spandx 0.18.1 → 0.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb37d5c085e6c24f08f563a34abe6395448e63a0f8a7571cd16ee7353fcf0e86
-  data.tar.gz: 8cb0c804cf63410200d1a8d7b28e7ba7ec1cf57e180d1e66e63664f3daf2e4b8
+  metadata.gz: 28d95986ecfe3d8616d52256ecf28003eb4cc6c28e30a6733e9e4e1012cf5375
+  data.tar.gz: bd8f7c53dbfa43e13a2f1a4f54c7a2517e70f3e529b1792b18ce6ef9cc208091
 SHA512:
-  metadata.gz: '0815ee42c9a013e2d4979d662166ca44d898d513b64250635ab36e8c65ab55d2eb1d7683b7cd1dcf4c2d8bc365d55433aba88713b3d4e2613c47dc62a7b53ba7'
-  data.tar.gz: 1dd8fa583d48f9007162b2eda18e07b0e58e906791c06491dd1d43dece6304c6831b279a4840761e8a370c6aaf6d7304e16eb2baa2a9f80b627bdffbf0ae2632
+  metadata.gz: b97733866a711008bebc338ff77e452696d5ae1f7c8b486fb13b08adc20c8fd2483cc288766920525057967889b3e42632abb0f6dd5cf03f273965ae27b0d1c8
+  data.tar.gz: fa296185eacf57b16c7f9b54cd9d1b19c8bfa524ce3de6b256b007a1c9d9cf41c51eb7c99e10331265d48b415c94119c1e2097f10764c2d4f420eb91762cf1f9

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 0.18.1
+Version 0.18.2
 
 # Changelog
 
@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.2] - 2021-06-05
+### Fixed
+- fix(dpkg): detect package manager for related dependencies
+- fix(terraform): detect package manager for related dependencies
+
 ## [0.18.1] - 2021-06-02
 ### Fixed
 - Parse `.terraform.lock.hcl` files with multiple providers.
@@ -232,7 +237,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Provide ruby API to the latest SPDX catalogue.
 
-[Unreleased]: https://github.com/spandx/spandx/compare/v0.18.1...HEAD
+[Unreleased]: https://github.com/spandx/spandx/compare/v0.18.2...HEAD
+[0.18.2]: https://github.com/spandx/spandx/compare/v0.18.1...v0.18.2
 [0.18.1]: https://github.com/spandx/spandx/compare/v0.18.0...v0.18.1
 [0.18.0]: https://github.com/spandx/spandx/compare/v0.17.0...v0.18.0
 [0.17.0]: https://github.com/spandx/spandx/compare/v0.16.1...v0.17.0

data/lib/spandx.rb

@@ -4,6 +4,7 @@ require 'addressable/uri'
 require 'bundler'
 require 'csv'
 require 'forwardable'
+require 'hcl2'
 require 'json'
 require 'logger'
 require 'net/hippie'

data/lib/spandx/cli/commands/scan.rb

@@ -37,10 +37,6 @@ module Spandx
           end
         end
 
-        def format(output)
-          Array(output).map(&:to_s)
-        end
-
         def with_printer(output)
           printer = ::Spandx::Cli::Printer.for(@options[:format])
           printer.print_header(output)

data/lib/spandx/core/dependency.rb

@@ -14,6 +14,8 @@ module Spandx
         Spandx::Python::Parsers::PipfileLock => :pypi,
         Spandx::Ruby::Parsers::GemfileLock => :rubygems,
         Spandx::Os::Parsers::Apk => :apk,
+        Spandx::Os::Parsers::Dpkg => :dpkg,
+        Spandx::Terraform::Parsers::LockFile => :terraform,
       }.freeze
       attr_reader :path, :name, :version, :licenses, :meta
 

data/lib/spandx/terraform/parsers/lock_file.rb

@@ -5,7 +5,7 @@ module Spandx
     module Parsers
       class LockFile < ::Spandx::Core::Parser
         def initialize
-          @parser = Spandx::Terraform::Parsers::Hcl.new
+          @parser = Hcl2::Parser.new
         end
 
         def match?(pathname)

data/lib/spandx/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Spandx
-  VERSION = '0.18.1'
+  VERSION = '0.18.2'
 end

data/spandx.gemspec

@@ -14,7 +14,7 @@ Gem::Specification.new do |spec|
   spec.description   = 'Spanx is a ruby API for interacting with the spdx.org software license catalogue. This gem includes a command line interface to scan a software project for the software licenses that are associated with each dependency in the project. Spandx also allows you to hook additional information for each dependency found. For instance, you can add plugin to Spandx to find and report vulnerabilities for the dependencies it found.'
   spec.homepage      = 'https://spandx.github.io/'
   spec.license       = 'MIT'
-  spec.required_ruby_version = Gem::Requirement.new('>= 2.5.0')
+  spec.required_ruby_version = Gem::Requirement.new('>= 2.6.0')
 
   spec.metadata['homepage_uri'] = spec.homepage
   spec.metadata['source_code_uri'] = 'https://github.com/spandx/spandx'
@@ -34,6 +34,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency 'addressable', '~> 2.7'
   spec.add_dependency 'bundler', '>= 1.16', '< 3.0.0'
+  spec.add_dependency 'hcl2', '~> 0.1'
   spec.add_dependency 'net-hippie', '~> 1.0'
   spec.add_dependency 'nokogiri', '~> 1.10'
   spec.add_dependency 'oj', '~> 3.10'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spandx
 version: !ruby/object:Gem::Version
-  version: 0.18.1
+  version: 0.18.2
 platform: ruby
 authors:
 - Can Eldem
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-06-03 00:00:00.000000000 Z
+date: 2021-06-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
@@ -45,6 +45,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: 3.0.0
+- !ruby/object:Gem::Dependency
+  name: hcl2
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: net-hippie
   requirement: !ruby/object:Gem::Requirement
@@ -434,7 +448,6 @@ files:
 - lib/spandx/spdx/expression.rb
 - lib/spandx/spdx/gateway.rb
 - lib/spandx/spdx/license.rb
-- lib/spandx/terraform/parsers/hcl.rb
 - lib/spandx/terraform/parsers/lock_file.rb
 - lib/spandx/version.rb
 - spandx.gemspec
@@ -453,7 +466,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 2.6.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/lib/spandx/terraform/parsers/hcl.rb

@@ -1,108 +0,0 @@
-# frozen_string_literal: true
-
-module Spandx
-  module Terraform
-    module Parsers
-      class Hcl < Parslet::Parser
-        rule(:alpha) { match['a-zA-Z'] }
-        rule(:assign) { str('=') }
-        rule(:colon) { str(':') }
-        rule(:comma) { str(',') }
-        rule(:comment) { (str('#') | str('//')) >> ((str("\n") >> str("\r").maybe).absent? >> any).repeat >> eol }
-        rule(:crlf) { match('[\r\n]') }
-        rule(:digit) { match('\d') }
-        rule(:dot) { str('.') }
-        rule(:eol) { whitespace? >> crlf.repeat }
-        rule(:greater_than_or_equal_to) { str('>=') }
-        rule(:hyphen) { str('-') }
-        rule(:lbracket) { str('[') }
-        rule(:lcurly) { str('{') }
-        rule(:major) { number }
-        rule(:major_minor) { (number >> dot >> number) }
-        rule(:major_minor_patch) { number >> dot >> number >> dot >> number }
-        rule(:multiline_comment) { str('/*') >> (str('*/').absent? >> any).repeat >> str('*/') }
-        rule(:number) { digit.repeat }
-        rule(:plus) { str('+') }
-        rule(:pre_release) { hyphen >> (alpha | digit).repeat }
-        rule(:pre_release?) { pre_release.maybe }
-        rule(:quote) { str('"') }
-        rule(:rbracket) { str(']') }
-        rule(:rcurly) { str('}') }
-        rule(:slash) { str('/') }
-        rule(:space) { match('\s') }
-        rule(:tilda_wacka) { str('~>') }
-        rule(:version) { number >> dot >> number >> dot >> number >> pre_release? }
-        rule(:whitespace) { (multiline_comment | comment | space).repeat }
-        rule(:whitespace?) { whitespace.maybe }
-
-        rule(:pessimistic_version_constraint) do
-          tilda_wacka >> whitespace >> (
-            major_minor_patch |
-            major_minor |
-            major
-          )
-        end
-
-        rule(:greater_than_or_equal_to_version) do
-          greater_than_or_equal_to >> whitespace >> (
-            major_minor_patch |
-            major_minor |
-            major
-          )
-        end
-
-        rule(:version_constraint) do
-          pessimistic_version_constraint | greater_than_or_equal_to_version
-        end
-
-        rule :version_assignment do
-          str('version') >> whitespace >> assign >> whitespace >> quote >> version.as(:version) >> quote
-        end
-
-        rule :constraint_assignment do
-          str('constraints') >> whitespace >> assign >> whitespace >> quote >> version_constraint.as(:constraints) >> quote
-        end
-
-        rule :string do
-          quote >> (
-            digit | dot | alpha | str('~> ') | slash | colon | assign | plus
-          ).repeat(1).as(:value) >> quote
-        end
-
-        rule :array_item do
-          whitespace? >> string >> comma.maybe >> eol
-        end
-
-        rule :array do
-          lbracket >> eol >> array_item.repeat >> whitespace >> rbracket
-        end
-
-        rule :argument_value do
-          (array.as(:values) | string) >> eol
-        end
-
-        rule :argument do
-          whitespace >> alpha.repeat(1).as(:name) >> whitespace >> assign >> whitespace >> argument_value
-        end
-
-        rule :block_body do
-          lcurly >> crlf >> argument.repeat.as(:arguments) >> rcurly
-        end
-
-        rule :identifier do
-          whitespace >> quote >> (alpha | dot | slash).repeat(1).as(:name) >> quote >> whitespace
-        end
-
-        rule :block do
-          alpha.repeat(1).as(:type) >> identifier >> block_body
-        end
-
-        rule :blocks do
-          whitespace? >> (block >> eol.maybe).repeat(1).as(:blocks)
-        end
-
-        root(:blocks)
-      end
-    end
-  end
-end