult.new(dependencies: deps)
+      end
     end
   end
 end

data/lib/bibliothecary/parsers/homebrew.rb

@@ -5,6 +5,10 @@ module Bibliothecary
 
       HOMEBREW_REGEXP = /^brew\s(.+),?\s?/
 
+      def self.file_patterns
+        ["Brewfile", "Brewfile.lock.json"]
+      end
+
       def self.mapping
         {
           match_filename("Brewfile", case_insensitive: true) => {

data/lib/bibliothecary/parsers/julia.rb

@@ -5,12 +5,24 @@ module Bibliothecary
     class Julia
       include Bibliothecary::Analyser
 
+      def self.file_patterns
+        ["REQUIRE", "Project.toml", "Manifest.toml"]
+      end
+
       def self.mapping
         {
           match_filename("REQUIRE", case_insensitive: true) => {
             kind: "manifest",
             parser: :parse_require,
           },
+          match_filename("Project.toml") => {
+            kind: "manifest",
+            parser: :parse_project_toml,
+          },
+          match_filename("Manifest.toml") => {
+            kind: "lockfile",
+            parser: :parse_manifest_toml,
+          },
         }
       end
 
@@ -41,6 +53,49 @@ module Bibliothecary
         end
         ParserResult.new(dependencies: deps)
       end
+
+      def self.parse_project_toml(file_contents, options: {})
+        source = options.fetch(:filename, "Project.toml")
+        manifest = Tomlrb.parse(file_contents)
+        deps = []
+
+        manifest.fetch("deps", {}).each do |name, _uuid|
+          deps << Dependency.new(
+            name: name,
+            requirement: "*",
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: deps)
+      end
+
+      def self.parse_manifest_toml(file_contents, options: {})
+        source = options.fetch(:filename, "Manifest.toml")
+        manifest = Tomlrb.parse(file_contents)
+        deps = []
+
+        manifest.fetch("deps", {}).each do |name, entries|
+          # entries is an array of package entries (usually just one)
+          entry = entries.is_a?(Array) ? entries.first : entries
+          next unless entry.is_a?(Hash)
+
+          version = entry["version"]
+          next unless version
+
+          deps << Dependency.new(
+            name: name,
+            requirement: version,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: deps)
+      end
     end
   end
 end

data/lib/bibliothecary/parsers/luarocks.rb

@@ -5,11 +5,16 @@ module Bibliothecary
     class LuaRocks
       include Bibliothecary::Analyser
 
+      def self.file_patterns
+        ["*.rockspec"]
+      end
+
       def self.mapping
         {
           match_extension(".rockspec") => {
             kind: "manifest",
             parser: :parse_rockspec,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/maven.rb

@@ -62,6 +62,10 @@ module Bibliothecary
       # e.g. "[info]  "
       SBT_IGNORE_REGEXP = /^\[info\]\s*$/
 
+      def self.file_patterns
+        ["ivy.xml", "pom.xml", "build.gradle", "build.gradle.kts", "gradle-dependencies-q.txt", "maven-resolved-dependencies.txt", "sbt-update-full.txt", "maven-dependency-tree.txt", "maven-dependency-tree.dot", "gradle.lockfile", "verification-metadata.xml"]
+      end
+
       # Copied from the "strings-ansi" gem, because it seems abandoned: https://github.com/piotrmurach/strings-ansi/pull/2
       # From: https://github.com/piotrmurach/strings-ansi/blob/35d0c9430cf0a8022dc12bdab005bce296cb9f00/lib/strings/ansi.rb#L14-L29
       # License: MIT

data/lib/bibliothecary/parsers/meteor.rb

@@ -7,11 +7,16 @@ module Bibliothecary
     class Meteor
       include Bibliothecary::Analyser
 
+      def self.file_patterns
+        ["versions.json"]
+      end
+
       def self.mapping
         {
           match_filename("versions.json") => {
             kind: "manifest",
             parser: :parse_manifest,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/mlflow.rb

@@ -5,12 +5,16 @@ module Bibliothecary
     class MLflow
       include Bibliothecary::Analyser
 
+      def self.file_patterns
+        ["MLmodel"]
+      end
+
       def self.mapping
         {
           match_filename("MLmodel") => {
             kind: 'manifest',
             parser: :parse_mlmodel,
-            related_to: [ 'manifest' ]
+            can_have_lockfile: false,
           }
         }
       end

data/lib/bibliothecary/parsers/nimble.rb

@@ -9,11 +9,16 @@ module Bibliothecary
       # or: requires "packagename"
       REQUIRES_REGEXP = /^\s*requires\s+"([^"]+)"/
 
+      def self.file_patterns
+        ["*.nimble"]
+      end
+
       def self.mapping
         {
           match_extension(".nimble") => {
             kind: "manifest",
             parser: :parse_nimble,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/nix.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Bibliothecary
+  module Parsers
+    class Nix
+      include Bibliothecary::Analyser
+
+      def self.file_patterns
+        [
+          "flake.nix",
+          "flake.lock",
+          "nix/sources.json",
+          "npins/sources.json",
+        ]
+      end
+
+      def self.mapping
+        {
+          match_filename("flake.nix") => {
+            kind: "manifest",
+            parser: :parse_flake_nix,
+          },
+          match_filename("flake.lock") => {
+            kind: "lockfile",
+            parser: :parse_flake_lock,
+          },
+          match_filename("nix/sources.json") => {
+            kind: "lockfile",
+            parser: :parse_niv_sources,
+          },
+          match_filename("npins/sources.json") => {
+            kind: "lockfile",
+            parser: :parse_npins_sources,
+          },
+        }
+      end
+
+      # Parse flake.nix manifest file
+      # Extracts inputs from the Nix expression using regex
+      def self.parse_flake_nix(file_contents, options: {})
+        source = options.fetch(:filename, nil)
+        dependencies = []
+
+        # Pattern 1: name.url = "...";
+        # e.g., nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+        file_contents.scan(/^\s*([\w][\w-]*)\.url\s*=\s*"([^"]+)"/) do |name, url|
+          requirement = parse_flake_url(url)
+          dependencies << Dependency.new(
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        # Pattern 2: name = { url = "..."; ... };
+        # e.g., home-manager = { url = "github:nix-community/home-manager"; };
+        file_contents.scan(/^\s*([\w][\w-]*)\s*=\s*\{\s*\n?\s*url\s*=\s*"([^"]+)"/) do |name, url|
+          requirement = parse_flake_url(url)
+          dependencies << Dependency.new(
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
+      # Parse flake.lock lockfile
+      def self.parse_flake_lock(file_contents, options: {})
+        source = options.fetch(:filename, nil)
+        lock = JSON.parse(file_contents)
+        dependencies = []
+
+        nodes = lock.fetch("nodes", {})
+        root_node = nodes.fetch("root", {})
+        root_inputs = root_node.fetch("inputs", {})
+
+        root_inputs.each do |name, node_key|
+          # node_key can be a string or an array (for follows)
+          node_key = node_key.first if node_key.is_a?(Array)
+          node = nodes[node_key]
+          next unless node
+
+          locked = node.fetch("locked", {})
+          requirement = format_locked_version(locked)
+
+          dependencies << Dependency.new(
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
+      # Parse niv sources.json lockfile
+      def self.parse_niv_sources(file_contents, options: {})
+        source = options.fetch(:filename, nil)
+        sources = JSON.parse(file_contents)
+        dependencies = []
+
+        sources.each do |name, attrs|
+          next unless attrs.is_a?(Hash)
+
+          requirement = format_niv_version(attrs)
+
+          dependencies << Dependency.new(
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
+      # Parse npins sources.json lockfile
+      def self.parse_npins_sources(file_contents, options: {})
+        source = options.fetch(:filename, nil)
+        data = JSON.parse(file_contents)
+        dependencies = []
+
+        pins = data.fetch("pins", {})
+
+        pins.each do |name, attrs|
+          next unless attrs.is_a?(Hash)
+
+          requirement = format_npins_version(attrs)
+
+          dependencies << Dependency.new(
+            name: name,
+            requirement: requirement,
+            type: "runtime",
+            source: source,
+            platform: platform_name
+          )
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
+      # Parse a flake URL into a version/requirement string
+      # Examples:
+      #   "github:NixOS/nixpkgs/nixos-unstable" => "nixos-unstable"
+      #   "github:NixOS/nixpkgs" => "*"
+      #   "git+https://github.com/foo/bar?ref=v1.0" => "v1.0"
+      def self.parse_flake_url(url)
+        case url
+        when /^github:([^\/]+)\/([^\/\?]+)(?:\/([^\?]+))?/
+          $3 || "*"
+        when /^gitlab:([^\/]+)\/([^\/\?]+)(?:\/([^\?]+))?/
+          $3 || "*"
+        when /\?ref=([^&]+)/
+          $1
+        when /\?rev=([^&]+)/
+          $1
+        else
+          "*"
+        end
+      end
+
+      # Format locked version from flake.lock node
+      def self.format_locked_version(locked)
+        rev = locked["rev"]
+        return rev[0..6] if rev # Short commit hash
+
+        locked["version"] || "*"
+      end
+
+      # Format version from niv sources.json entry
+      def self.format_niv_version(attrs)
+        if attrs["rev"]
+          attrs["rev"][0..6]
+        elsif attrs["version"]
+          attrs["version"]
+        else
+          "*"
+        end
+      end
+
+      # Format version from npins sources.json entry
+      def self.format_npins_version(attrs)
+        if attrs["revision"]
+          attrs["revision"][0..6]
+        elsif attrs["version"]
+          attrs["version"]
+        else
+          "*"
+        end
+      end
+    end
+  end
+end