licensure 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6759a51d14e8f88b4d718fb1368cf9e2593660e43863949d73bb929062be7c12
-  data.tar.gz: 396ad8b96f81968fffab0dce383b368632ae6c12f71c8055589c3b361b6a0fb8
+  metadata.gz: 5887811c86a3c1c6981aa5ec6c9b1efd5ac9b3752a93eb1d588c6d62acb9d704
+  data.tar.gz: 53baba973dcbc133f942fbf251b30bc380a745b473aa235bddd06cc929eb0098
 SHA512:
-  metadata.gz: 69a98b94fe4fe29946a48d8281ce993632db4be662e6cefb70cb5826d38807546a2dc8d4d1bf8598d63265ef4613b19b1797490b83efd84754d7a1a2a59f9a49
-  data.tar.gz: df348e79ddac7e9f8bb783a6743a0706b1fac62de1100268fceaa51b895c80813ebd730d0edb734be0905a95d4b88fdc0b666670baefbb6225664bccd0f831ee
+  metadata.gz: fd784c7b336d63fc34f34e229757877a8fd9efabc392dd66930da6241fbf7be4a2e19f450eaaed47f4930b4cc8dc9994fd1320c510cf83736de2650729d06dca
+  data.tar.gz: ebded542cf8af7901a0e59a4ab1c92e8f3a4e7531167a99022a7ce8c3a409208cd53617f225b630c2f36d3f0aba0bb565f23b793cfe03bba964595496ad5b778

data/README.md

@@ -56,10 +56,12 @@ ignored_gems:
 deny_unknown: true
 ```
 
-- `allowed_licenses`: Allowed license identifiers. Empty means allow all.
+- `allowed_licenses`: Allowed license identifiers. Empty means allow all. For gems with multiple licenses, all reported licenses must be included.
 - `ignored_gems`: Gem names excluded from checks.
 - `deny_unknown`: Treat gems without license metadata as warnings.
 
+When a gem reports non-SPDX license text and its `source_code_uri` or `homepage` points to GitHub, Licensure queries the GitHub repository license API and normalizes matched labels to `spdx_id` (for example, `Apache License, Version 2.0` -> `Apache-2.0`). Set `GITHUB_TOKEN` in CI to reduce API rate-limit risk.
+
 ## Commands
 
 ```bash

data/lib/licensure/license_checker.rb

@@ -34,12 +34,13 @@ module Licensure
           next
         end
 
-        if allowed_license?(info.licenses)
+        disallowed = disallowed_licenses(info.licenses)
+        if disallowed.empty?
           passed << info
           next
         end
 
-        reason = "License '#{info.licenses.join(", ")}' is not in the allowed list"
+        reason = "Licenses '#{disallowed.join(", ")}' are not in the allowed list"
         violations << Violation.new(gem_info: info, reason: reason)
       end
 
@@ -49,9 +50,9 @@ module Licensure
     private
 
     # @param licenses [Array<String>]
-    # @return [Boolean]
-    def allowed_license?(licenses)
-      licenses.any? { |license| @configuration.allowed_licenses.include?(license) }
+    # @return [Array<String>]
+    def disallowed_licenses(licenses)
+      licenses.reject { |license| @configuration.allowed_licenses.include?(license) }
     end
   end
 end

data/lib/licensure/license_fetcher.rb

@@ -7,6 +7,7 @@ module Licensure
   # Fetches gem license data from local gemspecs and RubyGems API.
   class LicenseFetcher
     RUBYGEMS_ENDPOINT = "https://rubygems.org/api/v1/gems".freeze
+    GITHUB_LICENSE_ENDPOINT = "https://api.github.com/repos".freeze
     REQUEST_TIMEOUT = 5
 
     # @param dependencies [Array<Hash{Symbol => String}>]
@@ -20,16 +21,32 @@ module Licensure
     # @return [Licensure::GemLicenseInfo]
     def fetch(name, version)
       local = fetch_from_gemspec(name)
-      return build_info(name, version, local[:licenses], :gemspec, local[:homepage]) if local
+      return build_info_from_payload(name, version, local, :gemspec) if local
 
       remote = fetch_from_api(name)
-      return build_info(name, version, remote[:licenses], :api, remote[:homepage]) if remote
+      return build_info_from_payload(name, version, remote, :api) if remote
 
       build_info(name, version, [], :unknown, nil)
     end
 
     private
 
+    # @param name [String]
+    # @param version [String]
+    # @param payload [Hash]
+    # @param source [Symbol]
+    # @return [Licensure::GemLicenseInfo]
+    def build_info_from_payload(name, version, payload, source)
+      licenses = normalize_with_github(
+        payload[:licenses],
+        payload[:source_code_uri],
+        payload[:homepage]
+      )
+      homepage = payload[:homepage] || payload[:source_code_uri]
+
+      build_info(name, version, licenses, source, homepage)
+    end
+
     # @param name [String]
     # @return [Hash, nil]
     def fetch_from_gemspec(name)
@@ -37,7 +54,11 @@ module Licensure
       licenses = normalize_licenses(spec.licenses, spec.license)
       return nil if licenses.empty?
 
-      { licenses: licenses, homepage: spec.homepage }
+      {
+        licenses: licenses,
+        homepage: spec.homepage,
+        source_code_uri: spec.metadata&.[]("source_code_uri")
+      }
     rescue Gem::LoadError
       nil
     end
@@ -56,7 +77,11 @@ module Licensure
       licenses = normalize_licenses(payload["licenses"], payload["license"])
       return nil if licenses.empty?
 
-      { licenses: licenses, homepage: payload["homepage_uri"] || payload["homepage"] }
+      {
+        licenses: licenses,
+        homepage: payload["homepage_uri"] || payload["homepage"],
+        source_code_uri: payload["source_code_uri"]
+      }
     rescue JSON::ParserError, StandardError
       nil
     end
@@ -85,6 +110,109 @@ module Licensure
            .uniq
     end
 
+    # @param licenses [Array<String>]
+    # @param source_code_uri [String, nil]
+    # @param homepage [String, nil]
+    # @return [Array<String>]
+    def normalize_with_github(licenses, source_code_uri, homepage)
+      return licenses if licenses.empty?
+      return licenses unless github_normalization_needed?(licenses)
+
+      repository = github_repository(source_code_uri || homepage)
+      return licenses unless repository
+
+      github_license = fetch_github_license(repository[:owner], repository[:repo])
+      return licenses unless github_license
+
+      canonicalize_licenses(
+        licenses,
+        github_license[:spdx_id],
+        github_license[:name],
+        github_license[:key]
+      )
+    end
+
+    # @param licenses [Array<String>]
+    # @return [Boolean]
+    def github_normalization_needed?(licenses)
+      licenses.any? { |license| license.match?(/\s|,|\blicense\b|\bversion\b/i) }
+    end
+
+    # @param url [String, nil]
+    # @return [Hash{Symbol => String}, nil]
+    def github_repository(url)
+      return nil if url.to_s.strip.empty?
+
+      uri = URI(url)
+      host = uri.host.to_s.downcase
+      return nil unless %w[github.com www.github.com].include?(host)
+
+      segments = uri.path.to_s.split("/").reject(&:empty?)
+      return nil if segments.size < 2
+
+      owner = segments[0]
+      repo = segments[1].sub(/\.git\z/, "")
+      return nil if owner.empty? || repo.empty?
+
+      { owner: owner, repo: repo }
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # @param owner [String]
+    # @param repo [String]
+    # @return [Hash{Symbol => String}, nil]
+    def fetch_github_license(owner, repo)
+      uri = URI("#{GITHUB_LICENSE_ENDPOINT}/#{owner}/#{repo}/license")
+      request = Net::HTTP::Get.new(uri)
+      request["Accept"] = "application/vnd.github+json"
+      request["X-GitHub-Api-Version"] = "2022-11-28"
+      request["User-Agent"] = "Licensure/#{Licensure::VERSION}"
+
+      token = ENV["GITHUB_TOKEN"]
+      request["Authorization"] = "Bearer #{token}" unless token.to_s.empty?
+
+      response = http_client_for(uri).request(request)
+      return nil unless response.is_a?(Net::HTTPSuccess)
+
+      payload = JSON.parse(response.body)
+      license = payload["license"]
+      return nil unless license.is_a?(Hash)
+
+      spdx_id = license["spdx_id"].to_s.strip
+      return nil if spdx_id.empty? || spdx_id == "NOASSERTION"
+
+      { spdx_id: spdx_id, name: license["name"], key: license["key"] }
+    rescue JSON::ParserError, StandardError
+      nil
+    end
+
+    # @param licenses [Array<String>]
+    # @param spdx_id [String]
+    # @param name [String, nil]
+    # @param key [String, nil]
+    # @return [Array<String>]
+    def canonicalize_licenses(licenses, spdx_id, name, key)
+      fingerprints = [spdx_id, name, key].filter_map { |value| license_fingerprint(value) }.uniq
+      return licenses if fingerprints.empty?
+
+      licenses.map do |license|
+        fingerprint = license_fingerprint(license)
+        fingerprints.include?(fingerprint) ? spdx_id : license
+      end.uniq
+    end
+
+    # @param value [String, nil]
+    # @return [String, nil]
+    def license_fingerprint(value)
+      fingerprint = value.to_s.downcase
+                         .gsub(/\b(the|license|version)\b/, "")
+                         .gsub(/[^a-z0-9]/, "")
+      return nil if fingerprint.empty?
+
+      fingerprint
+    end
+
     # @param name [String]
     # @param version [String]
     # @param licenses [Array<String>]

data/lib/licensure/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Licensure
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: licensure
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Yudai Takada