continuous-delivery-scripts 4.2.0__tar.gz → 4.3.0__tar.gz

{continuous_delivery_scripts-4.2.0/continuous_delivery_scripts.egg-info → continuous_delivery_scripts-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.2.0
+Version: 4.3.0
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -239,17 +239,18 @@ same commands whichever CI system the team chooses.
 
 | Command | What it does | Key arguments | Typical environment |
 | --- | --- | --- | --- |
-| `cd-assert-news` | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
-| `cd-create-news-file` | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
-| `cd-determine-version` | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
-| `cd-generate-news` | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
-| `cd-get-config` | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
-| `cd-tag-and-release` | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
-| `cd-generate-docs` | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| `cd-generate-spdx` | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| `cd-license-files` | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
-| `cd-record-secrets` | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
-| `cd-detect-secrets` | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
+| [`cd-assert-news`](./guides/checking-news-fragments.md) | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
+| [`cd-create-news-file`](./guides/creating-news-fragments.md) | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
+| [`cd-determine-version`](./guides/previewing-versions.md) | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
+| [`cd-generate-news`](./guides/managing-changelogs.md) | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
+| [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
+| [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
+| [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports | CI gate or developer review |
+| [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
+| [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
+| [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
 
 For example, `cd-create-news-file "Fix dependency resolution" --type bugfix`
 adds a news fragment. For release workflow details, see the

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/README.md

@@ -178,17 +178,18 @@ same commands whichever CI system the team chooses.
 
 | Command | What it does | Key arguments | Typical environment |
 | --- | --- | --- | --- |
-| `cd-assert-news` | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
-| `cd-create-news-file` | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
-| `cd-determine-version` | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
-| `cd-generate-news` | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
-| `cd-get-config` | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
-| `cd-tag-and-release` | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
-| `cd-generate-docs` | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| `cd-generate-spdx` | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| `cd-license-files` | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
-| `cd-record-secrets` | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
-| `cd-detect-secrets` | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
+| [`cd-assert-news`](./guides/checking-news-fragments.md) | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
+| [`cd-create-news-file`](./guides/creating-news-fragments.md) | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
+| [`cd-determine-version`](./guides/previewing-versions.md) | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
+| [`cd-generate-news`](./guides/managing-changelogs.md) | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
+| [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
+| [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
+| [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports | CI gate or developer review |
+| [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
+| [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
+| [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
 
 For example, `cd-create-news-file "Fix dependency resolution" --type bugfix`
 adds a news fragment. For release workflow details, see the

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/_version.py

@@ -11,8 +11,8 @@ References
 This file is autogenerated, do not modify by hand.
 """
 
-__version__ = "4.2.0"
-COMMIT = "757dd096956394de1185aa8f7bb169dc0d0fc982"
+__version__ = "4.3.0"
+COMMIT = "3e8ffc7bd8472928ca195f17fb278d40476ef8a2"
 MAJOR = 4
-MINOR = 2
+MINOR = 3
 PATCH = 0

continuous_delivery_scripts-4.3.0/continuous_delivery_scripts/check_licence_compliance.py

@@ -0,0 +1,48 @@
+#
+# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+"""Check project and dependency licences without generating SPDX documents."""
+
+import argparse
+import logging
+import sys
+from pathlib import Path
+
+from continuous_delivery_scripts.language_specifics import get_language_specifics
+from continuous_delivery_scripts.utils.logging import log_exception, set_log_level
+
+logger = logging.getLogger(__name__)
+
+
+def main() -> int:
+    """Check licence compliance and optionally write third-party IP summaries."""
+    parser = argparse.ArgumentParser(description="Check project and dependency licence compliance.")
+    parser.add_argument(
+        "-o",
+        "--output-dir",
+        type=Path,
+        help="Write third-party IP summaries to this existing directory (no SPDX documents).",
+    )
+    parser.add_argument("-v", "--verbose", action="count", default=0, help="Increase logging verbosity.")
+    args = parser.parse_args()
+    set_log_level(args.verbose)
+
+    try:
+        plugin = get_language_specifics()
+        if not plugin.can_get_project_metadata():
+            raise ValueError("The selected language plugin cannot provide metadata for licence compliance checks.")
+        project = plugin.get_current_spdx_project()
+        if project is None:
+            raise ValueError("The selected language plugin did not return a project for licence compliance checks.")
+        if args.output_dir is not None:
+            project.generate_licensing_summary(args.output_dir)
+        project.check_licence_compliance()
+        return 0
+    except Exception as error:
+        log_exception(logger, error)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/spdx_report/spdx_document.py

@@ -6,6 +6,7 @@
 
 from pathlib import Path
 from typing import TYPE_CHECKING, List, Optional
+from urllib.parse import urlsplit
 
 from continuous_delivery_scripts.spdx_report.spdx_dependency import (
     DependencySpdxDocumentRef,
@@ -24,6 +25,7 @@ from continuous_delivery_scripts.utils.configuration import (
 )
 from continuous_delivery_scripts.utils.hash_helpers import generate_uuid_based_on_str
 from continuous_delivery_scripts.utils.package_helpers import PackageMetadata
+from continuous_delivery_scripts.utils.third_party_licences import LICENSE_REF_PROPRIETARY
 
 if TYPE_CHECKING:
     from spdx.document import Document
@@ -230,7 +232,7 @@ class SpdxDocument:
             the corresponding document
         """
         from spdx.creationinfo import Person, Organization, Tool
-        from spdx.document import Document, License
+        from spdx.document import Document, ExtractedLicense, License
         from spdx.review import Review
         from spdx.version import Version
 
@@ -262,7 +264,35 @@ class SpdxDocument:
         #  be described in a file and hence, all dependencies are described
         #  in separate files. Find out what to do with dependencies when new
         #  tools are released as it is not entirely clear in the specification
-        doc.package = self.generate_spdx_package().generate_spdx_package()
+        spdx_package = self.generate_spdx_package()
+        doc.package = spdx_package.generate_spdx_package()
+        if LICENSE_REF_PROPRIETARY in spdx_package.main_licence or LICENSE_REF_PROPRIETARY in spdx_package.licence:
+            proprietary_licence = ExtractedLicense(LICENSE_REF_PROPRIETARY)
+            proprietary_licence.full_name = "Proprietary licence"
+            proprietary_licence.text = "Proprietary licence terms are not included in this SPDX document."
+            proprietary_licence.comment = (
+                "This is a locally defined licence reference, not an SPDX License List identifier. "
+                "See https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/ "
+                "for the LicenseRef format; consult the rights holder for the licence terms."
+            )
+            if LICENSE_REF_PROPRIETARY in spdx_package.main_licence:
+                licence_urls = {
+                    evidence.get("path", "")
+                    for evidence in self._package_metadata.licence_evidence
+                    if evidence.get("kind") == "licence"
+                }
+                for url in sorted(licence_urls):
+                    try:
+                        parsed_url = urlsplit(url)
+                    except ValueError:
+                        continue
+                    if (
+                        parsed_url.scheme in ("http", "https")
+                        and parsed_url.netloc
+                        and not any(c.isspace() for c in url)
+                    ):
+                        proprietary_licence.add_xref(url)
+            doc.add_extr_lic(proprietary_licence)
 
         for external_reference in self.external_refs:
             doc.add_ext_document_reference(external_reference.generate_external_reference())

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/spdx_report/spdx_package.py

@@ -20,6 +20,7 @@ from continuous_delivery_scripts.spdx_report.spdx_helpers import (
 from continuous_delivery_scripts.utils.definitions import UNKNOWN
 from continuous_delivery_scripts.utils.package_helpers import PackageMetadata
 from continuous_delivery_scripts.utils.third_party_licences import (
+    LICENSE_REF_PROPRIETARY,
     UNKNOWN_LICENCE,
     cleanse_licence_expression,
     is_licence_accepted,
@@ -141,7 +142,14 @@ class SpdxPackage:
     @property
     def is_main_licence_accepted(self) -> bool:
         """States whether the main licence of the package is part of the accepted licence list."""
-        return bool(is_licence_accepted(self.main_licence))
+        return bool(is_licence_accepted(self.main_licence, self._project_licence_refs))
+
+    @property
+    def _project_licence_refs(self) -> List[str]:
+        """Allow the project's own proprietary licence without permitting it for dependencies."""
+        if not self._is_dependency and LICENSE_REF_PROPRIETARY in self.main_licence:
+            return [LICENSE_REF_PROPRIETARY]
+        return []
 
     @property
     def licence(self) -> str:
@@ -162,7 +170,7 @@ class SpdxPackage:
     @property
     def is_licence_accepted(self) -> bool:
         """States whether the actual package's licence of the package is part of the accepted licence list."""
-        return bool(is_licence_accepted(self.licence))
+        return bool(is_licence_accepted(self.licence, self._project_licence_refs))
 
     @property
     def author(self) -> str:

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/spdx_report/templates/third_party_IP_report.html.jinja2

@@ -49,6 +49,9 @@
       .hero .meta { margin: .75rem 0 0; color: #e5f2f5; }
       main { padding-block: 2rem 4rem; }
       .page-nav { display: flex; flex-wrap: wrap; gap: 1rem; margin-bottom: 2rem; }
+      .download-links { display: flex; flex-wrap: wrap; gap: .75rem; }
+      .download-link { display: inline-flex; align-items: center; min-height: 2.75rem; padding: .5rem .9rem; border: 1px solid var(--accent); border-radius: .5rem; background: var(--surface); font-weight: 650; text-decoration: none; }
+      .download-link:hover { background: var(--background); text-decoration: underline; }
       section { margin-bottom: 2.75rem; }
       h2 { margin: 0 0 1rem; font-size: 1.5rem; }
       h3 { margin: 0 0 .5rem; font-size: 1.05rem; }
@@ -118,6 +121,15 @@
         <a href="#dependency-summary">Dependency summary</a>
         <a href="#package-licences">Package licences</a>
       </nav>
+      <section class="panel" aria-labelledby="downloads-heading">
+        <h2 id="downloads-heading">Download this report</h2>
+        <p>Choose a format for further analysis or sharing.</p>
+        <div class="download-links">
+          <a class="download-link" href="third_party_IP_report.csv" download="third_party_IP_report.csv">Download CSV</a>
+          <a class="download-link" href="third_party_IP_report.json" download="third_party_IP_report.json">Download JSON</a>
+          <a class="download-link" href="third_party_IP_report.txt" download="third_party_IP_report.txt">Download text</a>
+        </div>
+      </section>
       <section id="summary" aria-labelledby="summary-heading">
         <h2 id="summary-heading">Summary</h2>
         <div class="summary-grid">

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/utils/language_specifics_base.py

@@ -15,6 +15,7 @@ from continuous_delivery_scripts.utils.configuration import (
 )
 from continuous_delivery_scripts.utils.definitions import CommitType
 from continuous_delivery_scripts.utils.git_helpers import GitWrapper
+from continuous_delivery_scripts.utils.third_party_licences import normalise_proprietary_licence
 
 if TYPE_CHECKING:
     from continuous_delivery_scripts.spdx_report.spdx_project import SpdxProject
@@ -35,7 +36,9 @@ SPDX-License-Identifier: {licence_identifier}
 def _generate_generic_licence_header_template() -> str:
     """Generates the header template which is put at the top of source files."""
     return GENERIC_LICENCE_HEADER_TEMPLATE.format(
-        licence_identifier=configuration.get_value(ConfigurationVariable.FILE_LICENCE_IDENTIFIER),
+        licence_identifier=normalise_proprietary_licence(
+            str(configuration.get_value(ConfigurationVariable.FILE_LICENCE_IDENTIFIER))
+        ),
         author="${owner}",
         date="${years}",
     )

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts/utils/third_party_licences.py

@@ -48,6 +48,16 @@ UNKNOWN_LICENCE = Licence(
     url="Unknown",
     reference="Unknown",
 )
+LICENSE_REF_PROPRIETARY = "LicenseRef-Proprietary"
+PROPRIETARY_LICENCE = Licence(
+    reference_number="",
+    identifier=LICENSE_REF_PROPRIETARY,
+    name="Proprietary licence",
+    is_deprecated=False,
+    is_osi_approved=False,
+    url="",
+    reference="",
+)
 
 LICENCE_LIKELIHOOD_THRESHOLD = 0.5
 
@@ -260,6 +270,10 @@ class OpenSourceLicences:
 
     def get_licence(self, licence_descriptor: Optional[str]) -> Optional[Licence]:
         """Determines the licence based on a string descriptor e.g. Apache 2."""
+        if licence_descriptor and normalise_proprietary_licence(licence_descriptor) == LICENSE_REF_PROPRIETARY:
+            return PROPRIETARY_LICENCE
+        if licence_descriptor and licence_descriptor.lower().startswith("licenseref-"):
+            return None
         self.load()
         if not self._licence_store or not self._licence_list or not licence_descriptor:
             return None
@@ -286,14 +300,28 @@ class OpenSourceLicences:
 OPENSOURCE_LICENCES = OpenSourceLicences()
 
 
+def normalise_proprietary_licence(licence_expression: str) -> str:
+    """Use a stable SPDX licence reference for proprietary declarations."""
+    return re.sub(
+        r"(?<![\w-])(?:LicenseRef-)?Proprietary(?:\s+Licen[cs]e)?(?![\w-])",
+        LICENSE_REF_PROPRIETARY,
+        licence_expression,
+        flags=re.IGNORECASE,
+    )
+
+
 def cleanse_licence_expression(licence_expression: str) -> str:
     """Cleanses a licence expression by using SPDX identifiers when possible.
 
     A licence expression can be a combination of licences and in a lot of cases is free-form text.
     The idea is to return an equivalent expression but using SPDX identifiers when possible.
     """
-    simplified_expression = _parse_licence_expression(Licensing(), licence_expression).simplify()
+    simplified_expression = _parse_licence_expression(
+        Licensing(), normalise_proprietary_licence(licence_expression)
+    ).simplify()
     for s in simplified_expression.symbols:
+        if s.key.startswith("LicenseRef-"):
+            continue
         corresponding_licence = OPENSOURCE_LICENCES.get_licence(s.key)
         if corresponding_licence:
             s.key = corresponding_licence.identifier
@@ -301,6 +329,9 @@ def cleanse_licence_expression(licence_expression: str) -> str:
 
 
 def _iter_matching_licences(desc: str) -> Iterable[Licence]:
+    if normalise_proprietary_licence(desc.strip()) == LICENSE_REF_PROPRIETARY:
+        yield PROPRIETARY_LICENCE
+        return
     licence = OPENSOURCE_LICENCES.get_licence(desc)
     if licence:
         yield licence
@@ -342,7 +373,7 @@ def get_allowed_opensource_licences() -> Iterable[Licence]:
 
 def simplify_licence_expression(licence_expression: str) -> str:
     """Simplifies a licence expression."""
-    return str(_parse_licence_expression(Licensing(), licence_expression).simplify())
+    return str(_parse_licence_expression(Licensing(), normalise_proprietary_licence(licence_expression)).simplify())
 
 
 def determine_licence_compound(main_licence: str, additional_licences: List[str]) -> str:
@@ -374,9 +405,10 @@ def _is_expression_or(licence_expression: str) -> bool:
     return isinstance(_parse_licence_expression(licensing_util, licence_expression), OR)
 
 
-def is_licence_accepted(licence_expression: str) -> bool:
+def is_licence_accepted(licence_expression: str, additional_identifiers: Iterable[str] = ()) -> bool:
     """Determines whether the licence expressed is valid with regards to project's accepted licences."""
     authorised_licences = [licence.identifier for licence in get_allowed_opensource_licences()]
+    authorised_licences.extend(additional_identifiers)
     is_or = _is_expression_or(licence_expression)
     if bool([licence for licence in determine_licences_not_in_list(licence_expression, iter(authorised_licences))]):
         return (

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0/continuous_delivery_scripts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.2.0
+Version: 4.3.0
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -239,17 +239,18 @@ same commands whichever CI system the team chooses.
 
 | Command | What it does | Key arguments | Typical environment |
 | --- | --- | --- | --- |
-| `cd-assert-news` | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
-| `cd-create-news-file` | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
-| `cd-determine-version` | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
-| `cd-generate-news` | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
-| `cd-get-config` | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
-| `cd-tag-and-release` | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
-| `cd-generate-docs` | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| `cd-generate-spdx` | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| `cd-license-files` | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
-| `cd-record-secrets` | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
-| `cd-detect-secrets` | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
+| [`cd-assert-news`](./guides/checking-news-fragments.md) | Validates a branch's news files; can add a missing file for a configured dependency-update branch. | `--current-branch` (`-b`), `--local` (`-l`) | CI; `--local` for developer checks |
+| [`cd-create-news-file`](./guides/creating-news-fragments.md) | Creates a one-line news fragment in the configured news directory. | Required news text; `--type` (`-t`), `--ref-number` (`-n`) | Developer |
+| [`cd-determine-version`](./guides/previewing-versions.md) | Calculates and prints the **project's prospective release version** without generating a changelog. | Required `--release-type` (`-t`) | Developer preview or CI |
+| [`cd-generate-news`](./guides/managing-changelogs.md) | Updates the project version and, for beta or production releases, builds the changelog from news fragments; prints the resulting version. | Required `--release-type` (`-t`) | CI release flow |
+| [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
+| [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
+| [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports | CI gate or developer review |
+| [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
+| [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
+| [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |
 
 For example, `cd-create-news-file "Fix dependency resolution" --type bugfix`
 adds a news fragment. For release workflow details, see the

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts.egg-info/SOURCES.txt

@@ -7,6 +7,7 @@ setup.py
 continuous_delivery_scripts/__init__.py
 continuous_delivery_scripts/_version.py
 continuous_delivery_scripts/assert_news.py
+continuous_delivery_scripts/check_licence_compliance.py
 continuous_delivery_scripts/create_news_file.py
 continuous_delivery_scripts/detect_secrets.py
 continuous_delivery_scripts/generate_docs.py

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/continuous_delivery_scripts.egg-info/entry_points.txt

@@ -1,5 +1,6 @@
 [console_scripts]
 cd-assert-news = continuous_delivery_scripts.assert_news:main
+cd-check-licence-compliance = continuous_delivery_scripts.check_licence_compliance:main
 cd-create-news-file = continuous_delivery_scripts.create_news_file:main
 cd-detect-secrets = continuous_delivery_scripts.detect_secrets:main
 cd-determine-version = continuous_delivery_scripts.get_version:main

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/setup.py

@@ -50,6 +50,7 @@ setup(
             f"cd-get-config={SOURCE_DIR}.get_config:main",
             f"cd-license-files={SOURCE_DIR}.license_files:main",
             f"cd-generate-spdx={SOURCE_DIR}.report_third_party_ip:main",
+            f"cd-check-licence-compliance={SOURCE_DIR}.check_licence_compliance:main",
             f"cd-detect-secrets={SOURCE_DIR}.detect_secrets:main",
             f"cd-record-secrets={SOURCE_DIR}.update_secrets_registry:main",
         ]

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/GitPython.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Sebastian Thiel <byronimo@gmail.com>, Michael Trier <mtrier@gmail.com>)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/Incremental.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (unknown)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/Jinja2.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (unknown)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/Mako.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Mike Bayer <mike@zzzcomputing.com>)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/Markdown.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Manfred Stienstra, Yuri Takhteyev (Waylan limberg <python.markdown@gmail.com>)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/MarkupSafe.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (unknown)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/PyYAML.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Kirill Simonov (xi@resolvent.net)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/Pygments.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Georg Brandl <georg@python.org>)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/SecretStorage.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Dmitry Shachnev <mitya57@gmail.com>)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/boolean.py.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Sebastian Kraemer (basti.kr@gmail.com)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/boto3.spdx

@@ -2,9 +2,9 @@
 
 SPDXVersion: SPDX-1.2
 DataLicense: CC0-1.0
-DocumentName: boto3-1.43.105
+DocumentName: boto3-1.43.106
 SPDXID: SPDXRef-DOCUMENT
-DocumentNamespace: http://spdx.org/spdxdocs/boto3-1.43.105-9e62df54-ada2-02ee-46b0-a1cf91e75f66
+DocumentNamespace: http://spdx.org/spdxdocs/boto3-1.43.106-5312fb83-fdd6-b8dc-38af-244f66958ad3
 DocumentComment: <text>This document was created automatically using available project and dependency information.</text>
 
 
@@ -12,14 +12,14 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Amazon Web Services (unknown)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package
 
 PackageName: boto3
 SPDXID: SPDXRef-boto3
-PackageVersion: 1.43.105
+PackageVersion: 1.43.106
 PackageDownloadLocation: NONE
 PackageSummary: <text>The AWS SDK for Python (Boto3)</text>
 PackageFileName: boto3

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/botocore.spdx

@@ -2,9 +2,9 @@
 
 SPDXVersion: SPDX-1.2
 DataLicense: CC0-1.0
-DocumentName: botocore-1.43.105
+DocumentName: botocore-1.43.106
 SPDXID: SPDXRef-DOCUMENT
-DocumentNamespace: http://spdx.org/spdxdocs/botocore-1.43.105-13165313-08f7-4942-d4c5-bc78feb4011a
+DocumentNamespace: http://spdx.org/spdxdocs/botocore-1.43.106-10e147fd-3ba0-1292-77d7-1e630c192997
 DocumentComment: <text>This document was created automatically using available project and dependency information.</text>
 
 
@@ -12,14 +12,14 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Person: Amazon Web Services (unknown)
 Creator: Tool: mbed-spdx-generator
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package
 
 PackageName: botocore
 SPDXID: SPDXRef-botocore
-PackageVersion: 1.43.105
+PackageVersion: 1.43.106
 PackageDownloadLocation: NONE
 PackageSummary: <text>Low-level, data-driven core of boto 3.</text>
 PackageFileName: botocore

{continuous_delivery_scripts-4.2.0 → continuous_delivery_scripts-4.3.0}/spdx-tmp/bracex.spdx

@@ -12,7 +12,7 @@ DocumentComment: <text>This document was created automatically using available p
 
 Creator: Tool: mbed-spdx-generator
 Creator: Person: unknown (Isaac Muse <Isaac.Muse@gmail.com>)
-Created: 2026-09-30T16:35:08Z
+Created: 2026-10-01T09:28:53Z
 
 
 # Package