spandx 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9c82d16a4a78e075ecebcd7308580b5e3ca44bcc274d3070ade1d546b9a38fa
-  data.tar.gz: 540a6a7f1d12f14c5d44feb15826b2f61ba8ee422d72e662328457b8df7260fc
+  metadata.gz: 14b8433caf34da68102cdf2db650684c9dbccc2e32509a63a44021978a8d1f6e
+  data.tar.gz: c7c342040a9c5a666708096f30228823a815256587ddd99b9b77fcb7f6856259
 SHA512:
-  metadata.gz: 1bb0a40e4723a2b3fc2b50a92d3df34df978753f5e14a76534758d9c946349475dfa18a123c1e0b3f1d89ac01fbbe9eecb520ca6842c122ba5af122d9466c639
-  data.tar.gz: faaedb6aaaf9ae486219ef396092c108ff359723a267291b5ef37b2bcf834195b5ace2578067598f97c71b68f78f4efb8ade261c3953184fd4a7be34eed9d7a9
+  metadata.gz: 9d916195c87c1162ec60ace64a7c36c5b693c51445361cf11242ca9ceb32c9a8b932d1a2bd65026757c56e556cdc677a738bb42f6dd266652c897737ce2da281
+  data.tar.gz: 92df5d8346276b1998f28bfad73ef26fd6e9bf300589997e5d6ad517e7044974b52b659082acae52e496ea51ff77e3f7bd8d4faa5f4d14d39c20c44a8fb529af

data/CHANGELOG.md

@@ -1,4 +1,4 @@
-Version 0.2.0
+Version 0.3.0
 
 # Changelog
 
@@ -8,8 +8,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+
+## [0.3.0] - 2020-01-29
 ### Added
-- Nil
+- Add `pom.xml` parser
+
+### Changed
+- Change minimum ruby from 2.5 to 2.4
 
 ## [0.2.0] - 2020-01-28
 ### Added
@@ -52,7 +57,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 - Provide ruby API to the latest SPDX catalogue.
 
-[Unreleased]: https://github.com/mokhan/spandx/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/mokhan/spandx/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/mokhan/spandx/compare/v0.2.0...v0.3.0
 [0.2.0]: https://github.com/mokhan/spandx/compare/v0.1.7...v0.2.0
 [0.1.7]: https://github.com/mokhan/spandx/compare/v0.1.6...v0.1.7
 [0.1.6]: https://github.com/mokhan/spandx/compare/v0.1.5...v0.1.6

data/lib/spandx/parsers.rb

@@ -3,6 +3,7 @@
 require 'spandx/parsers/base'
 require 'spandx/parsers/csproj'
 require 'spandx/parsers/gemfile_lock'
+require 'spandx/parsers/maven'
 require 'spandx/parsers/packages_config'
 require 'spandx/parsers/pipfile_lock'
 require 'spandx/parsers/sln'

data/lib/spandx/parsers/csproj.rb

@@ -4,7 +4,7 @@ module Spandx
   module Parsers
     class Csproj < Base
       def self.matches?(filename)
-        filename.match?(/.*\.csproj/)
+        ['.csproj', '.props'].include?(File.extname(filename))
       end
 
       def parse(lockfile)

data/lib/spandx/parsers/csproj/package_reference.rb

@@ -3,7 +3,21 @@
 module Spandx
   module Parsers
     class Csproj
-      PackageReference = Struct.new(:name, :version, keyword_init: true)
+      class PackageReference
+        attr_reader :name, :version
+
+        def initialize(name:, version:)
+          @name = name
+          @version = version
+        end
+
+        def to_h
+          {
+            name: name,
+            version: version
+          }
+        end
+      end
     end
   end
 end

data/lib/spandx/parsers/csproj/project_file.rb

@@ -9,17 +9,13 @@ module Spandx
         def initialize(path)
           @path = path
           @dir = File.dirname(path)
-          @document = Nokogiri::XML(IO.read(path))
+          @document = Nokogiri::XML(IO.read(path)).tap(&:remove_namespaces!)
         end
 
         def package_references
-          other = project_references.map(&:package_references).flatten
-          other + document.search('//PackageReference').map do |node|
-            PackageReference.new(
-              name: attribute_for('Include', node),
-              version: attribute_for('Version', node)
-            )
-          end
+          project_references.flat_map(&:package_references) +
+            references('GlobalPackageReference') +
+            references('PackageReference')
         end
 
         private
@@ -32,6 +28,20 @@ module Spandx
           end
         end
 
+        def references(key)
+          document.search("//#{key}").map do |node|
+            PackageReference.new(
+              name: name_from(node),
+              version: attribute_for('Version', node)
+            )
+          end
+        end
+
+        def name_from(node)
+          attribute_for('Include', node) ||
+            attribute_for('Update', node)
+        end
+
         def attribute_for(key, node)
           node.attribute(key)&.value&.strip ||
             node.at_xpath("./#{key}")&.content&.strip

data/lib/spandx/parsers/maven.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Spandx
+  module Parsers
+    class Maven < Base
+      class Metadata
+        attr_reader :artifact_id, :group_id, :version
+
+        def initialize(artifact_id:, group_id:, version:)
+          @artifact_id = artifact_id
+          @group_id = group_id.tr('.', '/')
+          @version = version
+        end
+
+        def licenses
+          pom.to_xml(indent: 2)
+          pom.search('//licenses/license').map do |node|
+            {
+              name: node.at_xpath('./name').text,
+              url: node.at_xpath('./url').text
+            }
+          end
+        end
+
+        private
+
+        def pom
+          @pom ||= fetch
+        end
+
+        def spec_url
+          [
+            'https://repo.maven.apache.org/maven2',
+            group_id,
+            artifact_id,
+            version,
+            "#{artifact_id}-#{version}.pom"
+          ].join('/')
+        end
+
+        def fetch
+          response = Spandx.http.get(spec_url)
+          return unless Spandx.http.ok?(response)
+
+          Nokogiri.XML(response.body).tap(&:remove_namespaces!)
+        end
+      end
+
+      def self.matches?(filename)
+        File.basename(filename) == 'pom.xml'
+      end
+
+      def parse(filename)
+        document = Nokogiri.XML(IO.read(filename)).tap(&:remove_namespaces!)
+        document.search('//project/dependencies/dependency').map do |node|
+          metadata = metadata_for(node)
+          Dependency.new(
+            name: metadata.artifact_id,
+            version: metadata.version,
+            licenses: metadata.licenses.map { |x| search_catalogue_for(x) }.compact
+          )
+        end
+      end
+
+      private
+
+      def metadata_for(node)
+        Metadata.new(
+          artifact_id: node.at_xpath('./artifactId').text,
+          group_id: node.at_xpath('./groupId').text,
+          version: node.at_xpath('./version').text
+        )
+      end
+
+      def search_catalogue_for(license_hash)
+        name = Content.new(license_hash[:name])
+
+        catalogue.find do |license|
+          score = name.similarity_score(Content.new(license.name))
+          score > 85
+        end
+      end
+    end
+  end
+end

data/lib/spandx/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Spandx
-  VERSION = '0.2.0'
+  VERSION = '0.3.0'
 end

data/spandx.gemspec

@@ -29,7 +29,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.required_ruby_version = '>= 2.5.0'
+  spec.required_ruby_version = '>= 2.4.0'
   spec.add_dependency 'bundler', '>= 1.16', '< 3.0.0'
   spec.add_dependency 'net-hippie', '~> 0.3'
   spec.add_dependency 'nokogiri', '~> 1.10'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spandx
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - mo khan
@@ -231,6 +231,7 @@ files:
 - lib/spandx/parsers/csproj/package_reference.rb
 - lib/spandx/parsers/csproj/project_file.rb
 - lib/spandx/parsers/gemfile_lock.rb
+- lib/spandx/parsers/maven.rb
 - lib/spandx/parsers/packages_config.rb
 - lib/spandx/parsers/pipfile_lock.rb
 - lib/spandx/parsers/sln.rb
@@ -252,7 +253,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.5.0
+      version: 2.4.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="