license_finder 6.9.0 → 6.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fc2352a955e259632d6033ca1ec13a03ef2d6925c0a0dde89f0bd4bbf125a333
-  data.tar.gz: 275ec53c07253065b18133ea74bfd4dc69f73cb1a6dff6ba6d08f4ee278111e8
+  metadata.gz: 006762262d406303612afa6cecfe8eef1c2812bc845664c976bf93f047775b38
+  data.tar.gz: 70d8bf402df648d8d1ad35038e021b30a66511e80a07e120e520e394d656b909
 SHA512:
-  metadata.gz: 657b1f48fc7b0f592dbec7428610b8984c9be7f897b0eb2bd0379399d41286ea77b925298207633c48e388da2ffd46f99859fbd1e57d885b508ee434162316fd
-  data.tar.gz: 02e5b8f9fc1e70ddeb1bd87f55920d4c5537c82511cbbafb7ff96f622dee26f6e4dca3da7e9f03c321a44a1b0bdb6c2135638dd0ca3872169cebdc3731f7b4cc
+  metadata.gz: f7bf3097774f1babde5e5326a0568412f4bdfb39bcb02923e89cbc20b0bae316e0c08be77d15a92f4a0d28036c44fdc55f1e7984c607f7a17d4e8f8b42273a96
+  data.tar.gz: 2a4e56a8bec0ee4a68b6b91814030bb5b32cf40cb4e2b9cb75e3a082adb96ea27f56f6152dadd46a1b03d4f81e63d1ad78c6071d4a20ee0e14809f1a9e82da61

data/CHANGELOG.md

@@ -1,3 +1,5 @@
+# [6.10.0] / 2020-11-27
+
 # [6.9.0] / 2020-10-05
 
 ### Changed
@@ -921,3 +923,4 @@ Bugfixes:
 [6.8.1]: https://github.com/pivotal/LicenseFinder/compare/v6.8.0...v6.8.1
 [6.8.2]: https://github.com/pivotal/LicenseFinder/compare/v6.8.1...v6.8.2
 [6.9.0]: https://github.com/pivotal/LicenseFinder/compare/v6.8.2...v6.9.0
+[6.10.0]: https://github.com/pivotal/LicenseFinder/compare/v6.9.0...v6.10.0

data/CONTRIBUTING.md

@@ -60,13 +60,13 @@ submitting a pull request which adds new columns to
 `lib/license_finder/reports/csv_report.rb`.
 
 It is also possible to generate a custom report from an ERB template.  Use this
-[example](https://gist.github.com/mainej/b190d2f138c2b9e2e20a) as a starting
+[example](https://github.com/pivotal/LicenseFinder/blob/master/examples/custom_erb_template.rb) as a starting
 point.  These reports will have access to the helpers in
 [`LicenseFinder::ErbReport`](https://github.com/pivotal/LicenseFinder/blob/master/lib/license_finder/reports/erb_report.rb).
 
 If you need a report with more detailed data or in a different format, we
 recommend writing a custom ruby script.  This
-[example](https://gist.github.com/mainej/48ac616844505d50f510) will get you
+[example](https://github.com/pivotal/LicenseFinder/blob/master/examples/extract_license_data.rb) will get you
 started.
 
 If you come up with something useful, consider posting it to the Google Group

data/Dockerfile

@@ -154,12 +154,15 @@ RUN wget -q https://packages.microsoft.com/config/ubuntu/16.04/packages-microsof
   sudo apt-get update &&\
   sudo apt-get install -y dotnet-runtime-2.1 dotnet-sdk-2.1 dotnet-sdk-2.2 dotnet-sdk-3.0 dotnet-sdk-3.1
 
+# install Composer
 RUN apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 4F4EA0AAE5267A6C &&\
     echo "deb http://ppa.launchpad.net/ondrej/php/ubuntu xenial main" | sudo tee /etc/apt/sources.list.d/php.list &&\
     apt-get update &&\
     apt-get install -y php7.4-cli &&\
+    EXPECTED_COMPOSER_INSTALLER_CHECKSUM="$(curl --silent https://composer.github.io/installer.sig)" &&\
     php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" &&\
-    php -r "if (hash_file('sha384', 'composer-setup.php') === '795f976fe0ebd8b75f26a6dd68f78fd3453ce79f32ecb33e7fd087d39bfeb978342fb73ac986cd4f54edd0dc902601dc') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); } echo PHP_EOL;" &&\
+    ACTUAL_COMPOSER_INSTALLER_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")" &&\
+    test "${ACTUAL_COMPOSER_INSTALLER_CHECKSUM}" = "${EXPECTED_COMPOSER_INSTALLER_CHECKSUM}" || (echo "ERROR: Invalid installer checksum" >&2; false) &&\
     php composer-setup.php &&\
     php -r "unlink('composer-setup.php');" &&\
     mv composer.phar /usr/bin/composer

data/README.md

@@ -135,7 +135,7 @@ command.
 
 If you have docker installed, try using the included `dlf` script (potentially
 symlinked to be in your path via `ln -s LicenseFinder/dlf /usr/local/bin` or
-whatever method you prefer). This will run any commmands passed to it inside a
+whatever method you prefer). This will run any commands passed to it inside a
 pre-provisioned Docker container to maintain consistent versions of all the
 package managers. For example,
 
@@ -159,7 +159,7 @@ passed to it from that directory.
 Note that the docker image will run the gem which is installed within it. 
 So the docker image tagged `4.0.2` will run *License Finder Version 4.0.2*
 
-See the [contibuting guide](https://github.com/pivotal/LicenseFinder/blob/master/CONTRIBUTING.md) for information on development. 
+See the [contributing guide](https://github.com/pivotal/LicenseFinder/blob/master/CONTRIBUTING.md) for information on development. 
 
 ### Activation
 
@@ -332,7 +332,7 @@ $ license_finder licenses add my_unknown_dependency MIT --homepage="www.unknown-
 ```
 
 This command would assign the MIT license to the dependency
-`my_unknown_dependency`. It will also set its homepage to `wwww.unknown-code.org`.
+`my_unknown_dependency`. It will also set its homepage to `www.unknown-code.org`.
 
 
 ### Adding Hidden Dependencies
@@ -420,6 +420,15 @@ If you store rebar dependencies in a custom directory (by setting `deps_dir` in
 You can also invoke a custom Mix script `remix` with `--mix_command remix` and
 set `--mix_deps_dir` to fetch Mix dependencies from a custom directory.
 
+### Narrow down Package Manager
+
+By default, license_finder will check for all supported package managers,
+but you can narrow it down to use only those you pass to `--enabled-package-manager`.
+For example,
+
+```
+$ license_finder --enabled-package-manager bundler npm
+```
 
 ### Saving Configuration
 
@@ -437,6 +446,11 @@ rebar_command: './rebarw'
 rebar_deps_dir: './rebar_deps'
 mix_command: './mixw'
 mix_deps_dir: './mix_deps'
+enabled_package_managers:
+  - bundler
+  - gradle
+  - rebar
+  - mix
 ```
 
 ### Gradle Projects

data/VERSION

@@ -1 +1 @@
-6.9.0
+6.10.0

data/ci/pipelines/pull-request.yml.erb

@@ -13,6 +13,8 @@ resource_types:
   source:
     repository: cfcommunity/slack-notification-resource
     tag: latest
+    username: ((LicenseFinderDocker.username))
+    password: ((LicenseFinderDocker.password))
 <% end %>
 
 resources:

data/ci/pipelines/release.yml.erb

@@ -8,6 +8,8 @@ resource_types:
   source:
     repository: cfcommunity/slack-notification-resource
     tag: latest
+    username: ((LicenseFinderDocker.username))
+    password: ((LicenseFinderDocker.password))
 <% end %>
 
 resources:

data/ci/tasks/rubocop.yml

@@ -5,6 +5,8 @@ image_resource:
   source:
     repository: ruby
     tag: 2.7.1
+    username: ((LicenseFinderDocker.username))
+    password: ((LicenseFinderDocker.password))
 
 inputs:
 - name: LicenseFinder

data/ci/tasks/update-changelog.yml

@@ -4,6 +4,8 @@ image_resource:
   source:
     repository: brenix/alpine-bash-git-ssh
     tag: latest
+    username: ((LicenseFinderDocker.username))
+    password: ((LicenseFinderDocker.password))
 platform: linux
 inputs:
 - name: lf-git

data/examples/Gemfile

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+source 'https://rubygems.org'
+gem 'license_finder', path: '..'

data/examples/custom_erb_template.rb

@@ -0,0 +1,24 @@
+#!/usr/bin/env ruby
+
+# frozen_string_literal: true
+
+require 'rubygems'
+require 'bundler/setup'
+
+# This is an example of how to programatically generate a report using a custom
+# ERB template. Run with
+# > bundle install
+# > ./custom_erb_template.rb
+
+require 'license_finder'
+
+# See lib/license_finder/core.rb for more configuration options.
+# A quiet logger is required when running reports...
+lf = LicenseFinder::Core.new(LicenseFinder::Configuration.with_optional_saved_config(logger: :quiet))
+
+# Find many more examples of complex ERB templates in
+# lib/license_finder/reports/templates/
+template = Pathname.new('./sample_template.erb')
+print LicenseFinder::ErbReport
+  .new(lf.acknowledged, project_name: lf.project_name)
+  .to_s(template)

data/examples/extract_license_data.rb

@@ -0,0 +1,63 @@
+#!/usr/bin/env ruby
+
+# frozen_string_literal: true
+
+require 'rubygems'
+require 'bundler/setup'
+
+# This is an example of how to programatically extract the information that
+# LicenseFinder has about packages and their licenses.
+# > bundle install
+# > ./extract_license_data.rb
+
+require 'license_finder'
+
+# See lib/license_finder/core.rb for more configuration options.
+# A quiet logger is required when running reports...
+lf = LicenseFinder::Core.new(LicenseFinder::Configuration.with_optional_saved_config(logger: :quiet))
+
+# Groups of packages
+lf.acknowledged # All (non-ignored) packages license_finder is tracking
+lf.unapproved # The packages which have not been approved or permitted
+lf.restricted # The packages which have been restricted
+
+# Package details
+lf.acknowledged.each do |package|
+  # Approvals
+  package.approved? # Whether the package has been approved manually or permitted
+  package.approved_manually?
+  package.permitted?
+  package.restricted?
+
+  # Licensing
+  # The set of licenses, each of which has a name and url, which
+  # license_finder will report for this package.
+  package.licenses
+  # Additional information about how these licenses were chosen
+  # (from decision, from spec, from files, or none-found).  See
+  # LicenseFinder::Licensing and LicenseFinder::Activation
+  package.activations
+  # The files that look like licenses, found in the package's
+  # directory.  Caveat: if a package's licenses were specified by a decision or
+  # by the package's spec, the license_files will be ignored.  That means,
+  # package.licenses may report different licenses than those found in
+  # license_files.
+  package.license_files
+  package.license_files.each do |file|
+    # The license found in this file.
+    file.license
+    # The text of the file.  Sometimes this will be an entire README file,
+    # because license_finder has found the phrase "is released under the
+    # MIT license" in it.
+    file.text
+  end
+  package.licensing.activations_from_decisions # If license_finder only knew about decisions, what licenses would it report?
+  package.licensing.activations_from_spec      # If license_finder only knew about package specs, what licenses would it report?
+  package.licensing.activations_from_files     # If license_finder only knew about package files, what licenses would it report?
+  package.licensing.activations_from_files.each do |activation|
+    # Each activation groups together all files that point to the same license.
+    # Each file contains its #license and #text.
+    activation.license
+    activation.files
+  end
+end

data/examples/sample_template.erb

@@ -0,0 +1,7 @@
+Licenses
+
+<%= dependencies.size %> total
+
+<% grouped_dependencies.each do |license_name, group| -%>
+* <%= group.size %> <%= license_name %>
+<% end %>

data/lib/license_finder/cli/base.rb

@@ -11,6 +11,10 @@ module LicenseFinder
                    desc: 'Where decisions are saved. Defaults to doc/dependency_decisions.yml.'
       class_option :log_directory,
                    desc: 'Where logs are saved. Defaults to ./lf_logs/$PROJECT/prepare_$PACKAGE_MANAGER.log'
+      class_option :enabled_package_managers,
+                   desc: 'List of package managers to be enabled. Defaults to all supported package managers.',
+                   type: :array,
+                   enum: LicenseFinder::Scanner.supported_package_manager_ids
 
       no_commands do
         def decisions
@@ -32,6 +36,7 @@ module LicenseFinder
         extract_options(
           :project_path,
           :decisions_file,
+          :enabled_package_managers,
           :go_full_version,
           :gradle_command,
           :gradle_include_groups,

data/lib/license_finder/cli/main.rb

@@ -19,7 +19,8 @@ module LicenseFinder
         'markdown' => MarkdownReport,
         'csv' => CsvReport,
         'xml' => XmlReport,
-        'json' => JsonReport
+        'json' => JsonReport,
+        'junit' => JunitReport
       }.freeze
 
       class_option :go_full_version, desc: 'Whether dependency version should include full version. Only meaningful if used with a Go project. Defaults to false.'

data/lib/license_finder/configuration.rb

@@ -65,6 +65,10 @@ module LicenseFinder
       Pathname(path_prefix).expand_path
     end
 
+    def enabled_package_manager_ids
+      get(:enabled_package_managers)
+    end
+
     def logger_mode
       get(:logger)
     end

data/lib/license_finder/core.rb

@@ -24,7 +24,7 @@ module LicenseFinder
     # Default +options+:
     # {
     #   project_path: Pathname.pwd
-    #   logger: {},   # can include quiet: true or debug: true
+    #   logger: nil,   # can be :quiet or :debug
     #   decisions_file: "doc/dependency_decisions.yml",
     #   gradle_command: "gradle",
     #   rebar_command: "rebar",
@@ -93,6 +93,7 @@ module LicenseFinder
         project_path: config.project_path,
         log_directory: File.join(config.log_directory, project_name),
         ignored_groups: decisions.ignored_groups,
+        enabled_package_manager_ids: config.enabled_package_manager_ids,
         go_full_version: config.go_full_version,
         gradle_command: config.gradle_command,
         gradle_include_groups: config.gradle_include_groups,

data/lib/license_finder/package_manager.rb

@@ -22,6 +22,10 @@ module LicenseFinder
       def takes_priority_over
         nil
       end
+
+      def id
+        name.split('::').last.downcase
+      end
     end
 
     def installed?(logger = Core.default_logger)

data/lib/license_finder/package_managers/composer.rb

@@ -33,7 +33,7 @@ module LicenseFinder
     end
 
     def prepare_command
-      'composer install --no-plugins --ignore-platform-reqs --no-interaction'
+      'composer install --no-plugins --no-scripts --ignore-platform-reqs --no-interaction'
     end
 
     def package_path

data/lib/license_finder/package_managers/npm.rb

@@ -14,7 +14,7 @@ module LicenseFinder
     end
 
     def prepare_command
-      'npm install --no-save'
+      'npm install --no-save --ignore-scripts'
     end
 
     def possible_package_paths

data/lib/license_finder/package_managers/yarn.rb

@@ -56,7 +56,7 @@ module LicenseFinder
     end
 
     def prepare_command
-      'yarn install --ignore-engines'
+      'yarn install --ignore-engines --ignore-scripts'
     end
 
     private

data/lib/license_finder/report.rb

@@ -30,3 +30,4 @@ require 'license_finder/reports/html_report'
 require 'license_finder/reports/markdown_report'
 require 'license_finder/reports/xml_report'
 require 'license_finder/reports/json_report'
+require 'license_finder/reports/junit_report'

data/lib/license_finder/reports/junit_report.rb

@@ -0,0 +1,19 @@
+require 'license_finder/reports/erb_report'
+
+module LicenseFinder
+  class JunitReport < ErbReport
+    ROOT_PATH = Pathname.new(__FILE__).dirname
+    TEMPLATE_PATH = ROOT_PATH.join('templates')
+
+    def to_s(filename = TEMPLATE_PATH.join("#{template_name}.erb"))
+      template = ERB.new(filename.read, nil, '-')
+      template.result(binding)
+    end
+
+    private
+
+    def template_name
+      'junit_report'
+    end
+  end
+end

data/lib/license_finder/reports/templates/junit_report.erb

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<testsuites failures="<%= unapproved_dependencies.size %>" name="<%= project_name %>" tests="<%= dependencies.size %>">
+<% sorted_dependencies.each_with_index do |dependency, i| -%>
+  <testsuite failures="<%= dependency.approved? ? "0" : "1" -%>" id="<%= i %>" name="<%= dependency.name %>" package="Gemfile.lock" skipped="0" tests="1" timestamp="<%= Time.now.strftime("%Y-%m-%dT%H:%M:%S:%6N") %>">
+    <testcase classname="<%= license_names(dependency) %>" name="<%= dependency.name %>"<%= dependency.approved? ? " /" : "" %>>
+    <%- unless dependency.approved? -%>
+      <failure message="Unapproved license in '<%= dependency.name %>' <%= dependency.version %>">
+Name: <%= dependency.name %>
+Version: <%= dependency.version %>
+Licence:
+<%- if dependency.licenses.any? -%>
+<%- dependency.licenses.each do |license| -%>- <%=license.name %>: <%=license.url %><% end %>
+<%- end -%>
+URL: <%= dependency.package_url %>
+Homepage: <%= dependency.homepage %>
+Summary: <%= REXML::Text.new(dependency.summary, false, nil, false) %>
+Description: <%= REXML::Text.new(dependency.description, false, nil, false) %>
+<% if dependency.parents.any? %>
+Dependencies:
+<% dependency.parents.to_a.each do |dep| -%>
+- <%= dep %>
+<% end -%>
+<% end -%>
+<%- if dependency.children.any? -%>
+Requirements:
+<%- dependency.children.each do |req| -%>
+- <%= req %>
+<% end -%>
+<% end -%>
+      </failure>
+      <system-out>
+stdout
+      </system-out>
+      <system-err>
+stderr
+      </system-err>
+    </testcase>
+  <%- end -%>
+  </testsuite>
+<% end -%>
+</testsuites>

data/lib/license_finder/scanner.rb

@@ -12,6 +12,10 @@ module LicenseFinder
         paths.reject { |path| subproject?(Pathname(path)) }
       end
 
+      def supported_package_manager_ids
+        PACKAGE_MANAGERS.map(&:id)
+      end
+
       private
 
       def subproject?(path)
@@ -28,6 +32,7 @@ module LicenseFinder
       @config = config
       @project_path = @config[:project_path]
       @logger = @config[:logger]
+      @enabled_package_manager_ids = @config[:enabled_package_manager_ids]
     end
 
     def active_packages
@@ -40,7 +45,7 @@ module LicenseFinder
       return @package_managers if @package_managers
 
       active_pm_classes = []
-      PACKAGE_MANAGERS.each do |pm_class|
+      enabled_package_managers.each do |pm_class|
         active = pm_class.new(@config).active?
 
         if active
@@ -56,5 +61,22 @@ module LicenseFinder
       active_pm_classes -= active_pm_classes.map(&:takes_priority_over)
       @package_managers = active_pm_classes.map { |pm_class| pm_class.new(@config) }
     end
+
+    private
+
+    def enabled_package_managers
+      enabled_pm_ids = @enabled_package_manager_ids
+
+      return PACKAGE_MANAGERS unless enabled_pm_ids
+
+      enabled_pm_classes = PACKAGE_MANAGERS.select { |pm_class| enabled_pm_ids.include?(pm_class.id) }
+
+      if enabled_pm_classes.length != enabled_pm_ids.length
+        unsupported_pm_ids = enabled_pm_ids - self.class.supported_package_manager_ids
+        raise "Unsupported package manager: #{unsupported_pm_ids.join(', ')}"
+      end
+
+      enabled_pm_classes
+    end
   end
 end

data/license_finder.gemspec

@@ -46,7 +46,7 @@ Gem::Specification.new do |s|
   s.add_dependency 'bundler'
   s.add_dependency 'rubyzip', '>=1', '<3'
   s.add_dependency 'thor', '~> 1.0.1'
-  s.add_dependency 'tomlrb', '~> 1.3.0'
+  s.add_dependency 'tomlrb', '>= 1.3', '< 2.1'
   s.add_dependency 'with_env', '1.1.0'
   s.add_dependency 'xml-simple', '~> 1.1.5'
 
@@ -63,6 +63,7 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'rubocop-performance', '~> 1.5.0'
   s.add_development_dependency 'webmock', '~> 3.5'
 
+  s.add_development_dependency 'nokogiri', '~>1.10'
   s.add_development_dependency 'rack', '~> 2.2.2'
   s.add_development_dependency 'rack-test', '~> 1.1.0', '> 0.7'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_finder
 version: !ruby/object:Gem::Version
-  version: 6.9.0
+  version: 6.10.0
 platform: ruby
 authors:
 - Ryan Collins
@@ -27,7 +27,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-05 00:00:00.000000000 Z
+date: 2020-11-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -81,16 +81,22 @@ dependencies:
   name: tomlrb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 1.3.0
+        version: '1.3'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: with_env
   requirement: !ruby/object:Gem::Requirement
@@ -273,6 +279,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.5'
+- !ruby/object:Gem::Dependency
+  name: nokogiri
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.10'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -351,6 +371,10 @@ files:
 - ci/tasks/run-tests.yml
 - ci/tasks/update-changelog.yml
 - dlf
+- examples/Gemfile
+- examples/custom_erb_template.rb
+- examples/extract_license_data.rb
+- examples/sample_template.erb
 - lib/license_finder.rb
 - lib/license_finder/cli.rb
 - lib/license_finder/cli/approvals.rb
@@ -472,10 +496,12 @@ files:
 - lib/license_finder/reports/erb_report.rb
 - lib/license_finder/reports/html_report.rb
 - lib/license_finder/reports/json_report.rb
+- lib/license_finder/reports/junit_report.rb
 - lib/license_finder/reports/markdown_report.rb
 - lib/license_finder/reports/merged_report.rb
 - lib/license_finder/reports/templates/bootstrap.css
 - lib/license_finder/reports/templates/html_report.erb
+- lib/license_finder/reports/templates/junit_report.erb
 - lib/license_finder/reports/templates/markdown_report.erb
 - lib/license_finder/reports/templates/xml_report.erb
 - lib/license_finder/reports/text_report.rb