licensed 4.2.0 → 4.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b65e198a420b03486b2680a6a83fb04b4e67684d28bc4ba9ef00c466ffd7489
-  data.tar.gz: ab2b10c6e854d3f1d7faa918e48addb497032838fd1cea942ff823053b891150
+  metadata.gz: a5e25ec11aa1545ab3a63cd560c95dd5f12c0008867a68668005473ab68b20ff
+  data.tar.gz: 9dd7d0fafc53407683ba844ae7f9ce4da2b52a72ebda61334739e9fb010b1af9
 SHA512:
-  metadata.gz: 8dee38c45e73cb03b7c94a9260bb9bc6f5919f53156b69a751238693920e2f120a3dcb0d43f66270fa9abc8305705fdced290978e51bfe762be5f0e5ba00230d
-  data.tar.gz: d352b46e40f545f0bd3e1aa29e3bb62454e2e329c64ce9197ba1f9c38b4f11bcbbbecc789658dcff0e6b79e43b4ee9cc839b5476e23cab44a559a605ddbd77b6
+  metadata.gz: 234bf05e1fd4aa01c19220ed566820b291169fb55714c5841dad75f3a01c06c37011dcc8a943008ff0b36325fb00637fcbbd3175c94cb9b18e65cbbcf2ed6514
+  data.tar.gz: 812597ad63783d2b16cf7cf33ab81e793ee9c8ae103b61927655019d8418a1ef5778d61ec288c817caf5e687776c8e15531cfc1c20dd1e650720ccd4f274296f

data/CHANGELOG.md

@@ -6,6 +6,18 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 4.3.1
+
+### Changed
+
+- Bump nokogiri to resolve vulnerabilities (https://github.com/github/licensed/pull/648)
+
+## 4.3.0
+
+### Added
+
+- Cocoapods support has been re-enabled using a cocoapods plugin (https://github.com/github/licensed/pull/644)
+
 ## 4.2.0
 
 ### Added
@@ -723,4 +735,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/4.2.0...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/4.3.1...HEAD

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    licensed (4.2.0)
+    licensed (4.3.1)
       json (~> 2.6)
       licensee (~> 9.16)
       parallel (~> 1.22)
@@ -14,7 +14,7 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.4.2)
+    activesupport (7.0.4.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -23,7 +23,7 @@ GEM
       public_suffix (>= 2.0.2, < 6.0)
     ast (2.4.2)
     byebug (11.1.3)
-    concurrent-ruby (1.2.0)
+    concurrent-ruby (1.2.2)
     dotenv (2.8.1)
     faraday (2.7.4)
       faraday-net_http (>= 2.0, < 3.1)
@@ -39,13 +39,15 @@ GEM
       rugged (>= 0.24, < 2.0)
       thor (>= 0.19, < 2.0)
     mini_portile2 (2.8.1)
-    minitest (5.17.0)
+    minitest (5.18.0)
+    minitest-hooks (1.5.0)
+      minitest (> 5.3)
     mocha (2.0.2)
       ruby2_keywords (>= 0.0.5)
-    nokogiri (1.14.0)
+    nokogiri (1.14.3)
       mini_portile2 (~> 2.8.0)
       racc (~> 1.4)
-    octokit (6.0.1)
+    octokit (6.1.0)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     parallel (1.22.1)
@@ -54,14 +56,14 @@ GEM
     pathname-common_prefix (0.0.1)
     public_suffix (5.0.1)
     racc (1.6.2)
-    rack (3.0.4.1)
+    rack (3.0.7)
     rainbow (3.1.1)
     rake (13.0.6)
     regexp_parser (2.6.2)
     reverse_markdown (2.1.1)
       nokogiri
     rexml (3.2.5)
-    rubocop (1.44.1)
+    rubocop (1.45.1)
       json (~> 2.3)
       parallel (~> 1.10)
       parser (>= 3.2.0.0)
@@ -80,7 +82,7 @@ GEM
     rubocop-performance (1.15.2)
       rubocop (>= 1.7.0, < 2.0)
       rubocop-ast (>= 0.4.0)
-    rubocop-rails (2.17.4)
+    rubocop-rails (2.18.0)
       activesupport (>= 4.2.0)
       rack (>= 1.1)
       rubocop (>= 1.33.0, < 2.0)
@@ -93,7 +95,7 @@ GEM
       faraday (>= 0.17.3, < 3)
     thor (1.2.1)
     tomlrb (2.0.3)
-    tzinfo (2.0.5)
+    tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.4.2)
 
@@ -104,6 +106,7 @@ DEPENDENCIES
   byebug (~> 11.1)
   licensed!
   minitest (~> 5.17)
+  minitest-hooks (~> 1.5)
   mocha (~> 2.0)
   rake (~> 13.0)
   rubocop-github (~> 0.20)

data/README.md

@@ -47,7 +47,7 @@ sudo apt-get install cmake pkg-config
 brew install cmake pkg-config
 ```
 
-### With a Gemfile
+### With Gemfile
 
 Add this line to your application's Gemfile:
 
@@ -61,7 +61,7 @@ And then execute:
 $> bundle
 ```
 
-### With a Homebrew (on macOS)
+### With Homebrew (on macOS)
 
 ```bash
 brew install licensed

data/docs/sources/cocoapods.md

@@ -1,10 +1,8 @@
 # CocoaPods
 
-**NOTE!**: Enumerating Cocoapods dependencies is disabled until the cocoapods-core gem is compatible with Rails 7+.  See https://github.com/CocoaPods/Core/pull/733
+The cocoapods source will detect dependencies when `Podfile` and `Podfile.lock` are found at an app's `source_path`.  The cocoapods source uses the [cocoapods-dependencies-list](https://github.com/jonabc/cocoapods-dependencies-list) plugin to enumerate dependencies and gather metadata on each package.
 
-The cocoapods source will detect dependencies when `Podfile` and `Podfile.lock` are found at an app's `source_path`.
-
-It uses the `pod` CLI commands to enumerate dependencies and gather metadata on each package.
+**NOTE:  Licensed does not install the [cocoapods-dependencies-list](https://github.com/jonanc/cocoapods-dependencies-list) plugin.  Users must install the gem alongside the cocoapods gem to enumerate cocoapods dependencies.**
 
 ## Evaluating dependencies from a specific target
 
@@ -15,3 +13,12 @@ cocoapods:
   targets:
     - ios
 ```
+
+## Specifying which pod executable to run
+
+The cocoapods source will call the `pod` executable to evaluate dependencies by default.  If needed, you can override the executable used with the `cocoapods.command` configuration option.  This might be useful if the full path to the `pod` executable is needed (e.g. `pod` is not findable from the system `PATH`), or if you need to execute `pod` with `bundle exec`.
+
+```yml
+cocoapods:
+  command: 'bundle exec pod'
+```

data/lib/licensed/configuration.rb

@@ -116,7 +116,7 @@ module Licensed
     # Returns an array of paths to files containing additional license terms.
     def additional_terms_for_dependency(dependency)
       amendment_paths = Array(self.dig("additional_terms", dependency["type"], dependency["name"]))
-      amendment_paths.flat_map { |path| Dir.glob(self.root.join(path)) }
+      amendment_paths.flat_map { |path| Dir.glob(self.root.join(path)) }.sort
     end
 
     private

data/lib/licensed/sources/cocoapods.rb

@@ -3,32 +3,29 @@ require "json"
 require "pathname"
 require "uri"
 
-# **NOTE** Cocoapods is disabled until cocoapods-core supports recent rails versions
-# https://github.com/CocoaPods/Core/pull/733
-# require "cocoapods-core"
-
 module Licensed
   module Sources
     class Cocoapods < Source
-      def enabled?
-        false
+      DEFAULT_POD_COMMAND = "pod".freeze
+      MISSING_PLUGIN_MESSAGE = "Error running `pods dependencies`. Please ensure the cocoapods-dependencies-list gem is installed, it is required for licensed to enumerate dependencies.".freeze
 
-        # return unless Licensed::Shell.tool_available?("pod")
+      def enabled?
+        return unless Licensed::Shell.tool_available?("pod")
 
-        # config.pwd.join("Podfile").exist? && config.pwd.join("Podfile.lock").exist?
+        config.pwd.join("Podfile").exist? && config.pwd.join("Podfile.lock").exist?
       end
 
       def enumerate_dependencies
         pods.map do |pod|
-          name = pod.name
-          path = dependency_path(pod.root_name)
-          version = lockfile.version(name).version
-
           Dependency.new(
-            path: path,
-            name: name,
-            version: version,
-            metadata: { "type" => Cocoapods.type }
+            name: pod["name"],
+            version: pod["version"],
+            path: pod["path"],
+            metadata: {
+              "type" => Cocoapods.type,
+              "summary"  => pod["summary"],
+              "homepage" => pod["homepage"]
+            }
           )
         end
       end
@@ -36,32 +33,32 @@ module Licensed
       private
 
       def pods
-        return lockfile.dependencies if targets.nil?
-
-        targets_to_validate = podfile.target_definition_list.filter { |t| targets.include?(t.label) }
-        if targets_to_validate.any?
-          targets_to_validate.map(&:dependencies).flatten
-        else
-          raise Licensed::Sources::Source::Error, "Unable to find any target in the Podfile matching the ones provided in the config."
-        end
+        cocoapods_dependencies_json.values.flatten
       end
 
-      def targets
-        @targets ||= config.dig("cocoapods", "targets")&.map { |t| "Pods-#{t}" }
-      end
+      def cocoapods_dependencies_json
+        args = ["dependencies", "--include-path"]
+        args << "--targets=#{targets.join(",")}" if targets.any?
 
-      def lockfile
-        @lockfile = nil
-        # @lockfile ||= Pod::Lockfile.from_file(config.pwd.join("Podfile.lock"))
+        output = Licensed::Shell.execute(*pod_command, *args, allow_failure: true)
+        if output.include? "Unknown command"
+          raise Licensed::Sources::Source::Error, MISSING_PLUGIN_MESSAGE
+        end
+
+        JSON.parse(output)
+      rescue JSON::ParserError => e
+        message = "Licensed was unable to parse the output from 'pod dependencies'. JSON Error: #{e.message}"
+        raise Licensed::Sources::Source::Error, message
       end
 
-      def podfile
-        @podfile = nil
-        # @podfile ||= Pod::Podfile.from_file(config.pwd.join("Podfile"))
+      def targets
+        return [] unless [String, Array].any? { |type| source_config["targets"].is_a?(type) }
+        Array(source_config["targets"]).map { |t| "Pods-#{t}" }
       end
 
-      def dependency_path(name)
-        config.pwd.join("Pods/#{name}")
+      def pod_command
+        return DEFAULT_POD_COMMAND unless source_config["command"].is_a?(String)
+        source_config["command"].split
       end
     end
   end

data/lib/licensed/sources/source.rb

@@ -90,6 +90,11 @@ module Licensed
         config.ignored?(dependency.metadata, require_version: self.class.require_matched_dependency_version)
       end
 
+      # Returns configuration options set for the current source
+      def source_config
+        @source_config ||= config[self.class.type].is_a?(Hash) ? config[self.class.type] : {}
+      end
+
       private
 
       # Returns a cached list of dependencies

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "4.2.0".freeze
+  VERSION = "4.3.1".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -21,7 +21,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = ">= 2.6.0"
+  spec.required_ruby_version = ">= 2.7.0"
 
   spec.add_dependency "licensee", "~> 9.16"
   spec.add_dependency "thor", "~> 1.2"
@@ -31,10 +31,10 @@ Gem::Specification.new do |spec|
   spec.add_dependency "parallel", "~> 1.22"
   spec.add_dependency "reverse_markdown", "~> 2.1"
   spec.add_dependency "json", "~> 2.6"
-  # spec.add_dependency "cocoapods-core", "~> 1.11"
 
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "minitest", "~> 5.17"
+  spec.add_development_dependency "minitest-hooks", "~> 1.5"
   spec.add_development_dependency "mocha", "~> 2.0"
   spec.add_development_dependency "rubocop-github", "~> 0.20"
   spec.add_development_dependency "byebug", "~> 11.1"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 4.2.0
+  version: 4.3.1
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-02-25 00:00:00.000000000 Z
+date: 2023-04-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -150,6 +150,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.17'
+- !ruby/object:Gem::Dependency
+  name: minitest-hooks
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: mocha
   requirement: !ruby/object:Gem::Requirement
@@ -321,7 +335,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="