license_patrol 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (198) hide show
  1. checksums.yaml +7 -0
  2. data/.force-build +0 -0
  3. data/.github/dependabot.yml +16 -0
  4. data/.github/workflows/install-test-tools.sh +28 -0
  5. data/.github/workflows/license_patrol.yml +13 -0
  6. data/.gitignore +13 -0
  7. data/.pre-commit-hooks.yaml +10 -0
  8. data/.rspec +1 -0
  9. data/.rubocop.yml +84 -0
  10. data/CHANGELOG.md +1070 -0
  11. data/CONTRIBUTING.md +122 -0
  12. data/Dockerfile +275 -0
  13. data/Gemfile +2 -0
  14. data/LICENSE +22 -0
  15. data/README.md +593 -0
  16. data/Rakefile +75 -0
  17. data/TODO.md +12 -0
  18. data/VERSION +1 -0
  19. data/bin/license_patrol +6 -0
  20. data/bin/license_patrol_pip.py +43 -0
  21. data/ci/pipelines/pull-request.yml.erb +138 -0
  22. data/ci/pipelines/release.yml.erb +176 -0
  23. data/ci/scripts/containerize-tests.sh +14 -0
  24. data/ci/scripts/pushscript.sh +31 -0
  25. data/ci/scripts/run-rubocop.sh +15 -0
  26. data/ci/scripts/run-tests.sh +41 -0
  27. data/ci/scripts/test.ps1 +81 -0
  28. data/ci/scripts/updateChangelog.sh +84 -0
  29. data/ci/tasks/build-and-push-gem.yml +10 -0
  30. data/ci/tasks/build-windows.yml +6 -0
  31. data/ci/tasks/build.yml +16 -0
  32. data/ci/tasks/rubocop.yml +15 -0
  33. data/ci/tasks/run-tests.yml +10 -0
  34. data/ci/tasks/update-changelog.yml +18 -0
  35. data/dlf +21 -0
  36. data/doc/dependency_decisions.yml +3 -0
  37. data/examples/Gemfile +4 -0
  38. data/examples/custom_erb_template.rb +24 -0
  39. data/examples/extract_license_data.rb +63 -0
  40. data/examples/sample_template.erb +7 -0
  41. data/lib/license_patrol/cli/approvals.rb +28 -0
  42. data/lib/license_patrol/cli/base.rb +113 -0
  43. data/lib/license_patrol/cli/dependencies.rb +44 -0
  44. data/lib/license_patrol/cli/ignored_dependencies.rb +32 -0
  45. data/lib/license_patrol/cli/ignored_groups.rb +32 -0
  46. data/lib/license_patrol/cli/inherited_decisions.rb +50 -0
  47. data/lib/license_patrol/cli/licenses.rb +31 -0
  48. data/lib/license_patrol/cli/main.rb +229 -0
  49. data/lib/license_patrol/cli/makes_decisions.rb +38 -0
  50. data/lib/license_patrol/cli/patched_thor.rb +33 -0
  51. data/lib/license_patrol/cli/permitted_licenses.rb +32 -0
  52. data/lib/license_patrol/cli/project_name.rb +32 -0
  53. data/lib/license_patrol/cli/restricted_licenses.rb +32 -0
  54. data/lib/license_patrol/cli.rb +20 -0
  55. data/lib/license_patrol/configuration.rb +197 -0
  56. data/lib/license_patrol/core.rb +121 -0
  57. data/lib/license_patrol/decision_applier.rb +70 -0
  58. data/lib/license_patrol/decisions.rb +334 -0
  59. data/lib/license_patrol/decisions_factory.rb +13 -0
  60. data/lib/license_patrol/diff.rb +51 -0
  61. data/lib/license_patrol/license/any_matcher.rb +15 -0
  62. data/lib/license_patrol/license/definitions.rb +498 -0
  63. data/lib/license_patrol/license/header_matcher.rb +17 -0
  64. data/lib/license_patrol/license/matcher.rb +24 -0
  65. data/lib/license_patrol/license/none_matcher.rb +11 -0
  66. data/lib/license_patrol/license/template.rb +19 -0
  67. data/lib/license_patrol/license/templates/0BSD.txt +10 -0
  68. data/lib/license_patrol/license/templates/AGPL3.txt +661 -0
  69. data/lib/license_patrol/license/templates/Apache1_1.txt +16 -0
  70. data/lib/license_patrol/license/templates/Apache2.txt +170 -0
  71. data/lib/license_patrol/license/templates/Artistic.txt +128 -0
  72. data/lib/license_patrol/license/templates/BSD.txt +24 -0
  73. data/lib/license_patrol/license/templates/CC01.txt +30 -0
  74. data/lib/license_patrol/license/templates/CC01_alt.txt +31 -0
  75. data/lib/license_patrol/license/templates/CDDL1.txt +131 -0
  76. data/lib/license_patrol/license/templates/CDDL1_1.txt +123 -0
  77. data/lib/license_patrol/license/templates/CPL1.txt +217 -0
  78. data/lib/license_patrol/license/templates/EPL1.txt +86 -0
  79. data/lib/license_patrol/license/templates/EPL2.txt +80 -0
  80. data/lib/license_patrol/license/templates/GPLv2.txt +339 -0
  81. data/lib/license_patrol/license/templates/GPLv3.txt +674 -0
  82. data/lib/license_patrol/license/templates/ISC.txt +2 -0
  83. data/lib/license_patrol/license/templates/LGPL.txt +165 -0
  84. data/lib/license_patrol/license/templates/LGPL2_1.txt +169 -0
  85. data/lib/license_patrol/license/templates/MIT.txt +9 -0
  86. data/lib/license_patrol/license/templates/MPL1_1.txt +469 -0
  87. data/lib/license_patrol/license/templates/MPL2.txt +373 -0
  88. data/lib/license_patrol/license/templates/NewBSD.txt +21 -0
  89. data/lib/license_patrol/license/templates/OFL.txt +91 -0
  90. data/lib/license_patrol/license/templates/Python.txt +47 -0
  91. data/lib/license_patrol/license/templates/Ruby.txt +52 -0
  92. data/lib/license_patrol/license/templates/SimplifiedBSD.txt +19 -0
  93. data/lib/license_patrol/license/templates/Unlicense.txt +24 -0
  94. data/lib/license_patrol/license/templates/WTFPL.txt +14 -0
  95. data/lib/license_patrol/license/templates/Zlib.txt +17 -0
  96. data/lib/license_patrol/license/text.rb +49 -0
  97. data/lib/license_patrol/license.rb +123 -0
  98. data/lib/license_patrol/license_aggregator.rb +59 -0
  99. data/lib/license_patrol/logger.rb +69 -0
  100. data/lib/license_patrol/manual_licenses.rb +79 -0
  101. data/lib/license_patrol/package.rb +200 -0
  102. data/lib/license_patrol/package_delta.rb +61 -0
  103. data/lib/license_patrol/package_manager.rb +183 -0
  104. data/lib/license_patrol/package_managers/bower.rb +37 -0
  105. data/lib/license_patrol/package_managers/bundler.rb +134 -0
  106. data/lib/license_patrol/package_managers/cargo.rb +38 -0
  107. data/lib/license_patrol/package_managers/carthage.rb +68 -0
  108. data/lib/license_patrol/package_managers/cocoa_pods.rb +66 -0
  109. data/lib/license_patrol/package_managers/composer.rb +63 -0
  110. data/lib/license_patrol/package_managers/conan.rb +70 -0
  111. data/lib/license_patrol/package_managers/conda.rb +131 -0
  112. data/lib/license_patrol/package_managers/dep.rb +45 -0
  113. data/lib/license_patrol/package_managers/dotnet.rb +86 -0
  114. data/lib/license_patrol/package_managers/erlangmk.rb +50 -0
  115. data/lib/license_patrol/package_managers/glide.rb +42 -0
  116. data/lib/license_patrol/package_managers/go_15vendorexperiment.rb +87 -0
  117. data/lib/license_patrol/package_managers/go_dep.rb +80 -0
  118. data/lib/license_patrol/package_managers/go_modules.rb +93 -0
  119. data/lib/license_patrol/package_managers/go_workspace.rb +117 -0
  120. data/lib/license_patrol/package_managers/govendor.rb +73 -0
  121. data/lib/license_patrol/package_managers/gradle.rb +99 -0
  122. data/lib/license_patrol/package_managers/gvt.rb +69 -0
  123. data/lib/license_patrol/package_managers/maven.rb +69 -0
  124. data/lib/license_patrol/package_managers/mix.rb +131 -0
  125. data/lib/license_patrol/package_managers/npm.rb +70 -0
  126. data/lib/license_patrol/package_managers/nuget.rb +159 -0
  127. data/lib/license_patrol/package_managers/pip.rb +70 -0
  128. data/lib/license_patrol/package_managers/pipenv.rb +63 -0
  129. data/lib/license_patrol/package_managers/pnpm.rb +126 -0
  130. data/lib/license_patrol/package_managers/pub.rb +86 -0
  131. data/lib/license_patrol/package_managers/rebar.rb +65 -0
  132. data/lib/license_patrol/package_managers/sbt.rb +46 -0
  133. data/lib/license_patrol/package_managers/spm.rb +93 -0
  134. data/lib/license_patrol/package_managers/trash.rb +43 -0
  135. data/lib/license_patrol/package_managers/yarn.rb +195 -0
  136. data/lib/license_patrol/package_utils/activation.rb +40 -0
  137. data/lib/license_patrol/package_utils/conan_info_parser.rb +77 -0
  138. data/lib/license_patrol/package_utils/conan_info_parser_v2.rb +82 -0
  139. data/lib/license_patrol/package_utils/gradle_dependency_finder.rb +15 -0
  140. data/lib/license_patrol/package_utils/license_files.rb +51 -0
  141. data/lib/license_patrol/package_utils/licensing.rb +40 -0
  142. data/lib/license_patrol/package_utils/maven_dependency_finder.rb +57 -0
  143. data/lib/license_patrol/package_utils/notice_files.rb +51 -0
  144. data/lib/license_patrol/package_utils/possible_license_file.rb +33 -0
  145. data/lib/license_patrol/package_utils/pypi.rb +43 -0
  146. data/lib/license_patrol/package_utils/sbt_dependency_finder.rb +15 -0
  147. data/lib/license_patrol/packages/bower_package.rb +45 -0
  148. data/lib/license_patrol/packages/bundler_package.rb +33 -0
  149. data/lib/license_patrol/packages/cargo_package.rb +28 -0
  150. data/lib/license_patrol/packages/carthage_package.rb +18 -0
  151. data/lib/license_patrol/packages/cocoa_pods_package.rb +22 -0
  152. data/lib/license_patrol/packages/composer_package.rb +13 -0
  153. data/lib/license_patrol/packages/conan_package.rb +23 -0
  154. data/lib/license_patrol/packages/conda_package.rb +74 -0
  155. data/lib/license_patrol/packages/erlangmk_package.rb +112 -0
  156. data/lib/license_patrol/packages/go_package.rb +30 -0
  157. data/lib/license_patrol/packages/gradle_package.rb +30 -0
  158. data/lib/license_patrol/packages/manual_package.rb +27 -0
  159. data/lib/license_patrol/packages/maven_package.rb +39 -0
  160. data/lib/license_patrol/packages/merged_package.rb +44 -0
  161. data/lib/license_patrol/packages/mix_package.rb +13 -0
  162. data/lib/license_patrol/packages/npm_package.rb +219 -0
  163. data/lib/license_patrol/packages/nuget_package.rb +13 -0
  164. data/lib/license_patrol/packages/pip_package.rb +50 -0
  165. data/lib/license_patrol/packages/pnpm_package.rb +13 -0
  166. data/lib/license_patrol/packages/pubspec_package.rb +18 -0
  167. data/lib/license_patrol/packages/rebar_package.rb +13 -0
  168. data/lib/license_patrol/packages/sbt_package.rb +22 -0
  169. data/lib/license_patrol/packages/spm_package.rb +18 -0
  170. data/lib/license_patrol/packages/yarn_package.rb +13 -0
  171. data/lib/license_patrol/platform.rb +15 -0
  172. data/lib/license_patrol/printer.rb +39 -0
  173. data/lib/license_patrol/project_finder.rb +62 -0
  174. data/lib/license_patrol/report.rb +34 -0
  175. data/lib/license_patrol/reports/csv_report.rb +108 -0
  176. data/lib/license_patrol/reports/diff_report.rb +29 -0
  177. data/lib/license_patrol/reports/erb_report.rb +62 -0
  178. data/lib/license_patrol/reports/html_report.rb +13 -0
  179. data/lib/license_patrol/reports/json_report.rb +31 -0
  180. data/lib/license_patrol/reports/junit_report.rb +23 -0
  181. data/lib/license_patrol/reports/markdown_report.rb +9 -0
  182. data/lib/license_patrol/reports/merged_report.rb +16 -0
  183. data/lib/license_patrol/reports/templates/bootstrap.css +9 -0
  184. data/lib/license_patrol/reports/templates/html_report.erb +113 -0
  185. data/lib/license_patrol/reports/templates/junit_report.erb +41 -0
  186. data/lib/license_patrol/reports/templates/markdown_report.erb +49 -0
  187. data/lib/license_patrol/reports/templates/xml_report.erb +19 -0
  188. data/lib/license_patrol/reports/text_report.rb +12 -0
  189. data/lib/license_patrol/reports/xml_report.rb +23 -0
  190. data/lib/license_patrol/scanner.rb +83 -0
  191. data/lib/license_patrol/shared_helpers/cmd.rb +13 -0
  192. data/lib/license_patrol/shared_helpers/common_path.rb +29 -0
  193. data/lib/license_patrol/version.rb +6 -0
  194. data/lib/license_patrol.rb +14 -0
  195. data/license_patrol.gemspec +75 -0
  196. data/release/instructions.md +8 -0
  197. data/swift-all-keys.asc +240 -0
  198. metadata +615 -0
data/README.md ADDED
@@ -0,0 +1,593 @@
1
+ # License Patrol
2
+
3
+ License Patrol is a fork of [LicenseFinder](https://github.com/pivotal/LicenseFinder).
4
+
5
+ [![Code Climate](https://codeclimate.com/github/pivotal/LicenseFinder.png)](https://codeclimate.com/github/pivotal/LicenseFinder)
6
+
7
+ Build status
8
+ * Ruby 2.7.8 [![Ruby 2.7.8 build status](https://norsk.cf-app.com/api/v1/teams/main/pipelines/LicenseFinder/jobs/ruby-2.7.8/badge)](https://norsk.cf-app.com/teams/main/pipelines/LicenseFinder)
9
+ * Ruby 3.1.4 [![Ruby 3.1.4 build status](https://norsk.cf-app.com/api/v1/teams/main/pipelines/LicenseFinder/jobs/ruby-3.1.4/badge)](https://norsk.cf-app.com/teams/main/pipelines/LicenseFinder)
10
+ * Ruby 3.2.3 [![Ruby 3.2.3 build status](https://norsk.cf-app.com/api/v1/teams/main/pipelines/LicenseFinder/jobs/ruby-3.2.3/badge)](https://norsk.cf-app.com/teams/main/pipelines/LicenseFinder)
11
+ * Ruby 3.3.0 [![Ruby 3.3.0 build status](https://norsk.cf-app.com/api/v1/teams/main/pipelines/LicenseFinder/jobs/ruby-3.3.0/badge)](https://norsk.cf-app.com/teams/main/pipelines/LicenseFinder)
12
+
13
+
14
+ LicensePatrol works with your package managers to find dependencies,
15
+ detect the licenses of the packages in them, compare those licenses
16
+ against a user-defined list of permitted licenses,
17
+ and give you an actionable exception report.
18
+
19
+ * code: https://github.com/powerhome/license_patrol
20
+ * ci: https://norsk.cf-app.com/teams/main/pipelines/LicenseFinder
21
+ * docker: [licensefinder/license_finder](https://hub.docker.com/r/licensefinder/license_finder/)
22
+ * the docker image contains all the package managers needed to run `license_patrol`
23
+ * support:
24
+ * The primary form of communication for support is through github issues. The google groups are not actively
25
+ monitored
26
+ * license-finder@googlegroups.com
27
+ * https://groups.google.com/forum/#!forum/license-finder
28
+
29
+ ### Supported project types
30
+
31
+ | Project Type | Package Manager | Tested on Version |
32
+ | ------------ |-----------------|------------------:|
33
+ | Ruby Gems | bundler | 2.3.7 |
34
+ | Python 2.7 Eggs | pip2 | 19.0.2 |
35
+ | Python 3.5 Eggs | pip3 | 20.0.2 |
36
+ | Node.js | npm | 6.4.1 |
37
+ | Bower | bower | 1.8.4 |
38
+ | Nuget (without license discovery) | nuget | 4.7.1.5393 |
39
+ | Godep | Godep | 80 |
40
+ | Go workspace | Go lang | 1.11.5 |
41
+ | Go modules | Go lang | 1.14.3 |
42
+ | Java | maven | 3.6.0 |
43
+ | Java | gradle | 5.6.4 |
44
+
45
+ ### Experimental project types
46
+
47
+ * Erlang (via `rebar` and `Erlang.mk`)
48
+ * Objective-C, Swift (via Carthage, CocoaPods \[0.39 and below. See [CocoaPods Specs Repo Sharding](http://blog.cocoapods.org/Sharding/)\]) and Swift Package Manager(SPM)
49
+ * Elixir (via `mix`)
50
+ * Golang (via `gvt`, `glide`,`dep`, `trash` and `govendor`)
51
+ * JavaScript (via `yarn`)
52
+ * C++/C (via `conan`)
53
+ * Scala (via `sbt`)
54
+ * Rust (via `cargo`)
55
+ * PHP (via `composer`)
56
+ * Python (via `Conda`, `pipenv`)
57
+ * Flutter (via `flutter pub`)
58
+
59
+ ## Installation
60
+
61
+ License Patrol may be run as a [pre-commit](https://pre-commit.com) hook by
62
+ adding the following to your `.pre-commit-config.yaml`:
63
+
64
+ ```yaml
65
+ repos:
66
+ - repo: https://github.com/powerhome/license_patrol
67
+ rev: v7.1.0 # You probably want the latest tag.
68
+ hooks:
69
+ - id: license-patrol
70
+ ```
71
+
72
+ Running License Patrol directly requires Ruby 2.6.0 or greater. If you have an
73
+ older version of Ruby installed, you can update via Homebrew:
74
+
75
+ ```sh
76
+ $ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"
77
+ ```
78
+
79
+ then:
80
+
81
+ ```sh
82
+ $ brew install ruby
83
+ ```
84
+
85
+ The easiest way to use `license_patrol` directly is to install it as a command
86
+ line tool, like brew, awk, gem or bundler:
87
+
88
+ ```sh
89
+ $ gem install license_patrol
90
+ ```
91
+
92
+ Though it's less preferable, if you are using bundler in a Ruby
93
+ project, you can add `license_patrol` to your Gemfile:
94
+
95
+ ```ruby
96
+ gem 'license_patrol', :group => :development
97
+ ```
98
+
99
+ This approach helps you remember to install `license_patrol`, but can
100
+ pull in unwanted dependencies, including `bundler`. To mitigate this
101
+ problem, see [Excluding Dependencies](#excluding-dependencies).
102
+
103
+
104
+ ## Usage
105
+
106
+ Make sure your dependencies are installed (with your package manager's install command: `bundle install`, `npm install`, etc.)
107
+
108
+ The first time you run `license_patrol` it will list all your project's packages.
109
+
110
+ ```sh
111
+ $ license_patrol
112
+ ```
113
+
114
+ Or, if you installed with bundler:
115
+
116
+ ```sh
117
+ $ bundle exec license_patrol
118
+ ```
119
+
120
+ The output will report that none of your packages have been
121
+ approved. Over time you will tell `license_patrol` which packages
122
+ are approved, so when you run this command in the future, it will
123
+ report current action items; i.e., packages that are new or have
124
+ never been approved.
125
+
126
+ If you don't wish to see progressive output "dots", use the `--quiet`
127
+ option.
128
+
129
+ If you'd like to see debugging output, use the `--debug`
130
+ option. `license_patrol` will then output info about packages, their
131
+ dependencies, and where and how each license was discovered. This can
132
+ be useful when you need to track down an unexpected package or
133
+ license.
134
+
135
+ If you do not want to manually run an individual package manager's prepare
136
+ command (ex: `bundle install`, `npm install`, etc) to ensure your project
137
+ is fully prepared to be scanned, use the `--prepare` or `-p` option which will run
138
+ each active package manager's prepare command for you. If you would like to continue
139
+ running `license_patrol` even if there is an issue with a prepare step, use the
140
+ `--prepare-no-fail` option which prepares but carries on despite any potential failures.
141
+
142
+ Run `license_patrol help` to see other available commands, and
143
+ `license_patrol help [COMMAND]` for detailed help on a specific
144
+ command.
145
+
146
+ ### Docker
147
+
148
+ If you have docker installed, try using the included `dlf` script (potentially
149
+ symlinked to be in your path via `ln -s LicensePatrol/dlf /usr/local/bin` or
150
+ whatever method you prefer). This will run any commands passed to it inside a
151
+ pre-provisioned Docker container to maintain consistent versions of all the
152
+ package managers. For example,
153
+
154
+ ```
155
+ $ dlf npm --version
156
+ 5.3.0
157
+
158
+ $ dlf license_patrol --help
159
+
160
+ Dependencies that need approval:
161
+ ...
162
+ license_patrol, 3.0.3, MIT
163
+
164
+ $ dlf "bundle install && license_patrol"
165
+ ```
166
+
167
+ You can better understand the way this script works by looking at its source, but for
168
+ reference it will mount your current directory at the path `/scan` and run any commands
169
+ passed to it from that directory. If your command has `&&`, ensure you quote the command.
170
+ If it does not, ensure the command is not quoted.
171
+
172
+ Note that the docker image will run the gem which is installed within it.
173
+ So the docker image tagged `7.0.0` will run *License Patrol Version 7.0.0*
174
+
175
+ See the [contributing guide](https://github.com/powerhome/license_patrol/blob/master/CONTRIBUTING.md) for information on development.
176
+
177
+ ### Activation
178
+
179
+ `license_patrol` will find and include packages for all supported
180
+ languages, as long as that language has a package definition in the project directory:
181
+
182
+ * `Gemfile` (for `bundler`)
183
+ * `requirements.txt` (for `pip`)
184
+ * `Pipfile.lock` (for `pipenv`)
185
+ * `package.json` (for `npm`)
186
+ * `pom.xml` (for `maven`)
187
+ * `build.gradle` or `build.gradle.kts` (for `gradle`)
188
+ * `settings.gradle` that specifies `rootProject.buildFileName` (for `gradle`)
189
+ * `bower.json` (for `bower`)
190
+ * `Podfile` (for `pod`) (set `ACKNOWLEDGEMENTS_PATH` variable if you want to target a particular `Pods-acknowledgements-<TARGET>.plist`. Can be useful in multi-target pods projects.)
191
+ * `Cartfile` (for `carthage`)
192
+ * `workspace-state.json` under build directory (provided as enviroment variable `SPM_DERIVED_DATA` for Xcode, or default `.build` for non-Xcode projects), (for `spm`)
193
+ * `rebar.config` (for `rebar`)
194
+ * `Erlang.mk` or `erlang.mk` file (for `Erlang.mk`)
195
+ * `mix.exs` (for `mix`)
196
+ * `packages/` directory (for `nuget`)
197
+ * `*.csproj` (for `dotnet`)
198
+ * `vendor/manifest` or `*/vendor/manifest` file (for `gvt`)
199
+ * `glide.lock` file (for `glide`)
200
+ * `vendor/vendor.json` file (for `govendor`)
201
+ * `Gopkg.lock` file (for `dep`)
202
+ * `Godeps/Godeps.json` (for `godep`)
203
+ * `*.envrc` file (for `go`)
204
+ * `go.mod` file (for `go mod`)
205
+ * `vendor.conf` file (for `trash`)
206
+ * `yarn.lock` file (for `yarn`)
207
+ * `conanfile.txt` file (for `conan`)
208
+ * `build.sbt` file (for `sbt`)
209
+ * `Cargo.lock` file (for `cargo`)
210
+ * `composer.lock` file (for `composer`)
211
+ * `environment.yml` file (for `conda`)
212
+ * `pubspec.yaml & .pub cache locaton through ENV variable` (for `flutter`)
213
+
214
+ ### Continuous Integration
215
+
216
+ `license_patrol` will return a non-zero exit status if there are unapproved
217
+ dependencies. This can be useful for inclusion in a CI environment to alert you
218
+ if someone adds an unapproved dependency to the project.
219
+
220
+
221
+ ## Approving Dependencies
222
+
223
+ `license_patrol` will inform you whenever you have an unapproved dependency.
224
+ If your business decides this is an acceptable risk, the easiest way to approve
225
+ the dependency is by running `license_patrol approvals add`.
226
+
227
+ For example, let's assume you've added the `awesome_gpl_gem`
228
+ to your Gemfile, which `license_patrol` reports is unapproved:
229
+
230
+ ```sh
231
+ $ license_patrol
232
+ Dependencies that need approval:
233
+ awesome_gpl_gem, 1.0.0, GPL
234
+ ```
235
+
236
+ Your business tells you that in this case, it's acceptable to use this
237
+ gem. You now run:
238
+
239
+ ```sh
240
+ $ license_patrol approvals add awesome_gpl_gem
241
+ ```
242
+
243
+ If you rerun `license_patrol`, you should no longer see
244
+ `awesome_gpl_gem` in the output.
245
+
246
+ To approve specific version
247
+
248
+ ```sh
249
+ $ license_patrol approvals add awesome_gpl_gem --version=1.0.0
250
+ ```
251
+
252
+ To record who approved the dependency and why:
253
+
254
+ ```sh
255
+ $ license_patrol approvals add awesome_gpl_gem --who CTO --why "Go ahead"
256
+ ```
257
+
258
+ ### Permitting Licenses
259
+
260
+ Approving packages one-by-one can be tedious. Usually your business has
261
+ blanket policies about which packages are approved. To tell `license_patrol`
262
+ that any package with the MIT license should be approved, run:
263
+
264
+ ``` sh
265
+ $ license_patrol permitted_licenses add MIT
266
+ ```
267
+
268
+ Any current or future packages with the MIT license will be excluded from the
269
+ output of `license_patrol`.
270
+
271
+ You can also record `--who` and `--why` when changing permitted licenses,
272
+ or making any other decision about your project.
273
+
274
+
275
+ ## Output and Artifacts
276
+
277
+ ### Decisions file
278
+
279
+ Any decisions you make about approvals will be recorded in a YAML file named
280
+ `doc/dependency_decisions.yml`.
281
+
282
+ This file must be committed to version control. Rarely, you will have to
283
+ manually resolve conflicts in it. In this situation, keep in mind that each
284
+ decision has an associated timestamp, and the decisions are processed
285
+ top-to-bottom, with later decisions overwriting or appending to earlier
286
+ decisions.
287
+
288
+ ### Output from `action_items`
289
+
290
+ You could expect `license_patrol`, which is an alias for `license_patrol
291
+ action_items` to output something like the following on a Rails project where
292
+ MIT had been permitted:
293
+
294
+ ```
295
+ Dependencies that need approval:
296
+
297
+ highline, 1.6.14, ruby
298
+ json, 1.7.5, ruby
299
+ mime-types, 1.19, ruby
300
+ rails, 3.2.8, unknown
301
+ rdoc, 3.12, unknown
302
+ rubyzip, 0.9.9, ruby
303
+ xml-simple, 1.1.1, unknown
304
+ ```
305
+
306
+ You can customize the format of the output in the same way that you customize
307
+ [output from `report`](#output-from-report).
308
+
309
+ ### Output from `project_roots`
310
+
311
+ The `license_patrol project_roots` command will output the current working directory as a string in an array.
312
+
313
+ Using the `--recursive` option means the array will include subdirectories that contain a known package manager. With the exception that Gradle and Maven subprojects will not be included.
314
+
315
+
316
+ ### Output from `report`
317
+
318
+ The `license_patrol report` command will output human-readable reports that you
319
+ could send to your non-technical business partners, lawyers, etc. You can
320
+ choose the format of the report (text, csv, html or markdown); see
321
+ `license_patrol --help report` for details. The output is sent to STDOUT, so
322
+ you can save the reports wherever you want them. You can commit them to
323
+ version control if you like.
324
+
325
+ The HTML report generated by `license_patrol report --format html` summarizes
326
+ all of your project's dependencies and includes information about which need to
327
+ be approved. The project name at the top of the report can be set with
328
+ `license_patrol project_name add`.
329
+
330
+ ### Note:
331
+ When using the yarn package manager, when a node_module's package.json doesn't
332
+ explicitly declare a license, yarn indicates that it has inferred the license based
333
+ on some keywords in other files by appending an asterisk to the license name. If you
334
+ see a * at the end of the license name, this is intended.
335
+
336
+ See [CONTRIBUTING.md](https://github.com/powerhome/license_patrol/blob/master/CONTRIBUTING.md#adding-reports)
337
+ for advice about adding and customizing reports.
338
+
339
+
340
+ ## Manual Intervention
341
+
342
+ ### Setting Licenses
343
+
344
+ When `license_patrol` reports that a dependency's license is 'unknown',
345
+ you should manually research what the actual license is. When you
346
+ have established the real license, you can record it with:
347
+
348
+ ```sh
349
+ $ license_patrol licenses add my_unknown_dependency MIT
350
+ ```
351
+
352
+ This command would assign the MIT license to all versions of the dependency
353
+ `my_unknown_dependency`. If you prefer, you could instead assign the license
354
+ to only a specific version of the dependency:
355
+
356
+ ```sh
357
+ $ license_patrol licenses add my_unknown_dependency MIT --version=1.0.0
358
+ ```
359
+
360
+ Please note that adding a license to a specific version of a dependency will
361
+ cause any licenses previously added to all versions of that dependency to be
362
+ forgotten. Similarly, adding a license to all versions of a dependency will
363
+ override any licenses previously added to specific versions of that dependency.
364
+
365
+ There are several ways in which you can remove licenses that were previously
366
+ added through the `licenses add` command:
367
+
368
+ ```sh
369
+ # Removes all licenses from any version of the dependency
370
+ $ license_patrol licenses remove my_unknown_dependency
371
+
372
+ # Removes just the MIT license from any version of the dependency
373
+ $ license_patrol licenses remove my_unknown_dependency MIT
374
+
375
+ # Removes all licenses from only version 1.0.0 of the dependency
376
+ # This has no effect if you had last added a license to all versions of the dependency
377
+ $ license_patrol licenses remove my_unknown_dependency --version=1.0.0
378
+
379
+ # Removes just the MIT license from only version 1.0.0 of the dependency
380
+ # This has no effect if you had last added a license to all versions of the dependency
381
+ $ license_patrol licenses remove my_unknown_dependency MIT --version=1.0.0
382
+ ```
383
+
384
+ ### Adding Hidden Dependencies
385
+
386
+ `license_patrol` can track dependencies that your package managers
387
+ don't know about (JS libraries that don't appear in your
388
+ Gemfile/requirements.txt/package.json, etc.)
389
+
390
+ ```sh
391
+ $ license_patrol dependencies add my_js_dep MIT 0.1.2
392
+ ```
393
+
394
+ Run `license_patrol dependencies help` for
395
+ additional documentation about managing these dependencies.
396
+
397
+ `license_patrol` cannot automatically detect when one of these
398
+ dependencies has been removed from your project, so you can use:
399
+
400
+ ```sh
401
+ $ license_patrol dependencies remove my_js_dep
402
+ ```
403
+
404
+ ### Excluding Dependencies
405
+
406
+ Sometimes a project will have development or test dependencies which
407
+ you don't want to track. You can exclude theses dependencies by running
408
+ `license_patrol ignored_groups`. (Currently this only works for packages
409
+ managed by Bundler, NPM, Yarn, Maven, Pip2, Pip3, and Nuget.)
410
+
411
+ On rare occasions a package manager will report an individual dependency
412
+ that you want to exclude from all reports, even though it is approved.
413
+ You can exclude an individual dependency by running
414
+ `license_patrol ignored_dependencies`. Think carefully before adding
415
+ dependencies to this list. A likely item to exclude is `bundler`,
416
+ since it is a common dependency whose version changes from machine to
417
+ machine. Adding it to the `ignored_dependencies` would prevent it
418
+ (and its oscillating versions) from appearing in reports.
419
+
420
+ ### Restricting Licenses
421
+
422
+ Some projects will have a list of licenses that cannot be used. You can
423
+ restrict these licenses with `license_patrol restricted_licenses add`. Any dependency
424
+ that has exclusively restricted licenses will always appear in the action
425
+ items, even if someone attempts to manually approve or permit it. However,
426
+ if a dependency has even one license that is not restricted, it can still be
427
+ manually approved or permitted.
428
+
429
+ ## Decision inheritance
430
+
431
+ Add or remove decision files you want to inherit from - see `license_patrol inherited_decisions help` for more information.
432
+
433
+ This allows you to have a centralized decision file for approved/restricted licenses. If you have multiple projects it's way easier to have one single place where you approved or restricted licenses defined.
434
+
435
+ Add one or more decision files to the inherited decisions
436
+ ```bash
437
+ license_patrol inherited_decisions add DECISION_FILE
438
+ ```
439
+
440
+ Remove one or more decision files from the inherited decisions
441
+ ```bash
442
+ license_patrol inherited_decisions remove DECISION_FILE
443
+ ```
444
+
445
+ List all the inherited decision files
446
+ ```bash
447
+ license_patrol inherited_decisions list
448
+ ```
449
+
450
+ ## Configuration
451
+
452
+ Be default, `license_patrol` expects the decisions file to be stored at
453
+ `doc/dependency_decisions.yml`. All commands can be passed `--decisions_file`
454
+ to override this location.
455
+
456
+ ### Package Manager Configuration
457
+
458
+ If you have a gradle project, you can invoke gradle with a custom script by
459
+ passing (for example) `--gradle_command gradlew` to `license_patrol` or
460
+ `license_patrol report`.
461
+
462
+ Similarly you can invoke a custom rebar script with `--rebar_command rebar`.
463
+ If you store rebar dependencies in a custom directory (by setting `deps_dir` in
464
+ `rebar.config`), set `--rebar_deps_dir`.
465
+
466
+ You can also invoke a custom Mix script `remix` with `--mix_command remix` and
467
+ set `--mix_deps_dir` to fetch Mix dependencies from a custom directory.
468
+
469
+ ### Narrow down Package Manager
470
+
471
+ By default, license_patrol will check for all supported package managers,
472
+ but you can narrow it down to use only those you pass to `--enabled-package-managers`.
473
+ For example,
474
+
475
+ ```
476
+ $ license_patrol --enabled-package-managers bundler npm
477
+ ```
478
+
479
+ ### Saving Configuration
480
+
481
+ It may be difficult to remember to pass command line options to every command.
482
+ In some of these cases you can store default values in a YAML formatted config
483
+ file. `license_patrol` looks for this file in `config/license_patrol.yml`.
484
+
485
+ As an example, the file might look like this:
486
+
487
+ ```yaml
488
+ ---
489
+ decisions_file: './some_path/decisions.yml'
490
+ gradle_command: './gradlew'
491
+ rebar_command: './rebarw'
492
+ rebar_deps_dir: './rebar_deps'
493
+ mix_command: './mixw'
494
+ mix_deps_dir: './mix_deps'
495
+ enabled_package_managers:
496
+ - bundler
497
+ - gradle
498
+ - rebar
499
+ - mix
500
+ ```
501
+
502
+ ### Gradle Projects
503
+
504
+ `license_patrol` supports both Gradle 1.x and Gradle 2.x. You need to have installed
505
+ the license-gradle-plugin in your project:
506
+ [https://github.com/hierynomus/license-gradle-plugin](https://github.com/hierynomus/license-gradle-plugin)
507
+
508
+ By default, `license_patrol` will report on Gradle's "runtime" dependencies. If
509
+ you want to generate a report for some other dependency configuration (e.g.
510
+ Android projects will sometimes specify their meaningful dependencies in the
511
+ "compile" group), you can specify it in your project's `build.gradle`:
512
+
513
+ ```
514
+ // Must come *after* applying the appropriate plugin from [https://github.com/hierynomus/license-gradle-plugin](https://github.com/hierynomus/license-gradle-plugin)
515
+
516
+ downloadLicenses {
517
+ dependencyConfiguration "compile"
518
+ }
519
+ ```
520
+
521
+ ### Conan Projects
522
+
523
+ `license_patrol` supports Conan. You need to have the following lines in your conanfile.txt for `license_patrol` to retrieve dependencies' licenses.
524
+ Ensure that `conan install` does not generate an error.
525
+
526
+ ```
527
+ [imports]
528
+ ., license* -> ./licenses @ folder=True, ignore_case=True
529
+ ```
530
+
531
+ ### SBT Projects
532
+
533
+ `license_patrol` supports SBT. You need to have installed the sbt-license-report in your project:
534
+ [https://github.com/sbt/sbt-license-report](https://github.com/sbt/sbt-license-report)
535
+
536
+ By default, `license_patrol` will report on SBT's "compile" and "test" dependencies. If
537
+ you want to generate a report for some other dependency configuration, you can specify
538
+ it in your projects's `build.sbt`
539
+
540
+ ```
541
+ licenseConfigurations := Set("compile", "provided")
542
+ ```
543
+
544
+ ## Requirements
545
+
546
+ `license_patrol` requires ruby >= 2.6.0.
547
+
548
+
549
+ ## Upgrading
550
+
551
+ To upgrade from a LicenseFinder version older than 6.0, you have to replace the terminology `whitelist` with `permit` and `blacklist` with `restrict` in your `dependency_decisions.yml`. See [Changelog](https://github.com/pivotal/LicenseFinder/blob/master/CHANGELOG.md#600--2020-01-22) for more details.
552
+
553
+
554
+ ## A Plea to Package Authors and Maintainers
555
+
556
+ Please add a license to your package specs! Most packaging systems
557
+ allow for the specification of one or more licenses.
558
+
559
+ For example, Ruby Gems can specify a license by name:
560
+
561
+ ```ruby
562
+ Gem::Specification.new do |s|
563
+ s.name = "my_great_gem"
564
+ s.license = "MIT"
565
+ end
566
+ ```
567
+
568
+ And save a `LICENSE` file which contains your license text in your repo.
569
+
570
+ ## Known issues with specific package managers
571
+
572
+ * Bundler
573
+ * When using `--project-path`, Bundler cannot find the Gemfile.
574
+
575
+ * Yarn
576
+ * A module that is incompatible with the platform on which
577
+ license_patrol is run will always be reported to have a license type
578
+ of "unknown". ([#456](https://github.com/powerhome/license_patrol/issues/456))
579
+
580
+ ## Support
581
+
582
+ * Send an email to the list: [license-finder@googlegroups.com](license-finder@googlegroups.com)
583
+ * View the project backlog at Pivotal Tracker: [https://www.pivotaltracker.com/n/projects/234851](https://www.pivotaltracker.com/n/projects/234851)
584
+
585
+
586
+ ## Contributing
587
+
588
+ See [CONTRIBUTING.md](https://github.com/powerhome/license_patrol/blob/master/CONTRIBUTING.md).
589
+
590
+
591
+ ## License
592
+
593
+ LicensePatrol is released under the MIT License. http://www.opensource.org/licenses/mit-license
data/Rakefile ADDED
@@ -0,0 +1,75 @@
1
+ # frozen_string_literal: true
2
+
3
+ require 'bundler'
4
+ Bundler::GemHelper.install_tasks
5
+
6
+ require './lib/license_patrol/platform'
7
+ require 'rspec/core/rake_task'
8
+
9
+ desc 'Run all specs in spec/'
10
+ RSpec::Core::RakeTask.new(:spec) do |t|
11
+ t.fail_on_error = true
12
+ t.pattern = './spec/**/*_spec.rb'
13
+ t.rspec_opts = %w[--color]
14
+ end
15
+
16
+ namespace :features do
17
+ desc 'Run test tagged \'focus\''
18
+ RSpec::Core::RakeTask.new(:focus) do |t|
19
+ t.fail_on_error = true
20
+ t.pattern = './features/**/*_spec.rb'
21
+ opts = %w[--color --format d --tag focus]
22
+ opts += LicensePatrol::Platform.darwin? ? [] : %w[--tag ~ios]
23
+ t.rspec_opts = opts
24
+ end
25
+ end
26
+
27
+ desc 'Run all specs in features/'
28
+ RSpec::Core::RakeTask.new(:features) do |t|
29
+ t.fail_on_error = true
30
+ t.pattern = './features/**/*_spec.rb'
31
+ opts = %w[--color --format d]
32
+ opts += LicensePatrol::Platform.darwin? ? [] : %w[--tag ~ios]
33
+ t.rspec_opts = opts
34
+ end
35
+
36
+ desc 'Check for non-Ruby development dependencies.'
37
+ task :check_dependencies do
38
+ require './lib/license_patrol'
39
+ satisfied = true
40
+ LicensePatrol::Scanner::PACKAGE_MANAGERS.each do |package_manager|
41
+ satisfied = false unless package_manager.new(project_path: Pathname.new('')).installed?(LicensePatrol::Logger.new(LicensePatrol::Logger::MODE_INFO))
42
+ end
43
+ $stdout.flush
44
+ exit 1 unless satisfied
45
+ end
46
+
47
+ desc 'Configure LF and LF PR pipeline'
48
+ task :update_pipeline, [:slack_url, :slack_channel] do |_, args|
49
+ slack_url = args[:slack_url]
50
+ slack_channel = args[:slack_channel]
51
+
52
+ unless slack_url || slack_channel
53
+ puts 'Warning: skipping slack notifications setup'
54
+ puts 'Warning: You should provide slack channel and url to receive slack notifications on build failures'
55
+ end
56
+
57
+ ruby_versions = %w[3.3.0 3.2.3 3.1.4 2.7.8]
58
+
59
+ params = []
60
+ params << "ruby_versions=#{ruby_versions.join(',')}"
61
+ params << "slack_url=#{slack_url}" if slack_url
62
+ params << "slack_channel=#{slack_channel}" if slack_channel
63
+
64
+ vars = params.join(' ')
65
+
66
+ cmd = "bash -c \"fly -t osl set-pipeline -n -p LicensePatrol --config <(erb #{vars} ci/pipelines/release.yml.erb)\""
67
+ system(cmd)
68
+
69
+ cmd = "bash -c \"fly -t osl set-pipeline -n -p LicensePatrol-pr --config <(erb #{vars} ci/pipelines/pull-request.yml.erb)\""
70
+ system(cmd)
71
+ end
72
+
73
+ task default: :spec
74
+ task features: :check_dependencies
75
+ task 'features:focus': :check_dependencies
data/TODO.md ADDED
@@ -0,0 +1,12 @@
1
+ # immediate
2
+
3
+ # architecture
4
+
5
+ # renamings, etc.
6
+
7
+ - classes under `package_managers` should be in a PackageManagers module
8
+ - `license_names_from_standard_spec` should be the default instance method
9
+
10
+ # docs
11
+
12
+ - specify gradle version >= 1.8
data/VERSION ADDED
@@ -0,0 +1 @@
1
+ 1.0.0
@@ -0,0 +1,6 @@
1
+ #!/usr/bin/env ruby
2
+ # frozen_string_literal: true
3
+
4
+ require 'license_patrol'
5
+
6
+ LicensePatrol::CLI::Main.start