license_finder 7.1.0 → 7.2.0

data/lib/license_finder/package_utils/possible_license_file.rb

@@ -3,7 +3,11 @@
 module LicenseFinder
   class PossibleLicenseFile
     def initialize(path, options = {})
-      @path = Pathname(path)
+      if !path.is_a?(Zip::Entry)
+        @path = Pathname(path)
+      else
+        @zip_entry = path
+      end
       @logger = options[:logger]
     end
 
@@ -16,7 +20,9 @@ module LicenseFinder
     end
 
     def text
-      if @path.exist?
+      if @zip_entry
+        @zip_entry.get_input_stream.read
+      elsif @path.exist?
         @text ||= (@path.respond_to?(:binread) ? @path.binread : @path.read)
       else
         @logger.info('ERROR', "#{@path} does not exists", color: :red)

data/lib/license_finder/packages/maven_package.rb

@@ -5,13 +5,17 @@ module LicenseFinder
     def initialize(spec, options = {})
       name = spec['artifactId']
       name = "#{spec['groupId']}:#{name}" if options[:include_groups]
+      @jar_file = spec['jarFile']
 
       super(
         name,
         spec['version'],
         options.merge(
           spec_licenses: Array(spec['licenses']).map { |l| l['name'] },
-          groups: Array(spec['groupId'])
+          groups: Array(spec['groupId']),
+          summary: spec['summary'],
+          description: spec['description'],
+          homepage: spec['homepage']
         )
       )
     end
@@ -23,5 +27,13 @@ module LicenseFinder
     def package_url
       "https://search.maven.org/artifact/#{CGI.escape(groups.first)}/#{CGI.escape(name.split(':').last)}/#{CGI.escape(version)}/jar"
     end
+
+    def license_files
+      LicenseFiles.find(@jar_file, logger: logger)
+    end
+
+    def notice_files
+      NoticeFiles.find(@jar_file, logger: logger)
+    end
   end
 end

data/lib/license_finder/packages/npm_package.rb

@@ -23,12 +23,12 @@ module LicenseFinder
       def flattened_dependencies(npm_json, existing_packages = {})
         identifier = Identifier.from_hash npm_json
         if existing_packages[identifier].nil?
-          existing_packages[identifier] = NpmPackage.new(npm_json) if identifier
+          existing_packages[identifier] = package_for_dependency(npm_json) if identifier
           npm_json.fetch('dependencies', {}).values.map do |d|
             flattened_dependencies(d, existing_packages)
           end
         else
-          duplicate_package = NpmPackage.new(npm_json)
+          duplicate_package = package_for_dependency(npm_json)
           unless existing_packages[identifier].dependencies.include?(duplicate_package.dependencies)
             existing_packages[identifier].dependencies |= duplicate_package.dependencies
             npm_json.fetch('dependencies', {}).values.map do |d|
@@ -39,6 +39,23 @@ module LicenseFinder
         existing_packages
       end
 
+      # Read the dependency's package.json file in order to get details like the license, authors,
+      # and so on. In NPM versions < 7, this information was included in the output of `npm list`.
+      # In later versions, it no longer is, and has to be read from the package.json file instead.
+      def package_for_dependency(npm_json)
+        package_path = npm_json['path']
+        package_json_path = Pathname.new(package_path).join('package.json') unless package_path.nil?
+
+        if package_json_path.nil? || !package_json_path.exist?
+          # Ancient NPM versions did not have the "path" field. Resort to the old way of gathering
+          # the details, expecting them to be contained in the output of `npm list`.
+          NpmPackage.new(npm_json)
+        else
+          package_json = JSON.parse(package_json_path.read, max_nesting: false)
+          NpmPackage.new(npm_json, package_json)
+        end
+      end
+
       def populate_groups(package_json)
         package_json.groups.each do |group|
           group.package_names.each do |package_name|
@@ -64,25 +81,34 @@ module LicenseFinder
       end
     end
 
-    def initialize(npm_json)
-      @json = npm_json
+    def initialize(npm_json, package_json = npm_json)
+      @npm_json = npm_json
+      @json = package_json
       @identifier = Identifier.from_hash(npm_json)
       @dependencies = deps_from_json
       super(@identifier.name,
             @identifier.version,
-            description: npm_json['description'],
-            homepage: npm_json['homepage'],
+            description: package_json['description'],
+            homepage: package_json['homepage'],
             authors: author_names,
-            spec_licenses: Package.license_names_from_standard_spec(npm_json),
+            spec_licenses: Package.license_names_from_standard_spec(package_json),
             install_path: npm_json['path'],
             children: @dependencies.map(&:name))
     end
 
     def author_names
       names = []
-      names.push(author_name(@json['author'])) unless @json['author'].nil?
+      if @json['author'].is_a?(Array)
+        # "author":["foo","bar"] isn't valid according to the NPM package.json schema, but can be found in the wild.
+        names += @json['author'].map { |a| author_name(a) }
+      else
+        names << author_name(@json['author']) unless @json['author'].nil?
+      end
       names += @json['contributors'].map { |c| author_name(c) } if @json['contributors'].is_a?(Array)
-      names.join(', ')
+      names.compact.join(', ')
+    rescue TypeError
+      puts "Warning: Invalid author and/or contributors metadata found in package.json for #{@identifier}"
+      nil
     end
 
     def author_name(author)
@@ -117,7 +143,7 @@ module LicenseFinder
     private
 
     def deps_from_json
-      @json.fetch('dependencies', {}).values.map { |dep| Identifier.from_hash(dep) }.compact
+      @npm_json.fetch('dependencies', {}).values.map { |dep| Identifier.from_hash(dep) }.compact
     end
 
     class Identifier
@@ -131,7 +157,7 @@ module LicenseFinder
       def self.from_hash(hash)
         name = hash['name']
         version = hash['version']
-        return nil if name.nil? || version.nil?
+        return nil if name.nil? || name.empty? || version.nil? || version.empty?
 
         Identifier.new(name, version)
       end

data/lib/license_finder/printer.rb

@@ -4,7 +4,7 @@ module LicenseFinder
   class Printer
     attr_reader :padding
 
-    def initialize #:nodoc:
+    def initialize # :nodoc:
       @base = nil
       @mute = false
       @padding = 0
@@ -24,7 +24,7 @@ module LicenseFinder
       spaces + set_color(message.to_s, *color)
     end
 
-    def set_color(string, *) #:nodoc:
+    def set_color(string, *) # :nodoc:
       string
     end
 

data/lib/license_finder/scanner.rb

@@ -3,7 +3,7 @@
 module LicenseFinder
   class Scanner
     PACKAGE_MANAGERS = [
-      GoModules, GoDep, GoWorkspace, Go15VendorExperiment, Glide, Gvt, Govendor, Trash, Dep, Bundler, NPM, PNPM, Pip,
+      GoModules, GoDep, GoWorkspace, Go15VendorExperiment, Glide, Gvt, Govendor, Trash, Bundler, NPM, PNPM, Pip,
       Yarn, Bower, Maven, Gradle, CocoaPods, Rebar, Erlangmk, Nuget, Carthage, Mix, Conan, Sbt, Cargo, Dotnet, Composer, Pipenv,
       Conda, Spm, Pub
     ].freeze
@@ -50,10 +50,10 @@ module LicenseFinder
         active = pm_class.new(@config).active?
 
         if active
-          @logger.info pm_class, 'is active', color: :green
+          @logger.info pm_class, "is active for '#{@project_path}'", color: :green
           active_pm_classes << pm_class
         else
-          @logger.debug pm_class, 'is not active', color: :red
+          @logger.debug pm_class, "is not active for '#{@project_path}'", color: :red
         end
       end
 

data/license_finder.gemspec

@@ -3,7 +3,7 @@
 version = File.read(File.expand_path('VERSION', __dir__)).strip
 
 Gem::Specification.new do |s|
-  s.required_ruby_version = '>= 2.4.0'
+  s.required_ruby_version = '>= 2.6.0'
   s.name        = 'license_finder'
   s.version     = version
 
@@ -44,30 +44,31 @@ Gem::Specification.new do |s|
   s.license = 'MIT'
 
   s.add_dependency 'bundler'
+  s.add_dependency 'csv', '~> 3.2'
   s.add_dependency 'rubyzip', '>=1', '<3'
   s.add_dependency 'thor', '~> 1.2'
   s.add_dependency 'tomlrb', '>= 1.3', '< 2.1'
   s.add_dependency 'with_env', '1.1.0'
   s.add_dependency 'xml-simple', '~> 1.1.9'
 
-  s.add_development_dependency 'addressable', '2.8.1'
-  s.add_development_dependency 'capybara', '~> 3.32.2'
+  s.add_development_dependency 'addressable', '2.8.6'
+  s.add_development_dependency 'capybara', '~> 3.39.2'
   s.add_development_dependency 'cocoapods', '>= 1.0.0' if RUBY_PLATFORM.match?(/darwin/)
   s.add_development_dependency 'e2mmap', '~> 0.1.0'
-  s.add_development_dependency 'fakefs', '~> 1.8.0'
-  s.add_development_dependency 'matrix', '~> 0.1.0'
-  s.add_development_dependency 'mime-types', '3.4.1'
+  s.add_development_dependency 'fakefs', '~> 2.5.0'
+  s.add_development_dependency 'matrix', '~> 0.4.2'
+  s.add_development_dependency 'mime-types', '3.5.2'
   s.add_development_dependency 'pry', '~> 0.14.1'
-  s.add_development_dependency 'rake', '~> 13.0.6'
+  s.add_development_dependency 'rake', '~> 13.1.0'
   s.add_development_dependency 'rspec', '~> 3'
   s.add_development_dependency 'rspec-its', '~> 1.3.0'
-  s.add_development_dependency 'rubocop', '~> 1.12.1'
-  s.add_development_dependency 'rubocop-performance', '~> 1.10.2'
+  s.add_development_dependency 'rubocop', '~> 1.60.2'
+  s.add_development_dependency 'rubocop-performance', '~> 1.20.2'
   s.add_development_dependency 'webmock', '~> 3.14'
 
   s.add_development_dependency 'nokogiri', '~>1.10'
   s.add_development_dependency 'rack', '~> 3.0.0'
-  s.add_development_dependency 'rack-test', '> 0.7', '~> 2.0.2'
+  s.add_development_dependency 'rack-test', '> 0.7', '~> 2.1.0'
 
   s.files         = `git ls-files`.split("\n").reject { |f| f.start_with?('spec', 'features') }
   s.executables   = `git ls-files -- bin/*`.split("\n").map { |f| File.basename(f) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_finder
 version: !ruby/object:Gem::Version
-  version: 7.1.0
+  version: 7.2.0
 platform: ruby
 authors:
 - Ryan Collins
@@ -27,7 +27,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-11-28 00:00:00.000000000 Z
+date: 2024-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -43,6 +43,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: csv
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -131,28 +145,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.8.1
+        version: 2.8.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 2.8.1
+        version: 2.8.6
 - !ruby/object:Gem::Dependency
   name: capybara
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.32.2
+        version: 3.39.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 3.32.2
+        version: 3.39.2
 - !ruby/object:Gem::Dependency
   name: e2mmap
   requirement: !ruby/object:Gem::Requirement
@@ -173,42 +187,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 2.5.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.8.0
+        version: 2.5.0
 - !ruby/object:Gem::Dependency
   name: matrix
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.4.2
 - !ruby/object:Gem::Dependency
   name: mime-types
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.4.1
+        version: 3.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.4.1
+        version: 3.5.2
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
@@ -229,14 +243,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: 13.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.6
+        version: 13.1.0
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -271,28 +285,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.1
+        version: 1.60.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.1
+        version: 1.60.2
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.2
+        version: 1.20.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.2
+        version: 1.20.2
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -344,7 +358,7 @@ dependencies:
         version: '0.7'
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.2
+        version: 2.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -354,7 +368,7 @@ dependencies:
         version: '0.7'
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.0.2
+        version: 2.1.0
 description: |2
       LicenseFinder works with your package managers to find
       dependencies, detect the licenses of the packages in them, compare
@@ -434,12 +448,18 @@ files:
 - lib/license_finder/license/none_matcher.rb
 - lib/license_finder/license/template.rb
 - lib/license_finder/license/templates/0BSD.txt
+- lib/license_finder/license/templates/AGPL3.txt
 - lib/license_finder/license/templates/Apache1_1.txt
 - lib/license_finder/license/templates/Apache2.txt
+- lib/license_finder/license/templates/Artistic.txt
 - lib/license_finder/license/templates/BSD.txt
 - lib/license_finder/license/templates/CC01.txt
+- lib/license_finder/license/templates/CC01_alt.txt
 - lib/license_finder/license/templates/CDDL1.txt
+- lib/license_finder/license/templates/CDDL1_1.txt
+- lib/license_finder/license/templates/CPL1.txt
 - lib/license_finder/license/templates/EPL1.txt
+- lib/license_finder/license/templates/EPL2.txt
 - lib/license_finder/license/templates/GPLv2.txt
 - lib/license_finder/license/templates/GPLv3.txt
 - lib/license_finder/license/templates/ISC.txt
@@ -453,6 +473,7 @@ files:
 - lib/license_finder/license/templates/Python.txt
 - lib/license_finder/license/templates/Ruby.txt
 - lib/license_finder/license/templates/SimplifiedBSD.txt
+- lib/license_finder/license/templates/Unlicense.txt
 - lib/license_finder/license/templates/WTFPL.txt
 - lib/license_finder/license/templates/Zlib.txt
 - lib/license_finder/license/text.rb
@@ -496,6 +517,7 @@ files:
 - lib/license_finder/package_managers/yarn.rb
 - lib/license_finder/package_utils/activation.rb
 - lib/license_finder/package_utils/conan_info_parser.rb
+- lib/license_finder/package_utils/conan_info_parser_v2.rb
 - lib/license_finder/package_utils/gradle_dependency_finder.rb
 - lib/license_finder/package_utils/license_files.rb
 - lib/license_finder/package_utils/licensing.rb
@@ -566,14 +588,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.4.0
+      version: 2.6.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.5.10
 signing_key: 
 specification_version: 4
 summary: Audit the OSS licenses of your application's dependencies.