gitlab-license_finder 6.14.2.1

data/lib/license_finder/package_managers/conda.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Conda < PackageManager
+    attr_reader :conda_bash_setup_script
+
+    def initialize(options = {})
+      @conda_bash_setup_script = options[:conda_bash_setup_script] || Pathname("#{ENV['HOME']}/miniconda3/etc/profile.d/conda.sh")
+      super
+    end
+
+    # This command is *not* directly executable. See .conda() below.
+    def prepare_command
+      "conda env create -f #{detected_package_path}"
+    end
+
+    def prepare
+      return if environment_exists?
+
+      prep_cmd = prepare_command
+      _stdout, stderr, status = Dir.chdir(project_path) { conda(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def current_packages
+      conda_list.map do |entry|
+        case entry['channel']
+        when 'pypi'
+          # PyPI is much faster than `conda search`, use it when we can.
+          PipPackage.new(entry['name'], entry['version'], PyPI.definition(entry['name'], entry['version']))
+        else
+          CondaPackage.new(conda_search_info(entry))
+        end
+      end.compact
+    end
+
+    def possible_package_paths
+      [project_path.join('environment.yaml'), project_path.join('environment.yml')]
+    end
+
+    private
+
+    def environment_exists?
+      environments.grep(environment_name).any?
+    end
+
+    def environments
+      command = 'conda env list'
+      stdout, stderr, status = conda command
+
+      environments = []
+      if status.success?
+        environments = stdout.split("\n").grep_v(/^#/).map { |line| line.split.first }
+      else
+        log_errors_with_cmd command, stderr
+      end
+      environments
+    end
+
+    def environment_file
+      detected_package_path
+    end
+
+    def environment_name
+      @environment_name ||= YAML.load_file(environment_file).fetch('name')
+    end
+
+    def conda(command)
+      Open3.capture3('bash', '-c', "source #{conda_bash_setup_script} && #{command}")
+    end
+
+    def activated_conda(command)
+      Open3.capture3('bash', '-c', "source #{conda_bash_setup_script} && conda activate #{environment_name} && #{command}")
+    end
+
+    # Algorithm is based on
+    # https://bioinformatics.stackexchange.com/a/11226
+    # but completely recoded in Ruby. Like the poster, if the package is
+    # actually managed by conda, we assume that all the potential infos (for
+    # various architectures, versions of python, etc) have the same license.
+    def conda_list
+      command = 'conda list'
+      stdout, stderr, status = activated_conda(command)
+
+      if status.success?
+        conda_list = []
+        stdout.each_line do |line|
+          next if line =~ /^\s*#/
+
+          name, version, build, channel = line.split
+          conda_list << {
+            'name' => name,
+            'version' => version,
+            'build' => build,
+            'channel' => channel
+          }
+        end
+        conda_list
+      else
+        log_errors_with_cmd command, stderr
+        []
+      end
+    end
+
+    def conda_search_info(list_entry)
+      command = 'conda search --info --json '
+      command += "--channel #{list_entry['channel']} " if list_entry['channel'] && !list_entry['channel'].empty?
+      command += "'#{list_entry['name']} #{list_entry['version']}'"
+
+      # Errors from conda (in --json mode, at least) show up in stdout, not stderr
+      stdout, _stderr, status = activated_conda(command)
+
+      name = list_entry['name']
+
+      if status.success?
+        JSON(stdout).fetch(name).first
+      else
+        log_errors_with_cmd command, stdout
+        list_entry
+      end
+    rescue KeyError
+      logger.info('Conda', "Key error trying to find #{name} in\n#{JSON(stdout)}")
+      list_entry
+    end
+  end
+end

data/lib/license_finder/package_managers/dep.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'tomlrb'
+
+module LicenseFinder
+  class Dep < PackageManager
+    def possible_package_paths
+      [project_path.join('Gopkg.lock')]
+    end
+
+    def current_packages
+      toml = Tomlrb.load_file(detected_package_path)
+      projects = toml['projects']
+
+      return [] if projects.nil?
+
+      projects.map do |project|
+        GoPackage.from_dependency({
+                                    'ImportPath' => project['name'],
+                                    'InstallPath' => project_path.join('vendor', project['name']),
+                                    'Rev' => project['revision'],
+                                    'Homepage' => repo_name(project['name'])
+                                  }, nil, true)
+      end
+    end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+
+    def self.takes_priority_over
+      Go15VendorExperiment
+    end
+
+    def prepare_command
+      'dep ensure -vendor-only'
+    end
+
+    def package_management_command
+      'dep'
+    end
+  end
+end

data/lib/license_finder/package_managers/dotnet.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'pathname'
+require 'json'
+
+module LicenseFinder
+  class Dotnet < PackageManager
+    class AssetFile
+      def initialize(path)
+        @manifest = JSON.parse(File.read(path))
+      end
+
+      def dependencies
+        libs = @manifest.fetch('libraries').reject do |_, v|
+          v.fetch('type') == 'project'
+        end
+
+        libs.keys.map do |name|
+          parts = name.split('/')
+          PackageMetadata.new(parts[0], parts[1], possible_spec_paths(name))
+        end
+      end
+
+      def possible_spec_paths(package_key)
+        lib = @manifest.fetch('libraries').fetch(package_key)
+        spec_filename = lib.fetch('files').find { |f| f.end_with?('.nuspec') }
+        return [] if spec_filename.nil?
+
+        @manifest.fetch('packageFolders').keys.map do |root|
+          Pathname(root).join(lib.fetch('path'), spec_filename).to_s
+        end
+      end
+    end
+
+    class PackageMetadata
+      attr_reader :name, :version, :possible_spec_paths
+
+      def initialize(name, version, possible_spec_paths)
+        @name = name
+        @version = version
+        @possible_spec_paths = possible_spec_paths
+      end
+
+      def read_license_urls
+        possible_spec_paths.flat_map do |path|
+          Nuget.nuspec_license_urls(File.read(path)) if File.exist? path
+        end.compact
+      end
+
+      def ==(other)
+        other.name == name && other.version == version && other.possible_spec_paths == possible_spec_paths
+      end
+    end
+
+    def possible_package_paths
+      paths = Dir[project_path.join('*.csproj')]
+      paths.map { |p| Pathname(p) }
+    end
+
+    def current_packages
+      package_metadatas = asset_files
+                          .flat_map { |path| AssetFile.new(path).dependencies }
+                          .uniq { |d| [d.name, d.version] }
+
+      package_metadatas.map do |d|
+        path = Dir.glob("#{Dir.home}/.nuget/packages/#{d.name.downcase}/#{d.version}").first
+        NugetPackage.new(d.name, d.version, spec_licenses: d.read_license_urls, install_path: path)
+      end
+    end
+
+    def asset_files
+      Dir[project_path.join('**/project.assets.json')]
+    end
+
+    def package_management_command
+      'dotnet'
+    end
+
+    def prepare_command
+      "#{package_management_command} restore"
+    end
+  end
+end

data/lib/license_finder/package_managers/erlangmk.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Erlangmk < PackageManager
+    def package_management_command
+      'make'
+    end
+
+    def package_management_command_with_path
+      "#{package_management_command} --directory=#{project_path} --no-print-directory"
+    end
+
+    # The IS_DEP=1 is added because not all erlang.mk-based projects are
+    # updated to a version that is compatible with LicenseFinder
+    def prepare_command
+      "#{package_management_command_with_path} IS_DEP=1 fetch-deps"
+    end
+
+    def possible_package_paths
+      [
+        project_path.join('Erlang.mk'),
+        project_path.join('erlang.mk')
+      ]
+    end
+
+    def current_packages
+      deps.map do |dep|
+        ErlangmkPackage.new(dep)
+      end
+    end
+
+    private
+
+    def deps
+      command = "#{package_management_command_with_path} QUERY='name fetch_method repo version absolute_path' query-deps"
+      stdout, stderr, status = Cmd.run(command)
+      if status.success?
+        dep_re = Regexp.new('^\s*DEP')
+        line_re = Regexp.new('^[_a-z0-9]+:')
+        stdout.each_line.map(&:strip).select { |line| !(line.start_with?('make') || line =~ dep_re) && line =~ line_re }
+      elsif stderr.include? "No rule to make target 'query-deps'"
+        # The stderr check happens because not all erlang.mk-based projects are
+        # updated to a version that is compatible with LicenseFinder
+        []
+      else
+        raise "Command '#{command}' failed to execute: #{stderr}"
+      end
+    end
+  end
+end

data/lib/license_finder/package_managers/glide.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Glide < PackageManager
+    def possible_package_paths
+      [project_path.join('glide.lock')]
+    end
+
+    def current_packages
+      detected_path = detected_package_path
+
+      YAML.load_file(detected_path).fetch('imports').map do |package_hash|
+        import_path = package_hash.fetch('name')
+        license_path = project_path.join('vendor', import_path)
+
+        GoPackage.from_dependency({
+                                    'ImportPath' => import_path,
+                                    'InstallPath' => license_path,
+                                    'Rev' => package_hash.fetch('version')
+                                  }, nil, true)
+      end
+    end
+
+    def self.takes_priority_over
+      Go15VendorExperiment
+    end
+
+    def package_management_command
+      'glide'
+    end
+
+    def prepare_command
+      'glide install'
+    end
+  end
+end

data/lib/license_finder/package_managers/go_15vendorexperiment.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Go15VendorExperiment < PackageManager
+    def initialize(options = {})
+      super
+      @full_version = options[:go_full_version]
+    end
+
+    def active?
+      super && go_files_exist?
+    end
+
+    def go_files_exist?
+      !Dir[project_path.join('**/*.go')].empty? && !Dir[project_path.join('vendor/**/*.go')].empty?
+    end
+
+    def possible_package_paths
+      [project_path.join('vendor')]
+    end
+
+    def project_sha(path)
+      Dir.chdir(path) do
+        stdout, _stderr, status = Cmd.run('git rev-list --max-count 1 HEAD')
+        raise 'git rev-list failed' unless status.success?
+
+        stdout.strip
+      end
+    end
+
+    def current_packages
+      deps = go_list
+      vendored_deps = deps.select { |dep| detected_package_path.join(dep).exist? }
+      vendored_deps.map do |dep|
+        GoPackage.from_dependency({
+                                    'ImportPath' => dep,
+                                    'InstallPath' => detected_package_path.join(dep),
+                                    'Rev' => 'vendored-' + project_sha(detected_package_path.join(dep)),
+                                    'Homepage' => repo_name(dep)
+                                  }, nil, true)
+      end
+    end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+
+    def package_management_command
+      'go'
+    end
+
+    def go_list
+      Dir.chdir(project_path) do
+        # avoid checking canonical import path. some projects uses
+        # non-canonical import path and rely on the fact that the deps are
+        # checked in. Canonical paths are only checked by `go get'. We
+        # discovered that `go list' will print a warning and unfortunately exit
+        # with status code 1. Setting GOPATH to nil removes those warnings.
+        orig_gopath = ENV['GOPATH']
+        ENV['GOPATH'] = nil
+        val, _stderr, status = Cmd.run('go list -f "{{join .Deps \"\n\"}}" ./...')
+        ENV['GOPATH'] = orig_gopath
+        return [] unless status.success?
+
+        # Select non-standard packages. `go list std` returns the list of standard
+        # dependencies. We then filter those dependencies out of the full list of
+        # dependencies.
+        deps = val.split("\n")
+        Cmd.run('go list std').first.split("\n").each do |std|
+          deps.delete_if do |dep|
+            dep =~ %r{(\/|^)#{std}(\/|$)}
+          end
+        end
+        deps.map do |d|
+          dep_parts = d.split('/')
+          if dep_parts.length > 2
+            dep_parts[0..2].join('/')
+          else
+            d
+          end
+        end
+      end
+    end
+  end
+end

data/lib/license_finder/package_managers/go_dep.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class GoDep < PackageManager
+    OLD_GODEP_VENDOR_PATH = 'Godeps/_workspace/src'
+    GODEP_VENDOR_PATH = 'vendor'
+
+    def initialize(options = {})
+      super
+      @full_version = options[:go_full_version]
+    end
+
+    def current_packages
+      packages_from_json(detected_package_path.read)
+      # godep includes subpackages as a seperate dependency, we can de-dup that
+    end
+
+    def self.takes_priority_over
+      Go15VendorExperiment
+    end
+
+    def possible_package_paths
+      [project_path.join('Godeps/Godeps.json')]
+    end
+
+    def package_management_command
+      'godep'
+    end
+
+    private
+
+    def install_prefix
+      @install_prefix ||= if project_path.join(OLD_GODEP_VENDOR_PATH).directory?
+                            project_path.join(OLD_GODEP_VENDOR_PATH)
+                          elsif project_path.join(GODEP_VENDOR_PATH).directory?
+                            project_path.join(GODEP_VENDOR_PATH)
+                          else
+                            download_dependencies
+                            Pathname(ENV['GOPATH'] ? ENV['GOPATH'] + '/src' : ENV['HOME'] + '/go/src')
+                          end
+    end
+
+    def download_dependencies
+      command = "#{package_management_command} restore"
+      _, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" if !status.success? && status.exitstatus != 1
+    end
+
+    def packages_from_json(json_string)
+      all_packages = JSON.parse(json_string)['Deps']
+
+      return [] unless all_packages
+
+      packages_grouped_by_revision = all_packages.group_by { |package| package['Rev'] }
+      result = []
+
+      packages_grouped_by_revision.each do |_sha, packages_in_group|
+        all_paths_in_group = packages_in_group.map { |p| p['ImportPath'] }
+        common_paths = CommonPathHelper.longest_common_paths(all_paths_in_group)
+        package_info = packages_in_group.first
+
+        common_paths.each do |common_path|
+          dependency_info_hash = {
+            'Homepage' => common_path,
+            'ImportPath' => common_path,
+            'InstallPath' => package_info['InstallPath'],
+            'Rev' => package_info['Rev']
+          }
+
+          result << GoPackage.from_dependency(dependency_info_hash,
+                                              install_prefix,
+                                              @full_version)
+        end
+      end
+      result
+    end
+  end
+end

data/lib/license_finder/package_managers/go_modules.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'license_finder/packages/go_package'
+
+module LicenseFinder
+  class GoModules < PackageManager
+    PACKAGES_FILE = 'go.mod'
+
+    class << self
+      def takes_priority_over
+        Go15VendorExperiment
+      end
+    end
+
+    def active?
+      mod_files?
+    end
+
+    def current_packages
+      packages = packages_info.map do |package|
+        name, version, install_path = package.split(',')
+        read_package(install_path, name, version) if install_path.to_s != ''
+      end.compact
+      packages.reject do |package|
+        Pathname(package.install_path).cleanpath == Pathname(project_path).cleanpath
+      end
+    end
+
+    private
+
+    def packages_info
+      Dir.chdir(project_path) do
+        # Explanations:
+        # * Only list dependencies (packages not listed in the project directory)
+        #   (.DepOnly)
+        # * Ignore packages that have nil modules
+        #   (.Module)
+        # * Ignore standard library packages
+        #   (not .Standard)
+        # * Replacement modules are respected
+        #   (or .Module.Replace .Module)
+        # * Module cache directory or (vendored) package directory
+        #   (or $mod.Dir .Dir)
+        format_str = \
+          '{{ if and (.DepOnly) (.Module) (not .Standard) }}'\
+            '{{ $mod := (or .Module.Replace .Module) }}'\
+            '{{ $mod.Path }},{{ $mod.Version }},{{ or $mod.Dir .Dir }}'\
+          '{{ end }}'
+
+        # The module list flag (`-m`) is intentionally not used here. If the module
+        # dependency tree were followed, transitive dependencies that are never imported
+        # may be included.
+        #
+        # Instead, the owning module is listed for each imported package. This better
+        # matches the implementation of other Go package managers.
+        #
+        # TODO: Figure out a way to make the vendor directory work (i.e. remove the
+        # -mod=readonly flag). Each of the imported packages gets listed separatly,
+        # confusing the issue as to which package is the root of the module.
+        go_list_cmd = "GO111MODULE=on go list -mod=readonly -deps -f '#{format_str}' ./..."
+        info_output, stderr, status = Cmd.run(go_list_cmd)
+        log_errors_with_cmd(go_list_cmd, "Getting the dependencies from go list failed \n\t#{stderr}") unless status.success?
+        raise "Command '#{go_list_cmd}' failed to execute" unless status.success?
+
+        # Since many packages may belong to a single module, #uniq is used to deduplicate
+        info_output.split("\n").uniq
+      end
+    end
+
+    def mod_files?
+      mod_file_paths.any?
+    end
+
+    def mod_file_paths
+      Dir[project_path.join(PACKAGES_FILE)]
+    end
+
+    def read_package(install_path, name, version)
+      info = {
+        'ImportPath' => name,
+        'InstallPath' => install_path,
+        'Rev' => version,
+        'Homepage' => repo_name(name)
+      }
+
+      GoPackage.from_dependency(info, nil, true)
+    end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+  end
+end