gitlab-license_finder 6.14.2.1

data/lib/license_finder/cli/main.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require 'license_finder/report'
+require 'license_finder/version'
+require 'license_finder/diff'
+require 'license_finder/package_delta'
+require 'license_finder/license_aggregator'
+require 'license_finder/project_finder'
+require 'license_finder/logger'
+
+module LicenseFinder
+  module CLI
+    class Main < Base
+      extend Rootcommand
+
+      FORMATS = {
+        'text' => TextReport,
+        'html' => HtmlReport,
+        'markdown' => MarkdownReport,
+        'csv' => CsvReport,
+        'xml' => XmlReport,
+        'json' => JsonReport,
+        'junit' => JunitReport
+      }.freeze
+
+      class_option :go_full_version, desc: 'Whether dependency version should include full version. Only meaningful if used with a Go project. Defaults to false.'
+      class_option :gradle_include_groups, desc: 'Whether dependency name should include group id. Only meaningful if used with a Java/gradle project. Defaults to false.'
+      class_option :gradle_command,
+                   desc: "Command to use when fetching gradle packages. Only meaningful if used with a Java/gradle project.
+                          Defaults to 'gradlew' / 'gradlew.bat' if the wrapper is present, otherwise to 'gradle'."
+      class_option :maven_include_groups, desc: 'Whether dependency name should include group id. Only meaningful if used with a Java/maven project. Defaults to false.'
+      class_option :maven_options, desc: 'Maven options to append to command. Defaults to empty.'
+      class_option :npm_options, desc: 'npm options to append to command. Defaults to empty.'
+      class_option :pip_requirements_path, desc: 'Path to python requirements file. Defaults to requirements.txt.'
+      class_option :python_version, desc: 'Python version to invoke pip with. Valid versions: 2 or 3. Default: 2'
+      class_option :rebar_command, desc: "Command to use when fetching rebar packages. Only meaningful if used with a Erlang/rebar project. Defaults to 'rebar'."
+      class_option :rebar_deps_dir, desc: "Path to rebar dependencies directory. Only meaningful if used with a Erlang/rebar project. Defaults to 'deps'."
+      class_option :elixir_command, desc: "Command to use when parsing package metadata for Mix. Only meaningful if used with a Mix project (i.e., Elixir or Erlang). Defaults to 'elixir'."
+      class_option :mix_command, desc: "Command to use when fetching packages through Mix. Only meaningful if used with a Mix project (i.e., Elixir or Erlang). Defaults to 'mix'."
+      class_option :mix_deps_dir, desc: "Path to Mix dependencies directory. Only meaningful if used with a Mix project (i.e., Elixir or Erlang). Defaults to 'deps'."
+      class_option :sbt_include_groups, desc: 'Whether dependency name should include group id. Only meaningful if used with a Scala/sbt project. Defaults to false.'
+      class_option :conda_bash_setup_script, desc: "Path to conda.sh script. Only meaningful if used with a Conda project. Defaults to '~/miniconda3/etc/profile.d/conda.sh'."
+      class_option :composer_check_require_only,
+                   desc: "Whether to only check for licenses from dependencies on the 'require' section. Only meaningful if used with a Composer project. Defaults to false."
+
+      # Method options which are shared between report and action_item
+      def self.format_option
+        method_option :format,
+                      desc: 'Emit detailed info about what LicenseFinder is doing',
+                      default: 'text',
+                      enum: FORMATS.keys
+      end
+
+      def self.shared_options
+        method_option :debug,
+                      aliases: '-d',
+                      type: :boolean,
+                      desc: 'Emit detailed info about what LicenseFinder is doing'
+
+        method_option :prepare,
+                      aliases: '-p',
+                      type: :boolean,
+                      desc: 'Prepares the project first for license_finder',
+                      default: false,
+                      required: false
+
+        method_option :prepare_no_fail,
+                      type: :boolean,
+                      desc: 'Prepares the project first for license_finder but carries on despite any potential failures',
+                      default: false,
+                      required: false
+
+        method_option :recursive,
+                      aliases: '-r',
+                      type: :boolean,
+                      default: false,
+                      desc: 'Recursively runs License Finder on all sub-projects'
+
+        method_option :aggregate_paths,
+                      aliases: '-a',
+                      type: :array,
+                      desc: "Generate a single report for multiple projects. Ex: --aggregate_paths='path/to/project1' 'path/to/project2'"
+
+        method_option :quiet,
+                      aliases: '-q',
+                      type: :boolean,
+                      desc: 'Silences progress report',
+                      required: false
+
+        method_option :columns,
+                      desc: "For text or CSV reports, which columns to print. Pick from: #{CsvReport::AVAILABLE_COLUMNS}",
+                      type: :array
+      end
+
+      desc 'project_roots', 'List project directories to be scanned'
+      shared_options
+      def project_roots
+        config.strict_matching = true
+        project_path = config.project_path.to_s || Pathname.pwd.to_s
+        paths = aggregate_paths
+        filtered_project_roots = Scanner.remove_subprojects(paths)
+
+        filtered_project_roots << project_path if aggregate_paths.include?(project_path) && !filtered_project_roots.include?(project_path)
+
+        say(filtered_project_roots)
+      end
+
+      desc 'action_items', 'List unapproved dependencies (the default action for `license_finder`)'
+      shared_options
+      format_option
+      def action_items
+        finder = LicenseAggregator.new(config, aggregate_paths)
+        any_packages = finder.any_packages?
+        unapproved = finder.unapproved
+        restricted = finder.restricted
+
+        # Ensure to start output on a new line even with dot progress indicators.
+        say "\n"
+
+        unless any_packages
+          say 'No dependencies recognized!', :red
+          exit 0
+        end
+
+        if unapproved.empty?
+          say 'All dependencies are approved for use', :green
+        else
+          unless restricted.empty?
+            say 'Restricted dependencies:', :red
+            say report_of(restricted)
+          end
+
+          other_unapproved = unapproved - restricted
+          unless other_unapproved.empty?
+            say 'Dependencies that need approval:', :yellow
+            say report_of(other_unapproved)
+          end
+
+          exit 1
+        end
+      end
+
+      default_task :action_items
+
+      desc 'report', "Print a report of the project's dependencies to stdout"
+      shared_options
+      format_option
+      method_option :write_headers, type: :boolean, desc: 'Write exported columns as header row (csv).', default: false, required: false
+      method_option :save, desc: "Save report to a file. Default: 'license_report.csv' in project root.", lazy_default: 'license_report'
+
+      def report
+        finder = LicenseAggregator.new(config, aggregate_paths)
+        report = report_of(finder.dependencies)
+        save? ? save_report(report, config.save_file) : say(report)
+      end
+
+      desc 'version', 'Print the version of LicenseFinder'
+      def version
+        puts LicenseFinder::VERSION
+      end
+
+      desc 'diff OLDFILE NEWFILE', 'Command to view the differences between two generated reports (csv).'
+      format_option
+      method_option :save, desc: "Save report to a file. Default: 'license_report.csv' in project root.", lazy_default: 'license_report'
+      def diff(file1, file2)
+        f1 = IO.read(file1)
+        f2 = IO.read(file2)
+        report = DiffReport.new(Diff.compare(f1, f2))
+        save? ? save_report(report, config.save_file) : say(report)
+      end
+
+      subcommand 'dependencies', Dependencies, 'Add or remove dependencies that your package managers are not aware of'
+      subcommand 'licenses', Licenses, "Set a dependency's licenses, if the licenses found by license_finder are missing or wrong"
+      subcommand 'approvals', Approvals, 'Manually approve dependencies, even if their licenses are not permitted'
+      subcommand 'ignored_groups', IgnoredGroups, 'Exclude test and development dependencies from action items and reports'
+      subcommand 'ignored_dependencies', IgnoredDependencies, 'Exclude individual dependencies from action items and reports'
+      subcommand 'permitted_licenses', PermittedLicenses, 'Automatically approve any dependency that has a permitted license'
+      subcommand 'restricted_licenses', RestrictedLicenses, 'Forbid approval of any dependency whose licenses are all restricted'
+      subcommand 'project_name', ProjectName, 'Set the project name, for display in reports'
+      subcommand 'inherited_decisions', InheritedDecisions, 'Add or remove decision files you want to inherit from'
+
+      private
+
+      def check_valid_project_path
+        raise "Project path '#{config.project_path}' does not exist!" unless config.valid_project_path?
+      end
+
+      def aggregate_paths
+        check_valid_project_path
+        aggregate_paths = config.aggregate_paths
+        project_path = config.project_path.to_s || Pathname.pwd.to_s
+        aggregate_paths = ProjectFinder.new(project_path, config.strict_matching).find_projects if config.recursive
+
+        if aggregate_paths.nil? || aggregate_paths.empty?
+          [project_path]
+        else
+          aggregate_paths
+        end
+      end
+
+      def save_report(content, file_name)
+        dir = File.dirname(file_name)
+        FileUtils.mkdir_p(dir) unless Dir.exist?(dir)
+
+        File.open(file_name, 'w') do |f|
+          f.write(content)
+        end
+      end
+
+      def report_of(content)
+        report = FORMATS[config.format] || FORMATS['text']
+        report = MergedReport if report == CsvReport && config.aggregate_paths
+        report.of(content, columns: config.columns, project_name: decisions.project_name || config.project_path.basename.to_s, write_headers: config.write_headers)
+      end
+
+      def save?
+        !!config.save_file
+      end
+    end
+  end
+end

data/lib/license_finder/cli/makes_decisions.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+    module MakesDecisions
+      def self.included(mod)
+        mod.extend(ClassMethods)
+      end
+
+      module ClassMethods
+        def auditable
+          method_option :who, desc: 'The person making this decision'
+          method_option :why, desc: 'The reason for making this decision'
+        end
+
+        def approvable
+          method_option :version, desc: 'The version that will be approved'
+        end
+      end
+
+      private
+
+      def txn
+        @txn ||= {
+          who: options[:who],
+          why: options[:why],
+          versions: options[:version] ? [options[:version]] : [],
+          when: Time.now.getutc
+        }
+      end
+
+      def modifying
+        yield
+        decisions.save!(config.decisions_file_path)
+      end
+    end
+  end
+end

data/lib/license_finder/cli/patched_thor.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+    module Rootcommand
+      # Helper to auto-generate the documentation for a group of commands
+      def subcommand(namespace, klass, namespace_description)
+        description = "#{namespace} [#{(klass.tasks.keys - ['help']).join('|')}]"
+        desc description, "#{namespace_description} - see `license_finder #{namespace} help` for more information"
+        super namespace, klass
+      end
+    end
+
+    # Thor fix for `license_finder <subcommand> help <action>`
+    module Subcommand
+      # Hack to override the help message produced by Thor.
+      # https://github.com/wycats/thor/issues/261#issuecomment-16880836
+      def banner(command, _namespace = nil, _subcommand = nil)
+        "#{basename} #{underscore_name(name)} #{command.usage}"
+      end
+
+      protected
+
+      def underscore_name(name)
+        underscored = name.split('::').last
+        underscored.gsub!(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+        underscored.gsub!(/([a-z\d])([A-Z])/, '\1_\2')
+        underscored.tr!('-', '_')
+        underscored.downcase
+      end
+    end
+  end
+end

data/lib/license_finder/cli/permitted_licenses.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+    class PermittedLicenses < Base
+      extend Subcommand
+      include MakesDecisions
+
+      desc 'list', 'List all the permitted licenses'
+      def list
+        say 'Permitted Licenses:', :blue
+        say_each(decisions.permitted, &:name)
+      end
+
+      auditable
+      desc 'add LICENSE...', 'Add one or more licenses to the permitted licenses'
+      def add(*licenses)
+        assert_some licenses
+        modifying { licenses.each { |l| decisions.permit(l, txn) } }
+        say "Added #{licenses.join(', ')} to the permitted licenses"
+      end
+
+      auditable
+      desc 'remove LICENSE...', 'Remove one or more licenses from the permitted licenses'
+      def remove(*licenses)
+        assert_some licenses
+        modifying { licenses.each { |l| decisions.unpermit(l, txn) } }
+        say "Removed #{licenses.join(', ')} from the license permitted licenses"
+      end
+    end
+  end
+end

data/lib/license_finder/cli/project_name.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+    class ProjectName < Base
+      extend Subcommand
+      include MakesDecisions
+
+      desc 'show', 'Show the project name'
+      def show
+        say 'Project Name:', :blue
+        say decisions.project_name
+      end
+
+      auditable
+      desc 'add NAME', 'Set the project name'
+      def add(name)
+        modifying { decisions.name_project(name, txn) }
+
+        say "Set the project name to #{name}", :green
+      end
+
+      auditable
+      desc 'remove', 'Remove the project name'
+      def remove
+        modifying { decisions.unname_project(txn) }
+
+        say 'Removed the project name'
+      end
+    end
+  end
+end

data/lib/license_finder/cli/restricted_licenses.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+    class RestrictedLicenses < Base
+      extend Subcommand
+      include MakesDecisions
+
+      desc 'list', 'List all the restricted licenses'
+      def list
+        say 'Restricted Licenses:', :blue
+        say_each(decisions.restricted, &:name)
+      end
+
+      auditable
+      desc 'add LICENSE...', 'Add one or more licenses to the restricted licenses'
+      def add(*licenses)
+        assert_some licenses
+        modifying { licenses.each { |l| decisions.restrict(l, txn) } }
+        say "Added #{licenses.join(', ')} to the restricted licenses"
+      end
+
+      auditable
+      desc 'remove LICENSE...', 'Remove one or more licenses from the restricted licenses'
+      def remove(*licenses)
+        assert_some licenses
+        modifying { licenses.each { |l| decisions.unrestrict(l, txn) } }
+        say "Removed #{licenses.join(', ')} from the restricted licenses"
+      end
+    end
+  end
+end

data/lib/license_finder/cli.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module CLI
+  end
+end
+
+require 'license_finder/cli/patched_thor'
+require 'license_finder/cli/base'
+require 'license_finder/cli/makes_decisions'
+require 'license_finder/cli/inherited_decisions'
+require 'license_finder/cli/permitted_licenses'
+require 'license_finder/cli/restricted_licenses'
+require 'license_finder/cli/dependencies'
+require 'license_finder/cli/licenses'
+require 'license_finder/cli/approvals'
+require 'license_finder/cli/ignored_groups'
+require 'license_finder/cli/ignored_dependencies'
+require 'license_finder/cli/project_name'
+require 'license_finder/cli/main'

data/lib/license_finder/configuration.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+
+require_relative 'platform'
+
+module LicenseFinder
+  class Configuration
+    def self.with_optional_saved_config(primary_config)
+      project_path = Pathname(primary_config.fetch(:project_path, Pathname.pwd)).expand_path
+      config_file =  project_path.join('config', 'license_finder.yml')
+      saved_config = config_file.exist? ? YAML.safe_load(config_file.read) : {}
+      new(primary_config, saved_config)
+    end
+
+    def initialize(primary_config, saved_config)
+      @primary_config = primary_config
+      @saved_config = saved_config
+    end
+
+    def valid_project_path?
+      return project_path.exist? if get(:project_path)
+
+      true
+    end
+
+    def elixir_command
+      get(:elixir_command) || 'elixir'
+    end
+
+    def mix_command
+      get(:mix_command) || 'mix'
+    end
+
+    def merge(other_hash)
+      dup_with other_hash
+    end
+
+    def rebar_deps_dir
+      path = get(:rebar_deps_dir) || '_build/default/lib'
+      project_path.join(path).expand_path
+    end
+
+    def mix_deps_dir
+      path = get(:mix_deps_dir) || 'deps'
+      project_path.join(path).expand_path
+    end
+
+    def decisions_file_path
+      path = File.join(project_path, 'doc/dependency_decisions.yml') unless project_path.nil?
+      path = get(:decisions_file) unless get(:decisions_file).nil?
+      path = 'doc/dependency_decisions.yml' if path.nil?
+      Pathname.new(path)
+    end
+
+    def log_directory
+      path = get(:log_directory) || 'lf_logs'
+
+      if (aggregate_paths || recursive) && project_path == ''
+        Pathname(path).expand_path
+      else
+        project_path.join(path).expand_path
+      end
+    end
+
+    def project_path
+      Pathname(path_prefix).expand_path
+    end
+
+    def enabled_package_manager_ids
+      get(:enabled_package_managers)
+    end
+
+    def logger_mode
+      get(:logger)
+    end
+
+    def gradle_command
+      get(:gradle_command)
+    end
+
+    def go_full_version
+      get(:go_full_version)
+    end
+
+    def gradle_include_groups
+      get(:gradle_include_groups)
+    end
+
+    def maven_include_groups
+      get(:maven_include_groups)
+    end
+
+    def maven_options
+      get(:maven_options)
+    end
+
+    def npm_options
+      get(:npm_options)
+    end
+
+    def pip_requirements_path
+      get(:pip_requirements_path)
+    end
+
+    def conda_bash_setup_script
+      get(:conda_bash_setup_script)
+    end
+
+    def python_version
+      get(:python_version)
+    end
+
+    def rebar_command
+      get(:rebar_command)
+    end
+
+    def prepare
+      get(:prepare) || prepare_no_fail
+    end
+
+    def prepare_no_fail
+      get(:prepare_no_fail)
+    end
+
+    def write_headers
+      get(:write_headers)
+    end
+
+    def save_file
+      get(:save)
+    end
+
+    def aggregate_paths
+      get(:aggregate_paths)
+    end
+
+    def recursive
+      get(:recursive)
+    end
+
+    def format
+      get(:format)
+    end
+
+    def columns
+      get(:columns)
+    end
+
+    def sbt_include_groups
+      get(:sbt_include_groups)
+    end
+
+    def composer_check_require_only
+      get(:composer_check_require_only)
+    end
+
+    attr_writer :strict_matching
+
+    attr_reader :strict_matching
+
+    protected
+
+    attr_accessor :primary_config
+    def dup_with(other_hash)
+      dup.tap do |dup|
+        dup.primary_config.merge!(other_hash)
+      end
+    end
+
+    private
+
+    attr_reader :saved_config
+
+    def get(key)
+      @primary_config[key.to_sym] || @saved_config[key.to_s]
+    end
+
+    def initialize_copy(orig)
+      super
+      @primary_config = @primary_config.dup
+    end
+
+    def path_prefix
+      get(:project_path) || ''
+    end
+  end
+end