licensee 10.0.0 → 10.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbe5733519ac70cb6abdf04a94a91e0561b4733ecfaf1be5a2f3358b7178f146
-  data.tar.gz: 2dcdc288201a43e20bada85d4019937002c97325c28d3620876a0e4eebefbe92
+  metadata.gz: 7cb258a437a638b51ce88253da3fdc5e9024bbcc4ca39ad85a7d9082e5affc9c
+  data.tar.gz: b565687716e0006143184d8b05aef9f01af3c6a69fe76314d98cb83814350274
 SHA512:
-  metadata.gz: e836c91d216d21da1428e063b6eee658b18ed05c4722c54b4cd427eafed96acd0af0f3096f503e344b63bb08ff73a7a8fe6ee879aec6be0b231905554531c31e
-  data.tar.gz: '08feed6876192a2088d7e2dba10b6176834f6d6cfb930afdb394c15ea51517c75637db1f5ee1f3dda6bb020288a9e69ecf7767d51267f3c13d8b1fcb46128eb4'
+  metadata.gz: 7c91eb05607ecee1a7d87b968c78078443ba1a961e59d5b9811aab1cfb311671becf52223a82a8f63e7b17874f1f0152e0978c63e0af13b8bdf8bd80a2eb3d85
+  data.tar.gz: 06b6501dbd438cb2a218cec4d879c2f8d838642c7fff10753df4f3ac908c84062a1ae47df76750868aade6634e3deb8a1fca50f8027772b11bc33bcd2d64fa93

data/lib/licensee/commands/detect.rb

@@ -15,13 +15,80 @@ class LicenseeCLI < Thor
   option :diff, type: :boolean, desc: 'Compare the license to the closest match'
   option :ref, type: :string, desc: 'The name of the commit/branch/tag to search (github.com only)'
   option :filesystem, type: :boolean, desc: 'Force looking at the filesystem (ignore git data)'
+  option :recursive, type: :boolean, desc: 'Recursively detect licenses in subdirectories'
+  option :depth, type: :numeric, default: 3, desc: 'Maximum directory depth for --recursive'
   def detect(_path = nil)
     Licensee.confidence_threshold = options[:confidence]
 
-    handle_json_output if options[:json]
+    if options[:recursive]
+      handle_recursive_detect
+    else
+      handle_json_output if options[:json]
+      print_project_summary
+      print_matched_files
+      maybe_diff_license_file
+    end
+  end
+
+  private
+
+  def handle_recursive_detect
+    root = File.expand_path(path || Dir.pwd)
+    results = collect_recursive_results(root, root, options[:depth])
+    output_recursive_results(results)
+    exit(results.any? { |r| !r[:project].licenses.empty? })
+  end
+
+  def output_recursive_results(results)
+    if options[:json]
+      say results.map { |r| r[:project].to_h.merge(path: r[:path]) }.to_json
+    else
+      print_recursive_results(results)
+    end
+  end
+
+  def collect_recursive_results(root, current, remaining_depth)
+    results = []
+    add_recursive_project(root, current, results)
+    return results if remaining_depth <= 0
+
+    subdirectories(current).each do |full_path|
+      results.concat(collect_recursive_results(root, full_path, remaining_depth - 1))
+    end
+    results
+  end
+
+  def subdirectories(path)
+    Dir.children(path).sort.filter_map do |entry|
+      full_path = File.join(path, entry)
+      full_path if File.directory?(full_path)
+    end
+  rescue StandardError
+    []
+  end
+
+  def add_recursive_project(root, full_path, results)
+    proj = Licensee.project(full_path,
+                            detect_packages: options[:packages],
+                            detect_readme:   options[:readme])
+    return if proj.licenses.empty?
+
+    rel = Pathname.new(full_path).relative_path_from(Pathname.new(root)).to_s
+    rel = '.' if rel == ''
+    results << { path: rel, project: proj }
+  end
+
+  def print_recursive_results(results)
+    if results.empty?
+      say 'No licenses detected.'
+      return
+    end
 
-    print_project_summary
-    print_matched_files
-    maybe_diff_license_file
+    results.each do |result|
+      proj = result[:project]
+      license_ids = proj.licenses.map(&:spdx_id).join(', ')
+      matched_files = proj.matched_files.map(&:path).join(', ')
+      say "#{result[:path]} (#{matched_files}): #{license_ids}"
+    end
   end
 end

data/lib/licensee/commands/diff.rb

@@ -6,11 +6,12 @@ require 'tmpdir'
 class LicenseeCLI < Thor
   desc 'diff [PATH]', 'Compare the given license text to a known license'
   option :license, type: :string, desc: 'The SPDX ID or key of the license to compare'
+  option :line_diff, type: :boolean, desc: 'Use line-based diff instead of word-based diff'
   def diff(_path = nil)
     say "Comparing to #{expected_license.name}:"
     print_table diff_summary_rows
     exit_on_exact_match
-    say word_diff
+    say diff_output
   end
 
   private
@@ -43,13 +44,15 @@ class LicenseeCLI < Thor
     @input_text ||= license_to_diff.content_normalized(wrap: 80)
   end
 
-  def word_diff
-    Dir.mktmpdir { |dir| word_diff_in_dir(dir) }
+  def diff_output
+    Dir.mktmpdir { |dir| diff_output_in_dir(dir) }
   end
 
-  def word_diff_in_dir(dir)
+  def diff_output_in_dir(dir)
     path = File.expand_path 'LICENSE', dir
-    Dir.chdir(dir) { git_word_diff(path) }
+    Dir.chdir(dir) do
+      options[:line_diff] ? git_line_diff(path) : git_word_diff(path)
+    end
   end
 
   def git_word_diff(path)
@@ -61,6 +64,15 @@ class LicenseeCLI < Thor
     `git diff --word-diff`
   end
 
+  def git_line_diff(path)
+    `git init`
+    File.write(path, expected_text)
+    `git add LICENSE`
+    `git commit -m 'left'`
+    File.write(path, input_text)
+    `git diff`
+  end
+
   def license_to_diff
     return options[:license_to_diff] if options[:license_to_diff]
     return project.license_file if remote? || ($stdin.tty? && project.license_file)

data/lib/licensee/license_meta.rb

@@ -54,9 +54,14 @@ module Licensee
       alias_method :"#{field}?", field
     end
 
-    # Backward compatibalize `#["spdx-id"]` calls to avoid a breaking change
+    # Backward compatibility: `#["spdx-id"]` calls to avoid a breaking change.
+    # Also ensure computed fields (e.g. "source") route through the instance
+    # method rather than reading the raw nil struct field, keeping hash-style
+    # and method-style access consistent.
     def [](key)
       key = 'spdx_id' if key == 'spdx-id'
+      return source if key.to_s == 'source'
+
       super
     end
 

data/lib/licensee/matchers/package.rb

@@ -8,6 +8,12 @@ module Licensee
       # license entry in the database (e.g. LGPL-3.0-or-later → lgpl-3.0).
       SPDX_SUFFIX_REGEX = /-or-later\z|-only\z/i
 
+      # Regex matching individual SPDX expression tokens (license IDs or operators).
+      SPDX_TOKEN_REGEX = /[A-Za-z0-9.\-+]+/
+
+      # SPDX boolean operators to skip when parsing compound expressions.
+      SPDX_OPERATORS = %w[OR AND WITH].freeze
+
       def match
         return @match if defined? @match
 
@@ -24,12 +30,44 @@ module Licensee
         90
       end
 
+      # Returns all licenses found in a compound SPDX expression such as
+      # "MIT OR Apache-2.0". Unknown identifiers resolve to the 'other'
+      # (NOASSERTION) license. Returns nil when the property is absent or
+      # contains only a single token (plain license key).
+      def spdx_expression_licenses
+        return @spdx_expression_licenses if defined? @spdx_expression_licenses
+
+        @spdx_expression_licenses = resolve_spdx_expression_licenses
+      end
+
       def license_property
         raise NotImplementedError, "#{self.class}#license_property is not implemented"
       end
 
       private
 
+      def find_license_for_token(token, licenses)
+        key = token.downcase
+        licenses.find { |l| l.key == key } ||
+          match_by_spdx_base_key(key, licenses)
+      end
+
+      def spdx_expression_tokens(prop)
+        prop.scan(SPDX_TOKEN_REGEX).reject { |t| SPDX_OPERATORS.include?(t.upcase) }
+      end
+
+      def resolve_spdx_expression_licenses
+        prop = license_property
+        return nil if prop.nil? || prop.to_s.empty?
+
+        tokens = spdx_expression_tokens(prop)
+        return nil if tokens.size <= 1
+
+        licenses = Licensee.licenses(hidden: true)
+        other = License.find('other')
+        tokens.map { |t| find_license_for_token(t, licenses) || other }
+      end
+
       def match_by_spdx_base_key(prop, licenses)
         base = prop.sub(SPDX_SUFFIX_REGEX, '')
         return if base == prop

data/lib/licensee/matchers/pyproject.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+module Licensee
+  module Matchers
+    # Matches license identifiers in pyproject.toml.
+    # Based on Matchers::Cargo
+    class PyProject < Licensee::Matchers::Package
+      LICENSE_REGEX = /^\s*['"]?license['"]?\s*=\s*['"]([^'"]+)['"]\s*/ix
+
+      private
+
+      def license_property
+        match = @file.content.match LICENSE_REGEX
+        match[1].downcase if match && match[1]
+      end
+    end
+  end
+end

data/lib/licensee/matchers.rb

@@ -15,6 +15,7 @@ module Licensee
     autoload :NpmBower,  'licensee/matchers/npm_bower'
     autoload :NuGet,     'licensee/matchers/nuget'
     autoload :Package,   'licensee/matchers/package'
+    autoload :PyProject, 'licensee/matchers/pyproject'
     autoload :Reference, 'licensee/matchers/reference'
     autoload :Spdx,      'licensee/matchers/spdx'
   end

data/lib/licensee/project_files/package_manager_file.rb

@@ -14,16 +14,18 @@ module Licensee
 
       # Hash of Filename => [possible matchers]
       FILENAMES_EXTENSIONS = {
-        'DESCRIPTION'  => [Matchers::Cran],
-        'dist.ini'     => [Matchers::DistZilla],
-        'LICENSE.spdx' => [Matchers::Spdx],
-        'Cargo.toml'   => [Matchers::Cargo]
+        'DESCRIPTION'    => [Matchers::Cran],
+        'dist.ini'       => [Matchers::DistZilla],
+        'LICENSE.spdx'   => [Matchers::Spdx],
+        'Cargo.toml'     => [Matchers::Cargo],
+        'pyproject.toml' => [Matchers::PyProject]
       }.freeze
 
       FILENAMES_SCORES = {
         'package.json'     => 1.0,
         'LICENSE.spdx'     => 1.0,
         'Cargo.toml'       => 1.0,
+        'pyproject.toml'   => 1.0,
         'DESCRIPTION'      => 0.9,
         'dist.ini'         => 0.8,
         'bower.json'       => 0.75,

data/lib/licensee/projects/git_project.rb

@@ -8,12 +8,6 @@
 #  :name - the file's path relative to the repo root
 #  :oid  - the file's OID
 
-begin
-  require 'rugged'
-rescue LoadError
-  # rugged is optional; GitProject will raise RuggedNotAvailable when not installed
-end
-
 module Licensee
   module Projects
     # Scans a Git repository (via Rugged) for license-related files.
@@ -24,7 +18,12 @@ module Licensee
       class RuggedNotAvailable < InvalidRepository; end
 
       def self.available?
-        !!defined?(Rugged)
+        return true if defined?(Rugged)
+
+        require 'rugged'
+        true
+      rescue LoadError
+        false
       end
 
       def initialize(repo, revision: nil, **args)

data/lib/licensee/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Licensee
-  VERSION = '10.0.0'
+  VERSION = '10.1.0'
 end

data/spec/fixtures/detect.json

@@ -93,7 +93,7 @@
     },
     {
       "filename": "licensee.gemspec",
-      "content": "# frozen_string_literal: true\n\nrequire File.expand_path('lib/licensee/version', __dir__)\n\nGem::Specification.new do |gem|\n  gem.name    = 'licensee'\n  gem.version = Licensee::VERSION\n\n  gem.summary = 'A Ruby Gem to detect open source project licenses'\n  gem.description = <<-DESC\n    Licensee automates the process of reading LICENSE files and\n    compares their contents to known licenses using a fancy maths.\n  DESC\n\n  gem.authors  = ['Ben Balter']\n  gem.email    = 'ben.balter@github.com'\n  gem.homepage = 'https://github.com/licensee/licensee'\n  gem.license  = 'MIT'\n  gem.metadata['rubygems_mfa_required'] = 'true'\n\n  gem.bindir = 'bin'\n  gem.executables << 'licensee'\n\n  gem.add_dependency('dotenv', '>= 2', '< 4')\n  gem.add_dependency('octokit', '>= 4.20', '< 11.0')\n  gem.add_dependency('reverse_markdown', '>= 1', '< 4')\n  gem.add_dependency('rugged', '>= 0.24', '<2.0')\n  gem.add_dependency('thor', '>= 0.19', '< 2.0')\n\n  gem.add_development_dependency('gem-release', '~> 2.0')\n  gem.add_development_dependency('mustache', '>= 0.9', '< 2.0')\n  gem.add_development_dependency('pry', '~> 0.9')\n  gem.add_development_dependency('rspec', '~> 3.5')\n  gem.add_development_dependency('rubocop', '~> 1.0')\n  gem.add_development_dependency('rubocop-performance', '~> 1.5')\n  gem.add_development_dependency('rubocop-rspec', '~> 3.0')\n  gem.add_development_dependency('simplecov', '~> 0.16')\n  gem.add_development_dependency('webmock', '~> 3.1')\n\n  gem.required_ruby_version = '>= 3.2'\n\n  # ensure the gem is built out of versioned files\n  gem.files = Dir[\n    '{bin,lib,man,test,vendor,spec}/**/*',\n    'README*', 'LICENSE*'\n  ] & `git ls-files -z`.split(\"\\0\")\nend\n",
+      "content": "# frozen_string_literal: true\n\nrequire File.expand_path('lib/licensee/version', __dir__)\n\nGem::Specification.new do |gem|\n  gem.name    = 'licensee'\n  gem.version = Licensee::VERSION\n\n  gem.summary = 'A Ruby Gem to detect open source project licenses'\n  gem.description = <<-DESC\n    Licensee automates the process of reading LICENSE files and\n    compares their contents to known licenses using a fancy maths.\n  DESC\n\n  gem.authors  = ['Ben Balter']\n  gem.email    = 'ben.balter@github.com'\n  gem.homepage = 'https://github.com/licensee/licensee'\n  gem.license  = 'MIT'\n  gem.metadata['rubygems_mfa_required'] = 'true'\n  gem.post_install_message = <<~MSG\n    NOTE: The rugged gem is no longer a required dependency of licensee.\n    If you scan bare Git repositories or Git repos without a working tree,\n    add rugged to your Gemfile or run: gem install rugged\n  MSG\n\n  gem.bindir = 'bin'\n  gem.executables << 'licensee'\n\n  gem.add_dependency('dotenv', '>= 2', '< 4')\n  gem.add_dependency('octokit', '>= 4.20', '< 11.0')\n  gem.add_dependency('reverse_markdown', '>= 1', '< 4')\n  gem.add_dependency('thor', '>= 0.19', '< 2.0')\n\n  gem.add_development_dependency('gem-release', '~> 2.0')\n  gem.add_development_dependency('mustache', '>= 0.9', '< 2.0')\n  gem.add_development_dependency('pry', '~> 0.9')\n  gem.add_development_dependency('rspec', '~> 3.5')\n  gem.add_development_dependency('rubocop', '~> 1.0')\n  gem.add_development_dependency('rubocop-performance', '~> 1.5')\n  gem.add_development_dependency('rubocop-rspec', '~> 3.0')\n  gem.add_development_dependency('rugged', '>= 0.24', '<2.0')\n  gem.add_development_dependency('simplecov', '~> 1.0')\n  gem.add_development_dependency('webmock', '~> 3.1')\n\n  gem.required_ruby_version = '>= 3.2'\n\n  # ensure the gem is built out of versioned files\n  gem.files = Dir[\n    '{bin,lib,man,test,vendor,spec}/**/*',\n    'README*', 'LICENSE*'\n  ] & `git ls-files -z`.split(\"\\0\")\nend\n",
       "content_hash": null,
       "content_normalized": null,
       "matcher": {

data/spec/integration_spec.rb

@@ -368,6 +368,14 @@ RSpec.describe Integration do
           expect(project).to have_attributes(license: license, package_file: have_attributes(path: 'package.json'))
         end
 
+        it 'matches a pyproject.toml file' do
+          write_file.call('pyproject.toml', "[project]\nlicense = \"MIT\"")
+          project = project_type.new(project_path, detect_packages: true)
+
+          license = Licensee::License.find('mit')
+          expect(project).to have_attributes(license: license, package_file: have_attributes(path: 'pyproject.toml'))
+        end
+
         it 'matches a README file' do
           write_file.call('README', "## License\n#{Licensee::License.find('mit').content}")
           project = project_type.new(project_path, detect_readme: true)

data/spec/licensee/commands/detect_spec.rb

@@ -176,4 +176,94 @@ RSpec.describe Licensee::Commands::Detect do
       expect(output[1]).to include('Unsupported remote URL')
     end
   end
+
+  context 'when using --recursive' do
+    let(:fixtures_path) { File.expand_path('../../fixtures', __dir__) }
+
+    context 'when scanning a directory with licensed subdirectories' do
+      let(:arguments) { ['--recursive', fixtures_path] }
+
+      it 'returns a zero exit code' do
+        expect(status.exitstatus).to be(0)
+      end
+
+      it 'outputs at least one result' do
+        expect(stdout).not_to be_empty
+      end
+
+      it 'outputs lines in path (file): LICENSE format' do
+        expect(stdout.lines).to all(match(/\S+ \(.+\): \S+/))
+      end
+    end
+
+    context 'when scanning an empty directory' do
+      let(:arguments) { ['--recursive', tmpdir] }
+
+      after { FileUtils.rm_rf(tmpdir) }
+
+      def tmpdir
+        @tmpdir ||= Dir.mktmpdir
+      end
+
+      it 'returns a non-zero exit code' do
+        expect(status.exitstatus).to be(1)
+      end
+
+      it 'says no licenses detected' do
+        expect(stdout).to include('No licenses detected')
+      end
+    end
+
+    context 'when PATH itself has a license' do
+      let(:arguments) { ['--recursive', File.join(fixtures_path, 'mit')] }
+
+      it 'includes the root directory in output' do
+        expect(stdout).to include('.')
+      end
+
+      it 'returns zero exit code' do
+        expect(status.exitstatus).to be(0)
+      end
+    end
+
+    context 'when using --json' do
+      let(:arguments) { ['--recursive', '--json', fixtures_path] }
+
+      it 'returns valid JSON array' do
+        parsed = JSON.parse(stdout)
+        expect(parsed).to be_an(Array)
+      end
+
+      it 'includes path keys in each result' do
+        parsed = JSON.parse(stdout)
+        expect(parsed.all? { |r| r.key?('path') }).to be true
+      end
+    end
+
+    context 'when using --depth' do
+      after { FileUtils.rm_rf(shallow_path) }
+
+      def shallow_path
+        @shallow_path ||= begin
+          dir = Dir.mktmpdir
+          subdir = File.join(dir, 'deep', 'nested', 'project')
+          FileUtils.mkdir_p(subdir)
+          FileUtils.cp(File.join(fixtures_path, 'mit', 'LICENSE.txt'), subdir)
+          dir
+        end
+      end
+
+      it 'with depth 1 does not find deeply nested licenses' do
+        _, _, s = Open3.capture3(*[command, '--recursive', '--depth', '1', shallow_path].flatten,
+                                 chdir: project_root)
+        expect(s.exitstatus).to be(1)
+      end
+
+      it 'with depth 3 finds the nested license' do
+        out, = Open3.capture3(*[command, '--recursive', '--depth', '3', shallow_path].flatten,
+                              chdir: project_root)
+        expect(out).to include('MIT')
+      end
+    end
+  end
 end

data/spec/licensee/commands/diff_spec.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Licensee
+  module Commands
+    module Diff
+    end
+  end
+end
+
+RSpec.describe Licensee::Commands::Diff do
+  let(:mit_fixture_path) { fixture_path('mit_markdown') }
+  let(:license_file)     { File.join(mit_fixture_path, 'LICENSE.md') }
+
+  def run_diff(*extra_args)
+    Dir.chdir project_root do
+      Open3.capture3(
+        'bundle', 'exec', 'bin/licensee', 'diff', license_file,
+        '--license=mit', *extra_args
+      )
+    end
+  end
+
+  def stdout(args = []) = run_diff(*args)[0]
+  def status(args = []) = run_diff(*args)[2]
+
+  context 'with default (word diff)' do
+    it 'returns a zero exit code for an exact match' do
+      _out, _err, s = run_diff
+      expect(s.exitstatus).to be(0)
+    end
+
+    it 'outputs similarity information' do
+      expect(stdout).to match(/Similarity/i)
+    end
+  end
+
+  context 'with --line-diff' do
+    it 'returns a zero exit code for an exact match' do
+      _out, _err, s = run_diff('--line-diff')
+      expect(s.exitstatus).to be(0)
+    end
+
+    it 'outputs similarity information' do
+      expect(stdout(['--line-diff'])).to match(/Similarity/i)
+    end
+  end
+end

data/spec/licensee/commands/version_spec.rb

@@ -15,6 +15,7 @@ RSpec.describe Licensee::Commands::Version do
   end
 
   def stdout = output[0]
+  def stderr = output[1]
   def status = output[2]
 
   it 'returns the version' do
@@ -24,4 +25,8 @@ RSpec.describe Licensee::Commands::Version do
   it 'Returns a zero exit code' do
     expect(status.exitstatus).to be(0)
   end
+
+  it 'does not output warnings to stderr' do
+    expect(stderr).to eq('')
+  end
 end

data/spec/licensee/license_meta_spec.rb

@@ -68,6 +68,20 @@ RSpec.describe Licensee::LicenseMeta do
     end
   end
 
+  context 'when accessing the computed "source" field via #[]' do
+    it 'returns the SPDX URL when spdx_id is set' do
+      expect(meta['source']).to eql('https://spdx.org/licenses/MIT.html')
+    end
+
+    it 'is consistent with the #source method' do
+      expect(meta['source']).to eql(meta.source)
+    end
+
+    it 'is consistent with to_h' do
+      expect(meta['source']).to eql(meta.to_h[:source])
+    end
+  end
+
   describe '#from_yaml' do
     subject(:license_meta) { described_class.from_yaml(yaml) }
 

data/spec/licensee/matchers/package_matcher_spec.rb

@@ -73,4 +73,83 @@ RSpec.describe Licensee::Matchers::Package do
       expect { base_matcher.send(:license_property) }.to raise_error(NotImplementedError, /Package#license_property/)
     end
   end
+
+  describe '#spdx_expression_licenses' do
+    context 'with a plain single license key' do
+      let(:license_property) { 'mit' }
+
+      it 'returns nil (not a compound expression)' do
+        expect(matcher.spdx_expression_licenses).to be_nil
+      end
+    end
+
+    context 'with a nil license property' do
+      let(:license_property) { nil }
+
+      it 'returns nil' do
+        expect(matcher.spdx_expression_licenses).to be_nil
+      end
+    end
+
+    context 'with an "MIT OR Apache-2.0" expression' do
+      let(:license_property) { 'MIT OR Apache-2.0' }
+
+      it 'does not include the OR operator as a license' do
+        expect(matcher.spdx_expression_licenses.size).to eq(2)
+      end
+
+      it 'includes MIT' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('mit'))
+      end
+
+      it 'includes Apache-2.0' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('apache-2.0'))
+      end
+    end
+
+    context 'with an "MIT AND Apache-2.0" expression' do
+      let(:license_property) { 'MIT AND Apache-2.0' }
+
+      it 'includes MIT' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('mit'))
+      end
+
+      it 'includes Apache-2.0' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('apache-2.0'))
+      end
+    end
+
+    context 'with a compound expression containing an unknown identifier' do
+      let(:license_property) { 'UnknownFoo OR MIT' }
+
+      it 'returns other for the unknown identifier' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('other'))
+      end
+
+      it 'returns MIT for the known identifier' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('mit'))
+      end
+    end
+
+    context 'with a compound expression where all identifiers are unknown' do
+      let(:license_property) { 'UnknownFoo OR AnotherUnknown' }
+
+      it 'returns other for all tokens' do
+        result = matcher.spdx_expression_licenses
+        expect(result).to all(eq(Licensee::License.find('other')))
+      end
+    end
+
+    context 'with -or-later suffix tokens in compound expression' do
+      let(:license_property) { 'LGPL-2.1-or-later OR GPL-3.0-or-later' }
+
+      it 'strips -or-later and returns LGPL-2.1' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('lgpl-2.1'))
+      end
+
+      it 'strips -or-later and returns GPL-3.0' do
+        expect(matcher.spdx_expression_licenses).to include(Licensee::License.find('gpl-3.0'))
+      end
+    end
+  end
 end

data/spec/licensee_spec.rb

@@ -45,6 +45,14 @@ RSpec.describe Licensee do
         expect { project }.to raise_error(ArgumentError, /Unsupported remote URL/)
       end
     end
+
+    context 'when rugged is not available' do
+      before { allow(Licensee::Projects::GitProject).to receive(:available?).and_return(false) }
+
+      it 'falls back to FSProject' do
+        expect(project).to be_a(Licensee::Projects::FSProject)
+      end
+    end
   end
 
   context 'when using the confidence threshold' do

data/spec/script_vendor_licenses_spec.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+# rubocop:disable RSpec/DescribeClass
+RSpec.describe 'script/vendor-licenses' do
+  let(:script_path) { File.expand_path('script/vendor-licenses', project_root) }
+  let(:vendor_data_dir) { File.expand_path('vendor/choosealicense.com/_data', project_root) }
+  let(:vendor_licenses_dir) { File.expand_path('vendor/choosealicense.com/_licenses', project_root) }
+
+  it 'passes a POSIX sh syntax check' do
+    _, stderr, status = Open3.capture3('sh', '-n', script_path)
+    expect(status.exitstatus).to be(0), "sh -n failed: #{stderr}"
+  end
+
+  it 'does not contain Bash-specific syntax' do
+    content = File.read(script_path)
+    expect(content).not_to include('[[')
+  end
+
+  it 'uses --no-wildcards-match-slash for GNU tar' do
+    content = File.read(script_path)
+    expect(content).to include('--no-wildcards-match-slash')
+  end
+
+  it 'does not vendor nested _data/i18n files' do
+    nested = Dir["#{vendor_data_dir}/i18n/**/*.yml"]
+    expect(nested).to be_empty, "Unexpected nested i18n files found: #{nested.join(', ')}"
+  end
+
+  it 'vendors top-level _data YAML files' do
+    top_level = Dir["#{vendor_data_dir}/*.yml"]
+    expect(top_level).not_to be_empty
+  end
+
+  it 'vendors _licenses files' do
+    expect(Dir["#{vendor_licenses_dir}/*"]).not_to be_empty
+  end
+end
+# rubocop:enable RSpec/DescribeClass

data/vendor/choosealicense.com/_licenses/cc0-1.0.txt

@@ -12,7 +12,7 @@ note: Creative Commons recommends taking the additional step of adding a boilerp
 
 using:
   Awesome: https://github.com/sindresorhus/awesome/blob/main/license
-  Shields.io: https://github.com/badges/shields/blob/master/LICENSE
+  just: https://github.com/casey/just/blob/master/LICENSE
   psdash: https://github.com/Jahaja/psdash/blob/master/LICENSE
 
 permissions:

data/vendor/choosealicense.com/_licenses/gfdl-1.3.txt

@@ -10,8 +10,8 @@ how: Create a text file (typically named COPYING, as per GNU conventions) in the
 note: The Free Software Foundation recommends taking the additional step of adding a boilerplate notice after the title of a licensed document. The boilerplate can be found at the "addendum" part of the license.
 
 using:
-  GNU LilyPond (Documentation): https://git.savannah.gnu.org/cgit/lilypond.git/tree/COPYING.FDL
-  GNU Scientific Library (Documentation): https://git.savannah.gnu.org/cgit/gsl.git/tree/doc/_static/fdl.txt
+  Mastodon (Documentation): https://github.com/mastodon/documentation/blob/main/LICENSE
+  Regular Expression Museum: https://github.com/thaliaarchi/regexp-museum/blob/main/LICENSE
   Qt (Documentation): https://code.qt.io/cgit/qt/qt.git/tree/LICENSE.FDL
   
 permissions:

data/vendor/choosealicense.com/_licenses/gpl-3.0.txt

@@ -14,7 +14,7 @@ note: The Free Software Foundation recommends taking the additional step of addi
 
 using:
   Ansible: https://github.com/ansible/ansible/blob/devel/COPYING
-  Bash: https://git.savannah.gnu.org/cgit/bash.git/tree/COPYING
+  Niri: https://github.com/niri-wm/niri/blob/main/LICENSE
   uBlock Origin: https://github.com/gorhill/uBlock/blob/master/LICENSE.txt
 
 permissions:

data/vendor/license-list-XML/src/EUPL-1.2.xml

@@ -9,6 +9,7 @@
       <crossRef>https://joinup.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt</crossRef>
       <crossRef>http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32017D0863</crossRef>
       <crossRef>https://opensource.org/license/EUPL-1.2</crossRef>
+      <crossRef>https://interoperable-europe.ec.europa.eu/sites/default/files/inline-files/EUPL%20v1_2%20EN(1).txt</crossRef>
     </crossRefs>
     <notes>
       This license was released: 19 May 2016. This license is available in the

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: licensee
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 10.1.0
 platform: ruby
 authors:
 - Ben Balter
 bindir: bin
 cert_chain: []
-date: 2026-05-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dotenv
@@ -219,14 +219,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.16'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -283,6 +283,7 @@ files:
 - lib/licensee/matchers/npm_bower.rb
 - lib/licensee/matchers/nuget.rb
 - lib/licensee/matchers/package.rb
+- lib/licensee/matchers/pyproject.rb
 - lib/licensee/matchers/reference.rb
 - lib/licensee/matchers/spdx.rb
 - lib/licensee/project_files.rb
@@ -383,6 +384,7 @@ files:
 - spec/fixtures/wrk-modified-apache/LICENSE
 - spec/integration_spec.rb
 - spec/licensee/commands/detect_spec.rb
+- spec/licensee/commands/diff_spec.rb
 - spec/licensee/commands/license_path_spec.rb
 - spec/licensee/commands/version_spec.rb
 - spec/licensee/content_helper_spec.rb
@@ -416,6 +418,7 @@ files:
 - spec/licensee/projects/project_spec.rb
 - spec/licensee/rule_spec.rb
 - spec/licensee_spec.rb
+- spec/script_vendor_licenses_spec.rb
 - spec/spec_helper.rb
 - spec/vendored_license_spec.rb
 - vendor/choosealicense.com/_data/fields.yml
@@ -538,7 +541,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A Ruby Gem to detect open source project licenses
 test_files: []