licensed 3.1.0 → 3.2.3

data/lib/licensed/sources/bundler/definition.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Licensed
+  module Bundler
+    module DefinitionExtensions
+      attr_accessor :force_exclude_groups
+
+      # Override specs to avoid logic that would raise Gem::NotFound
+      # which is handled in this ./missing_specification.rb, and to not add
+      # bundler as a dependency if it's not a user-requested gem.
+      #
+      # Newer versions of Bundler have changed the implementation of specs_for
+      # as well which no longer calls this function.  Overriding this function
+      # gives a stable access point for licensed
+      def specs
+        @specs ||= begin
+          specs = resolve.materialize(requested_dependencies)
+
+          all_dependencies = requested_dependencies.concat(specs.flat_map(&:dependencies))
+          if all_dependencies.any? { |d| d.name == "bundler" } && !specs["bundler"].any?
+            bundler = sources.metadata_source.specs.search(Gem::Dependency.new("bundler", ::Bundler::VERSION)).last
+            specs["bundler"] = bundler
+          end
+
+          specs
+        end
+      end
+
+      # Override requested_groups to also exclude any groups that are
+      # in the "bundler.without" section of the licensed configuration file.
+      def requested_groups
+        super - Array(force_exclude_groups)
+      end
+    end
+  end
+end

data/lib/licensed/sources/bundler/missing_specification.rb

@@ -38,17 +38,20 @@ module Licensed
         "could not find #{name} (#{version}) in any sources"
       end
     end
+
+    module LazySpecification
+      def __materialize__
+        spec = super
+        return spec if spec
+
+        Licensed::Bundler::MissingSpecification.new(name: name, version: version, platform: platform, source: source)
+      end
+    end
   end
 end
 
 module Bundler
   class LazySpecification
-    alias_method :orig_materialize, :__materialize__
-    def __materialize__
-      spec = orig_materialize
-      return spec if spec
-
-      Licensed::Bundler::MissingSpecification.new(name: name, version: version, platform: platform, source: source)
-    end
+    prepend ::Licensed::Bundler::LazySpecification
   end
 end

data/lib/licensed/sources/bundler.rb

@@ -3,6 +3,7 @@ require "delegate"
 begin
   require "bundler"
   require "licensed/sources/bundler/missing_specification"
+  require "licensed/sources/bundler/definition"
 rescue LoadError
 end
 
@@ -29,7 +30,7 @@ module Licensed
         # `loaded_from` if available.
         def spec_file
           return @spec_file if defined?(@spec_file)
-          return @spec_file = nil unless loaded_from && File.exist?(loaded_from)
+          return @spec_file = nil unless loaded_from && File.file?(loaded_from)
           @spec_file = begin
             file = { name: File.basename(loaded_from), dir: File.dirname(loaded_from) }
             Licensee::ProjectFiles::PackageManagerFile.new(File.read(loaded_from), file)
@@ -37,7 +38,6 @@ module Licensed
         end
       end
 
-      GEMFILES = { "Gemfile" => "Gemfile.lock", "gems.rb" => "gems.locked" }
       DEFAULT_WITHOUT_GROUPS = %i{development test}
       RUBY_PACKER_ERROR = "The bundler source cannot be used from the executable built with ruby-packer.  Please install licensed using `gem install` or using bundler."
 
@@ -45,15 +45,20 @@ module Licensed
         # running a ruby-packer-built licensed exe when ruby isn't available
         # could lead to errors if the host ruby doesn't exist
         return false if ruby_packer? && !Licensed::Shell.tool_available?("ruby")
-        defined?(::Bundler) && lockfile_path && lockfile_path.exist?
+
+        # if Bundler isn't loaded, this enumerator won't work!
+        return false unless defined?(::Bundler)
+
+        with_application_environment { ::Bundler.default_lockfile&.exist? }
+      rescue ::Bundler::GemfileNotFound
+        false
       end
 
       def enumerate_dependencies
         raise Licensed::Sources::Source::Error.new(RUBY_PACKER_ERROR) if ruby_packer?
 
-        with_local_configuration do
-          specs.map do |spec|
-            next if spec.name == "bundler" && !include_bundler?
+        with_application_environment do
+          definition.specs.map do |spec|
             next if spec.name == config["name"]
 
             error = spec.error if spec.respond_to?(:error)
@@ -73,41 +78,13 @@ module Licensed
         end
       end
 
-      # Returns an array of Gem::Specifications for all gem dependencies
-      def specs
-        @specs ||= definition.specs_for(groups)
-      end
-
-      # Returns whether to include bundler as a listed dependency of the project
-      def include_bundler?
-        @include_bundler ||= begin
-          # include if bundler is listed as a direct dependency that should be included
-          requested_dependencies = definition.dependencies.select { |d| (d.groups & groups).any? && d.should_include? }
-          return true if requested_dependencies.any? { |d| d.name == "bundler" }
-          # include if bundler is an indirect dependency
-          return true if specs.flat_map(&:dependencies).any? { |d| d.name == "bundler" }
-          false
-        end
-      end
-
-      # Build the bundler definition
       def definition
-        @definition ||= ::Bundler::Definition.build(gemfile_path, lockfile_path, nil)
-      end
-
-      # Returns the bundle definition groups, removing "without" groups,
-      # and including "with" groups
-      def groups
-        @groups ||= definition.groups - bundler_setting_array(:without) + bundler_setting_array(:with) - exclude_groups
-      end
-
-      # Returns a bundler setting as an array.
-      # Depending on the version of bundler, array values are either returned as
-      # a raw string ("a:b:c") or as an array ([:a, :b, :c])
-      def bundler_setting_array(key)
-        setting = ::Bundler.settings[key]
-        setting = setting.split(":").map(&:to_sym) if setting.is_a?(String)
-        Array(setting)
+        @definition ||= begin
+          definition = ::Bundler::Definition.build(::Bundler.default_gemfile, ::Bundler.default_lockfile, nil)
+          definition.extend Licensed::Bundler::DefinitionExtensions
+          definition.force_exclude_groups = exclude_groups
+          definition
+        end
       end
 
       # Returns any groups to exclude specified from both licensed configuration
@@ -121,46 +98,33 @@ module Licensed
         end
       end
 
-      # Returns the path to the Bundler Gemfile
-      def gemfile_path
-        @gemfile_path ||= GEMFILES.keys
-                                  .map { |g| config.pwd.join g }
-                                  .find { |f| f.exist? }
-      end
+      # helper to clear all bundler environment around a yielded block
+      def with_application_environment
+        backup = nil
 
-      # Returns the path to the Bundler Gemfile.lock
-      def lockfile_path
-        return unless gemfile_path
-        @lockfile_path ||= gemfile_path.dirname.join(GEMFILES[gemfile_path.basename.to_s])
-      end
+        ::Bundler.ui.silence do
+          if ::Bundler.root != config.source_path
+            backup = ENV.to_hash
+            ENV.replace(::Bundler.original_env)
 
-      # helper to clear all bundler environment around a yielded block
-      def with_local_configuration
-        # silence any bundler warnings while running licensed
-        bundler_ui, ::Bundler.ui = ::Bundler.ui, ::Bundler::UI::Silent.new
+            # reset bundler to load from the current app's source path
+            ::Bundler.reset!
+          end
 
-        original_bundle_gemfile = nil
-        if gemfile_path.to_s != ENV["BUNDLE_GEMFILE"]
-          # force bundler to use the local gem file
-          original_bundle_gemfile, ENV["BUNDLE_GEMFILE"] = ENV["BUNDLE_GEMFILE"], gemfile_path.to_s
+          # ensure the bundler environment is loaded before enumeration
+          ::Bundler.load
 
-          # reset all bundler configuration
-          ::Bundler.reset!
-          # and re-configure with settings for current directory
-          ::Bundler.configure
+          yield
         end
-
-        yield
       ensure
-        if original_bundle_gemfile
-          ENV["BUNDLE_GEMFILE"] = original_bundle_gemfile
-
+        if backup
           # restore bundler configuration
+          ENV.replace(backup)
           ::Bundler.reset!
-          ::Bundler.configure
         end
 
-        ::Bundler.ui = bundler_ui
+        # reload the bundler environment after enumeration
+        ::Bundler.load
       end
 
       # Returns whether the current licensed execution is running ruby-packer

data/lib/licensed/sources/dep.rb

@@ -40,10 +40,10 @@ module Licensed
         end
       end
 
-      # Returns the godoc.org page for a package.
+      # Returns the pkg.go.dev page for a package.
       def homepage(import_path)
         return unless import_path
-        "https://godoc.org/#{import_path}"
+        "https://pkg.go.dev/#{import_path}"
       end
 
       # Returns whether the package is part of the go std list.  Replaces

data/lib/licensed/sources/go.rb

@@ -98,7 +98,7 @@ module Licensed
       # Returns whether the package is local to the current project
       def local_package?(package)
         return false unless package && package["Dir"]
-        return false unless File.fnmatch?("#{config.root.to_s}*", package["Dir"], File::FNM_CASEFOLD)
+        return false unless File.fnmatch?("#{config.root}*", package["Dir"], File::FNM_CASEFOLD)
         vendored_path_parts(package).nil?
       end
 
@@ -132,10 +132,10 @@ module Licensed
         end
       end
 
-      # Returns the godoc.org page for a package.
+      # Returns the pkg.go.dev page for a package.
       def homepage(import_path)
         return unless import_path
-        "https://godoc.org/#{import_path}"
+        "https://pkg.go.dev/#{import_path}"
       end
 
       # Returns the root directory to search for a package license

data/lib/licensed/sources/gradle.rb

@@ -125,10 +125,10 @@ module Licensed
       def self.add_gradle_license_report_plugins_block(gradle_build_file)
 
         if gradle_build_file.include? "plugins"
-          gradle_build_file.gsub(/(?<=plugins)\s+{/, " { id 'com.github.jk1.dependency-license-report' version '1.6'")
+          gradle_build_file.gsub(/(?<=plugins)\s+{/, " { id 'com.github.jk1.dependency-license-report' version '1.16'")
         else
 
-          gradle_build_file = " plugins { id 'com.github.jk1.dependency-license-report' version '1.6' }" + gradle_build_file
+          gradle_build_file = " plugins { id 'com.github.jk1.dependency-license-report' version '1.16' }" + gradle_build_file
         end
       end
 

data/lib/licensed/sources/helpers/content_versioning.rb

@@ -61,11 +61,12 @@ module Licensed
 
         paths = paths.compact.select { |path| File.file?(path) }
         return if paths.empty?
-
+        # rubocop:disable GitHub/InsecureHashAlgorithm
         paths.sort
              .reduce(Digest::XXHash64.new, :file)
              .digest
              .to_s(16) # convert to hex
+        # rubocop:enable GitHub/InsecureHashAlgorithm
       end
     end
   end

data/lib/licensed/sources/npm.rb

@@ -33,11 +33,12 @@ module Licensed
 
       def enumerate_dependencies
         packages.map do |name, package|
-          path = package["path"]
+          errors = package["problems"] unless package["path"]
           Dependency.new(
             name: name,
-            version: package["version"],
-            path: path,
+            version: package["version"] || package["required"],
+            path: package["path"],
+            errors: Array(errors),
             metadata: {
               "type"     => NPM.type,
               "name"     => package["name"],

data/lib/licensed/sources/nuget.rb

@@ -234,8 +234,7 @@ module Licensed
         ].compact
 
         nuget_package_dirs.map { |dir| File.join(dir, dependency_path) }
-                          .select { |path| File.directory?(path) }
-                          .first
+                          .find { |path| File.directory?(path) }
       end
     end
   end

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "3.1.0".freeze
+  VERSION = "3.2.3".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/lib/licensed.rb

@@ -6,6 +6,7 @@ require "licensed/dependency"
 require "licensed/git"
 require "licensed/sources"
 require "licensed/configuration"
+require "licensed/report"
 require "licensed/reporters"
 require "licensed/commands"
 require "licensed/ui/shell"

data/licensed.gemspec

@@ -26,16 +26,16 @@ Gem::Specification.new do |spec|
   spec.add_dependency "licensee", ">= 9.14.0", "< 10.0.0"
   spec.add_dependency "thor", ">= 0.19"
   spec.add_dependency "pathname-common_prefix", "~> 0.0.1"
-  spec.add_dependency "tomlrb", "~> 1.2"
+  spec.add_dependency "tomlrb", ">= 1.2", "< 3.0"
   spec.add_dependency "bundler", ">= 1.10"
   spec.add_dependency "ruby-xxHash", "~> 0.4"
   spec.add_dependency "parallel", ">= 0.18.0"
-  spec.add_dependency "reverse_markdown", "~> 1.0"
+  spec.add_dependency "reverse_markdown", ">= 1", "< 3"
 
   spec.add_development_dependency "rake", ">= 12.3.3"
   spec.add_development_dependency "minitest", "~> 5.8"
   spec.add_development_dependency "mocha", "~> 1.0"
-  spec.add_development_dependency "rubocop", "~> 0.49", "< 0.67"
+  spec.add_development_dependency "rubocop", "~> 0.49", "< 1.20"
   spec.add_development_dependency "rubocop-github", "~> 0.6"
-  spec.add_development_dependency "byebug", "~> 10.0.0"
+  spec.add_development_dependency "byebug", "~> 11.0.1"
 end

data/script/source-setup/go

@@ -25,7 +25,7 @@ if [ "$1" == "-f" ]; then
   fi
 fi
 
-(cd src/test && go get)
+(export GO111MODULE=off && cd src/test && go get)
 if go help mod >/dev/null; then
   (cd src/modules_test && GO111MODULE=on go mod download)
 fi

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.2.3
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2021-06-16 00:00:00.000000000 Z
+date: 2021-09-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -62,16 +62,22 @@ dependencies:
   name: tomlrb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -118,16 +124,22 @@ dependencies:
   name: reverse_markdown
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -179,7 +191,7 @@ dependencies:
         version: '0.49'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.67'
+        version: '1.20'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -189,7 +201,7 @@ dependencies:
         version: '0.49'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '0.67'
+        version: '1.20'
 - !ruby/object:Gem::Dependency
   name: rubocop-github
   requirement: !ruby/object:Gem::Requirement
@@ -210,14 +222,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.0.0
+        version: 11.0.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 10.0.0
+        version: 11.0.1
 description: Licensed automates extracting and validating the licenses of dependencies.
 email:
 - opensource+licensed@github.com
@@ -226,6 +238,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/dependabot.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/test.yml"
 - ".gitignore"
@@ -241,8 +254,25 @@ files:
 - Rakefile
 - docker/Dockerfile.build-linux
 - docs/adding_a_new_source.md
-- docs/commands.md
+- docs/commands/README.md
+- docs/commands/cache.md
+- docs/commands/env.md
+- docs/commands/list.md
+- docs/commands/migrate.md
+- docs/commands/notices.md
+- docs/commands/status.md
+- docs/commands/version.md
 - docs/configuration.md
+- docs/configuration/README.md
+- docs/configuration/allowed_licenses.md
+- docs/configuration/application_name.md
+- docs/configuration/application_source.md
+- docs/configuration/configuration_root.md
+- docs/configuration/configuring_multiple_apps.md
+- docs/configuration/dependency_source_enumerators.md
+- docs/configuration/ignoring_dependencies.md
+- docs/configuration/metadata_cache.md
+- docs/configuration/reviewing_dependencies.md
 - docs/migrations/v2.md
 - docs/migrations/v3.md
 - docs/packaging.md
@@ -280,6 +310,7 @@ files:
 - lib/licensed/git.rb
 - lib/licensed/migrations.rb
 - lib/licensed/migrations/v2.rb
+- lib/licensed/report.rb
 - lib/licensed/reporters.rb
 - lib/licensed/reporters/cache_reporter.rb
 - lib/licensed/reporters/json_reporter.rb
@@ -292,6 +323,7 @@ files:
 - lib/licensed/sources.rb
 - lib/licensed/sources/bower.rb
 - lib/licensed/sources/bundler.rb
+- lib/licensed/sources/bundler/definition.rb
 - lib/licensed/sources/bundler/missing_specification.rb
 - lib/licensed/sources/cabal.rb
 - lib/licensed/sources/composer.rb