continuous-delivery-scripts 4.3.0__tar.gz → 4.4.0__tar.gz

{continuous_delivery_scripts-4.3.0/continuous_delivery_scripts.egg-info → continuous_delivery_scripts-4.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: continuous-delivery-scripts
-Version: 4.3.0
+Version: 4.4.0
 Summary: Git-based CI/CD tools for releases, changelogs, SPDX SBOMs and licence reporting
 Home-page: https://github.com/ARMmbed/continuous-delivery-scripts
 Author: Arm
@@ -246,8 +246,8 @@ same commands whichever CI system the team chooses.
 | [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
 | [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
 | [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports | CI gate or developer review |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); optional `--lookup-scancode` | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports, `--lookup-scancode` | CI gate or developer review |
 | [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
 | [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
 | [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |

{continuous_delivery_scripts-4.3.0 → continuous_delivery_scripts-4.4.0}/README.md

@@ -185,8 +185,8 @@ same commands whichever CI system the team chooses.
 | [`cd-get-config`](./guides/reading-project-configuration.md) | Prints a project configuration value. | Either `--key` (`-k`) or `--config-variable` (`-c`) | Developer or CI |
 | [`cd-tag-and-release`](./guides/automating-releases.md) | Runs the release flow, including documentation, licensing summaries, Git tagging, packaging and publication through the selected [language plugin](./continuous_delivery_scripts/plugins). | Required `--release-type` (`-t`); optional `--current-branch` (`-b`) | CI release flow |
 | [`cd-generate-docs`](./guides/generating-code-documentation.md) | Generates code documentation in the configured output directory (or one specified on the command line). | `--output_directory` | Developer preview or CI |
-| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); create the directory first | CI audit; developer review also possible |
-| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports | CI gate or developer review |
+| [`cd-generate-spdx`](./guides/generating-an-spdx-sbom.md) | Generates SPDX documents and third-party licence summaries, then checks licence compliance when project metadata is available. | Required `--output-dir` (`-o`); optional `--lookup-scancode` | CI audit; developer review also possible |
+| [`cd-check-licence-compliance`](./guides/checking-licence-compliance.md) | Checks project and dependency licences without creating SPDX documents; optionally writes third-party IP summaries. | Optional `--output-dir` (`-o`) for reports, `--lookup-scancode` | CI gate or developer review |
 | [`cd-license-files`](./guides/licence-header-management.md) | Adds or updates source-file licence and copyright headers when the language plugin supports them. | `--verbose` (`-v`) | Developer or CI |
 | [`cd-record-secrets`](./guides/recording-secrets.md) | Records accepted findings in the project's [detect-secrets](https://github.com/Yelp/detect-secrets) registry. | `--registry-file` (`-r`); defaults to the configured registry | Developer (registry maintenance) |
 | [`cd-detect-secrets`](./guides/checking-for-secrets.md) | Checks Git-tracked files against that registry and fails if new secrets are found. | `--registry-file` (`-r`); defaults to the configured registry | CI; developer checks also possible |

{continuous_delivery_scripts-4.3.0 → continuous_delivery_scripts-4.4.0}/continuous_delivery_scripts/_version.py

@@ -11,8 +11,8 @@ References
 This file is autogenerated, do not modify by hand.
 """
 
-__version__ = "4.3.0"
-COMMIT = "3e8ffc7bd8472928ca195f17fb278d40476ef8a2"
+__version__ = "4.4.0"
+COMMIT = "b480ded441705a4dda9e7d2d3e7a3e1b45729688"
 MAJOR = 4
-MINOR = 3
+MINOR = 4
 PATCH = 0

{continuous_delivery_scripts-4.3.0 → continuous_delivery_scripts-4.4.0}/continuous_delivery_scripts/check_licence_compliance.py

@@ -10,6 +10,7 @@ import sys
 from pathlib import Path
 
 from continuous_delivery_scripts.language_specifics import get_language_specifics
+from continuous_delivery_scripts.spdx_report.licence_assessment import LicenceAssessment
 from continuous_delivery_scripts.utils.logging import log_exception, set_log_level
 
 logger = logging.getLogger(__name__)
@@ -24,6 +25,11 @@ def main() -> int:
         type=Path,
         help="Write third-party IP summaries to this existing directory (no SPDX documents).",
     )
+    parser.add_argument(
+        "--lookup-scancode",
+        action="store_true",
+        help="Consult ScanCode LicenseDB for unclassified licences or missing assessment rules.",
+    )
     parser.add_argument("-v", "--verbose", action="count", default=0, help="Increase logging verbosity.")
     args = parser.parse_args()
     set_log_level(args.verbose)
@@ -35,9 +41,23 @@ def main() -> int:
         project = plugin.get_current_spdx_project()
         if project is None:
             raise ValueError("The selected language plugin did not return a project for licence compliance checks.")
+        if args.lookup_scancode:
+            project.enable_scancode_lookup()
         if args.output_dir is not None:
             project.generate_licensing_summary(args.output_dir)
+        counts = {
+            status.value: sum(result.status is status for result in project.licence_assessments.values())
+            for status in LicenceAssessment
+        }
+        print("Dependency licence assessment: " + ", ".join(f"{name}: {count}" for name, count in counts.items()))
+        if args.lookup_scancode:
+            for name, result in project.licence_assessments.items():
+                for info in result.scancode_licences:
+                    print(f"{name}: ScanCode LicenseDB: {info.identifier} ({info.category}): {info.url}")
         project.check_licence_compliance()
+        if args.lookup_scancode:
+            for warning in project.scancode_follow_up_warnings():
+                print(f"WARNING: {warning}", file=sys.stderr)
         return 0
     except Exception as error:
         log_exception(logger, error)

{continuous_delivery_scripts-4.3.0 → continuous_delivery_scripts-4.4.0}/continuous_delivery_scripts/report_third_party_ip.py

@@ -36,11 +36,13 @@ def generate_spdx_project_reports(project: "SpdxProject", output_directory: Path
     return project
 
 
-def generate_spdx_reports(output_directory: Path) -> Optional["SpdxProject"]:
+def generate_spdx_reports(output_directory: Path, lookup_scancode: bool = False) -> Optional["SpdxProject"]:
     """Generates all the SPDX reports for the current project."""
     project = get_language_specifics().get_current_spdx_project()
     if not project:
         return None
+    if lookup_scancode:
+        project.enable_scancode_lookup()
     return generate_spdx_project_reports(project, output_directory)
 
 
@@ -59,6 +61,11 @@ def main() -> int:
         required=True,
         type=convert_to_path,
     )
+    parser.add_argument(
+        "--lookup-scancode",
+        action="store_true",
+        help="Consult ScanCode LicenseDB for unclassified licences or missing assessment rules.",
+    )
 
     parser.add_argument(
         "-v",
@@ -72,9 +79,12 @@ def main() -> int:
 
     try:
         if get_language_specifics().can_get_project_metadata():
-            project = generate_spdx_reports(args.output_dir)
+            project = generate_spdx_reports(args.output_dir, lookup_scancode=args.lookup_scancode)
             if project:
                 project.check_licence_compliance()
+                if args.lookup_scancode:
+                    for warning in project.scancode_follow_up_warnings():
+                        print(f"WARNING: {warning}", file=sys.stderr)
         return 0
     except Exception as e:
         log_exception(logger, e)

continuous_delivery_scripts-4.4.0/continuous_delivery_scripts/spdx_report/data/licence_assessment.toml

@@ -0,0 +1,105 @@
+#
+# Copyright (C) 2020-2026 Arm Limited or its affiliates and Contributors. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+#
+
+# Default screening policy. These are review priorities, not legal conclusions.
+# Project overrides are merged by licence ID and rule ID.
+schema_version = 1
+
+[settings]
+# Keep existing compliance exit codes unchanged unless a project opts in.
+fail_on = []
+
+[classifications]
+MIT = "PERMISSIVE"
+"MIT-0" = "PERMISSIVE"
+"0BSD" = "PERMISSIVE"
+"BSD-2-Clause" = "PERMISSIVE"
+"BSD-3-Clause" = "PERMISSIVE"
+ISC = "PERMISSIVE"
+"Apache-2.0" = "PERMISSIVE"
+"Python-2.0" = "PERMISSIVE"
+"PSF-2.0" = "PERMISSIVE"
+"MPL-2.0" = "WEAK_COPYLEFT"
+"LGPL-2.1-only" = "WEAK_COPYLEFT"
+"LGPL-2.1-or-later" = "WEAK_COPYLEFT"
+"LGPL-3.0-only" = "WEAK_COPYLEFT"
+"LGPL-3.0-or-later" = "WEAK_COPYLEFT"
+"GPL-2.0-only" = "STRONG_COPYLEFT"
+"GPL-2.0-or-later" = "STRONG_COPYLEFT"
+"GPL-3.0-only" = "STRONG_COPYLEFT"
+"GPL-3.0-or-later" = "STRONG_COPYLEFT"
+"AGPL-3.0-only" = "NETWORK_COPYLEFT"
+"AGPL-3.0-or-later" = "NETWORK_COPYLEFT"
+"CC0-1.0" = "PUBLIC_DOMAIN"
+Unlicense = "PUBLIC_DOMAIN"
+"LicenseRef-Proprietary" = "PROPRIETARY"
+
+# Map LicenseDB's own vocabulary to screening categories. Unmapped categories
+# remain review-only; these are not legal compatibility decisions.
+[scancode_categories]
+Permissive = "PERMISSIVE"
+"Copyleft Limited" = "WEAK_COPYLEFT"
+Copyleft = "STRONG_COPYLEFT"
+"Public Domain" = "PUBLIC_DOMAIN"
+"Proprietary Free" = "PROPRIETARY"
+Commercial = "PROPRIETARY"
+"Free Restricted" = "PROPRIETARY"
+"Non-Commercial" = "PROPRIETARY"
+
+[[rules]]
+id = "permissive-dependency"
+project_category = "*"
+dependency_category = "PERMISSIVE"
+status = "ALLOW"
+reason = "A permissive dependency generally permits redistribution; retain its notices and conditions."
+
+[[rules]]
+id = "public-domain-dependency"
+project_category = "*"
+dependency_category = "PUBLIC_DOMAIN"
+status = "ALLOW"
+reason = "No copyleft obligation is identified for this public-domain dependency; check its notices."
+
+[[rules]]
+id = "apache-2-to-gpl-2-only"
+project_licence = "GPL-2.0-only"
+dependency_licence = "Apache-2.0"
+status = "REVIEW"
+reason = "Apache-2.0 and GPL-2.0-only have a known directional compatibility concern for combined works."
+
+[[rules]]
+id = "apache-2-to-gpl-2-or-later"
+project_licence = "GPL-2.0-or-later"
+dependency_licence = "Apache-2.0"
+status = "REVIEW"
+reason = "Review the GPL version selected for a combined work before incorporating Apache-2.0 code."
+
+[[rules]]
+id = "weak-copyleft-dependency"
+project_category = "*"
+dependency_category = "WEAK_COPYLEFT"
+status = "REVIEW"
+reason = "Weak copyleft obligations depend on modification, linking and how the work is distributed."
+
+[[rules]]
+id = "strong-copyleft-dependency"
+project_category = "*"
+dependency_category = "STRONG_COPYLEFT"
+status = "REVIEW"
+reason = "Strong copyleft obligations may affect a combined or redistributed work; review the usage."
+
+[[rules]]
+id = "network-copyleft-dependency"
+project_category = "*"
+dependency_category = "NETWORK_COPYLEFT"
+status = "REVIEW"
+reason = "Network copyleft obligations may apply to network use as well as distribution; review the usage."
+
+[[rules]]
+id = "proprietary-dependency"
+project_category = "*"
+dependency_category = "PROPRIETARY"
+status = "REVIEW"
+reason = "A proprietary licence reference does not reveal its terms; consult the rights holder."