license_finder-rubyzip3 7.2.1.1

data/lib/license_finder/package_managers/nuget.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require 'rexml/document'
+require 'zip'
+
+module LicenseFinder
+  class Nuget < PackageManager
+    class Assembly
+      attr_reader :name, :path
+
+      def initialize(path, name)
+        @path = path
+        @name = name
+      end
+
+      def dependencies
+        xml = REXML::Document.new(File.read(path.join('packages.config')))
+        packages = REXML::XPath.match(xml, '//package')
+        packages.map do |p|
+          attrs = p.attributes
+          Dependency.new(attrs['id'], attrs['version'], name)
+        end
+      end
+    end
+
+    Dependency = Struct.new(:name, :version, :assembly)
+
+    def possible_package_paths
+      path = project_path.join('vendor/*.nupkg')
+      nuget_dir = Dir[path].map { |pkg| File.dirname(pkg) }.uniq
+
+      # Presence of a .sln is a good indicator for a dotnet solution
+      # cf.: https://docs.microsoft.com/en-us/nuget/tools/cli-ref-restore#remarks
+      path = project_path.join('*.sln')
+      solution_file = Dir[path].first
+
+      possible_paths = [project_path.join('packages.config'), project_path.join('.nuget')]
+      possible_paths.unshift(Pathname(solution_file)) unless solution_file.nil?
+      possible_paths.unshift(Pathname(nuget_dir.first)) unless nuget_dir.empty?
+      possible_paths
+    end
+
+    def assemblies
+      Dir.glob(project_path.join('**', 'packages.config'), File::FNM_DOTMATCH).map do |d|
+        path = Pathname.new(d).dirname
+        name = path.basename.to_s
+        Assembly.new path, name
+      end
+    end
+
+    def current_packages
+      dependencies.each_with_object({}) do |dep, memo|
+        licenses = license_urls(dep)
+        licenses&.map! do |license|
+          license.gsub('https://licenses.nuget.org/', '')
+        end
+
+        path = Dir.glob("#{Dir.home}/.nuget/packages/#{dep.name.downcase}/#{dep.version}").first
+
+        memo[dep.name] ||= NugetPackage.new(dep.name, dep.version, spec_licenses: licenses, install_path: path)
+        memo[dep.name].groups << dep.assembly unless memo[dep.name].groups.include? dep.assembly
+      end.values
+    end
+
+    def license_urls(dep)
+      files = Dir["**/#{dep.name}.#{dep.version}.nupkg"]
+
+      return nil if files.empty?
+
+      file = files.first
+      Zip::File.open file do |zipfile|
+        content = zipfile.read("#{dep.name}.nuspec")
+        Nuget.nuspec_license_urls(content)
+      end
+    end
+
+    def dependencies
+      assemblies.flat_map(&:dependencies)
+    end
+
+    def nuget_binary
+      legacy_vcproj = Dir['**/*.vcproj'].any?
+
+      if legacy_vcproj
+        '/usr/local/bin/nugetv3.5.0.exe'
+      else
+        '/usr/local/bin/nuget.exe'
+      end
+    end
+
+    def package_management_command
+      return 'nuget' if LicenseFinder::Platform.windows?
+
+      "mono #{nuget_binary}"
+    end
+
+    def prepare
+      Dir.chdir(project_path) do
+        cmd = prepare_command
+        stdout, stderr, status = Cmd.run(cmd)
+        return if status.success?
+
+        log_errors stderr
+
+        if stderr.include?('-PackagesDirectory')
+          logger.info cmd, 'trying fallback prepare command', color: :magenta
+
+          cmd = "#{cmd} -PackagesDirectory /#{Dir.home}/.nuget/packages"
+          stdout, stderr, status = Cmd.run(cmd)
+          return if status.success?
+
+          log_errors_with_cmd(cmd, stderr)
+        end
+
+        error_message = "Prepare command '#{cmd}' failed\n#{stderr}"
+        error_message += "\n#{stdout}\n" if !stdout.nil? && !stdout.empty?
+        raise error_message unless @prepare_no_fail
+      end
+    end
+
+    def prepare_command
+      cmd = package_management_command
+      sln_files = Dir['*.sln']
+      cmds = []
+      if sln_files.count > 1
+        sln_files.each do |sln|
+          cmds << "#{cmd} restore #{sln}"
+        end
+      else
+        cmds << "#{cmd} restore"
+      end
+
+      cmds.join(' && ')
+    end
+
+    def installed?(logger = Core.default_logger)
+      _stdout, _stderr, status = Cmd.run(nuget_check)
+      if status.success?
+        logger.debug self.class, 'is installed', color: :green
+      else
+        logger.info self.class, 'is not installed', color: :red
+      end
+      status.success?
+    end
+
+    def nuget_check
+      return 'where nuget' if LicenseFinder::Platform.windows?
+
+      "which mono && ls #{nuget_binary}"
+    end
+
+    def self.nuspec_license_urls(specfile_content)
+      xml = REXML::Document.new(specfile_content)
+      REXML::XPath.match(xml, '//metadata//licenseUrl')
+                  .map(&:get_text)
+                  .map(&:to_s)
+    end
+  end
+end

data/lib/license_finder/package_managers/pip.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Pip < PackageManager
+    DEFAULT_VERSION = '3'
+
+    def initialize(options = {})
+      super
+      @requirements_path = options[:pip_requirements_path] || Pathname('requirements.txt')
+      @python_version = options[:python_version] || DEFAULT_VERSION
+      raise "Invalid python version \'#{@python_version}\'. Valid versions are '2' or '3'." unless %w[2 3].include?(@python_version)
+    end
+
+    def current_packages
+      pip_output.map do |name, version, children, location|
+        PipPackage.new(
+          name,
+          version,
+          PyPI.definition(name, version),
+          logger: logger,
+          children: children,
+          install_path: Pathname(location).join(name)
+        )
+      end
+    end
+
+    def package_management_command
+      "pip#{@python_version}"
+    end
+
+    def prepare_command
+      "pip#{@python_version} install"
+    end
+
+    def prepare
+      prep_cmd = "#{prepare_command} -r #{@requirements_path}"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def possible_package_paths
+      if project_path.nil?
+        [@requirements_path]
+      else
+        [project_path.join(@requirements_path)]
+      end
+    end
+
+    private
+
+    def pip_output
+      command = "python#{@python_version == '2' ? '' : '3'} #{LicenseFinder::BIN_PATH.join('license_finder_pip.py')} #{detected_package_path}"
+      stdout, stderr, status = Cmd.run(command)
+
+      if status.success?
+        JSON(stdout).map do |package|
+          package.values_at('name', 'version', 'dependencies', 'location')
+        end
+      else
+        log_errors "LicenseFinder command '#{command}' failed:\n\t#{stderr}"
+        []
+      end
+    end
+  end
+end

data/lib/license_finder/package_managers/pipenv.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'license_finder/package_utils/pypi'
+
+module LicenseFinder
+  class Pipenv < PackageManager
+    def initialize(options = {})
+      super
+      @lockfile = Pathname('Pipfile.lock')
+    end
+
+    def current_packages
+      @current_packages ||=
+        begin
+          packages = {}
+          each_dependency(groups: allowed_groups) do |name, data, group|
+            version = canonicalize(data['version'] || 'unknown')
+            package = packages.fetch(key_for(name, version)) do |key|
+              packages[key] = build_package_for(name, version)
+            end
+            package.groups << group
+          end
+          packages.values
+        end
+    end
+
+    def possible_package_paths
+      project_path ? [project_path.join(@lockfile)] : [@lockfile]
+    end
+
+    private
+
+    def each_dependency(groups: [])
+      dependencies = JSON.parse(IO.read(detected_package_path))
+      groups.each do |group|
+        dependencies[group].each do |name, data|
+          yield name, data, group
+        end
+      end
+    end
+
+    def canonicalize(version)
+      version.sub(/^==/, '')
+    end
+
+    def build_package_for(name, version)
+      PipPackage.new(name, version, PyPI.definition(name, version))
+    end
+
+    def key_for(name, version)
+      "#{name}-#{version}"
+    end
+
+    def allowed_groups
+      %w[default develop] - ignored_groups.to_a
+    end
+
+    def ignored_groups
+      @ignored_groups || []
+    end
+  end
+end

data/lib/license_finder/package_managers/pnpm.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'tempfile'
+
+module LicenseFinder
+  class PNPM < PackageManager
+    def initialize(options = {})
+      super
+      @pnpm_options = options[:pnpm_options]
+    end
+
+    SHELL_COMMAND = 'pnpm licenses list --json --long'
+
+    def possible_package_paths
+      [project_path.join('pnpm-lock.yaml')]
+    end
+
+    def self.takes_priority_over
+      NPM
+    end
+
+    def current_packages
+      # check if the minimum version of PNPM is met
+      raise 'The minimum PNPM version is not met, requires 7.17.0 or later' unless supported_pnpm?
+
+      # check if the project directory has workspace file
+      cmd = PNPM::SHELL_COMMAND.to_s
+      cmd += ' --no-color'
+      cmd += ' --recursive' unless project_has_workspaces == false
+      cmd += " --dir #{project_path}" unless project_path.nil?
+      cmd += " #{@pnpm_options}" unless @pnpm_options.nil?
+
+      stdout, stderr, status = Cmd.run(cmd)
+      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
+
+      json_objects = JSON.parse(stdout)
+      get_pnpm_packages(json_objects)
+    end
+
+    def get_pnpm_packages(json_objects)
+      packages = []
+      incompatible_packages = []
+
+      json_objects.map do |_, value|
+        value.each do |pkg|
+          name = pkg['name']
+
+          if pkg['version']
+            version = pkg['version']
+          elsif pkg['versions']
+            version = pkg['versions'][0]
+          end
+
+          license = pkg['license']
+          homepage = pkg['vendorUrl']
+          author = pkg['vendorName']
+          module_path = pkg['path']
+
+          package = PNPMPackage.new(
+            name,
+            version,
+            spec_licenses: [license],
+            homepage: homepage,
+            authors: author,
+            install_path: module_path
+          )
+          packages << package
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
+    def package_management_command
+      'pnpm'
+    end
+
+    def prepare_command
+      'pnpm install --no-lockfile --ignore-scripts'
+    end
+
+    def prepare
+      prep_cmd = "#{prepare_command}#{production_flag}"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    private
+
+    def project_has_workspaces
+      Dir.chdir(project_path) do
+        return File.file?('pnpm-workspace.yaml')
+      end
+    end
+
+    # PNPM introduced the licenses command in 7.17.0
+    def supported_pnpm?
+      Dir.chdir(project_path) do
+        version_string, stderr_str, status = Cmd.run('pnpm --version')
+        raise "Command 'pnpm -v' failed to execute: #{stderr_str}" unless status.success?
+
+        version = version_string.split('.').map(&:to_i)
+        major = version[0]
+        minor = version[1]
+        patch = version[1]
+
+        return true if major > 7
+        return true if major == 7 && minor > 17
+        return true if major == 7 && minor == 17 && patch >= 0
+
+        return false
+      end
+    end
+
+    def production_flag
+      return '' if @ignored_groups.nil?
+
+      @ignored_groups.include?('devDependencies') ? ' --prod' : ''
+    end
+  end
+end

data/lib/license_finder/package_managers/pub.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'yaml'
+
+module LicenseFinder
+  class Pub < PackageManager
+    class PubError < RuntimeError; end
+
+    def current_packages
+      unless File.exist?('pubspec.lock')
+        raise PubError, "No checked-out Pub packages found.
+          Please install your dependencies first."
+      end
+
+      if ENV['PUB_CACHE'].nil? || ENV['PUB_CACHE'].eql?('')
+        raise PubError, 'While PUB_CACHE environment variable is empty, retrieving package licenses is impossible. Please set the PUB_CACHE env variable (default: ~/.pub)'
+      end
+
+      stdout, _stderr, _status = Cmd.run('flutter pub deps --json')
+      yaml_deps = JSON.parse(stdout)
+      yaml_deps['packages'].map do |dependency|
+        package_name = dependency['name']
+        subpath = "#{dependency['name']}-#{dependency['version']}"
+        package_version = dependency['version']
+
+        project_repo = dependency['source'] == 'git' ? Pathname("#{ENV['PUB_CACHE']}/git/#{dependency['name']}-*/") : Pathname("#{ENV['PUB_CACHE']}/hosted/pub.dartlang.org/#{subpath}")
+
+        homepage = read_repository_home(project_repo)
+        homepage = "https://pub.dev/packages/#{package_name}" if homepage.nil? || homepage.empty?
+        PubPackage.new(
+          package_name,
+          package_version,
+          license_text(project_repo),
+          logger: logger,
+          install_path: project_repo,
+          homepage: homepage
+        )
+      end
+    end
+
+    def possible_package_paths
+      [project_path.join('pubspec.lock')]
+    end
+
+    def package_management_command
+      'flutter'
+    end
+
+    def prepare_command
+      'flutter pub get'
+    end
+
+    def prepare
+      prep_cmd = "#{prepare_command} #{production_flag}"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    private
+
+    def license_text(subpath)
+      license_path = license_pattern(subpath).find { |f| File.exist?(f) }
+      license_path.nil? ? nil : IO.read(license_path)
+    end
+
+    def license_pattern(subpath)
+      Dir.glob(subpath.join('LICENSE*'), File::FNM_CASEFOLD)
+    end
+
+    def production_flag
+      return '' if @ignored_groups.nil?
+
+      @ignored_groups.include?('devDependencies') ? '' : 'no-'
+    end
+
+    def read_repository_home(project_repo)
+      package_yaml = project_repo.join('pubspec.yaml')
+      YAML.load(IO.read(package_yaml))['repository'] if Dir.exist?(project_repo) && File.exist?(package_yaml)
+    end
+  end
+end

data/lib/license_finder/package_managers/rebar.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Rebar < PackageManager
+    def initialize(options = {})
+      super
+      @command = options[:rebar_command] || package_management_command
+      @deps_path = Pathname(options[:rebar_deps_dir] || File.join(project_path, '_build/default/lib'))
+    end
+
+    def current_packages
+      rebar_deps.map do |name, version|
+        licenses, homepage = dep_info(name)
+        RebarPackage.new(
+          name,
+          version,
+          install_path: @deps_path.join(name),
+          homepage: homepage,
+          spec_licenses: licenses.nil? ? [] : [licenses],
+          logger: logger
+        )
+      end
+    end
+
+    def package_management_command
+      'rebar3'
+    end
+
+    def possible_package_paths
+      [project_path.join('rebar.config')]
+    end
+
+    private
+
+    def rebar_deps
+      command = "#{@command} tree"
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" unless status.success?
+
+      stdout
+        .each_line
+        .reject { |line| line.start_with?('=') || line.include?('project app') }
+        .map do |line|
+          matches = line.match(/(?<name>\w+)─(?<version>\S+)\s*/)
+          [matches[:name], matches[:version]] if matches
+        end.compact
+    end
+
+    def dep_info(name)
+      command = "#{@command} pkgs #{name}"
+      stdout, _, status = Cmd.run(command)
+      return [nil, nil] unless status.success?
+
+      licenses = nil
+      homepage = nil
+
+      stdout.scan(/Licenses: (?<licenses>.+)|(?<homepage>(https|http).*)/) do |pkg_licenses, pkg_homepage|
+        licenses ||= pkg_licenses
+        homepage ||= pkg_homepage
+      end
+
+      [licenses, homepage]
+    end
+  end
+end

data/lib/license_finder/package_managers/sbt.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'csv'
+require 'license_finder/package_utils/sbt_dependency_finder'
+
+module LicenseFinder
+  class Sbt < PackageManager
+    def initialize(options = {})
+      super
+      @include_groups = options[:sbt_include_groups]
+    end
+
+    def current_packages
+      command = "#{package_management_command} dumpLicenseReport"
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" unless status.success?
+
+      dependencies = SbtDependencyFinder.new(project_path).dependencies
+      packages = dependencies.flat_map do |text|
+        contents = CSV.parse(text, headers: true)
+        contents.map do |row|
+          group_id, name, version = row['Dependency'].split('#').map(&:strip)
+          spec = {
+            'artifactId' => name,
+            'groupId' => group_id,
+            'version' => version,
+            'licenses' => [{ 'name' => row['License'] }]
+          }
+
+          path = File.join("#{Dir.home}/.ivy2/cache", "#{spec['groupId']}/#{spec['artifactId']}")
+          SbtPackage.new(spec, logger: logger, include_groups: @include_groups, install_path: path)
+        end
+      end
+
+      packages.uniq
+    end
+
+    def package_management_command
+      'sbt'
+    end
+
+    def possible_package_paths
+      [project_path.join('build.sbt')]
+    end
+  end
+end