spandx 0.17.0 → 0.18.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d884c729b0d1cb14391435f68b78a77cfb2a73860b8757d4421bda9ff06276bd
-  data.tar.gz: 2fe44244d7285b7fc5bd9ddf8660b2bd4b435d8908b6c5e67d305181e6356658
+  metadata.gz: 81626f66bcff1fbe9a38a489f72e0f00bbd355f91ed43582e563a04089016e83
+  data.tar.gz: b5ed156f7c0b5f9972d2e8e564dd37666f1fa8acf5c26ae4192db2a4d6d68c2e
 SHA512:
-  metadata.gz: a6f25542efd0f506dbe65f5dbd179d562fbb37fd9498cffc1cee2ac8a0bfdfabab614269920aa2799736a198529408300277c2d87c7303f3463bd37e0ff67ee8
-  data.tar.gz: ebe7266727203ec7a84e741e2dfa5fa76db8a9da30dbfbb258618adbda6e7463a04174fd0c706c23c65068857f06584eef2fcdd25e05fe1ad0ebf5dbd9489c06
+  metadata.gz: e81245600853fa6677deedd50ece29463a50736c44cb4503391e8777b31f3493c4d9405cc33bde47538d2f991befea153abdefe0b9cfe04954f0c73277c70005
+  data.tar.gz: 190c97f3ab8e9431a5ca52ffd4dfb524f6438997a8912288c8abd821e220dfbda149fe1107f0f63b6e8e5bff6258a312800654764073e1c929182175bc89a27c

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 0.17.0
+Version 0.18.3
 
 # Changelog
 
@@ -8,6 +8,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [0.18.3] - 2021-12-15
+- fix(spdx): fallback to online catalogue when local catalogue is not available.
+
+## [0.18.2] - 2021-06-05
+### Fixed
+- fix(dpkg): detect package manager for related dependencies
+- fix(terraform): detect package manager for related dependencies
+
+## [0.18.1] - 2021-06-02
+### Fixed
+- Parse `.terraform.lock.hcl` files with multiple providers.
+
+## [0.18.0] - 2021-05-10
+### Added
+- Add support for parsing `.terraform.lock.hcl` files.
+
 ## [0.17.0] - 2020-12-28
 ### Added
 - Allow indexing gems from index.rubygems.org.
@@ -223,7 +240,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Provide ruby API to the latest SPDX catalogue.
 
-[Unreleased]: https://github.com/spandx/spandx/compare/v0.17.0...HEAD
+[Unreleased]: https://github.com/spandx/spandx/compare/v0.18.3...HEAD
+[0.18.3]: https://github.com/spandx/spandx/compare/v0.18.2...v0.18.3
+[0.18.2]: https://github.com/spandx/spandx/compare/v0.18.1...v0.18.2
+[0.18.1]: https://github.com/spandx/spandx/compare/v0.18.0...v0.18.1
+[0.18.0]: https://github.com/spandx/spandx/compare/v0.17.0...v0.18.0
 [0.17.0]: https://github.com/spandx/spandx/compare/v0.16.1...v0.17.0
 [0.16.1]: https://github.com/spandx/spandx/compare/v0.16.0...v0.16.1
 [0.16.0]: https://github.com/spandx/spandx/compare/v0.15.1...v0.16.0

data/README.md

@@ -4,7 +4,7 @@
 
 # Spandx ![badge](https://github.com/spandx/spandx/workflows/ci/badge.svg)
 
-A ruby API for interacting with the https://spdx.org software license catalogue.
+A Ruby API for interacting with the https://spdx.org software license catalogue.
 This gem includes a command line interface to scan a software project for the
 software licenses that are associated with each dependency in the project.
 `spandx` leverages an offline cache of software licenses for known dependencies.
@@ -104,7 +104,7 @@ end
 
 ## Development
 
-After checking out the repo, run `bin/setup` to install dependencies. Then, run `bin/cibuild` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bin/test` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
 
 To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 

data/lib/spandx/cli/commands/scan.rb

@@ -37,10 +37,6 @@ module Spandx
           end
         end
 
-        def format(output)
-          Array(output).map(&:to_s)
-        end
-
         def with_printer(output)
           printer = ::Spandx::Cli::Printer.for(@options[:format])
           printer.print_header(output)

data/lib/spandx/core/dependency.rb

@@ -14,6 +14,8 @@ module Spandx
         Spandx::Python::Parsers::PipfileLock => :pypi,
         Spandx::Ruby::Parsers::GemfileLock => :rubygems,
         Spandx::Os::Parsers::Apk => :apk,
+        Spandx::Os::Parsers::Dpkg => :dpkg,
+        Spandx::Terraform::Parsers::LockFile => :terraform,
       }.freeze
       attr_reader :path, :name, :version, :licenses, :meta
 

data/lib/spandx/spdx/catalogue.rb

@@ -37,7 +37,8 @@ module Spandx
         end
 
         def from_git
-          from_json(Spandx.git[:spdx].read('json/licenses.json'))
+          json = Spandx.git[:spdx].read('json/licenses.json')
+          json ? from_json(json) : latest
         end
 
         def default

data/lib/spandx/terraform/parsers/lock_file.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Spandx
+  module Terraform
+    module Parsers
+      class LockFile < ::Spandx::Core::Parser
+        def initialize
+          @parser = Hcl2::Parser.new
+        end
+
+        def match?(pathname)
+          basename = pathname.basename
+          basename.fnmatch?('.terraform.lock.hcl')
+        end
+
+        def parse(path)
+          tree = @parser.parse(path.read)
+          tree[:blocks].map do |block|
+            version_arg = version_arg_from(block)
+            ::Spandx::Core::Dependency.new(
+              name: block[:name].to_s,
+              version: version_arg[:value]&.to_s,
+              path: path
+            )
+          end
+        end
+
+        private
+
+        def version_arg_from(block)
+          block[:arguments].find do |x|
+            x[:name] == 'version'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/spandx/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Spandx
-  VERSION = '0.17.0'
+  VERSION = '0.18.3'
 end

data/lib/spandx.rb

@@ -4,6 +4,7 @@ require 'addressable/uri'
 require 'bundler'
 require 'csv'
 require 'forwardable'
+require 'hcl2'
 require 'json'
 require 'logger'
 require 'net/hippie'

data/spandx.gemspec

@@ -11,10 +11,10 @@ Gem::Specification.new do |spec|
   spec.email         = ['eldemcan@gmail.com', 'mo@mokhan.ca']
 
   spec.summary       = 'A ruby interface to the SPDX catalogue.'
-  spec.description   = 'Spanx is a ruby API for interacting with the spdx.org software license catalogue. This gem includes a command line interface to scan a software project for the software licenses that are associated with each dependency in the project. Spandx also allows you to hook additional information for each dependency found. For instance, you can add plugin to Spandx to find and report vulnerabilities for the dependencies it found.'
+  spec.description   = 'Spandx is a ruby API for interacting with the spdx.org software license catalogue. This gem includes a command line interface to scan a software project for the software licenses that are associated with each dependency in the project. Spandx also allows you to hook additional information for each dependency found. For instance, you can add plugin to Spandx to find and report vulnerabilities for the dependencies it found.'
   spec.homepage      = 'https://spandx.github.io/'
   spec.license       = 'MIT'
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.5.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 2.6.0')
 
   spec.metadata['homepage_uri'] = spec.homepage
   spec.metadata['source_code_uri'] = 'https://github.com/spandx/spandx'
@@ -34,6 +34,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'addressable', '~> 2.7'
   spec.add_dependency 'bundler', '>= 1.16', '< 3.0.0'
+  spec.add_dependency 'hcl2', '~> 0.1'
   spec.add_dependency 'net-hippie', '~> 1.0'
   spec.add_dependency 'nokogiri', '~> 1.10'
   spec.add_dependency 'oj', '~> 3.10'

metadata

@@ -1,15 +1,15 @@
 --- !ruby/object:Gem::Specification
 name: spandx
 version: !ruby/object:Gem::Version
-  version: 0.17.0
+  version: 0.18.3
 platform: ruby
 authors:
 - Can Eldem
 - mo khan
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-12-29 00:00:00.000000000 Z
+date: 2021-12-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -45,6 +45,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
+- !ruby/object:Gem::Dependency
+  name: hcl2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: net-hippie
   requirement: !ruby/object:Gem::Requirement
@@ -353,7 +367,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.7'
-description: Spanx is a ruby API for interacting with the spdx.org software license
+description: Spandx is a ruby API for interacting with the spdx.org software license
   catalogue. This gem includes a command line interface to scan a software project
   for the software licenses that are associated with each dependency in the project.
   Spandx also allows you to hook additional information for each dependency found.
@@ -434,6 +448,7 @@ files:
 - lib/spandx/spdx/expression.rb
 - lib/spandx/spdx/gateway.rb
 - lib/spandx/spdx/license.rb
+- lib/spandx/terraform/parsers/lock_file.rb
 - lib/spandx/version.rb
 - spandx.gemspec
 homepage: https://spandx.github.io/
@@ -443,7 +458,7 @@ metadata:
   homepage_uri: https://spandx.github.io/
   source_code_uri: https://github.com/spandx/spandx
   changelog_uri: https://github.com/spandx/spandx/blob/main/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -451,15 +466,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 2.6.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.3
-signing_key: 
+rubygems_version: 3.2.32
+signing_key:
 specification_version: 4
 summary: A ruby interface to the SPDX catalogue.
 test_files: []