gitlab-license_finder 6.14.2.1

data/lib/license_finder/package_managers/nuget.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+
+require 'rexml/document'
+require 'zip'
+
+module LicenseFinder
+  class Nuget < PackageManager
+    class Assembly
+      attr_reader :name, :path
+
+      def initialize(path, name)
+        @path = path
+        @name = name
+      end
+
+      def dependencies
+        xml = REXML::Document.new(File.read(path.join('packages.config')))
+        packages = REXML::XPath.match(xml, '//package')
+        packages.map do |p|
+          attrs = p.attributes
+          Dependency.new(attrs['id'], attrs['version'], name)
+        end
+      end
+    end
+
+    Dependency = Struct.new(:name, :version, :assembly)
+
+    def possible_package_paths
+      path = project_path.join('vendor/*.nupkg')
+      nuget_dir = Dir[path].map { |pkg| File.dirname(pkg) }.uniq
+
+      # Presence of a .sln is a good indicator for a dotnet solution
+      # cf.: https://docs.microsoft.com/en-us/nuget/tools/cli-ref-restore#remarks
+      path = project_path.join('*.sln')
+      solution_file = Dir[path].first
+
+      possible_paths = [project_path.join('packages.config'), project_path.join('.nuget')]
+      possible_paths.unshift(Pathname(solution_file)) unless solution_file.nil?
+      possible_paths.unshift(Pathname(nuget_dir.first)) unless nuget_dir.empty?
+      possible_paths
+    end
+
+    def assemblies
+      Dir.glob(project_path.join('**', 'packages.config'), File::FNM_DOTMATCH).map do |d|
+        path = Pathname.new(d).dirname
+        name = path.basename.to_s
+        Assembly.new path, name
+      end
+    end
+
+    def current_packages
+      dependencies.each_with_object({}) do |dep, memo|
+        licenses = license_urls(dep)
+        path = Dir.glob("#{Dir.home}/.nuget/packages/#{dep.name.downcase}/#{dep.version}").first
+
+        memo[dep.name] ||= NugetPackage.new(dep.name, dep.version, spec_licenses: licenses, install_path: path)
+        memo[dep.name].groups << dep.assembly unless memo[dep.name].groups.include? dep.assembly
+      end.values
+    end
+
+    def license_urls(dep)
+      files = Dir["**/#{dep.name}.#{dep.version}.nupkg"]
+      return nil if files.empty?
+
+      file = files.first
+      Zip::File.open file do |zipfile|
+        content = zipfile.read(dep.name + '.nuspec')
+        Nuget.nuspec_license_urls(content)
+      end
+    end
+
+    def dependencies
+      assemblies.flat_map(&:dependencies)
+    end
+
+    def nuget_binary
+      legacy_vcproj = Dir['**/*.vcproj'].any?
+
+      if legacy_vcproj
+        '/usr/local/bin/nugetv3.5.0.exe'
+      else
+        '/usr/local/bin/nuget.exe'
+      end
+    end
+
+    def package_management_command
+      return 'nuget' if LicenseFinder::Platform.windows?
+
+      "mono #{nuget_binary}"
+    end
+
+    def prepare
+      Dir.chdir(project_path) do
+        cmd = prepare_command
+        stdout, stderr, status = Cmd.run(cmd)
+        return if status.success?
+
+        log_errors stderr
+
+        if stderr.include?('-PackagesDirectory')
+          logger.info cmd, 'trying fallback prepare command', color: :magenta
+
+          cmd = "#{cmd} -PackagesDirectory /#{Dir.home}/.nuget/packages"
+          stdout, stderr, status = Cmd.run(cmd)
+          return if status.success?
+
+          log_errors_with_cmd(cmd, stderr)
+        end
+
+        error_message = "Prepare command '#{cmd}' failed\n#{stderr}"
+        error_message += "\n#{stdout}\n" if !stdout.nil? && !stdout.empty?
+        raise error_message unless @prepare_no_fail
+      end
+    end
+
+    def prepare_command
+      cmd = package_management_command
+      sln_files = Dir['*.sln']
+      cmds = []
+      if sln_files.count > 1
+        sln_files.each do |sln|
+          cmds << "#{cmd} restore #{sln}"
+        end
+      else
+        cmds << "#{cmd} restore"
+      end
+
+      cmds.join(' && ')
+    end
+
+    def installed?(logger = Core.default_logger)
+      _stdout, _stderr, status = Cmd.run(nuget_check)
+      if status.success?
+        logger.debug self.class, 'is installed', color: :green
+      else
+        logger.info self.class, 'is not installed', color: :red
+      end
+      status.success?
+    end
+
+    def nuget_check
+      return 'where nuget' if LicenseFinder::Platform.windows?
+
+      "which mono && ls #{nuget_binary}"
+    end
+
+    def self.nuspec_license_urls(specfile_content)
+      xml = REXML::Document.new(specfile_content)
+      REXML::XPath.match(xml, '//metadata//licenseUrl')
+                  .map(&:get_text)
+                  .map(&:to_s)
+    end
+  end
+end

data/lib/license_finder/package_managers/pip.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Pip < PackageManager
+    DEFAULT_VERSION = '2'
+
+    def initialize(options = {})
+      super
+      @requirements_path = options[:pip_requirements_path] || Pathname('requirements.txt')
+      @python_version = options[:python_version] || DEFAULT_VERSION
+      raise "Invalid python version \'#{@python_version}\'. Valid versions are '2' or '3'." unless %w[2 3].include?(@python_version)
+    end
+
+    def current_packages
+      pip_output.map do |name, version, children, location|
+        PipPackage.new(
+          name,
+          version,
+          PyPI.definition(name, version),
+          logger: logger,
+          children: children,
+          install_path: Pathname(location).join(name)
+        )
+      end
+    end
+
+    def package_management_command
+      "pip#{@python_version}"
+    end
+
+    def prepare_command
+      "pip#{@python_version} install"
+    end
+
+    def prepare
+      prep_cmd = "#{prepare_command} -r #{@requirements_path}"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def possible_package_paths
+      if project_path.nil?
+        [@requirements_path]
+      else
+        [project_path.join(@requirements_path)]
+      end
+    end
+
+    private
+
+    def pip_output
+      command = "python#{@python_version == '2' ? '' : '3'} #{LicenseFinder::BIN_PATH.join('license_finder_pip.py')} #{detected_package_path}"
+      stdout, stderr, status = Cmd.run(command)
+
+      if status.success?
+        JSON(stdout).map do |package|
+          package.values_at('name', 'version', 'dependencies', 'location')
+        end
+      else
+        log_errors "LicenseFinder command '#{command}' failed:\n\t#{stderr}"
+        []
+      end
+    end
+  end
+end

data/lib/license_finder/package_managers/pipenv.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'license_finder/package_utils/pypi'
+
+module LicenseFinder
+  class Pipenv < PackageManager
+    def initialize(options = {})
+      super
+      @lockfile = Pathname('Pipfile.lock')
+    end
+
+    def current_packages
+      @current_packages ||=
+        begin
+          packages = {}
+          each_dependency(groups: allowed_groups) do |name, data, group|
+            version = canonicalize(data['version'] || 'unknown')
+            package = packages.fetch(key_for(name, version)) do |key|
+              packages[key] = build_package_for(name, version)
+            end
+            package.groups << group
+          end
+          packages.values
+        end
+    end
+
+    def possible_package_paths
+      project_path ? [project_path.join(@lockfile)] : [@lockfile]
+    end
+
+    private
+
+    def each_dependency(groups: [])
+      dependencies = JSON.parse(IO.read(detected_package_path))
+      groups.each do |group|
+        dependencies[group].each do |name, data|
+          yield name, data, group
+        end
+      end
+    end
+
+    def canonicalize(version)
+      version.sub(/^==/, '')
+    end
+
+    def build_package_for(name, version)
+      PipPackage.new(name, version, PyPI.definition(name, version))
+    end
+
+    def key_for(name, version)
+      "#{name}-#{version}"
+    end
+
+    def allowed_groups
+      %w[default develop] - ignored_groups.to_a
+    end
+
+    def ignored_groups
+      @ignored_groups || []
+    end
+  end
+end

data/lib/license_finder/package_managers/rebar.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Rebar < PackageManager
+    def initialize(options = {})
+      super
+      @command = options[:rebar_command] || package_management_command
+      @deps_path = Pathname(options[:rebar_deps_dir] || File.join(project_path, '_build/default/lib'))
+    end
+
+    def current_packages
+      rebar_deps.map do |name, version|
+        licenses, homepage = dep_info(name)
+        RebarPackage.new(
+          name,
+          version,
+          install_path: @deps_path.join(name),
+          homepage: homepage,
+          spec_licenses: licenses.nil? ? [] : [licenses],
+          logger: logger
+        )
+      end
+    end
+
+    def package_management_command
+      'rebar3'
+    end
+
+    def possible_package_paths
+      [project_path.join('rebar.config')]
+    end
+
+    private
+
+    def rebar_deps
+      command = "#{@command} tree"
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" unless status.success?
+
+      stdout
+        .each_line
+        .reject { |line| line.start_with?('=') || line.include?('project app') }
+        .map do |line|
+          matches = line.match(/(?<name>\w+)─(?<version>[\S.]+)\s*/)
+          [matches[:name], matches[:version]] if matches
+        end.compact
+    end
+
+    def dep_info(name)
+      command = "#{@command} pkgs #{name}"
+      stdout, _, status = Cmd.run(command)
+      return [nil, nil] unless status.success?
+
+      licenses = nil
+      homepage = nil
+
+      stdout.scan(/Licenses: (?<licenses>.+)|(?<homepage>(https|http).*)/) do |pkg_licenses, pkg_homepage|
+        licenses ||= pkg_licenses
+        homepage ||= pkg_homepage
+      end
+
+      [licenses, homepage]
+    end
+  end
+end

data/lib/license_finder/package_managers/sbt.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'csv'
+require 'license_finder/package_utils/sbt_dependency_finder'
+
+module LicenseFinder
+  class Sbt < PackageManager
+    def initialize(options = {})
+      super
+      @include_groups = options[:sbt_include_groups]
+    end
+
+    def current_packages
+      command = "#{package_management_command} dumpLicenseReport"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" unless status.success?
+
+      dependencies = SbtDependencyFinder.new(project_path).dependencies
+      packages = dependencies.flat_map do |text|
+        options = {
+          headers: true
+        }
+
+        contents = CSV.parse(text, options)
+        contents.map do |row|
+          group_id, name, version = row['Dependency'].split('#').map(&:strip)
+          spec = {
+            'artifactId' => name,
+            'groupId' => group_id,
+            'version' => version,
+            'licenses' => [{ 'name' => row['License'] }]
+          }
+
+          path = File.join("#{Dir.home}/.ivy2/cache", "#{spec['groupId']}/#{spec['artifactId']}")
+          SbtPackage.new(spec, logger: logger, include_groups: @include_groups, install_path: path)
+        end
+      end
+
+      packages.uniq
+    end
+
+    def package_management_command
+      'sbt'
+    end
+
+    def possible_package_paths
+      [project_path.join('build.sbt')]
+    end
+  end
+end

data/lib/license_finder/package_managers/spm.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Spm < PackageManager
+    class SpmError < RuntimeError; end
+
+    def current_packages
+      unless File.exist?(workspace_state_path)
+        raise SpmError, 'No checked-out SPM packages found.
+          Please install your dependencies first.'
+      end
+
+      workspace_state = JSON.parse(IO.read(workspace_state_path))
+      workspace_state['object']['dependencies'].map do |dependency|
+        package_ref = dependency['packageRef']
+        checkout_state = dependency['state']['checkoutState']
+
+        subpath = dependency['subpath']
+        package_name = package_ref['name']
+        package_version = checkout_state['version'] || checkout_state['revision']
+        homepage = package_ref['path']
+
+        SpmPackage.new(
+          package_name,
+          package_version,
+          license_text(subpath),
+          logger: logger,
+          install_path: project_checkout(subpath),
+          homepage: homepage
+        )
+      end
+    end
+
+    def package_management_command
+      LicenseFinder::Platform.darwin? ? 'xcodebuild' : 'swift'
+    end
+
+    def prepare_command
+      LicenseFinder::Platform.darwin? ? 'xcodebuild -resolvePackageDependencies' : 'swift package resolve'
+    end
+
+    def possible_package_paths
+      [workspace_state_path]
+    end
+
+    private
+
+    def resolved_package
+      if File.exist?(resolved_path)
+        @resolved_file ||= IO.read(resolved_path)
+      else
+        raise SpmError, 'No Package.resolved found.
+          Please install your dependencies first and provide it via environment variable
+          SPM_PACKAGE_RESOLVED'
+      end
+    end
+
+    def resolved_path
+      # Xcode projects have SPM packages info under project's derived data location
+      derived_data_folder = ENV['SPM_DERIVED_DATA']
+      if derived_data_folder
+        pathname = Pathname.new(derived_data_folder)
+        pathname.absolute? ? pathname : project_path.join(derived_data_folder)
+      else
+        project_path.join('.build')
+      end
+    end
+
+    def workspace_state_path
+      resolved_path.join('workspace-state.json')
+    end
+
+    def license_text(subpath)
+      license_path = license_pattern(subpath).find { |f| File.exist?(f) }
+      license_path.nil? ? nil : IO.read(license_path)
+    end
+
+    def project_checkout(subpath)
+      resolved_path.join('checkouts', subpath)
+    end
+
+    def license_pattern(subpath)
+      checkout_path = project_checkout(subpath)
+      Dir.glob(checkout_path.join('LICENSE*'), File::FNM_CASEFOLD)
+    end
+
+    def name_version_from_line(cartfile_line)
+      cartfile_line.split(' ')[1, 2].map { |f| f.split('/').last.delete('"').gsub('.git', '') }
+    end
+  end
+end

data/lib/license_finder/package_managers/trash.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Trash < PackageManager
+    class << self
+      def package_management_command
+        'trash'
+      end
+
+      def takes_priority_over
+        Go15VendorExperiment
+      end
+    end
+
+    def prepare_command
+      'trash'
+    end
+
+    def possible_package_paths
+      [project_path.join('vendor.conf')]
+    end
+
+    def current_packages
+      dependencies_path = project_path.join('trash.lock')
+
+      YAML.load_file(dependencies_path).fetch('import').map do |package_hash|
+        import_path = package_hash.fetch('package')
+        license_path = project_path.join('vendor', import_path)
+
+        GoPackage.from_dependency({
+                                    'ImportPath' => import_path,
+                                    'InstallPath' => license_path,
+                                    'Rev' => package_hash.fetch('version'),
+                                    'Homepage' => repo_name(import_path)
+                                  }, nil, true)
+      end
+    end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+  end
+end

data/lib/license_finder/package_managers/yarn.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Yarn < PackageManager
+    SHELL_COMMAND = 'yarn licenses list --no-progress --json'
+
+    def possible_package_paths
+      [project_path.join('yarn.lock')]
+    end
+
+    def current_packages
+      cmd = "#{Yarn::SHELL_COMMAND}#{production_flag}"
+      suffix = " --cwd #{project_path}" unless project_path.nil?
+      cmd += suffix unless suffix.nil?
+
+      stdout, _stderr, status = Cmd.run(cmd)
+      return [] unless status.success?
+
+      packages = []
+      incompatible_packages = []
+
+      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
+      json_objects = json_strings.map { |json_object| JSON.parse(json_object) }
+
+      if json_objects.last['type'] == 'table'
+        license_json = json_objects.pop['data']
+        packages = packages_from_json(license_json)
+      end
+
+      json_objects.each do |json_object|
+        match = /(?<name>[\w,\-]+)@(?<version>(\d+\.?)+)/ =~ json_object['data'].to_s
+        if match
+          package = YarnPackage.new(name, version, spec_licenses: ['unknown'])
+          incompatible_packages.push(package)
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
+    def prepare
+      prep_cmd = "#{prepare_command}#{production_flag}"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def self.takes_priority_over
+      NPM
+    end
+
+    def package_management_command
+      'yarn'
+    end
+
+    def prepare_command
+      'yarn install --ignore-engines --ignore-scripts'
+    end
+
+    private
+
+    def packages_from_json(json_data)
+      body = json_data['body']
+      head = json_data['head']
+
+      packages = body.map do |json_package|
+        Hash[head.zip(json_package)]
+      end
+
+      valid_packages = filter_yarn_internal_package(packages)
+
+      valid_packages.map do |package_hash|
+        YarnPackage.new(
+          package_hash['Name'],
+          package_hash['Version'],
+          spec_licenses: [package_hash['License']],
+          homepage: package_hash['VendorUrl'],
+          authors: package_hash['VendorName'],
+          install_path: project_path.join(modules_folder, package_hash['Name'])
+        )
+      end
+    end
+
+    def modules_folder
+      return @modules_folder if @modules_folder
+
+      stdout, _stderr, status = Cmd.run('yarn config get modules-folder')
+      @modules_folder = 'node_modules' if !status.success? || stdout.strip == 'undefined'
+      @modules_folder ||= stdout.strip
+    end
+
+    # remove fake package created by yarn [Yarn Bug]
+    def filter_yarn_internal_package(all_packages)
+      internal_package_pattern = /workspace-aggregator-[a-zA-z0-9]{8}-[a-zA-z0-9]{4}-[a-zA-z0-9]{4}-[a-zA-z0-9]{4}-[a-zA-z0-9]{12}/
+      yarn_internal_package = all_packages.find { |package| internal_package_pattern.match(package['Name']) }
+      all_packages - [yarn_internal_package]
+    end
+
+    def production_flag
+      return '' if @ignored_groups.nil?
+
+      @ignored_groups.include?('devDependencies') ? ' --production' : ''
+    end
+  end
+end

data/lib/license_finder/package_utils/activation.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module Activation
+    # An Activation reports that a license has been activated for a package, and
+    # tracks the source of that information
+    Basic = Struct.new(:package, :license)
+
+    class FromDecision < Basic
+      def sources
+        ['from decision']
+      end
+    end
+
+    class FromSpec < Basic
+      def sources
+        ['from spec']
+      end
+    end
+
+    class FromFiles < Basic
+      def initialize(package, license, files)
+        super(package, license)
+        @files = files
+      end
+
+      attr_reader :files
+
+      def sources
+        files.map { |file| "from file '#{file.path}'" }
+      end
+    end
+
+    class None < Basic
+      def sources
+        []
+      end
+    end
+  end
+end