license_finder 6.14.1 → 7.0.0

data/lib/license_finder/cli/permitted_licenses.rb

@@ -8,7 +8,7 @@ module LicenseFinder
 
       desc 'list', 'List all the permitted licenses'
       def list
-        say 'Permitted Licenses:', :blue
+        printer.say 'Permitted Licenses:', :blue
         say_each(decisions.permitted, &:name)
       end
 
@@ -17,7 +17,7 @@ module LicenseFinder
       def add(*licenses)
         assert_some licenses
         modifying { licenses.each { |l| decisions.permit(l, txn) } }
-        say "Added #{licenses.join(', ')} to the permitted licenses"
+        printer.say "Added #{licenses.join(', ')} to the permitted licenses"
       end
 
       auditable
@@ -25,7 +25,7 @@ module LicenseFinder
       def remove(*licenses)
         assert_some licenses
         modifying { licenses.each { |l| decisions.unpermit(l, txn) } }
-        say "Removed #{licenses.join(', ')} from the license permitted licenses"
+        printer.say "Removed #{licenses.join(', ')} from the license permitted licenses"
       end
     end
   end

data/lib/license_finder/cli/project_name.rb

@@ -8,8 +8,8 @@ module LicenseFinder
 
       desc 'show', 'Show the project name'
       def show
-        say 'Project Name:', :blue
-        say decisions.project_name
+        printer.say 'Project Name:', :blue
+        printer.say decisions.project_name
       end
 
       auditable
@@ -17,7 +17,7 @@ module LicenseFinder
       def add(name)
         modifying { decisions.name_project(name, txn) }
 
-        say "Set the project name to #{name}", :green
+        printer.say "Set the project name to #{name}", :green
       end
 
       auditable
@@ -25,7 +25,7 @@ module LicenseFinder
       def remove
         modifying { decisions.unname_project(txn) }
 
-        say 'Removed the project name'
+        printer.say 'Removed the project name'
       end
     end
   end

data/lib/license_finder/cli/restricted_licenses.rb

@@ -8,7 +8,7 @@ module LicenseFinder
 
       desc 'list', 'List all the restricted licenses'
       def list
-        say 'Restricted Licenses:', :blue
+        printer.say 'Restricted Licenses:', :blue
         say_each(decisions.restricted, &:name)
       end
 
@@ -17,7 +17,7 @@ module LicenseFinder
       def add(*licenses)
         assert_some licenses
         modifying { licenses.each { |l| decisions.restrict(l, txn) } }
-        say "Added #{licenses.join(', ')} to the restricted licenses"
+        printer.say "Added #{licenses.join(', ')} to the restricted licenses"
       end
 
       auditable
@@ -25,7 +25,7 @@ module LicenseFinder
       def remove(*licenses)
         assert_some licenses
         modifying { licenses.each { |l| decisions.unrestrict(l, txn) } }
-        say "Removed #{licenses.join(', ')} from the restricted licenses"
+        printer.say "Removed #{licenses.join(', ')} from the restricted licenses"
       end
     end
   end

data/lib/license_finder/configuration.rb

@@ -145,6 +145,10 @@ module LicenseFinder
       get(:columns)
     end
 
+    def use_spdx_id
+      get(:use_spdx_id)
+    end
+
     def sbt_include_groups
       get(:sbt_include_groups)
     end
@@ -153,13 +157,12 @@ module LicenseFinder
       get(:composer_check_require_only)
     end
 
-    attr_writer :strict_matching
-
-    attr_reader :strict_matching
+    attr_accessor :strict_matching
 
     protected
 
     attr_accessor :primary_config
+
     def dup_with(other_hash)
       dup.tap do |dup|
         dup.primary_config.merge!(other_hash)

data/lib/license_finder/core.rb

@@ -31,6 +31,7 @@ module LicenseFinder
     #   rebar_deps_dir: "deps",
     # }
     def initialize(configuration)
+      @printer = Printer.new
       @logger = Logger.new(configuration.logger_mode)
       @config = configuration
       @scanner = Scanner.new(options)
@@ -68,7 +69,7 @@ module LicenseFinder
 
     private
 
-    attr_reader :logger
+    attr_reader :logger, :printer
 
     # The core of the system. The saved decisions are applied to the current
     # packages.

data/lib/license_finder/decisions.rb

@@ -194,9 +194,10 @@ module LicenseFinder
 
     def inherit_from(filepath_info)
       decisions =
-        if filepath_info.is_a?(Hash)
+        case filepath_info
+        when Hash
           resolve_inheritance(filepath_info)
-        elsif filepath_info =~ %r{^https?://}
+        when %r{^https?://}
           open_uri(filepath_info).read
         else
           Pathname(filepath_info).read
@@ -247,9 +248,7 @@ module LicenseFinder
 
       # ruby < 2.5.0 URI.open is private
       if Gem::Version.new(RUBY_VERSION) < Gem::Version.new('2.5.0')
-        # rubocop:disable Security/Open
         open(uri, header)
-        # rubocop:enable Security/Open
       else
         URI.open(uri, header)
       end
@@ -280,7 +279,12 @@ module LicenseFinder
     def self.restore(persisted, result = new)
       return result unless persisted
 
-      actions = YAML.load(persisted)
+      # From https://makandracards.com/makandra/465149-ruby-the-yaml-safe_load-method-hides-some-pitfalls
+      actions = if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
+                  YAML.safe_load(persisted, permitted_classes: [Symbol, Time], aliases: true)
+                else
+                  YAML.safe_load(persisted, [Symbol, Time], [], true)
+                end
 
       list_of_actions = (actions || []).map(&:first)
 

data/lib/license_finder/license/definitions.rb

@@ -27,7 +27,8 @@ module LicenseFinder
           ruby,
           simplifiedbsd,
           wtfpl,
-          zerobsd
+          zerobsd,
+          zlib
         ]
       end
 
@@ -45,6 +46,7 @@ module LicenseFinder
         License.new(
           short_name: 'Apache1_1',
           pretty_name: 'Apache 1.1',
+          spdx_id: 'Apache-1.1',
           other_names: [
             'Apache-1.1',
             'The Apache Software License, Version 1.1'
@@ -57,6 +59,7 @@ module LicenseFinder
         License.new(
           short_name: 'Apache2',
           pretty_name: 'Apache 2.0',
+          spdx_id: 'Apache-2.0',
           other_names: [
             'Apache-2.0',
             'Apache Software License',
@@ -78,6 +81,7 @@ module LicenseFinder
       def bsd
         License.new(
           short_name: 'BSD',
+          spdx_id: 'BSD-4-Clause',
           other_names: ['BSD4', 'bsd-old', '4-clause BSD', 'BSD-4-Clause', 'BSD 4-Clause', 'BSD License'],
           url: 'http://en.wikipedia.org/wiki/BSD_licenses#4-clause_license_.28original_.22BSD_License.22.29'
         )
@@ -86,6 +90,7 @@ module LicenseFinder
       def cc01
         License.new(
           short_name: 'CC01',
+          spdx_id: 'CC0-1.0',
           pretty_name: 'CC0 1.0 Universal',
           other_names: ['CC0 1.0'],
           url: 'http://creativecommons.org/publicdomain/zero/1.0'
@@ -95,6 +100,7 @@ module LicenseFinder
       def cddl1
         License.new(
           short_name: 'CDDL1',
+          spdx_id: 'CDDL-1.0',
           pretty_name: 'Common Development and Distribution License 1.0',
           other_names: [
             'CDDL-1.0',
@@ -108,6 +114,7 @@ module LicenseFinder
       def eclipse1
         License.new(
           short_name: 'EPL1',
+          spdx_id: 'EPL-1.0',
           pretty_name: 'Eclipse Public License 1.0',
           other_names: [
             'EPL-1.0',
@@ -121,6 +128,7 @@ module LicenseFinder
       def gplv2
         License.new(
           short_name: 'GPLv2',
+          spdx_id: 'GPL-2.0-only',
           other_names: ['GPL V2', 'gpl-v2', 'GNU GENERAL PUBLIC LICENSE Version 2'],
           url: 'http://www.gnu.org/licenses/gpl-2.0.txt'
         )
@@ -129,6 +137,7 @@ module LicenseFinder
       def gplv3
         License.new(
           short_name: 'GPLv3',
+          spdx_id: 'GPL-3.0-only',
           other_names: ['GPL V3', 'gpl-v3', 'GNU GENERAL PUBLIC LICENSE Version 3'],
           url: 'http://www.gnu.org/licenses/gpl-3.0.txt'
         )
@@ -137,6 +146,7 @@ module LicenseFinder
       def isc
         License.new(
           short_name: 'ISC',
+          spdx_id: 'ISC',
           url: 'http://en.wikipedia.org/wiki/ISC_license'
         )
       end
@@ -144,6 +154,7 @@ module LicenseFinder
       def lgpl
         License.new(
           short_name: 'LGPL',
+          spdx_id: 'LGPL-3.0-only',
           other_names: ['LGPL-3', 'LGPLv3', 'LGPL-3.0'],
           url: 'http://www.gnu.org/licenses/lgpl.txt'
         )
@@ -152,6 +163,7 @@ module LicenseFinder
       def lgpl2_1
         License.new(
           short_name: 'LGPL2_1',
+          spdx_id: 'LGPL-2.1-only',
           pretty_name: 'GNU Lesser General Public License version 2.1',
           other_names: [
             'LGPL-2.1-only',
@@ -177,6 +189,7 @@ module LicenseFinder
 
         License.new(
           short_name: 'MIT',
+          spdx_id: 'MIT',
           other_names: ['Expat', 'MIT license', 'MIT License', 'The MIT License (MIT)'],
           url: 'http://opensource.org/licenses/mit-license',
           matcher: matcher
@@ -196,6 +209,7 @@ module LicenseFinder
 
         License.new(
           short_name: 'MPL1_1',
+          spdx_id: 'MPL-1.1',
           pretty_name: 'Mozilla Public License 1.1',
           other_names: [
             'MPL-1.1',
@@ -217,6 +231,7 @@ module LicenseFinder
 
         License.new(
           short_name: 'MPL2',
+          spdx_id: 'MPL-2.0',
           pretty_name: 'Mozilla Public License 2.0',
           other_names: [
             'MPL-2.0',
@@ -242,6 +257,7 @@ module LicenseFinder
 
         License.new(
           short_name: 'NewBSD',
+          spdx_id: 'BSD-3-Clause',
           pretty_name: 'New BSD',
           other_names: [
             'Modified BSD',
@@ -265,6 +281,7 @@ module LicenseFinder
       def ofl
         License.new(
           short_name: 'OFL',
+          spdx_id: 'OFL-1.1',
           pretty_name: 'SIL OPEN FONT LICENSE Version 1.1',
           other_names: [
             'OPEN FONT LICENSE Version 1.1'
@@ -276,6 +293,7 @@ module LicenseFinder
       def python
         License.new(
           short_name: 'Python',
+          spdx_id: 'PSF-2.0',
           pretty_name: 'Python Software Foundation License',
           other_names: [
             'PSF',
@@ -296,6 +314,7 @@ module LicenseFinder
 
         License.new(
           short_name: 'Ruby',
+          spdx_id: 'Ruby',
           pretty_name: 'ruby',
           url: url,
           matcher: matcher
@@ -305,6 +324,7 @@ module LicenseFinder
       def simplifiedbsd
         License.new(
           short_name: 'SimplifiedBSD',
+          spdx_id: 'BSD-2-Clause',
           pretty_name: 'Simplified BSD',
           other_names: [
             'FreeBSD',
@@ -320,6 +340,7 @@ module LicenseFinder
       def wtfpl
         License.new(
           short_name: 'WTFPL',
+          spdx_id: 'WTFPL',
           pretty_name: 'WTFPL',
           other_names: [
             'WTFPL V2',
@@ -336,6 +357,7 @@ module LicenseFinder
 
         License.new(
           short_name: '0BSD',
+          spdx_id: '0BSD',
           pretty_name: 'BSD Zero Clause License',
           other_names: [
             '0-Clause BSD',
@@ -349,6 +371,18 @@ module LicenseFinder
           matcher: matcher
         )
       end
+
+      def zlib
+        License.new(
+          short_name: 'Zlib',
+          spdx_id: 'Zlib',
+          pretty_name: 'zlib/libpng license',
+          other_names: [
+            'zlib License'
+          ],
+          url: 'https://opensource.org/licenses/Zlib'
+        )
+      end
     end
   end
 end

data/lib/license_finder/license/templates/Zlib.txt

@@ -0,0 +1,17 @@
+Copyright (c) <year> <copyright holders>
+
+This software is provided 'as-is', without any express or implied
+warranty. In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+3. This notice may not be removed or altered from any source distribution.

data/lib/license_finder/license/text.rb

@@ -5,16 +5,17 @@ module LicenseFinder
     module Text
       SPACES = /\s+/.freeze
       QUOTES = /['`"]{1,2}/.freeze
+      YEAR_PLACEHOLDERS = /<year>/.freeze
       PLACEHOLDERS = /<[^<>]+>/.freeze
       SPECIAL_SINGLE_QUOTES = /[‘’]/.freeze
       SPECIAL_DOUBLE_QUOTES = /[“”„«»]/.freeze
       ALPHABET_ORDERED_LIST = /\\\([a-z]\\\)\\\s/.freeze
       ALPHABET_ORDERED_LIST_OPTIONAL = '(\([a-z]\)\s)?'
-      LIST_BULLETS = /(\d{1,2}\\\.|\\\*|\\\-)\\\s/.freeze
+      LIST_BULLETS = /(\d{1,2}\\\.|\\\*|\\-)\\\s/.freeze
       LIST_BULLETS_OPTIONAL = '(\d{1,2}.|\*|\-)?\s*'
       NEWLINE_CHARACTER = /\n+/.freeze
-      QUOTE_COMMENT_CHARACTER = /^\s*\>+/.freeze
-      ESCAPED_QUOTES = /\\\"/.freeze
+      QUOTE_COMMENT_CHARACTER = /^\s*>+/.freeze
+      ESCAPED_QUOTES = /\\"/.freeze
 
       def self.normalize_punctuation(text)
         text.dup.force_encoding('UTF-8')
@@ -32,6 +33,7 @@ module LicenseFinder
 
       def self.compile_to_regex(text)
         Regexp.new(Regexp.escape(normalize_punctuation(text))
+                       .gsub(YEAR_PLACEHOLDERS, '(\S*)')
                        .gsub(PLACEHOLDERS, '(.*)')
                        .gsub(',', '(,)?')
                        .gsub('HOLDER', '(HOLDER|OWNER)')

data/lib/license_finder/license.rb

@@ -40,6 +40,7 @@ module LicenseFinder
     def initialize(settings)
       @short_name  = settings.fetch(:short_name)
       @pretty_name = settings.fetch(:pretty_name, short_name)
+      @spdx_id     = settings.fetch(:spdx_id, '')
       @other_names = settings.fetch(:other_names, [])
       @url         = settings.fetch(:url)
       @matcher     = settings.fetch(:matcher) { Matcher.from_template(Template.named(short_name)) }
@@ -51,6 +52,10 @@ module LicenseFinder
       pretty_name
     end
 
+    def standard_id
+      spdx_id
+    end
+
     def stripped_name(name)
       name.sub(/^The /i, '')
     end
@@ -77,13 +82,13 @@ module LicenseFinder
 
     private
 
-    attr_reader :short_name, :pretty_name, :other_names
-    attr_reader :matcher
+    attr_reader :short_name, :pretty_name, :other_names, :spdx_id, :matcher
 
     def names
       ([short_name, pretty_name] + other_names).uniq
     end
   end
+
   class AndLicense < License
     def self.operator
       ' AND '
@@ -93,6 +98,7 @@ module LicenseFinder
       @short_name = name
       @pretty_name = name
       @url = nil
+      @spdx_id = nil
       @matcher = NoneMatcher.new
       # removes heading and trailing parentesis and splits
       name = name[1..-2] if name.start_with?('(')

data/lib/license_finder/logger.rb

@@ -11,7 +11,7 @@ module LicenseFinder
     attr_reader :mode
 
     def initialize(mode = nil)
-      @system_logger = ::Logger.new(STDOUT)
+      @system_logger = ::Logger.new($stdout)
       @system_logger.formatter = proc do |_, _, _, msg|
         "#{msg}\n"
       end

data/lib/license_finder/package.rb

@@ -18,7 +18,7 @@ module LicenseFinder
   #   the constructor options
   # - otherwise, override #licenses_from_spec or #license_files
   class Package
-    attr_reader :logger
+    attr_reader :logger, :name, :version, :authors, :summary, :description, :children, :parents, :groups, :manual_approval, :license_names_from_spec, :install_path
 
     def self.license_names_from_standard_spec(spec)
       licenses = spec['licenses'] || [spec['license']].compact
@@ -64,10 +64,6 @@ module LicenseFinder
 
     attr_accessor :homepage, :package_url
 
-    attr_reader :name, :version, :authors,
-                :summary, :description,
-                :children, :parents, :groups
-
     ## APPROVAL
 
     def approved_manually!(approval)
@@ -101,8 +97,6 @@ module LicenseFinder
       @restricted
     end
 
-    attr_reader :manual_approval
-
     ## EQUALITY
 
     def <=>(other)
@@ -120,10 +114,7 @@ module LicenseFinder
       [name, version].hash
     end
 
-    ## LICENSING
-
-    attr_reader :license_names_from_spec # stubbed in tests, otherwise private
-    attr_reader :install_path # checked in tests, otherwise private
+    ## LICENSING # stubbed in tests, otherwise private # checked in tests, otherwise private
 
     def licenses
       @licenses ||= activations.map(&:license).sort_by(&:name).to_set
@@ -200,3 +191,4 @@ require 'license_finder/packages/sbt_package'
 require 'license_finder/packages/cargo_package'
 require 'license_finder/packages/composer_package'
 require 'license_finder/packages/conda_package'
+require 'license_finder/packages/pubspec_package'

data/lib/license_finder/package_delta.rb

@@ -29,7 +29,7 @@ module LicenseFinder
     end
 
     def merged_package?
-      pick_package.class == MergedPackage
+      pick_package.instance_of?(MergedPackage)
     end
 
     def method_missing(_method_name)

data/lib/license_finder/package_manager.rb

@@ -177,5 +177,6 @@ require 'license_finder/package_managers/sbt'
 require 'license_finder/package_managers/cargo'
 require 'license_finder/package_managers/composer'
 require 'license_finder/package_managers/conda'
+require 'license_finder/package_managers/pub'
 
 require 'license_finder/package'

data/lib/license_finder/package_managers/cocoa_pods.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'open3'
 
 module LicenseFinder
   class CocoaPods < PackageManager
@@ -42,18 +43,24 @@ module LicenseFinder
     end
 
     def acknowledgements_path
-      search_paths = ['Pods/Pods-acknowledgements.plist',
-                      'Pods/Target Support Files/Pods/Pods-acknowledgements.plist',
-                      'Pods/Target Support Files/Pods-*/Pods-*-acknowledgements.plist']
-
-      result = Dir[*search_paths.map { |path| File.join(project_path, path) }].first
-      raise "Found a Podfile but no Pods directory in #{project_path}. Try running pod install before running license_finder." if result.nil?
+      if !ENV['ACKNOWLEDGEMENTS_PATH'].nil?
+        result = Dir[*ENV['ACKNOWLEDGEMENTS_PATH']].first
+      else
+        search_paths = ['Pods/Pods-acknowledgements.plist',
+                        'Pods/Target Support Files/Pods/Pods-acknowledgements.plist',
+                        'Pods/Target Support Files/Pods-*/Pods-*-acknowledgements.plist']
 
+        result = Dir[*search_paths.map { |path| File.join(project_path, path) }].first
+        raise "Found a Podfile but no Pods directory in #{project_path}. Try running pod install before running license_finder." if result.nil?
+      end
       result
     end
 
     def read_plist(pathname)
-      JSON.parse(`plutil -convert json -o - '#{pathname.gsub!(/[^0-9A-Za-z.\-]/, '')}'`)
+      out, err, status = Open3.capture3('plutil', '-convert', 'json', '-o', '-', pathname)
+      raise "#{out}\n\n#{err}" unless status.success?
+
+      JSON.parse(out)
     end
   end
 end

data/lib/license_finder/package_managers/conan.rb

@@ -18,10 +18,10 @@ module LicenseFinder
 
       deps = info_parser.parse(info_output)
       deps.map do |dep|
-        name, version = dep['name'].split('@').first.split('/')
+        name, version = dep['name'].split('/')
         url = dep['URL']
         license_file_path = Dir.glob("#{project_path}/licenses/#{name}/**/LICENSE*").first
-        ConanPackage.new(name, version, File.open(license_file_path).read, url) unless name == 'PROJECT'
+        ConanPackage.new(name, version, File.open(license_file_path).read, url) unless name == 'conanfile.txt'
       end.compact
     end
   end

data/lib/license_finder/package_managers/conda.rb

@@ -90,7 +90,7 @@ module LicenseFinder
       if status.success?
         conda_list = []
         stdout.each_line do |line|
-          next if line =~ /^\s*#/
+          next if /^\s*#/.match?(line)
 
           name, version, build, channel = line.split
           conda_list << {

data/lib/license_finder/package_managers/glide.rb

@@ -9,7 +9,13 @@ module LicenseFinder
     def current_packages
       detected_path = detected_package_path
 
-      YAML.load_file(detected_path).fetch('imports').map do |package_hash|
+      imports = if Gem::Version.new(Psych::VERSION) >= Gem::Version.new('3.1.0.pre1')
+                  YAML.safe_load(File.read(detected_path), permitted_classes: [Symbol, Time], aliases: true).fetch('imports')
+                else
+                  YAML.safe_load(File.read(detected_path), [Symbol, Time], [], true).fetch('imports')
+                end
+
+      imports.map do |package_hash|
         import_path = package_hash.fetch('name')
         license_path = project_path.join('vendor', import_path)
 

data/lib/license_finder/package_managers/go_15vendorexperiment.rb

@@ -37,7 +37,7 @@ module LicenseFinder
         GoPackage.from_dependency({
                                     'ImportPath' => dep,
                                     'InstallPath' => detected_package_path.join(dep),
-                                    'Rev' => 'vendored-' + project_sha(detected_package_path.join(dep)),
+                                    'Rev' => "vendored-#{project_sha(detected_package_path.join(dep))}",
                                     'Homepage' => repo_name(dep)
                                   }, nil, true)
       end
@@ -70,7 +70,7 @@ module LicenseFinder
         deps = val.split("\n")
         Cmd.run('go list std').first.split("\n").each do |std|
           deps.delete_if do |dep|
-            dep =~ %r{(\/|^)#{std}(\/|$)}
+            dep =~ %r{(/|^)#{std}(/|$)}
           end
         end
         deps.map do |d|

data/lib/license_finder/package_managers/go_dep.rb

@@ -38,7 +38,7 @@ module LicenseFinder
                             project_path.join(GODEP_VENDOR_PATH)
                           else
                             download_dependencies
-                            Pathname(ENV['GOPATH'] ? ENV['GOPATH'] + '/src' : ENV['HOME'] + '/go/src')
+                            Pathname(ENV['GOPATH'] ? "#{ENV['GOPATH']}/src" : "#{ENV['HOME']}/go/src")
                           end
     end
 

data/lib/license_finder/package_managers/go_workspace.rb

@@ -94,7 +94,7 @@ module LicenseFinder
         deps = val.split("\n")
         Cmd.run('go list std').first.split("\n").each do |std|
           deps.delete_if do |dep|
-            dep =~ %r{(\/|^)#{std}(\/|$)}
+            dep =~ %r{(/|^)#{std}(/|$)}
           end
         end
         deps

data/lib/license_finder/package_managers/nuget.rb

@@ -64,7 +64,7 @@ module LicenseFinder
 
       file = files.first
       Zip::File.open file do |zipfile|
-        content = zipfile.read(dep.name + '.nuspec')
+        content = zipfile.read("#{dep.name}.nuspec")
         Nuget.nuspec_license_urls(content)
       end
     end