license_finder 6.5.0 → 6.12.0

data/lib/license_finder/license/text.rb

@@ -10,8 +10,8 @@ module LicenseFinder
       SPECIAL_DOUBLE_QUOTES = /[“”„«»]/.freeze
       ALPHABET_ORDERED_LIST = /\\\([a-z]\\\)\\\s/.freeze
       ALPHABET_ORDERED_LIST_OPTIONAL = '(\([a-z]\)\s)?'
-      LIST_BULLETS = /(\d{1,2}\\\.|\\\*)\\\s/.freeze
-      LIST_BULLETS_OPTIONAL = '(\d{1,2}.|\*)?\s*'
+      LIST_BULLETS = /(\d{1,2}\\\.|\\\*|\\\-)\\\s/.freeze
+      LIST_BULLETS_OPTIONAL = '(\d{1,2}.|\*|\-)?\s*'
       NEWLINE_CHARACTER = /\n+/.freeze
       QUOTE_COMMENT_CHARACTER = /^\s*\>+/.freeze
       ESCAPED_QUOTES = /\\\"/.freeze

data/lib/license_finder/logger.rb

@@ -36,6 +36,8 @@ module LicenseFinder
         "\e[31m#{string}\e[0m"
       when :green
         "\e[32m#{string}\e[0m"
+      when :magenta
+        "\e[35m#{string}\e[0m"
       else
         string
       end

data/lib/license_finder/package.rb

@@ -189,6 +189,7 @@ require 'license_finder/packages/gradle_package'
 require 'license_finder/packages/cocoa_pods_package'
 require 'license_finder/packages/carthage_package'
 require 'license_finder/packages/rebar_package'
+require 'license_finder/packages/erlangmk_package'
 require 'license_finder/packages/mix_package'
 require 'license_finder/packages/merged_package'
 require 'license_finder/packages/nuget_package'
@@ -197,3 +198,4 @@ require 'license_finder/packages/yarn_package'
 require 'license_finder/packages/sbt_package'
 require 'license_finder/packages/cargo_package'
 require 'license_finder/packages/composer_package'
+require 'license_finder/packages/conda_package'

data/lib/license_finder/package_manager.rb

@@ -22,6 +22,10 @@ module LicenseFinder
       def takes_priority_over
         nil
       end
+
+      def id
+        name.split('::').last.downcase
+      end
     end
 
     def installed?(logger = Core.default_logger)
@@ -119,12 +123,16 @@ module LicenseFinder
     attr_reader :logger, :project_path
 
     def log_errors(stderr)
-      logger.info prepare_command, 'did not succeed.', color: :red
-      logger.info prepare_command, stderr, color: :red
-      log_to_file stderr
+      log_errors_with_cmd(prepare_command, stderr)
+    end
+
+    def log_errors_with_cmd(prep_cmd, stderr)
+      logger.info(prep_cmd, 'did not succeed.', color: :red)
+      logger.info(prep_cmd, stderr, color: :red)
+      log_to_file(prep_cmd, stderr)
     end
 
-    def log_to_file(contents)
+    def log_to_file(prep_cmd, contents)
       FileUtils.mkdir_p @log_directory
 
       # replace whitespace with underscores and remove slashes
@@ -132,7 +140,7 @@ module LicenseFinder
       log_file = File.join(@log_directory, "prepare_#{log_file_name || 'errors'}.log")
 
       File.open(log_file, 'w') do |f|
-        f.write("Prepare command \"#{prepare_command}\" failed with:\n")
+        f.write("Prepare command \"#{prep_cmd}\" failed with:\n")
         f.write("#{contents}\n\n")
       end
     end
@@ -159,6 +167,7 @@ require 'license_finder/package_managers/cocoa_pods'
 require 'license_finder/package_managers/carthage'
 require 'license_finder/package_managers/gradle'
 require 'license_finder/package_managers/rebar'
+require 'license_finder/package_managers/erlangmk'
 require 'license_finder/package_managers/nuget'
 require 'license_finder/package_managers/dotnet'
 require 'license_finder/package_managers/dep'
@@ -166,5 +175,6 @@ require 'license_finder/package_managers/conan'
 require 'license_finder/package_managers/sbt'
 require 'license_finder/package_managers/cargo'
 require 'license_finder/package_managers/composer'
+require 'license_finder/package_managers/conda'
 
 require 'license_finder/package'

data/lib/license_finder/package_managers/composer.rb

@@ -4,7 +4,10 @@ require 'json'
 
 module LicenseFinder
   class Composer < PackageManager
-    SHELL_COMMAND = 'composer licenses --format=json'
+    def initialize(options = {})
+      super
+      @check_require_only = !!options[:composer_check_require_only]
+    end
 
     def possible_package_paths
       [project_path.join('composer.lock'), project_path.join('composer.json')]
@@ -33,7 +36,7 @@ module LicenseFinder
     end
 
     def prepare_command
-      'composer install --no-plugins --ignore-platform-reqs --no-interaction'
+      'composer install --no-plugins --no-scripts --ignore-platform-reqs --no-interaction'
     end
 
     def package_path
@@ -50,8 +53,9 @@ module LicenseFinder
     end
 
     def composer_json
-      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(Composer::SHELL_COMMAND) }
-      raise "Command '#{Composer::SHELL_COMMAND}' failed to execute: #{stderr}" unless status.success?
+      command = "composer licenses --format=json#{@check_require_only ? ' --no-dev' : ''}"
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" unless status.success?
 
       JSON(stdout)
     end

data/lib/license_finder/package_managers/conda.rb

@@ -0,0 +1,131 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module LicenseFinder
+  class Conda < PackageManager
+    attr_reader :conda_bash_setup_script
+
+    def initialize(options = {})
+      @conda_bash_setup_script = options[:conda_bash_setup_script] || Pathname("#{ENV['HOME']}/miniconda3/etc/profile.d/conda.sh")
+      super
+    end
+
+    # This command is *not* directly executable. See .conda() below.
+    def prepare_command
+      "conda env create -f #{detected_package_path}"
+    end
+
+    def prepare
+      return if environment_exists?
+
+      prep_cmd = prepare_command
+      _stdout, stderr, status = Dir.chdir(project_path) { conda(prep_cmd) }
+      return if status.success?
+
+      log_errors stderr
+      raise "Prepare command '#{prep_cmd}' failed" unless @prepare_no_fail
+    end
+
+    def current_packages
+      conda_list.map do |entry|
+        case entry['channel']
+        when 'pypi'
+          # PyPI is much faster than `conda search`, use it when we can.
+          PipPackage.new(entry['name'], entry['version'], PyPI.definition(entry['name'], entry['version']))
+        else
+          CondaPackage.new(conda_search_info(entry))
+        end
+      end.compact
+    end
+
+    def possible_package_paths
+      [project_path.join('environment.yaml'), project_path.join('environment.yml')]
+    end
+
+    private
+
+    def environment_exists?
+      environments.grep(environment_name).any?
+    end
+
+    def environments
+      command = 'conda env list'
+      stdout, stderr, status = conda command
+
+      environments = []
+      if status.success?
+        environments = stdout.split("\n").grep_v(/^#/).map { |line| line.split.first }
+      else
+        log_errors_with_cmd command, stderr
+      end
+      environments
+    end
+
+    def environment_file
+      detected_package_path
+    end
+
+    def environment_name
+      @environment_name ||= YAML.load_file(environment_file).fetch('name')
+    end
+
+    def conda(command)
+      Open3.capture3('bash', '-c', "source #{conda_bash_setup_script} && #{command}")
+    end
+
+    def activated_conda(command)
+      Open3.capture3('bash', '-c', "source #{conda_bash_setup_script} && conda activate #{environment_name} && #{command}")
+    end
+
+    # Algorithm is based on
+    # https://bioinformatics.stackexchange.com/a/11226
+    # but completely recoded in Ruby. Like the poster, if the package is
+    # actually managed by conda, we assume that all the potential infos (for
+    # various architectures, versions of python, etc) have the same license.
+    def conda_list
+      command = 'conda list'
+      stdout, stderr, status = activated_conda(command)
+
+      if status.success?
+        conda_list = []
+        stdout.each_line do |line|
+          next if line =~ /^\s*#/
+
+          name, version, build, channel = line.split
+          conda_list << {
+            'name' => name,
+            'version' => version,
+            'build' => build,
+            'channel' => channel
+          }
+        end
+        conda_list
+      else
+        log_errors_with_cmd command, stderr
+        []
+      end
+    end
+
+    def conda_search_info(list_entry)
+      command = 'conda search --info --json '
+      command += "--channel #{list_entry['channel']} " if list_entry['channel'] && !list_entry['channel'].empty?
+      command += "'#{list_entry['name']} #{list_entry['version']}'"
+
+      # Errors from conda (in --json mode, at least) show up in stdout, not stderr
+      stdout, _stderr, status = activated_conda(command)
+
+      name = list_entry['name']
+
+      if status.success?
+        JSON(stdout).fetch(name).first
+      else
+        log_errors_with_cmd command, stdout
+        list_entry
+      end
+    rescue KeyError
+      logger.info('Conda', "Key error trying to find #{name} in\n#{JSON(stdout)}")
+      list_entry
+    end
+  end
+end

data/lib/license_finder/package_managers/dep.rb

@@ -18,11 +18,16 @@ module LicenseFinder
         GoPackage.from_dependency({
                                     'ImportPath' => project['name'],
                                     'InstallPath' => project_path.join('vendor', project['name']),
-                                    'Rev' => project['revision']
+                                    'Rev' => project['revision'],
+                                    'Homepage' => repo_name(project['name'])
                                   }, nil, true)
       end
     end
 
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+
     def self.takes_priority_over
       Go15VendorExperiment
     end

data/lib/license_finder/package_managers/dotnet.rb

@@ -63,7 +63,8 @@ module LicenseFinder
                           .uniq { |d| [d.name, d.version] }
 
       package_metadatas.map do |d|
-        NugetPackage.new(d.name, d.version, spec_licenses: d.read_license_urls)
+        path = Dir.glob("#{Dir.home}/.nuget/packages/#{d.name.downcase}/#{d.version}").first
+        NugetPackage.new(d.name, d.version, spec_licenses: d.read_license_urls, install_path: path)
       end
     end
 

data/lib/license_finder/package_managers/erlangmk.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module LicenseFinder
+  class Erlangmk < PackageManager
+    def package_management_command
+      'make'
+    end
+
+    def package_management_command_with_path
+      "#{package_management_command} --directory=#{project_path} --no-print-directory"
+    end
+
+    # The IS_DEP=1 is added because not all erlang.mk-based projects are
+    # updated to a version that is compatible with LicenseFinder
+    def prepare_command
+      "#{package_management_command_with_path} IS_DEP=1 fetch-deps"
+    end
+
+    def possible_package_paths
+      [
+        project_path.join('Erlang.mk'),
+        project_path.join('erlang.mk')
+      ]
+    end
+
+    def current_packages
+      deps.map do |dep|
+        ErlangmkPackage.new(dep)
+      end
+    end
+
+    private
+
+    def deps
+      command = "#{package_management_command_with_path} QUERY='name fetch_method repo version absolute_path' query-deps"
+      stdout, stderr, status = Cmd.run(command)
+      if status.success?
+        dep_re = Regexp.new('^\s*DEP')
+        line_re = Regexp.new('^[_a-z0-9]+:')
+        stdout.each_line.map(&:strip).select { |line| !(line.start_with?('make') || line =~ dep_re) && line =~ line_re }
+      elsif stderr.include? "No rule to make target 'query-deps'"
+        # The stderr check happens because not all erlang.mk-based projects are
+        # updated to a version that is compatible with LicenseFinder
+        []
+      else
+        raise "Command '#{command}' failed to execute: #{stderr}"
+      end
+    end
+  end
+end

data/lib/license_finder/package_managers/go_15vendorexperiment.rb

@@ -37,11 +37,16 @@ module LicenseFinder
         GoPackage.from_dependency({
                                     'ImportPath' => dep,
                                     'InstallPath' => detected_package_path.join(dep),
-                                    'Rev' => 'vendored-' + project_sha(detected_package_path.join(dep))
+                                    'Rev' => 'vendored-' + project_sha(detected_package_path.join(dep)),
+                                    'Homepage' => repo_name(dep)
                                   }, nil, true)
       end
     end
 
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
+
     def package_management_command
       'go'
     end

data/lib/license_finder/package_managers/go_dep.rb

@@ -4,6 +4,9 @@ require 'json'
 
 module LicenseFinder
   class GoDep < PackageManager
+    OLD_GODEP_VENDOR_PATH = 'Godeps/_workspace/src'
+    GODEP_VENDOR_PATH = 'vendor'
+
     def initialize(options = {})
       super
       @full_version = options[:go_full_version]
@@ -29,16 +32,20 @@ module LicenseFinder
     private
 
     def install_prefix
-      go_path = if workspace_dir.directory?
-                  workspace_dir
-                else
-                  Pathname(ENV['GOPATH'] || ENV['HOME'] + '/go')
-                end
-      go_path.join('src')
+      @install_prefix ||= if project_path.join(OLD_GODEP_VENDOR_PATH).directory?
+                            project_path.join(OLD_GODEP_VENDOR_PATH)
+                          elsif project_path.join(GODEP_VENDOR_PATH).directory?
+                            project_path.join(GODEP_VENDOR_PATH)
+                          else
+                            download_dependencies
+                            Pathname(ENV['GOPATH'] ? ENV['GOPATH'] + '/src' : ENV['HOME'] + '/go/src')
+                          end
     end
 
-    def workspace_dir
-      project_path.join('Godeps/_workspace')
+    def download_dependencies
+      command = "#{package_management_command} restore"
+      _, stderr, status = Dir.chdir(project_path) { Cmd.run(command) }
+      raise "Command '#{command}' failed to execute: #{stderr}" if !status.success? && status.exitstatus != 1
     end
 
     def packages_from_json(json_string)

data/lib/license_finder/package_managers/go_modules.rb

@@ -4,7 +4,7 @@ require 'license_finder/packages/go_package'
 
 module LicenseFinder
   class GoModules < PackageManager
-    PACKAGES_FILE = 'go.sum'
+    PACKAGES_FILE = 'go.mod'
 
     class << self
       def takes_priority_over
@@ -12,12 +12,8 @@ module LicenseFinder
       end
     end
 
-    def prepare_command
-      'GO111MODULE=on go mod tidy && GO111MODULE=on go mod vendor'
-    end
-
     def active?
-      sum_files?
+      mod_files?
     end
 
     def current_packages
@@ -33,19 +29,46 @@ module LicenseFinder
     private
 
     def packages_info
-      info_output, stderr, _status = Cmd.run("GO111MODULE=on go list -m -f '{{.Path}},{{.Version}},{{.Dir}}' all")
-      if stderr =~ Regexp.compile("can't compute 'all' using the vendor directory")
-        info_output, _stderr, _status = Cmd.run("GO111MODULE=on go list -m -mod=mod -f '{{.Path}},{{.Version}},{{.Dir}}' all")
-      end
+      Dir.chdir(project_path) do
+        # Explanations:
+        # * Only list dependencies (packages not listed in the project directory)
+        #   (.DepOnly)
+        # * Ignore standard library packages
+        #   (not .Standard)
+        # * Replacement modules are respected
+        #   (or .Module.Replace .Module)
+        # * Module cache directory or (vendored) package directory
+        #   (or $mod.Dir .Dir)
+        format_str = \
+          '{{ if and (.DepOnly) (not .Standard) }}'\
+            '{{ $mod := (or .Module.Replace .Module) }}'\
+            '{{ $mod.Path }},{{ $mod.Version }},{{ or $mod.Dir .Dir }}'\
+          '{{ end }}'
+
+        # The module list flag (`-m`) is intentionally not used here. If the module
+        # dependency tree were followed, transitive dependencies that are never imported
+        # may be included.
+        #
+        # Instead, the owning module is listed for each imported package. This better
+        # matches the implementation of other Go package managers.
+        #
+        # TODO: Figure out a way to make the vendor directory work (i.e. remove the
+        # -mod=readonly flag). Each of the imported packages gets listed separatly,
+        # confusing the issue as to which package is the root of the module.
+        go_list_cmd = "GO111MODULE=on go list -mod=readonly -deps -f '#{format_str}' ./..."
+        info_output, stderr, status = Cmd.run(go_list_cmd)
+        log_errors_with_cmd(go_list_cmd, "Getting the dependencies from go list failed \n\t#{stderr}") unless status.success?
 
-      info_output.split("\n")
+        # Since many packages may belong to a single module, #uniq is used to deduplicate
+        info_output.split("\n").uniq
+      end
     end
 
-    def sum_files?
-      sum_file_paths.any?
+    def mod_files?
+      mod_file_paths.any?
     end
 
-    def sum_file_paths
+    def mod_file_paths
       Dir[project_path.join(PACKAGES_FILE)]
     end
 
@@ -53,10 +76,15 @@ module LicenseFinder
       info = {
         'ImportPath' => name,
         'InstallPath' => install_path,
-        'Rev' => version
+        'Rev' => version,
+        'Homepage' => repo_name(name)
       }
 
       GoPackage.from_dependency(info, nil, true)
     end
+
+    def repo_name(name)
+      name.split('/')[0..2].join('/')
+    end
   end
 end