tetra 2.0.7 → 2.0.8

data/lib/tetra/data/license_map.yml

@@ -0,0 +1,124 @@
+# Mappings of Raw Maven License Names -> SPDX Identifiers
+# Based on https://spdx.org/licenses/ and openSUSE/Fedora standards
+
+# --- Apache Licenses ---
+"The Apache Software License, Version 2.0": "Apache-2.0"
+"Apache License, Version 2.0": "Apache-2.0"
+"Apache License Version 2.0": "Apache-2.0"
+"Apache 2.0": "Apache-2.0"
+"Apache License 2.0": "Apache-2.0"
+"AL 2.0": "Apache-2.0"
+"Apache Software License - Version 2.0": "Apache-2.0"
+"The Apache License, Version 2.0": "Apache-2.0"
+"Apache-2.0": "Apache-2.0"
+
+"Apache License, Version 1.1": "Apache-1.1"
+"The Apache Software License, Version 1.1": "Apache-1.1"
+"Apache 1.1": "Apache-1.1"
+
+"Apache License, Version 1.0": "Apache-1.0"
+
+# --- MIT Licenses ---
+"The MIT License": "MIT"
+"MIT License": "MIT"
+"MIT": "MIT"
+"MIT license": "MIT"
+"The MIT License (MIT)": "MIT"
+
+# --- Eclipse Public Licenses ---
+"Eclipse Public License 1.0": "EPL-1.0"
+"Eclipse Public License - v 1.0": "EPL-1.0"
+"Eclipse Public License, Version 1.0": "EPL-1.0"
+"EPL 1.0": "EPL-1.0"
+
+"Eclipse Public License 2.0": "EPL-2.0"
+"Eclipse Public License - v 2.0": "EPL-2.0"
+"EPL 2.0": "EPL-2.0"
+
+# --- GPL (General Public License) ---
+"GNU General Public License, version 2": "GPL-2.0-only"
+"GNU General Public License, Version 2": "GPL-2.0-only"
+"GPL 2.0": "GPL-2.0-only"
+"GPLv2": "GPL-2.0-only"
+"The GNU General Public License, Version 2": "GPL-2.0-only"
+
+"GNU General Public License, version 2 (GPLv2)": "GPL-2.0-only"
+"GNU General Public License, version 3": "GPL-3.0-only"
+"GPL 3.0": "GPL-3.0-only"
+"GPLv3": "GPL-3.0-only"
+
+# --- LGPL (Lesser General Public License) ---
+"GNU Lesser General Public License": "LGPL-2.1-only"
+"GNU Lesser General Public License, version 2.1": "LGPL-2.1-only"
+"LGPL 2.1": "LGPL-2.1-only"
+"LGPLv2.1": "LGPL-2.1-only"
+"The GNU Lesser General Public License, Version 2.1": "LGPL-2.1-only"
+
+"GNU Lesser General Public License, version 3": "LGPL-3.0-only"
+"LGPL 3.0": "LGPL-3.0-only"
+"LGPLv3": "LGPL-3.0-only"
+
+# --- BSD Licenses ---
+"The BSD License": "BSD-2-Clause" # Ambiguous, but often 2-clause in modern Java
+"BSD License": "BSD-2-Clause"
+"BSD-2-Clause": "BSD-2-Clause"
+"Two-clause BSD license": "BSD-2-Clause"
+"The BSD 2-Clause License": "BSD-2-Clause"
+
+"New BSD License": "BSD-3-Clause"
+"BSD 3-Clause": "BSD-3-Clause"
+"BSD 3-Clause License": "BSD-3-Clause"
+"The BSD 3-Clause License": "BSD-3-Clause"
+"Revised BSD License": "BSD-3-Clause"
+"Modified BSD License": "BSD-3-Clause"
+
+"BSD 0-Clause": "0BSD"
+"0BSD": "0BSD"
+
+# --- CDDL (Common Development and Distribution License) ---
+"Common Development and Distribution License": "CDDL-1.0"
+"CDDL 1.0": "CDDL-1.0"
+"CDDL-1.0": "CDDL-1.0"
+"COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0": "CDDL-1.0"
+
+"Common Development and Distribution License 1.1": "CDDL-1.1"
+"CDDL 1.1": "CDDL-1.1"
+
+# --- MPL (Mozilla Public License) ---
+"Mozilla Public License Version 1.1": "MPL-1.1"
+"MPL 1.1": "MPL-1.1"
+
+"Mozilla Public License Version 2.0": "MPL-2.0"
+"MPL 2.0": "MPL-2.0"
+"The Mozilla Public License, Version 2.0": "MPL-2.0"
+
+# --- ISC License ---
+"ISC License": "ISC"
+"The ISC License": "ISC"
+
+# --- Creative Commons ---
+"Creative Commons Zero v1.0 Universal": "CC0-1.0"
+"CC0 1.0 Universal": "CC0-1.0"
+"Public Domain": "CC0-1.0" # Approximation for Public Domain in SPDX
+
+"Creative Commons Attribution 3.0": "CC-BY-3.0"
+"CC BY 3.0": "CC-BY-3.0"
+
+"Creative Commons Attribution 4.0": "CC-BY-4.0"
+"CC BY 4.0": "CC-BY-4.0"
+
+# --- Other Common Java Licenses ---
+"The JSON License": "JSON"
+"JSON": "JSON"
+
+"Unlicense": "Unlicense"
+"The Unlicense": "Unlicense"
+
+"WTFPL": "WTFPL"
+"Do What The F*ck You Want To Public License": "WTFPL"
+
+"PostgreSQL License": "PostgreSQL"
+"The PostgreSQL License": "PostgreSQL"
+
+"Zlib License": "Zlib"
+"The zlib/libpng License": "Zlib"

data/lib/tetra/facades/ant.rb

@@ -1,15 +1,12 @@
-# encoding: UTF-8
-
+# frozen_string_literal: true
 module Tetra
   # encapsulates tetra-specific Ant commandline options
   class Ant
     # returns a command line for running Ant
     def self.commandline(project_path, ant_path)
-      if ant_path
-        File.join(project_path, ant_path, "ant")
-      else
-        "ant" # use system-provided executable
-      end
+      return "ant" unless ant_path
+
+      File.join(project_path, ant_path, "ant")
     end
   end
 end

data/lib/tetra/facades/bash.rb

@@ -1,5 +1,4 @@
-# encoding: UTF-8
-
+# frozen_string_literal: true
 module Tetra
   # runs Bash with tetra-specific options
   class Bash
@@ -16,32 +15,44 @@ module Tetra
       Tempfile.open("tetra-history") do |history_file|
         Tempfile.open("tetra-bashrc") do |bashrc_file|
           kit = Tetra::Kit.new(@project)
+
           ant_path = kit.find_executable("ant")
-          ant_in_kit = ant_path != nil
           ant_commandline = Tetra::Ant.commandline(@project.full_path, ant_path)
 
           mvn_path = kit.find_executable("mvn")
-          mvn_in_kit = mvn_path != nil
           mvn_commandline = Tetra::Mvn.commandline(@project.full_path, mvn_path)
 
           gradle_commandline = Tetra::Gradle.commandline(@project.full_path)
 
-          bashrc_content = Bashrc.new(history_file.path, ant_in_kit, ant_commandline, mvn_in_kit, mvn_commandline,
-                                      gradle_commandline).to_s
-          log.debug "writing bashrc file: #{bashrc_file.path}"
-          log.debug bashrc_content
+          bashrc_content = Bashrc.new(
+            history_file: history_file.path,
+            ant_in_kit: !ant_path.nil?,
+            ant_commandline: ant_commandline,
+            mvn_in_kit: !mvn_path.nil?,
+            mvn_commandline: mvn_commandline,
+            gradle_commandline: gradle_commandline
+          ).to_s
+
+          log.debug("writing bashrc file: #{bashrc_file.path}")
+          log.debug(bashrc_content)
 
           bashrc_file.write(bashrc_content)
           bashrc_file.flush
 
           if command
-            run("bash --rcfile #{bashrc_file.path} -i -c '#{command}'")
+            # SECURITY: Use array execution to prevent shell injection via 'command'
+            # The 'bash -c' flag normally takes a single string, so we must be careful.
+            # Ideally, passing it as a single array element ["bash", ..., "-c", command]
+            # is handled safely by ProcessRunner if it uses exec/system/spawn.
+            run(["bash", "--rcfile", bashrc_file.path, "-i", "-c", command])
             [command]
           else
-            run_interactive("bash --rcfile #{bashrc_file.path} -i")
+            # Interactive mode
+            run_interactive(["bash", "--rcfile", bashrc_file.path, "-i"])
+
             history = File.read(history_file)
-            log.debug "history contents:"
-            log.debug history
+            log.debug("history contents:")
+            log.debug(history)
 
             history.split("\n").map(&:strip)
           end
@@ -54,14 +65,12 @@ module Tetra
   class Bashrc
     include Tetra::Generatable
 
-    attr_reader :history_file
-    attr_reader :ant_in_kit
-    attr_reader :ant_commandline
-    attr_reader :mvn_in_kit
-    attr_reader :mvn_commandline
-    attr_reader :gradle_commandline
+    # Expose attributes for the ERB binding
+    attr_reader :history_file, :ant_in_kit, :ant_commandline,
+                :mvn_in_kit, :mvn_commandline, :gradle_commandline
 
-    def initialize(history_file, ant_in_kit, ant_commandline, mvn_in_kit, mvn_commandline, gradle_commandline)
+    def initialize(history_file:, ant_in_kit:, ant_commandline:,
+                   mvn_in_kit:, mvn_commandline:, gradle_commandline:)
       @history_file = history_file
       @ant_in_kit = ant_in_kit
       @ant_commandline = ant_commandline

data/lib/tetra/facades/git.rb

@@ -1,4 +1,6 @@
-# encoding: UTF-8
+# frozen_string_literal: true
+
+require "fileutils"
 
 module Tetra
   # facade to git, currently implemented with calls to the git command
@@ -15,10 +17,10 @@ module Tetra
     # inits a repo
     def init
       Dir.chdir(@directory) do
-        if Dir.exist?(".git") == false
-          run("git init")
-        else
+        if Dir.exist?(".git")
           fail GitAlreadyInitedError
+        else
+          git_cmd("init")
         end
       end
     end
@@ -28,8 +30,8 @@ module Tetra
     # returns nil if such commit does not exist
     def latest_id(comment_prefix)
       Dir.chdir(@directory) do
-        result = run("git rev-list --max-count=1 --grep=\"#{comment_prefix}\" --fixed-strings HEAD")
-        result.strip if result != ""
+        result = git_cmd("rev-list", "--max-count=1", "--grep", comment_prefix, "--fixed-strings", "HEAD")
+        result.strip unless result.empty?
       end
     end
 
@@ -39,7 +41,7 @@ module Tetra
     def latest_comment(comment_prefix)
       Dir.chdir(@directory) do
         id = latest_id(comment_prefix)
-        run("git rev-list --max-count=1 --format=%B #{id}") unless id.nil?
+        git_cmd("log", "-1", "--format=%B", id) if id
       end
     end
 
@@ -50,11 +52,11 @@ module Tetra
       log.debug "committing with message: #{message}"
 
       Dir.chdir(@directory) do
-        directories.each do |directory|
-          run("git rm -r --cached --ignore-unmatch #{directory}")
-          run("git add #{directory}")
+        if directories.any?
+          git_cmd("rm", "-r", "--cached", "--ignore-unmatch", *directories)
+          git_cmd("add", *directories)
         end
-        run("git commit --allow-empty -F -", false, message)
+        git_cmd_with_stdin(message, "commit", "--allow-empty", "-F", "-")
       end
     end
 
@@ -62,8 +64,8 @@ module Tetra
     def commit_file(path, message)
       Dir.chdir(@directory) do
         log.debug "committing path #{path} with message: #{message}"
-        run("git add #{path}")
-        run("git commit --allow-empty -F -", false, message)
+        git_cmd("add", path)
+        git_cmd_with_stdin(message, "commit", "--allow-empty", "-F", "-")
       end
     end
 
@@ -71,14 +73,14 @@ module Tetra
     def revert_directories(directories, id)
       Dir.chdir(@directory) do
         directories.each do |directory|
-          # reverts added and modified files, both in index and working tree
-          run("git checkout -f #{id} -- #{directory}")
+          git_cmd("checkout", "-f", id, "--", directory)
 
-          # compute the list of deleted files
-          files_in_commit = run("git ls-tree --name-only -r #{id} -- #{directory}").split("\n")
-          files_in_head = run("git ls-tree --name-only -r HEAD -- #{directory}").split("\n")
-          files_added_after_head = run("git ls-files -o -- #{directory}").split("\n")
-          files_to_delete = files_in_head - files_in_commit + files_added_after_head
+          # Returns list of files relative to current dir
+          files_in_commit = git_cmd("ls-tree", "--name-only", "-r", id, "--", directory).split("\n")
+          files_in_head   = git_cmd("ls-tree", "--name-only", "-r", "HEAD", "--", directory).split("\n")
+          files_added     = git_cmd("ls-files", "-o", "--", directory).split("\n")
+
+          files_to_delete = (files_in_head - files_in_commit) + files_added
 
           files_to_delete.each do |file|
             FileUtils.rm_rf(file)
@@ -91,15 +93,16 @@ module Tetra
     # leaving changes in the working directory
     def undo_last_commit
       Dir.chdir(@directory) do
-        run("git reset HEAD~")
+        git_cmd("reset", "HEAD~")
       end
     end
 
     # renames git special files to 'disable' them
     def disable_special_files(path)
       Dir.chdir(File.join(@directory, path)) do
-        Find.find(".") do |file|
-          next unless file =~ /\.git(ignore)?$/
+        # We look for .git directories or .gitignore files recursively
+        Dir.glob("**/.git*", File::FNM_DOTMATCH).each do |file|
+          next unless file.match?(/\.git(ignore)?$/)
 
           FileUtils.mv(file, "#{file}_disabled_by_tetra")
         end
@@ -111,22 +114,28 @@ module Tetra
     # returns the conflict count
     def merge_with_id(path, new_path, id)
       Dir.chdir(@directory) do
-        run("git show #{id}:#{path} > #{path}.old_version")
+        content = git_cmd("show", "#{id}:#{path}")
+
+        # Write the old version file manually using Ruby
+        temp_old_version = "#{path}.old_version"
+        File.write(temp_old_version, content)
 
         conflict_count = 0
         begin
-          run("git merge-file #{path} #{path}.old_version #{new_path} \
-                -L \"newly generated\" \
-                -L \"previously generated\" \
-                -L \"user edited\"")
+          git_cmd("merge-file", path, temp_old_version, new_path,
+                  "-L", "newly generated",
+                  "-L", "previously generated",
+                  "-L", "user edited")
         rescue ExecutionFailed => e
           if e.status > 0
             conflict_count = e.status
           else
             raise e
           end
+        ensure
+          # Clean up the temporary file
+          File.delete(temp_old_version) if File.exist?(temp_old_version)
         end
-        File.delete("#{path}.old_version")
         conflict_count
       end
     end
@@ -138,12 +147,12 @@ module Tetra
       Dir.chdir(@directory) do
         tracked_files = []
         begin
-          tracked_files += run("git diff-index --name-only #{id} -- #{directory}").split
+          tracked_files += git_cmd("diff-index", "--name-only", id, "--", directory).split
         rescue ExecutionFailed => e
-          raise e if e.status != 1 # status 1 is normal
+          raise e if e.status != 1
         end
 
-        untracked_files = run("git ls-files --exclude-standard --others -- #{directory}").split
+        untracked_files = git_cmd("ls-files", "--exclude-standard", "--others", "--", directory).split
         tracked_files + untracked_files
       end
     end
@@ -152,7 +161,22 @@ module Tetra
     def archive(directory, id, destination_path)
       Dir.chdir(@directory) do
         FileUtils.mkdir_p(File.dirname(destination_path))
-        run("git archive --format=tar #{id} -- #{directory} | xz -9e > #{destination_path}")
+
+        log.debug "archiving #{directory} from #{id} to #{destination_path}"
+
+        # This streams stdout from git directly to stdin of xz without loading
+        # data into Ruby memory (which could be big).
+        git_command = ["git", "archive", "--format=tar", id, "--", directory]
+        xz_command  = ["xz", "-9e"]
+
+        statuses = Open3.pipeline(git_command, xz_command, out: destination_path)
+
+        unless statuses.all?(&:success?)
+          fail ExecutionFailed.new(
+            "git archive pipeline failed (exit codes: #{statuses.map(&:exitstatus)})",
+            statuses.last.exitstatus
+          )
+        end
       end
       destination_path
     end
@@ -161,9 +185,20 @@ module Tetra
     # since from_id
     def format_patch(directory, from_id, destination_path)
       Dir.chdir(@directory) do
-        run("git format-patch -o #{destination_path} --no-numbered #{from_id} -- #{directory}").split
+        git_cmd("format-patch", "-o", destination_path, "--no-numbered", from_id, "--", directory).split
       end
     end
+
+    private
+
+    # Automatically passes "git" as the first argument in an Array.
+    def git_cmd(*args)
+      run(["git"] + args)
+    end
+
+    def git_cmd_with_stdin(stdin_data, *args)
+      run(["git"] + args, false, stdin_data)
+    end
   end
 
   class GitAlreadyInitedError < StandardError

data/lib/tetra/facades/gradle.rb

@@ -1,4 +1,4 @@
-# encoding: UTF-8
+# frozen_string_literal: true
 
 module Tetra
   # encapsulates tetra-specific Gradle commandline options
@@ -6,8 +6,9 @@ module Tetra
     # returns a command line for running Gradle
     def self.commandline(project_path)
       gradle_user_home = File.join(project_path, "kit", "gradle-home")
+      gradle_bin = File.join(project_path, "gradlew")
 
-      "./gradlew --gradle-user-home=#{gradle_user_home}"
+      "#{gradle_bin} --gradle-user-home=#{gradle_user_home}"
     end
   end
 end

data/lib/tetra/facades/mvn.rb

@@ -1,15 +1,15 @@
-# encoding: UTF-8
-
+# frozen_string_literal: true
 module Tetra
   # encapsulates tetra-specific Maven commandline options
   class Mvn
     # returns a command line for running Maven
     def self.commandline(project_path, mvn_path)
-      full_path = if mvn_path
-                    File.join(project_path, mvn_path, "mvn")
-                  else
-                    "mvn" # use system-provided executable
-                  end
+      executable = if mvn_path
+                     File.join(project_path, mvn_path, "mvn")
+                   else
+                     "mvn" # use system-provided executable
+                   end
+
       repo_path = File.join(project_path, "kit", "m2")
       config_path = File.join(project_path, "kit", "m2", "settings.xml")
 
@@ -19,7 +19,7 @@ module Tetra
         "--strict-checksums"
       ]
 
-      "#{full_path} #{options.join(' ')}"
+      "#{executable} #{options.join(' ')}"
     end
   end
 end

data/lib/tetra/facades/process_runner.rb

@@ -1,4 +1,4 @@
-# encoding: UTF-8
+# frozen_string_literal: true
 
 module Tetra
   # runs programs in subprocesses
@@ -8,62 +8,82 @@ module Tetra
     # runs a noninteractive executable and returns its output as a string
     # raises ExecutionFailed if the exit status is not 0
     # optionally echoes the executable's output/error to standard output/error
-    def run(commandline, echo = false, stdin = nil)
+    def run(commandline, echo = false, stdin_data = nil)
       log.debug "running `#{commandline}`"
 
-      out_recorder = echo ? RecordingIO.new(STDOUT) : RecordingIO.new
-      err_recorder = echo ? RecordingIO.new(STDERR) : RecordingIO.new
+      # Prepare buffers to capture output
+      out_buffer = StringIO.new
+      err_buffer = StringIO.new
+      exit_status = nil
+      # Flatten handles nested arrays, Compact removes nils
+      cmd_args = Array(commandline).flatten.compact.map(&:to_s)
 
-      status = Open4.spawn(commandline, stdin: stdin, stdout: out_recorder,
-                                        stderr: err_recorder, quiet: true).exitstatus
+      Open3.popen3(*cmd_args) do |stdin, stdout, stderr, wait_thr|
+        # 1. Handle Input (if any)
+        stdin.write(stdin_data) if stdin_data
+        stdin.close # Close stdin so the process knows input is finished
 
-      log.debug "`#{commandline}` exited with status #{status}"
+        # Use threads to read stdout and stderr simultaneously.
+        readers = []
 
-      if status != 0
-        log.warn("`#{commandline}` failed with status #{status}")
-        out = out_recorder.record
-        err = err_recorder.record
-        if out != "" || err != ""
+        readers << Thread.new do
+          stdout.each_line do |line|
+            print line if echo       # Echo to real STDOUT if requested
+            out_buffer << line       # Capture to memory
+          end
+        end
+
+        readers << Thread.new do
+          stderr.each_line do |line|
+            $stderr.print line if echo # Echo to real STDERR if requested
+            err_buffer << line         # Capture to memory
+          end
+        end
+
+        # Wait for reading to finish
+        readers.each(&:join)
+
+        # Get the exit code
+        exit_status = wait_thr.value
+      end
+
+      # Check for failure
+      unless exit_status.success?
+        # Extract strings from buffers
+        out = out_buffer.string
+        err = err_buffer.string
+
+        log.warn("`#{commandline}` failed with status #{exit_status.exitstatus}")
+
+        if !out.empty? || !err.empty?
           log.warn("Output follows:")
-          log.warn(out) unless out == ""
-          log.warn(err) unless err == ""
+          log.warn(out) unless out.empty?
+          log.warn(err) unless err.empty?
         end
-        fail ExecutionFailed.new(commandline, status, out, err)
+
+        fail ExecutionFailed.new(commandline, exit_status.exitstatus, out, err)
       end
 
-      out_recorder.record
+      # Return the standard output
+      out_buffer.string
     end
 
     # runs an interactive executable in a subshell
     def run_interactive(command)
-      log.debug "running `#{command}`"
-      success = system({}, command)
-      log.debug "`#{command}` exited with success #{success}"
-      fail ExecutionFailed.new(command, $CHILD_STATUS, nil, nil) unless success
-    end
+      log.debug "running interactive `#{command}`"
 
-    # records bytes sent via "<<" for later use
-    # optionally echoes to another IO object
-    class RecordingIO
-      attr_reader :record
+      # system() passes control to the subprocess
+      cmd_args = Array(command).flatten.compact.map(&:to_s)
+      success = system(*cmd_args)
 
-      def initialize(io = nil)
-        @io = io
-        @record = ""
-      end
+      log.debug "`#{command}` exited with success #{success}"
 
-      def <<(*args)
-        if @io
-          @io.<<(*args)
-          @io.flush
-        end
-        @record.<<(*args)
-      end
+      fail ExecutionFailed.new(command, $CHILD_STATUS.exitstatus, nil, nil) unless success
     end
   end
 
   # raised when a command returns a non-zero status
-  class ExecutionFailed < Exception
+  class ExecutionFailed < StandardError
     attr_reader :commandline
     attr_reader :status
     attr_reader :out
@@ -74,6 +94,7 @@ module Tetra
       @status = status
       @out = out
       @err = err
+      super("Command failed: #{commandline} (status: #{status})")
     end
 
     def to_s

data/lib/tetra/facades/tar.rb

@@ -1,5 +1,4 @@
-# encoding: UTF-8
-
+# frozen_string_literal: true
 module Tetra
   # encapsulates tar
   class Tar
@@ -7,8 +6,10 @@ module Tetra
 
     # decompresses a file in a target directory
     def decompress(tarfile, directory)
-      result = run("tar xvf #{tarfile} --directory #{directory}")
-      result.strip if result != ""
+      # Use Array format to prevent shell injection.
+      result = run(["tar", "xvf", tarfile, "--directory", directory])
+
+      result&.strip
     end
   end
 end

data/lib/tetra/facades/unzip.rb

@@ -1,5 +1,4 @@
-# encoding: UTF-8
-
+# frozen_string_literal: true
 module Tetra
   # encapsulates unzip
   class Unzip
@@ -7,8 +6,10 @@ module Tetra
 
     # decompresses a file in a target directory
     def decompress(zipfile, directory)
-      result = run("unzip #{zipfile} -d #{directory}")
-      result.strip if result != ""
+      # Use Array execution to prevent shell injection
+      result = run(["unzip", zipfile, "-d", directory])
+
+      result&.strip
     end
   end
 end