licensed 3.6.0 → 3.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a328b5551bdf77593f4bf97f4a846b7792898b6f749c25f5c5f39e68669f2164
-  data.tar.gz: ac9b2013cf25d9dab94aadd2122a41bfa2790d741bd9e1588a270cd122dfaddb
+  metadata.gz: 2b28b00b1b23f91bc89a99928d3ae07396afe29700e06c4e22debe1e4f3b2d45
+  data.tar.gz: 5e8ccfb04df77cb4802bc51825562ec52a5f8368718e66434460b61e425a864f
 SHA512:
-  metadata.gz: 846cadb01c2045ea258a785767ebfc8df3cee9d3a05648c93291c94cc21b7e84fb83146476c4afb64f9bc137a530cb84ba523ec41e2c4938396629b5b8901795
-  data.tar.gz: 4aa7028294894b9f0c1781b558032d80f87669e959e71aa1b635c7a8687f77b4cf11be6431f280cfcbc06ea25f605da061a9af2fb480ea134a4172f989060451
+  metadata.gz: 2b71b2fd45dcd9e61b425a08f0b2148ecd568ae4f3a0ffacd15213850fba8c313362783945cb3828592ef397f4d2ced750f890f6bf18447e6a32c02cbbb47795
+  data.tar.gz: aa587ef6d6e420761098ab2364aa485a36885cfdd6b09f9eec5ad838dbd108f759a91447818bc0279992b489513efad8a2381966dbbcf3f6fea3f3946069e676

data/CHANGELOG.md

@@ -6,6 +6,12 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 3.7.0
+
+### Changed
+
+- Pip and pipenv sources will find dependency licenses under `dist-info/license_files` when available (https://github.com/github/licensed/pull/504)
+
 ## 3.6.0
 
 2022-03-17
@@ -597,4 +603,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/3.6.0...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/3.7.0...HEAD

data/lib/licensed/sources/pip.rb

@@ -10,18 +10,17 @@ module Licensed
       PACKAGE_INFO_SEPARATOR = "\n---\n"
 
       def enabled?
-        virtual_env_pip && Licensed::Shell.tool_available?(virtual_env_pip)
+        !pip_command.empty? && Licensed::Shell.tool_available?(pip_command.join(""))
       end
 
       def enumerate_dependencies
         packages.map do |package|
-          location = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
           Dependency.new(
             name: package["Name"],
             version: package["Version"],
-            path: location,
+            path: package_license_location(package),
             metadata: {
-              "type"        => Pip.type,
+              "type"        => self.class.type,
               "summary"     => package["Summary"],
               "homepage"    => package["Home-page"]
             }
@@ -29,8 +28,24 @@ module Licensed
         end
       end
 
+      protected
+
+      # Returns the command to run pip
+      def pip_command
+        return [] unless virtual_env_dir
+        Array(File.join(virtual_env_dir, "bin", "pip"))
+      end
+
       private
 
+      # Returns the location of license files in the package, checking for the inclusion of a new `license_files`
+      # folder per https://peps.python.org/pep-0639/
+      def package_license_location(package)
+        dist_info = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
+        license_files = File.join(dist_info, "license_files")
+        return File.exist?(license_files) ? license_files : dist_info
+      end
+
       # Returns parsed information for all packages used by the project,
       # using `pip list` to determine what packages are used and `pip show`
       # to gather package information
@@ -64,17 +79,12 @@ module Licensed
 
       # Returns the output from `pip list --format=json`
       def pip_list_command
-        Licensed::Shell.execute(virtual_env_pip, "--disable-pip-version-check", "list", "--format=json")
+        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "list", "--format=json")
       end
 
       # Returns the output from `pip show <package> <package> ...`
       def pip_show_command(packages)
-        Licensed::Shell.execute(virtual_env_pip, "--disable-pip-version-check", "show", *packages)
-      end
-
-      def virtual_env_pip
-        return unless virtual_env_dir
-        File.join(virtual_env_dir, "bin", "pip")
+        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "show", *packages)
       end
 
       def virtual_env_dir

data/lib/licensed/sources/pipenv.rb

@@ -4,44 +4,16 @@ require "parallel"
 
 module Licensed
   module Sources
-    class Pipenv < Source
+    class Pipenv < Pip
       def enabled?
         Licensed::Shell.tool_available?("pipenv") && File.exist?(config.pwd.join("Pipfile.lock"))
       end
 
-      def enumerate_dependencies
-        Parallel.map(pakages_from_pipfile_lock, in_threads: Parallel.processor_count) do |package_name|
-          package = package_info(package_name)
-          location = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
-          Dependency.new(
-            name: package["Name"],
-            version: package["Version"],
-            path: location,
-            metadata: {
-              "type"        => Pipenv.type,
-              "summary"     => package["Summary"],
-              "homepage"    => package["Home-page"]
-            }
-          )
-        end
-      end
-
-      private
-
-      def pakages_from_pipfile_lock
-        Licensed::Shell.execute("pipenv", "run", "pip", "list")
-            .lines
-            .drop(2)  # Header
-            .map { |line| line.strip.split.first.strip }
-      end
+      protected
 
-      def package_info(package_name)
-        p_info = Licensed::Shell.execute("pipenv", "run", "pip", "--disable-pip-version-check", "show", package_name).lines
-        p_info.each_with_object(Hash.new(0)) { |pkg, a|
-          k, v = pkg.split(":", 2)
-          next if k.nil? || k.empty?
-          a[k.strip] = v&.strip
-        }
+      # Returns the command to run pip
+      def pip_command
+        %w(pipenv run pip)
       end
     end
   end

data/lib/licensed/sources/source.rb

@@ -14,8 +14,13 @@ module Licensed
       class << self
         attr_reader :sources
         def inherited(klass)
-          # add child source classes are defined,
-          # add them to the known sources list
+          # register the inherited class as a source on the Licensed::Sources::Source class
+          Licensed::Sources::Source.register_source(klass)
+        end
+
+        def register_source(klass)
+          # add the source class to the known sources list
+          return unless klass < Licensed::Sources::Source
           (@sources ||= []) << klass
         end
 

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "3.6.0".freeze
+  VERSION = "3.7.0".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -35,7 +35,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", ">= 12.3.3"
   spec.add_development_dependency "minitest", "~> 5.8"
   spec.add_development_dependency "mocha", "~> 1.0"
-  spec.add_development_dependency "rubocop", "~> 0.49", "< 1.20"
+  spec.add_development_dependency "rubocop", "~> 1.26", "< 1.27"
   spec.add_development_dependency "rubocop-github", "~> 0.6"
-  spec.add_development_dependency "byebug", "~> 11.0.1"
+  spec.add_development_dependency "byebug", "~> 11.1.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.7.0
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-17 00:00:00.000000000 Z
+date: 2022-04-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -188,20 +188,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.49'
+        version: '1.26'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.20'
+        version: '1.27'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.49'
+        version: '1.26'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.20'
+        version: '1.27'
 - !ruby/object:Gem::Dependency
   name: rubocop-github
   requirement: !ruby/object:Gem::Requirement
@@ -222,14 +222,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 11.0.1
+        version: 11.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 11.0.1
+        version: 11.1.3
 description: Licensed automates extracting and validating the licenses of dependencies.
 email:
 - opensource+licensed@github.com