license_scout 0.1.0

data/lib/license_scout/dependency_manager/bundler.rb

@@ -0,0 +1,159 @@
+#
+# Copyright:: Copyright 2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "license_scout/dependency_manager/base"
+require "license_scout/net_fetcher"
+require "license_scout/exceptions"
+
+require "bundler"
+require "mixlib/shellout"
+require "ffi_yajl"
+require "pathname"
+
+module LicenseScout
+  module DependencyManager
+    class Bundler < Base
+
+      def name
+        "ruby_bundler"
+      end
+
+      def detected?
+        # We only check for the existence of Gemfile in order to declare a
+        # project a Bundler project. If the Gemfile.lock does not exist
+        # we will raise a specific error to indicate that "bundle install"
+        # needs to be run before proceeding.
+        File.exists?(gemfile_path)
+      end
+
+      def dependency_data
+        bundler_script = File.join(File.dirname(__FILE__), "bundler/_bundler_script.rb")
+
+        Dir.chdir(project_dir) do
+          json_dep_data = with_clean_env do
+            ruby_bin_path = options.ruby_bin || "ruby"
+            s = Mixlib::ShellOut.new("#{ruby_bin_path} #{bundler_script}", environment: options.environment)
+            s.run_command
+            s.error!
+            s.stdout
+          end
+          FFI_Yajl::Parser.parse(json_dep_data)
+        end
+      end
+
+      def dependencies
+        if !File.exists?(lockfile_path)
+          raise LicenseScout::Exceptions::DependencyManagerNotRun.new(project_dir, name)
+        end
+
+        dependencies = []
+        dependency_data.each do |gem_data|
+          dependency_name = gem_data["name"]
+          dependency_version = gem_data["version"]
+          dependency_license = nil
+          dependency_license_files = []
+
+          if dependency_name == "bundler"
+            # Bundler is weird. It inserts itself as a dependency, but is a
+            # special case, so rubygems cannot correctly report the license.
+            # Additionally, rubygems reports the gem path as a path inside
+            # bundler's lib/ dir, so we have to munge it.
+            dependency_license = "MIT"
+            dependency_license_files = [File.join(File.dirname(__FILE__), "bundler/LICENSE.md")]
+          else
+            # Check license override and license_files override separately since
+            # only one might be set in the overrides.
+            dependency_license = options.overrides.license_for(name, dependency_name, dependency_version) || gem_data["license"]
+
+            override_license_files = options.overrides.license_files_for(name, dependency_name, dependency_version)
+            if override_license_files.empty?
+              dependency_license_files = auto_detect_license_files(gem_data["path"])
+            else
+              dependency_license_files = override_license_files.resolve_locations(gem_data["path"])
+            end
+          end
+
+          dependencies << Dependency.new(
+            dependency_name,
+            dependency_version,
+            dependency_license,
+            dependency_license_files
+          )
+        end
+
+        dependencies
+      end
+
+      private
+
+      #
+      # Execute the given command, removing any Ruby-specific environment
+      # variables. This is an "enhanced" version of +Bundler.with_clean_env+,
+      # which only removes Bundler-specific values. We need to remove all
+      # values, specifically:
+      #
+      # - _ORIGINAL_GEM_PATH
+      # - GEM_PATH
+      # - GEM_HOME
+      # - GEM_ROOT
+      # - BUNDLE_BIN_PATH
+      # - BUNDLE_GEMFILE
+      # - RUBYLIB
+      # - RUBYOPT
+      # - RUBY_ENGINE
+      # - RUBY_ROOT
+      # - RUBY_VERSION
+      #
+      # The original environment restored at the end of this call.
+      #
+      # @param [Proc] block
+      #   the block to execute with the cleaned environment
+      #
+      def with_clean_env(&block)
+        original = ENV.to_hash
+
+        ENV.delete("_ORIGINAL_GEM_PATH")
+        ENV.delete_if { |k, _| k.start_with?("BUNDLE_") }
+        ENV.delete_if { |k, _| k.start_with?("GEM_") }
+        ENV.delete_if { |k, _| k.start_with?("RUBY") }
+
+        yield
+      ensure
+        ENV.replace(original.to_hash)
+      end
+
+      def auto_detect_license_files(gem_path)
+        unless File.exist?(gem_path)
+          raise LicenseScout::Exceptions::InaccessibleDependency.new "Autodetected gem path '#{gem_path}' does not exist"
+        end
+
+        Dir.glob("#{gem_path}/*").select do |f|
+          POSSIBLE_LICENSE_FILES.include?(File.basename(f))
+        end
+      end
+
+      def gemfile_path
+        File.join(project_dir, "Gemfile")
+      end
+
+      def lockfile_path
+        File.join(project_dir, "Gemfile.lock")
+      end
+
+    end
+  end
+end

data/lib/license_scout/dependency_manager/rebar.rb

@@ -0,0 +1,92 @@
+#
+# Copyright:: Copyright 2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "license_scout/dependency_manager/base"
+require "license_scout/net_fetcher"
+require "license_scout/exceptions"
+require "license_scout/license_file_analyzer"
+
+require "mixlib/shellout"
+
+module LicenseScout
+  module DependencyManager
+    class Rebar < Base
+
+      def name
+        "erlang_rebar"
+      end
+
+      def detected?
+        File.exist?(rebar_config_path)
+      end
+
+      def dependencies
+        dependencies = []
+
+        Dir.glob("#{project_deps_dir}/*").each do |dep_dir|
+          next unless File.directory?(dep_dir)
+
+          dep_name = File.basename(dep_dir)
+          dep_version = git_rev_parse(dep_dir)
+
+          override_license_files = options.overrides.license_files_for(name, dep_name, dep_version)
+          license_files =
+            if override_license_files.empty?
+              Dir.glob("#{dep_dir}/*").select { |f| POSSIBLE_LICENSE_FILES.include?(File.basename(f)) }
+            else
+              override_license_files.resolve_locations(dep_dir)
+            end
+
+          license_name = options.overrides.license_for(name, dep_name, dep_version) || scan_licenses(license_files)
+
+          dep = Dependency.new(dep_name, dep_version, license_name, license_files)
+
+          dependencies << dep
+        end
+
+        dependencies
+      end
+
+      private
+
+      def git_rev_parse(dependency_dir)
+        s = Mixlib::ShellOut.new("git rev-parse HEAD", cwd: dependency_dir)
+        s.run_command
+        s.error!
+        s.stdout.strip
+      end
+
+      def project_deps_dir
+        File.join(project_dir, "deps")
+      end
+
+      def rebar_config_path
+        File.join(project_dir, "rebar.config")
+      end
+
+      def scan_licenses(license_files)
+        if license_files.empty?
+          nil
+        else
+          found_license = LicenseScout::LicenseFileAnalyzer.find_by_text(IO.read(license_files.first))
+          found_license ? found_license.short_name : nil
+        end
+      end
+
+    end
+  end
+end

data/lib/license_scout/dependency_manager.rb

@@ -0,0 +1,27 @@
+#
+# Copyright:: Copyright 2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "license_scout/dependency_manager/bundler"
+require "license_scout/dependency_manager/rebar"
+
+module LicenseScout
+  module DependencyManager
+    def self.implementations
+      [Bundler, Rebar]
+    end
+  end
+end

data/lib/license_scout/exceptions.rb

@@ -0,0 +1,74 @@
+#
+# Copyright:: Copyright 2016, Chef Software Inc.
+# License:: Apache License, Version 2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+module LicenseScout
+  module Exceptions
+    class Error < RuntimeError; end
+
+    class ProjectDirectoryMissing < Error
+      def initialize(project_dir)
+        @project_dir = project_dir
+      end
+
+      def to_s
+        "Could not locate or access the provided project directory '#{@project_dir}'."
+      end
+    end
+
+    class UnsupportedProjectType < Error
+      def initialize(project_dir)
+        @project_dir = project_dir
+      end
+
+      def to_s
+        "Could not find a supported dependency manager for the project in the provided directory '#{@project_dir}'."
+      end
+    end
+
+    class DependencyManagerNotRun < Error
+      def initialize(project_dir, dependency_manager_name)
+        @project_dir = project_dir
+        @dependency_manager_name = dependency_manager_name
+      end
+
+      def to_s
+        "Dependency manager '#{@dependency_manager_name}' is not yet run for project at '#{@project_dir}'."
+      end
+    end
+
+    class InaccessibleDependency < Error; end
+    class InvalidOverride < Error; end
+
+    class NetworkError < Error
+
+      attr_reader :from_url
+      attr_reader :network_error
+
+      def initialize(from_url, network_error)
+        @from_url = from_url
+        @network_error = network_error
+      end
+
+      def to_s
+        [
+          "Network error while fetching '#{from_url}'",
+          network_error.to_s,
+        ].join("\n")
+      end
+    end
+  end
+end

data/lib/license_scout/license_file_analyzer/any_matcher.rb

@@ -0,0 +1,37 @@
+# Copied from https://github.com/pivotal/LicenseFinder
+#
+# The MIT License
+#
+# Copyright (c) 2012 Pivotal Labs
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+module LicenseScout
+  module LicenseFileAnalyzer
+    class AnyMatcher
+      def initialize(*matchers)
+        @matchers = matchers
+      end
+
+      def matches_text?(text)
+        @matchers.any? { |m| m.matches_text? text }
+      end
+    end
+  end
+end

data/lib/license_scout/license_file_analyzer/definitions.rb

@@ -0,0 +1,212 @@
+# Copied from https://github.com/pivotal/LicenseFinder
+#
+# The MIT License
+#
+# Copyright (c) 2012 Pivotal Labs
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+require "license_scout/license_file_analyzer/matcher"
+require "license_scout/license_file_analyzer/any_matcher"
+require "license_scout/license_file_analyzer/header_matcher"
+require "license_scout/license_file_analyzer/template"
+
+module LicenseScout
+  module LicenseFileAnalyzer
+
+    class License
+
+      attr_reader :matcher
+      attr_reader :short_name
+
+      def initialize(short_name:, matcher: nil)
+        @short_name  = short_name
+        @matcher     = matcher || Matcher.from_template(Template.named(short_name))
+      end
+
+      def matches_text?(text)
+        matcher.matches_text?(text)
+      end
+
+    end
+
+    module Definitions
+      extend self
+
+      def all
+        [
+          apache2,
+          bsd,
+          gplv2,
+          gplv3,
+          isc,
+          lgpl,
+          mit,
+          mpl2,
+          bsd_3_clause,
+          python,
+          ruby,
+          bsd_2_clause,
+          erlang_public,
+        ]
+      end
+
+      private
+
+      def apache2
+        matcher = AnyMatcher.new(
+          Matcher.from_template(Template.named("Apache2")),
+          Matcher.from_template(Template.named("Apache2-short"))
+        )
+
+        License.new(
+          short_name:  "Apache-2.0",
+          matcher:     matcher
+        )
+      end
+
+      def bsd
+        License.new(
+          short_name:  "BSD"
+        )
+      end
+
+      def gplv2
+        License.new(
+          short_name:  "GPL-2.0"
+        )
+      end
+
+      def gplv3
+        License.new(
+          short_name:  "GPL-3.0"
+        )
+      end
+
+      def isc
+        License.new(
+          short_name: "ISC"
+        )
+      end
+
+      def lgpl
+        License.new(
+          short_name:  "LGPL-3.0"
+        )
+      end
+
+      def mit
+        url_regexp = %r{MIT Licen[sc]e.*http://(?:www\.)?opensource\.org/licenses/mit-license}
+        header_regexp = /The MIT Licen[sc]e/
+        one_liner_regexp = /is released under the MIT licen[sc]e/
+
+        matcher = AnyMatcher.new(
+          Matcher.from_template(Template.named("MIT")),
+          Matcher.from_regex(url_regexp),
+          HeaderMatcher.new(Matcher.from_regex(header_regexp)),
+          Matcher.from_regex(one_liner_regexp)
+        )
+
+        License.new(
+          short_name:  "MIT",
+          matcher:     matcher
+        )
+      end
+
+      def mpl2
+        header_regexp = /Mozilla Public Licen[sc]e, version 2.0/
+
+        matcher = AnyMatcher.new(
+          Matcher.from_template(Template.named("MPL2")),
+          HeaderMatcher.new(Matcher.from_regex(header_regexp))
+        )
+
+        License.new(
+          short_name:  "MPL-2.0",
+          matcher:     matcher
+        )
+      end
+
+      def bsd_3_clause
+        substitution = [
+          "Neither the name of <organization> nor the names of <possessive> contributors may be used to endorse or promote products derived from this software without specific prior written permission.",
+          "The names of its contributors may not be used to endorse or promote products derived from this software without specific prior written permission.",
+        ]
+
+        template = Template.named("BSD-3-Clause")
+        alternate_content = template.content.gsub(*substitution)
+
+        alt_format_template = Template.named("BSD-3-Clause-alt-format")
+        alt_format_with_alt_content = alt_format_template.content.gsub(*substitution)
+
+        matcher = AnyMatcher.new(
+          Matcher.from_template(template),
+          Matcher.from_text(alternate_content),
+          Matcher.from_template(alt_format_template),
+          Matcher.from_text(alt_format_with_alt_content)
+        )
+
+        License.new(
+          short_name:  "BSD-3-Clause",
+          matcher:     matcher
+        )
+      end
+
+      def python
+        License.new(
+          short_name:  "Python-2.0"
+        )
+      end
+
+      def ruby
+        url = "http://www.ruby-lang.org/en/LICENSE.txt"
+
+        matcher = AnyMatcher.new(
+          Matcher.from_template(Template.named("Ruby")),
+          Matcher.from_text(url)
+        )
+
+        License.new(
+          short_name:  "Ruby",
+          matcher:     matcher
+        )
+      end
+
+      def bsd_2_clause
+        matcher = AnyMatcher.new(
+          Matcher.from_template(Template.named("BSD-2-Clause")),
+          Matcher.from_template(Template.named("BSD-2-Clause-bullets"))
+        )
+
+        License.new(
+          short_name:  "BSD-2-Clause",
+          matcher:     matcher
+        )
+      end
+
+      def erlang_public
+        License.new(
+          short_name: "Erlang-Public",
+          matcher:    Matcher.from_template(Template.named("EPLICENSE"))
+        )
+      end
+
+    end
+  end
+end

data/lib/license_scout/license_file_analyzer/header_matcher.rb

@@ -0,0 +1,34 @@
+# Copied from https://github.com/pivotal/LicenseFinder
+#
+# The MIT License
+#
+# Copyright (c) 2012 Pivotal Labs
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+module LicenseScout
+  module LicenseFileAnalyzer
+    HeaderMatcher = Struct.new(:base_matcher) do
+      def matches_text?(text)
+        header = text.split("\n").first || ""
+        base_matcher.matches_text?(header)
+      end
+    end
+  end
+end

data/lib/license_scout/license_file_analyzer/matcher.rb

@@ -0,0 +1,46 @@
+# Copied from https://github.com/pivotal/LicenseFinder
+#
+# The MIT License
+#
+# Copyright (c) 2012 Pivotal Labs
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
+
+module LicenseScout
+  module LicenseFileAnalyzer
+    Matcher = Struct.new(:regexp) do
+      def self.from_template(template)
+        from_text(template.content)
+      end
+
+      def self.from_text(text)
+        from_regex(Text.compile_to_regex(text))
+      end
+
+      # an alias for Matcher.new, for uniformity of constructors
+      def self.from_regex(regexp)
+        new(regexp)
+      end
+
+      def matches_text?(text)
+        !!(Text.normalize_punctuation(text) =~ regexp)
+      end
+    end
+  end
+end