license_finder-rubyzip3 7.2.1.1

data/lib/license_finder/package_managers/spm.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Spm < PackageManager
+    class SpmError < RuntimeError; end
+
+    def current_packages
+      unless File.exist?(workspace_state_path)
+        raise SpmError, 'No checked-out SPM packages found.
+          Please install your dependencies first.'
+      end
+
+      workspace_state = JSON.parse(IO.read(workspace_state_path))
+      workspace_state['object']['dependencies'].map do |dependency|
+        package_ref = dependency['packageRef']
+        checkout_state = dependency['state']['checkoutState']
+
+        subpath = dependency['subpath']
+        package_name = package_ref['name']
+        package_version = checkout_state['version'] || checkout_state['revision']
+        homepage = package_ref['path']
+
+        SpmPackage.new(
+          package_name,
+          package_version,
+          license_text(subpath),
+          logger: logger,
+          install_path: project_checkout(subpath),
+          homepage: homepage
+        )
+      end
+    end
+
+    def package_management_command
+      LicenseFinder::Platform.darwin? ? 'xcodebuild' : 'swift'
+    end
+
+    def prepare_command
+      LicenseFinder::Platform.darwin? ? 'xcodebuild -resolvePackageDependencies' : 'swift package resolve'
+    end
+
+    def possible_package_paths
+      [workspace_state_path]
+    end
+
+    private
+
+    def resolved_package
+      if File.exist?(resolved_path)
+        @resolved_file ||= IO.read(resolved_path)
+      else
+        raise SpmError, 'No Package.resolved found.
+          Please install your dependencies first and provide it via environment variable
+          SPM_PACKAGE_RESOLVED'
+      end
+    end
+
+    def resolved_path
+      # Xcode projects have SPM packages info under project's derived data location
+      derived_data_folder = ENV['SPM_DERIVED_DATA']
+      if derived_data_folder
+        pathname = Pathname.new(derived_data_folder)
+        pathname.absolute? ? pathname : project_path.join(derived_data_folder)
+      else
+        project_path.join('.build')
+      end
+    end
+
+    def workspace_state_path
+      resolved_path.join('workspace-state.json')
+    end
+
+    def license_text(subpath)
+      license_path = license_pattern(subpath).find { |f| File.exist?(f) }
+      license_path.nil? ? nil : IO.read(license_path)
+    end
+
+    def project_checkout(subpath)
+      resolved_path.join('checkouts', subpath)
+    end
+
+    def license_pattern(subpath)
+      checkout_path = project_checkout(subpath)
+      Dir.glob(checkout_path.join('LICENSE*'), File::FNM_CASEFOLD)
+    end
+
+    def name_version_from_line(cartfile_line)
+      cartfile_line.split(' ')[1, 2].map { |f| f.split('/').last.delete('"').gsub('.git', '') }
+    end
+  end
+end

data/lib/license_finder/package_managers/trash.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Trash < PackageManager
+    class << self
+      def package_management_command
+        'trash'
+      end
+
+      def takes_priority_over
+        Go15VendorExperiment
+      end
+    end
+
+    def prepare_command
+      'trash'
+    end
+
+    def possible_package_paths
+      [project_path.join('vendor.conf')]
+    end
+
+    def current_packages
+      dependencies_path = project_path.join('trash.lock')
+
+      YAML.load_file(dependencies_path).fetch('import').map do |package_hash|
+        import_path = package_hash.fetch('package')
+        license_path = project_path.join('vendor', import_path)
+
+        GoPackage.from_dependency({
+                                    'ImportPath' => import_path,
+                                    'InstallPath' => license_path,
+                                    'Rev' => package_hash.fetch('version'),
+                                    'Homepage' => repo_name(import_path)
+                                  }, nil, true)
+      end
+    end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+  end
+end

data/lib/license_finder/package_managers/yarn.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Yarn < PackageManager
+    def initialize(options = {})
+      super
+      @yarn_options = options[:yarn_options]
+    end
+
+    SHELL_COMMAND = 'yarn licenses list --recursive --json'
+
+    def possible_package_paths
+      [project_path.join('yarn.lock')]
+    end
+
+    def current_packages
+      # the licenses plugin supports the classic production flag
+      cmd = "#{Yarn::SHELL_COMMAND}#{classic_yarn_production_flag}"
+      if yarn_version == 1
+        cmd += ' --no-progress'
+        cmd += " --cwd #{project_path}" unless project_path.nil?
+        cmd += " #{@yarn_options}" unless @yarn_options.nil?
+      end
+
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
+      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
+
+      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
+      json_objects = json_strings.map { |json_object| JSON.parse(json_object) }
+
+      if yarn_version == 1
+        get_yarn1_packages(json_objects)
+      else
+        get_yarn_packages(json_objects)
+      end
+    end
+
+    def prepare
+      prep_cmd = prepare_command.to_s
+      _stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def self.takes_priority_over
+      NPM
+    end
+
+    def package_management_command
+      'yarn'
+    end
+
+    def prepare_command
+      if yarn_version == 1
+        classic_yarn_prepare_command
+      else
+        yarn_prepare_command
+      end
+    end
+
+    private
+
+    def yarn_prepare_command
+      "#{yarn_plugin_production_command}yarn install && yarn plugin import https://raw.githubusercontent.com/mhassan1/yarn-plugin-licenses/#{yarn_licenses_plugin_version}/bundles/@yarnpkg/plugin-licenses.js"
+    end
+
+    def classic_yarn_prepare_command
+      "yarn install --ignore-engines --ignore-scripts#{classic_yarn_production_flag}"
+    end
+
+    def yarn_licenses_plugin_version
+      if yarn_version == 2
+        'v0.6.0'
+      else
+        'v0.7.2'
+      end
+    end
+
+    def yarn_version
+      Dir.chdir(project_path) do
+        version_string, stderr_str, status = Dir.chdir(project_path) { Cmd.run('yarn -v') }
+        raise "Command 'yarn -v' failed to execute: #{stderr_str}" unless status.success?
+
+        version = version_string.split('.').map(&:to_i)
+        return version[0]
+      end
+    end
+
+    def get_yarn_packages(json_objects)
+      packages = []
+      incompatible_packages = []
+      json_objects.each do |json_object|
+        license = json_object['value']
+        body = json_object['children']
+
+        body.each do |package_name, vendor_info|
+          valid_match = %r{(?<name>@?[\w/.-]+)@(?<manager>\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s
+          valid_match = %r{(?<name>@?[\w/.-]+)@virtual:.+#(\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s if manager.eql?('virtual')
+
+          if valid_match
+            homepage = vendor_info['children']['vendorUrl']
+            author = vendor_info['children']['vendorName']
+            package = YarnPackage.new(
+              name,
+              version,
+              spec_licenses: [license],
+              homepage: homepage,
+              authors: author,
+              install_path: project_path.join(modules_folder, name)
+            )
+            packages << package
+          end
+
+          incompatible_match = %r{(?<name>@?[\w/.-]+)@[a-z]*:(?<version>(\.))} =~ package_name.to_s
+          if incompatible_match
+            package = YarnPackage.new(name, version, spec_licenses: [license])
+            incompatible_packages.push(package)
+          end
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
+    def get_yarn1_packages(json_objects)
+      packages = []
+      if json_objects.last['type'] == 'table'
+        license_json = json_objects.pop['data']
+        packages = packages_from_json(license_json)
+      end
+
+      incompatible_packages = []
+      json_objects.each do |json_object|
+        match = %r{(?<name>@?[\w/.-]+)@(?<version>(\d+\.?)+)} =~ json_object['data'].to_s
+        if match
+          package = YarnPackage.new(name, version, spec_licenses: ['unknown'])
+          incompatible_packages.push(package)
+        end
+      end
+
+      packages + incompatible_packages.uniq
+    end
+
+    def packages_from_json(json_data)
+      body = json_data['body']
+      head = json_data['head']
+
+      packages = body.map do |json_package|
+        Hash[head.zip(json_package)]
+      end
+
+      valid_packages = filter_yarn_internal_package(packages)
+
+      valid_packages.map do |package_hash|
+        YarnPackage.new(
+          package_hash['Name'],
+          package_hash['Version'],
+          spec_licenses: [package_hash['License']],
+          homepage: package_hash['VendorUrl'],
+          authors: package_hash['VendorName'],
+          install_path: project_path.join(modules_folder, package_hash['Name'])
+        )
+      end
+    end
+
+    def modules_folder
+      return @modules_folder if @modules_folder
+
+      stdout, _stderr, status = Dir.chdir(project_path) { Cmd.run('yarn config get modules-folder') }
+      @modules_folder = 'node_modules' if !status.success? || stdout.strip == 'undefined'
+      @modules_folder ||= stdout.strip
+    end
+
+    # remove fake package created by yarn [Yarn Bug]
+    def filter_yarn_internal_package(all_packages)
+      internal_package_pattern = /workspace-aggregator-[a-zA-z0-9]{8}-[a-zA-z0-9]{4}-[a-zA-z0-9]{4}-[a-zA-z0-9]{4}-[a-zA-z0-9]{12}/
+      yarn_internal_package = all_packages.find { |package| internal_package_pattern.match(package['Name']) }
+      all_packages - [yarn_internal_package]
+    end
+
+    def classic_yarn_production_flag
+      return '' if @ignored_groups.nil?
+
+      @ignored_groups.include?('devDependencies') ? ' --production' : ''
+    end
+
+    def yarn_plugin_production_command
+      return '' if @ignored_groups.nil?
+
+      @ignored_groups.include?('devDependencies') ? 'yarn plugin import workspace-tools && yarn workspaces focus --all --production && ' : ''
+    end
+  end
+end

data/lib/license_finder/package_utils/activation.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  module Activation
+    # An Activation reports that a license has been activated for a package, and
+    # tracks the source of that information
+    Basic = Struct.new(:package, :license)
+
+    class FromDecision < Basic
+      def sources
+        ['from decision']
+      end
+    end
+
+    class FromSpec < Basic
+      def sources
+        ['from spec']
+      end
+    end
+
+    class FromFiles < Basic
+      def initialize(package, license, files)
+        super(package, license)
+        @files = files
+      end
+
+      attr_reader :files
+
+      def sources
+        files.map { |file| "from file '#{file.path}'" }
+      end
+    end
+
+    class None < Basic
+      def sources
+        []
+      end
+    end
+  end
+end

data/lib/license_finder/package_utils/conan_info_parser.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class ConanInfoParser
+    def parse(info)
+      @lines = info.lines.map(&:chomp)
+      @state = :project_level # state of the state machine
+      @projects = [] # list of projects
+      @current_project = nil # current project being populated in the SM
+      @current_vals = [] # current val list being populate in the SM
+      @current_key = nil # current key to be associated with the current val
+      while (line = @lines.shift)
+        next if line == ''
+
+        case @state
+        when :project_level
+          @current_project = {}
+          @current_project['name'] = line.strip
+          @state = :key_val
+        when :key_val
+          parse_key_val(line)
+        when :val_list
+          parse_val_list(line)
+        end
+      end
+      wrap_up
+    end
+
+    private
+
+    def parse_key_val(line)
+      key, val = key_val(line)
+      if val
+        @current_project[key.downcase] = val
+      elsif line.start_with?(' ')
+        @current_key = key.downcase
+        @current_vals = []
+        @state = :val_list
+      else
+        change_to_new_project_state line
+      end
+    end
+
+    def parse_val_list(line)
+      if val_list_level(line)
+        @current_vals << line.strip
+      else
+        @current_project[@current_key] = @current_vals
+        if line.start_with?(' ')
+          @state = :key_val
+          @lines.unshift(line)
+        else
+          change_to_new_project_state line
+        end
+      end
+    end
+
+    def wrap_up
+      @current_project[@current_key] = @current_vals if @current_vals.count && @current_key
+      @projects << @current_project
+    end
+
+    def val_list_level(line)
+      line.start_with?('        ')
+    end
+
+    def change_to_new_project_state(line)
+      @state = :project_level
+      @projects << @current_project
+      @lines.unshift(line)
+    end
+
+    def key_val(info)
+      info.split(':', 2).map(&:strip!)
+    end
+  end
+end

data/lib/license_finder/package_utils/conan_info_parser_v2.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class ConanInfoParserV2
+    def parse(info)
+      @lines = info.lines.map(&:chomp)
+      @state = :project_level # state of the state machine
+      @projects = [] # list of projects
+      @current_project = nil # current project being populated in the SM
+      @current_vals = [] # current val list being populate in the SM
+      @current_key = nil # current key to be associated with the current val
+
+      line = @lines.shift
+      line = @lines.shift while line != '======== Basic graph information ========'
+
+      while (line = @lines.shift)
+        next if line == ''
+
+        case @state
+        when :project_level
+          @current_project = {}
+          name, _id = line.strip.split('#')
+          @current_project['name'] = name
+          @state = :key_val
+        when :key_val
+          parse_key_val(line)
+        when :val_list
+          parse_val_list(line)
+        end
+      end
+      wrap_up
+    end
+
+    private
+
+    def parse_key_val(line)
+      key, val = key_val(line)
+      if val
+        @current_project[key.downcase] = val
+      elsif line.start_with?(' ')
+        @current_key = key.downcase
+        @current_vals = []
+        @state = :val_list
+      else
+        change_to_new_project_state line
+      end
+    end
+
+    def parse_val_list(line)
+      if val_list_level(line)
+        @current_vals << line.strip
+      else
+        @current_project[@current_key] = @current_vals
+        if line.start_with?(' ')
+          @state = :key_val
+          @lines.unshift(line)
+        else
+          change_to_new_project_state line
+        end
+      end
+    end
+
+    def wrap_up
+      @current_project[@current_key] = @current_vals if @current_vals.count && @current_key
+      @projects << @current_project
+    end
+
+    def val_list_level(line)
+      line.start_with?('    ')
+    end
+
+    def change_to_new_project_state(line)
+      @state = :project_level
+      @projects << @current_project
+      @lines.unshift(line)
+    end
+
+    def key_val(info)
+      info.split(':', 2).map(&:strip!)
+    end
+  end
+end

data/lib/license_finder/package_utils/gradle_dependency_finder.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class GradleDependencyFinder
+    def initialize(project_path)
+      @project_path = project_path
+    end
+
+    def dependencies
+      Pathname
+        .glob(@project_path.join('**', 'dependency-license.xml'))
+        .map(&:read)
+    end
+  end
+end

data/lib/license_finder/package_utils/license_files.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'license_finder/package_utils/possible_license_file'
+
+module LicenseFinder
+  class LicenseFiles
+    CANDIDATE_FILE_NAMES = %w[LICENSE License license LICENCE Licence licence COPYING copying README readme].freeze
+    CANDIDATE_PATH_WILDCARD = "*{#{CANDIDATE_FILE_NAMES.join(',')}}*"
+
+    def self.find(install_path, options = {})
+      new(install_path).find(options)
+    end
+
+    def initialize(install_path)
+      @install_path = install_path ? Pathname(install_path) : nil
+    end
+
+    def find(options = {})
+      paths_of_candidate_files
+        .map { |path| PossibleLicenseFile.new(path, options) }
+        .reject { |file| file.license.nil? }
+    end
+
+    private
+
+    attr_reader :install_path
+
+    def paths_of_candidate_files
+      candidate_files_and_dirs
+        .flat_map { |path| !path.is_a?(Zip::Entry) && path.directory? ? path.children : path }
+        .reject(&:directory?)
+        .uniq
+    end
+
+    def candidate_files_and_dirs
+      return [] if install_path.nil?
+
+      if !install_path.extname.casecmp('.jar').zero?
+        Pathname.glob(install_path.join('**', CANDIDATE_PATH_WILDCARD))
+      else
+        candidates_from_zip
+      end
+    end
+
+    def candidates_from_zip
+      Zip::File.open(install_path.to_s) do |zip_file|
+        zip_file.glob(CANDIDATE_PATH_WILDCARD, File::FNM_EXTGLOB)
+      end
+    end
+  end
+end

data/lib/license_finder/package_utils/licensing.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'license_finder/package_utils/activation'
+
+module LicenseFinder
+  Licensing = Struct.new(:package, :decided_licenses, :licenses_from_spec, :license_files) do
+    # Implements the algorithm for choosing the right set of licenses from
+    # among the various sources of licenses we know about.  In order of
+    # priority, licenses come from decisions, package specs, or package files.
+    def activations
+      if activations_from_decisions.any? then activations_from_decisions
+      elsif activations_from_spec.any?      then activations_from_spec
+      elsif activations_from_files.any?     then activations_from_files
+      else
+        [default_activation]
+      end
+    end
+
+    def activations_from_decisions
+      @activations_from_decisions ||= decided_licenses
+               .map { |license| Activation::FromDecision.new(package, license) }
+    end
+
+    def activations_from_spec
+      @activations_from_spec ||= licenses_from_spec
+               .map { |license| Activation::FromSpec.new(package, license) }
+    end
+
+    def activations_from_files
+      @activations_from_files ||= license_files
+               .group_by(&:license)
+               .map { |license, files| Activation::FromFiles.new(package, license, files) }
+    end
+
+    def default_activation
+      default_license = License.find_by_name nil
+      Activation::None.new(package, default_license)
+    end
+  end
+end

data/lib/license_finder/package_utils/maven_dependency_finder.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class MavenDependencyFinder
+    def initialize(project_path, m2_path)
+      @project_path = project_path
+      @m2_path = m2_path
+    end
+
+    def dependencies
+      options = {
+        'GroupTags' => { 'licenses' => 'license', 'dependencies' => 'dependency' },
+        'ForceArray' => %w[license dependency]
+      }
+
+      Pathname
+        .glob(@project_path.join('**', 'target', 'generated-resources', 'licenses.xml'))
+        .map(&:read)
+        .flat_map { |xml| XmlSimple.xml_in(xml, options)['dependencies'] }
+        .reject(&:empty?)
+        .each { |dep| add_info_from_m2(dep) }
+    end
+
+    # Add the name of the JAR file to allow later retrieval of license and notice files,
+    # and add the name, description and URL from the POM XML file.
+    def add_info_from_m2(dep)
+      m2_artifact_dir = @m2_path
+        .join(dep['groupId'].tr('.', '/'))
+        .join(dep['artifactId'])
+        .join(dep['version'])
+      artifact_basename = "#{dep['artifactId']}-#{dep['version']}"
+
+      # Basic support for Maven classifiers. So far, only "jakarta" is supported. Unfortunately,
+      # we do not have access to the "classifier" field here (licenses.xml does not have it).
+      jar_file = m2_artifact_dir.join("#{artifact_basename}.jar")
+      jar_file = m2_artifact_dir.join("#{artifact_basename}-jakarta.jar") unless File.exist?(jar_file) || !File.exist?(m2_artifact_dir.join("#{artifact_basename}-jakarta.jar"))
+
+      dep.store('jarFile', jar_file)
+
+      add_info_from_pom(m2_artifact_dir.join("#{artifact_basename}.pom"), dep)
+    end
+
+    # Extract name, description and URL from pom.xml
+    def add_info_from_pom(pom_file, dep)
+      pom = XmlSimple.xml_in(pom_file.read, { 'ForceArray' => false })
+
+      name = pom['name']
+      dep.store('summary', name) unless name.nil?
+
+      description = pom['description']
+      dep.store('description', description) unless description.nil?
+
+      url = pom['url']
+      dep.store('homepage', url) unless url.nil?
+    end
+  end
+end