licensed 2.14.1 → 2.14.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e51a39bfeaf0f48ca7a05b08047b8a64236b276097a0ee7f301dc1ca4e1ad1f
-  data.tar.gz: ee8de1cdebb66fa213f25b4b4bcd38957a4746b86bed6375a057cdd372603cc7
+  metadata.gz: 7f91fb96a7fae9a97255650d8b27b65236f681b69dcbe3092691bb703f04b60f
+  data.tar.gz: '0009173e203fbec4670773120888a2389c8a8e451a8d29ac0224548d8304df01'
 SHA512:
-  metadata.gz: 583a36dbc2a4e2cb6c9ae76a8976f01e61c2ec3f855d36aac3ce68f303170c7ddd2f0a5ed1e7acc5e67ae26eedd05ee05c1b884cf73a5a6836b2e81879b12078
-  data.tar.gz: ca025576af3f1a385f6517d2534a39e83ae2bc6a575933559f0457cab3afd28037ab16aef79e068958c225bdacec293b21afa3e4d2f5238bde473a3a3a924daa
+  metadata.gz: 4c463e87b87a2907a935f62c4191c754b499a2737bed527b0573030272a13b0e7daf780418602dc6a71522049dcf8e7a53b60ad46c3d24089b685b35453d4f4a
+  data.tar.gz: 4b33b7d301373075334f0302859ad7a4d9321a40c68df1a4f22f0af30ff73325190cdabd70532a48fd6c27bbed45532121065aeb61476a9b0bf3619f5c703924

data/CHANGELOG.md

@@ -6,6 +6,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 2.14.2
+2020-11-20
+
+## Fixed
+- Yarn source correctly finds dependency paths on disk (https://github.com/github/licensed/pull/326)
+- Go source better handles finding dependencies that have been vendored (https://github.com/github/licensed/pull/323)
+
 ## 2.14.1
 2020-10-09
 
@@ -366,4 +373,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/2.14.1...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/2.14.2...HEAD

data/lib/licensed/sources/go.rb

@@ -15,8 +15,7 @@ module Licensed
       def enumerate_dependencies
         with_configured_gopath do
           packages.map do |package|
-            import_path = non_vendored_path(package["ImportPath"], root_package["ImportPath"])
-            import_path ||= package["ImportPath"]
+            import_path = non_vendored_import_path(package)
             error = package.dig("Error", "Err") if package["Error"]
 
             Dependency.new(
@@ -81,34 +80,26 @@ module Licensed
         # return true if package self-identifies
         return true if package["Standard"]
 
-        import_path = package["ImportPath"]
+        import_path = non_vendored_import_path(package)
         return false unless import_path
 
-        # true if go standard packages includes the import path as given
-        return true if go_std_packages.include?(import_path)
-        return true if go_std_packages.include?("vendor/#{import_path}")
-        return true if go_std_packages.include?(import_path.sub("golang.org", "internal"))
-
-        # additional checks are only for vendored dependencies - return false
-        # if package isn't vendored
-        non_vendored_import_path = non_vendored_path(import_path, root_package["ImportPath"])
-        return false unless non_vendored_import_path
-
-        # return true if any of the go standard packages matches against
-        # the non-vendored import path
-        return true if go_std_packages.include?(non_vendored_import_path)
-        return true if go_std_packages.include?(non_vendored_import_path.sub("golang.org", "internal"))
-
-        # modify the import path to look like the import path `go list` returns for vendored std packages
-        vendor_path = import_path.sub("#{root_package["ImportPath"]}/", "")
-        go_std_packages.include?(vendor_path) || go_std_packages.include?(vendor_path.sub("golang.org", "golang_org"))
+        # check different variations of the import path to match against
+        # what's returned from `go list std`
+        [
+          import_path,
+          import_path.sub("golang.org", "internal"),
+          import_path.sub("golang.org", "golang_org"),
+        ].any? do |path|
+          # true if go standard packages includes the path or "vendor/<path>"
+          go_std_packages.include?(path) || go_std_packages.include?("vendor/#{path}")
+        end
       end
 
       # Returns whether the package is local to the current project
       def local_package?(package)
-        return false unless package && package["ImportPath"]
-        import_path = package["ImportPath"]
-        import_path.start_with?(root_package["ImportPath"]) && !import_path.include?("vendor/")
+        return false unless package && package["Dir"]
+        return false unless File.fnmatch?("#{config.root.to_s}*", package["Dir"])
+        vendored_path_parts(package).nil?
       end
 
       # Returns the version for a given package
@@ -155,36 +146,45 @@ module Licensed
 
         # search root choices:
         # 1. module directory if using go modules and directory is available
-        # 2. vendor folder if package is vendored
-        # 3. package root value if available
-        # 4. GOPATH if the package directory is under the gopath
-        # 5. nil
         module_dir = package.dig("Module", "Dir")
         return module_dir if module_dir
-        return package["Dir"].match("^(.*/vendor)/.*$")[1] if vendored_path?(package["Dir"], config.root)
+
+        # 2. vendor folder if package is vendored
+        parts = vendored_path_parts(package)
+        return parts[:vendor_path] if parts
+
+        # 3. package root value if available
         return package["Root"] if package["Root"]
+
+        # 4. GOPATH if the package directory is under the gopath
         return gopath if package["Dir"]&.start_with?(gopath)
+
+        # 5. nil
         nil
       end
 
-      # Returns whether a package is vendored or not based on a base path and
-      # whether the path contains a vendor component
+      # If the package is vendored, returns a Match object containing named
+      # :vendor_path and :import_path match groups based on the packages "Dir" value
+      #
+      # If the package is not vendored, returns nil
       #
-      # path - Package path to test
-      # base - The base path that the input must start with
-      def vendored_path?(path, base)
-        return false if path.nil? || base.nil?
-        path.start_with?(base.to_s) && path.include?("vendor/")
+      # package - Package to get vendored path information for
+      def vendored_path_parts(package)
+        return if package.nil? || package["Dir"].nil?
+        package["Dir"].match(/^(?<vendor_path>#{config.root}(\/.+)*\/[^\/]*vendor[^\/]*)\/(?<import_path>.+)$/i)
       end
 
-      # Returns the path parameter without the vendor component if one is found
+      # Returns the non-vendored portion of the package import path if vendored,
+      # otherwise returns the package's import path as given
       #
-      # path - Package path with vendor component
-      # base - The base path that the input must start with
-      def non_vendored_path(path, base)
-        return unless path
-        return unless vendored_path?(path, base)
-        path.split("vendor/")[1]
+      # package - Package to get the non-vendored import path for
+      def non_vendored_import_path(package)
+        return if package.nil?
+        parts = vendored_path_parts(package)
+        return parts[:import_path] if parts
+
+        # if a package isn't vendored, return the packages "ImportPath"
+        package["ImportPath"]
       end
 
       # Returns a hash of information about the package with a given import path

data/lib/licensed/sources/yarn.rb

@@ -36,7 +36,7 @@ module Licensed
       def packages
         return [] if yarn_package_tree.nil?
         all_dependencies = {}
-        recursive_dependencies(config.pwd, yarn_package_tree).each do |name, results|
+        recursive_dependencies(yarn_package_tree).each do |name, results|
           results.uniq! { |package| package["version"] }
           if results.size == 1
             # if there is only one package for a name, reference it by name
@@ -55,26 +55,34 @@ module Licensed
 
       # Recursively parse dependency JSON data.  Returns a hash mapping the
       # package name to it's metadata
-      def recursive_dependencies(path, dependencies, result = {})
+      def recursive_dependencies(dependencies, result = {})
         dependencies.each do |dependency|
           # "shadow" indicate a dependency requirement only, not a
           # resolved package identifier
           next if dependency["shadow"]
           name, _, version = dependency["name"].rpartition("@")
 
-          # the dependency should be found under the parent's "node_modules" path
-          dependency_path = path.join("node_modules", name)
           (result[name] ||= []) << {
             "id" => dependency["name"],
             "name" => name,
             "version" => version,
-            "path" => dependency_path
+            "path" => dependency_paths[dependency["name"]]
           }
-          recursive_dependencies(dependency_path, dependency["children"], result)
+          recursive_dependencies(dependency["children"], result)
         end
         result
       end
 
+      # Returns a hash that maps all dependency names to their location on disk
+      # by parsing every package.json file under node_modules.
+      def dependency_paths
+        @dependency_paths ||= Dir.glob(config.pwd.join("node_modules/**/package.json")).each_with_object({}) do |file, hsh|
+          dirname = File.dirname(file)
+          json = JSON.parse(File.read(file))
+          hsh["#{json["name"]}@#{json["version"]}"] = dirname
+        end
+      end
+
       # Finds and returns the yarn package tree listing from `yarn list` output
       def yarn_package_tree
         return @yarn_package_tree if defined?(@yarn_package_tree)

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "2.14.1".freeze
+  VERSION = "2.14.2".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 2.14.1
+  version: 2.14.2
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-09 00:00:00.000000000 Z
+date: 2020-11-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee