licensed 3.6.0 → 3.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a328b5551bdf77593f4bf97f4a846b7792898b6f749c25f5c5f39e68669f2164
-  data.tar.gz: ac9b2013cf25d9dab94aadd2122a41bfa2790d741bd9e1588a270cd122dfaddb
+  metadata.gz: 31f187eacefe804712d35112ff72bc25e5d4cdd8696ac529327689999de6160e
+  data.tar.gz: 6154eb5ff6efebaf727da8b03315dd7eed04b96911c9e43a81569138a39d0497
 SHA512:
-  metadata.gz: 846cadb01c2045ea258a785767ebfc8df3cee9d3a05648c93291c94cc21b7e84fb83146476c4afb64f9bc137a530cb84ba523ec41e2c4938396629b5b8901795
-  data.tar.gz: 4aa7028294894b9f0c1781b558032d80f87669e959e71aa1b635c7a8687f77b4cf11be6431f280cfcbc06ea25f605da061a9af2fb480ea134a4172f989060451
+  metadata.gz: e433eac2fa6ae6b394f6919fabb2c7f7b38fe335619cd13d392ce8bd208a9d6be06016789ba563660acf31110548daa2d3ebac306115dc01b3c3bb11d88f21d9
+  data.tar.gz: 2fab2eac0cce0339c50d8a7242cd29627ec2bdce027104dfec70c405cc0e3b1e50961ead3a6375d2cbd8476703c8af03dd7957fd0762f6794855caa47c1a2e73

data/CHANGELOG.md

@@ -6,6 +6,29 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 3.7.2
+
+### Fixed
+
+- Comparing dependency license contents now finds matching contents regardless of the order of the licenses (https://github.com/github/licensed/pull/516)
+- Fixed typo in a link in README.md (https://github.com/github/licensed/pull/514) 
+
+### Changed
+
+- Elixir testing setup is migrated to erlef/setup-beam (https://github.com/github/licensed/pull/512)
+
+## 3.7.1
+
+### Fixed
+
+- Dependencies' legal notice file matching has been made more strict to reduce false positives on code files containing the word `legal` (https://github.com/github/licensed/pull/510)
+
+## 3.7.0
+
+### Changed
+
+- Pip and pipenv sources will find dependency licenses under `dist-info/license_files` when available (https://github.com/github/licensed/pull/504)
+
 ## 3.6.0
 
 2022-03-17
@@ -597,4 +620,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/3.6.0...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/3.7.2...HEAD

data/README.md

@@ -86,7 +86,7 @@ A configuration file is required for most commands.  See the [configuration file
 
 ### Available dependency sources
 
-Licensed can enumerate dependency for many languages, package managers, and frameworks.  See the [sources documentation](./docs/sources) for the list of currently available sources.  Sources can be explicitly enabled and disabled as a [configuration option](./docs/configuration/dependency_source_enumerators.md.md).
+Licensed can enumerate dependency for many languages, package managers, and frameworks.  See the [sources documentation](./docs/sources) for the list of currently available sources.  Sources can be explicitly enabled and disabled as a [configuration option](./docs/configuration/dependency_source_enumerators.md).
 
 ## Development
 

data/lib/licensed/dependency.rb

@@ -3,7 +3,7 @@ require "licensee"
 
 module Licensed
   class Dependency < Licensee::Projects::FSProject
-    LEGAL_FILES_PATTERN = /(AUTHORS|NOTICE|LEGAL)(?:\..*)?\z/i
+    LEGAL_FILES_PATTERN = /#{File::SEPARATOR}(AUTHORS|NOTICE|LEGAL)(?:\..*)?\z/i
 
     attr_reader :name
     attr_reader :version

data/lib/licensed/dependency_record.rb

@@ -27,6 +27,14 @@ module Licensed
           "text" => text
         }
       end
+
+      def key
+        @key ||= begin
+          # rubocop:disable GitHub/InsecureHashAlgorithm
+          Digest::XXHash64.digest(sources.join("") + text)
+          # rubocop:enable GitHub/InsecureHashAlgorithm
+        end
+      end
     end
 
     include Licensee::ContentHelper
@@ -84,7 +92,7 @@ module Licensed
     # `Licensee::CotentHelper`
     def content
       return if licenses.nil? || licenses.empty?
-      licenses.map(&:text).compact.join
+      licenses.sort_by(&:key).map(&:text).compact.join
     end
 
     # Returns whether two records match based on their contents

data/lib/licensed/sources/pip.rb

@@ -10,18 +10,17 @@ module Licensed
       PACKAGE_INFO_SEPARATOR = "\n---\n"
 
       def enabled?
-        virtual_env_pip && Licensed::Shell.tool_available?(virtual_env_pip)
+        !pip_command.empty? && Licensed::Shell.tool_available?(pip_command.join(""))
       end
 
       def enumerate_dependencies
         packages.map do |package|
-          location = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
           Dependency.new(
             name: package["Name"],
             version: package["Version"],
-            path: location,
+            path: package_license_location(package),
             metadata: {
-              "type"        => Pip.type,
+              "type"        => self.class.type,
               "summary"     => package["Summary"],
               "homepage"    => package["Home-page"]
             }
@@ -29,8 +28,24 @@ module Licensed
         end
       end
 
+      protected
+
+      # Returns the command to run pip
+      def pip_command
+        return [] unless virtual_env_dir
+        Array(File.join(virtual_env_dir, "bin", "pip"))
+      end
+
       private
 
+      # Returns the location of license files in the package, checking for the inclusion of a new `license_files`
+      # folder per https://peps.python.org/pep-0639/
+      def package_license_location(package)
+        dist_info = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
+        license_files = File.join(dist_info, "license_files")
+        return File.exist?(license_files) ? license_files : dist_info
+      end
+
       # Returns parsed information for all packages used by the project,
       # using `pip list` to determine what packages are used and `pip show`
       # to gather package information
@@ -64,17 +79,12 @@ module Licensed
 
       # Returns the output from `pip list --format=json`
       def pip_list_command
-        Licensed::Shell.execute(virtual_env_pip, "--disable-pip-version-check", "list", "--format=json")
+        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "list", "--format=json")
       end
 
       # Returns the output from `pip show <package> <package> ...`
       def pip_show_command(packages)
-        Licensed::Shell.execute(virtual_env_pip, "--disable-pip-version-check", "show", *packages)
-      end
-
-      def virtual_env_pip
-        return unless virtual_env_dir
-        File.join(virtual_env_dir, "bin", "pip")
+        Licensed::Shell.execute(*pip_command, "--disable-pip-version-check", "show", *packages)
       end
 
       def virtual_env_dir

data/lib/licensed/sources/pipenv.rb

@@ -4,44 +4,16 @@ require "parallel"
 
 module Licensed
   module Sources
-    class Pipenv < Source
+    class Pipenv < Pip
       def enabled?
         Licensed::Shell.tool_available?("pipenv") && File.exist?(config.pwd.join("Pipfile.lock"))
       end
 
-      def enumerate_dependencies
-        Parallel.map(pakages_from_pipfile_lock, in_threads: Parallel.processor_count) do |package_name|
-          package = package_info(package_name)
-          location = File.join(package["Location"], package["Name"].gsub("-", "_") +  "-" + package["Version"] + ".dist-info")
-          Dependency.new(
-            name: package["Name"],
-            version: package["Version"],
-            path: location,
-            metadata: {
-              "type"        => Pipenv.type,
-              "summary"     => package["Summary"],
-              "homepage"    => package["Home-page"]
-            }
-          )
-        end
-      end
-
-      private
-
-      def pakages_from_pipfile_lock
-        Licensed::Shell.execute("pipenv", "run", "pip", "list")
-            .lines
-            .drop(2)  # Header
-            .map { |line| line.strip.split.first.strip }
-      end
+      protected
 
-      def package_info(package_name)
-        p_info = Licensed::Shell.execute("pipenv", "run", "pip", "--disable-pip-version-check", "show", package_name).lines
-        p_info.each_with_object(Hash.new(0)) { |pkg, a|
-          k, v = pkg.split(":", 2)
-          next if k.nil? || k.empty?
-          a[k.strip] = v&.strip
-        }
+      # Returns the command to run pip
+      def pip_command
+        %w(pipenv run pip)
       end
     end
   end

data/lib/licensed/sources/source.rb

@@ -14,8 +14,13 @@ module Licensed
       class << self
         attr_reader :sources
         def inherited(klass)
-          # add child source classes are defined,
-          # add them to the known sources list
+          # register the inherited class as a source on the Licensed::Sources::Source class
+          Licensed::Sources::Source.register_source(klass)
+        end
+
+        def register_source(klass)
+          # add the source class to the known sources list
+          return unless klass < Licensed::Sources::Source
           (@sources ||= []) << klass
         end
 

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "3.6.0".freeze
+  VERSION = "3.7.2".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -35,7 +35,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", ">= 12.3.3"
   spec.add_development_dependency "minitest", "~> 5.8"
   spec.add_development_dependency "mocha", "~> 1.0"
-  spec.add_development_dependency "rubocop", "~> 0.49", "< 1.20"
+  spec.add_development_dependency "rubocop", "~> 1.26", "< 1.27"
   spec.add_development_dependency "rubocop-github", "~> 0.6"
-  spec.add_development_dependency "byebug", "~> 11.0.1"
+  spec.add_development_dependency "byebug", "~> 11.1.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.7.2
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-17 00:00:00.000000000 Z
+date: 2022-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -188,20 +188,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.49'
+        version: '1.26'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.20'
+        version: '1.27'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.49'
+        version: '1.26'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.20'
+        version: '1.27'
 - !ruby/object:Gem::Dependency
   name: rubocop-github
   requirement: !ruby/object:Gem::Requirement
@@ -222,14 +222,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 11.0.1
+        version: 11.1.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 11.0.1
+        version: 11.1.3
 description: Licensed automates extracting and validating the licenses of dependencies.
 email:
 - opensource+licensed@github.com