fosslight-dependency 3.0.7__py3-none-any.whl → 4.1.30__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- fosslight_dependency/LICENSES/LICENSE +201 -0
- fosslight_dependency/LICENSES/LicenseRef-3rd_party_licenses.txt +1254 -0
- fosslight_dependency/__init__.py +0 -1
- fosslight_dependency/_analyze_dependency.py +130 -0
- fosslight_dependency/_graph_convertor.py +67 -0
- fosslight_dependency/_help.py +79 -0
- fosslight_dependency/_package_manager.py +397 -0
- fosslight_dependency/cli.py +127 -0
- fosslight_dependency/constant.py +57 -0
- fosslight_dependency/dependency_item.py +103 -0
- fosslight_dependency/package_manager/Android.py +90 -0
- fosslight_dependency/package_manager/Cargo.py +144 -0
- fosslight_dependency/package_manager/Carthage.py +130 -0
- fosslight_dependency/package_manager/Cocoapods.py +194 -0
- fosslight_dependency/package_manager/Go.py +179 -0
- fosslight_dependency/package_manager/Gradle.py +123 -0
- fosslight_dependency/package_manager/Helm.py +106 -0
- fosslight_dependency/package_manager/Maven.py +274 -0
- fosslight_dependency/package_manager/Npm.py +296 -0
- fosslight_dependency/package_manager/Nuget.py +368 -0
- fosslight_dependency/package_manager/Pnpm.py +155 -0
- fosslight_dependency/package_manager/Pub.py +241 -0
- fosslight_dependency/package_manager/Pypi.py +395 -0
- fosslight_dependency/package_manager/Swift.py +159 -0
- fosslight_dependency/package_manager/Unity.py +118 -0
- fosslight_dependency/package_manager/Yarn.py +231 -0
- fosslight_dependency/package_manager/__init__.py +0 -0
- fosslight_dependency/run_dependency_scanner.py +393 -0
- fosslight_dependency-4.1.30.dist-info/METADATA +213 -0
- fosslight_dependency-4.1.30.dist-info/RECORD +37 -0
- {fosslight_dependency-3.0.7.dist-info → fosslight_dependency-4.1.30.dist-info}/WHEEL +1 -1
- fosslight_dependency-4.1.30.dist-info/entry_points.txt +2 -0
- fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/Apache-2.0.txt +201 -0
- fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/LicenseRef-3rd_party_licenses.txt +1254 -0
- fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/MIT.txt +21 -0
- fosslight_dependency/_version.py +0 -1
- fosslight_dependency/analyze_dependency.py +0 -1090
- fosslight_dependency/third_party/askalono/askalono.exe +0 -0
- fosslight_dependency/third_party/askalono/askalono_macos +0 -0
- fosslight_dependency/third_party/nomos/nomossa +0 -0
- fosslight_dependency-3.0.7.dist-info/3rd_party_licenses.txt +0 -726
- fosslight_dependency-3.0.7.dist-info/METADATA +0 -51
- fosslight_dependency-3.0.7.dist-info/RECORD +0 -13
- fosslight_dependency-3.0.7.dist-info/entry_points.txt +0 -3
- {fosslight_dependency-3.0.7.dist-info → fosslight_dependency-4.1.30.dist-info/licenses}/LICENSE +0 -0
- {fosslight_dependency-3.0.7.dist-info → fosslight_dependency-4.1.30.dist-info}/top_level.txt +0 -0
|
@@ -0,0 +1,393 @@
|
|
|
1
|
+
#!/usr/bin/env python
|
|
2
|
+
# -*- coding: utf-8 -*-
|
|
3
|
+
# Copyright (c) 2020 LG Electronics Inc.
|
|
4
|
+
# SPDX-License-Identifier: Apache-2.0
|
|
5
|
+
|
|
6
|
+
import os
|
|
7
|
+
import platform
|
|
8
|
+
import sys
|
|
9
|
+
import warnings
|
|
10
|
+
from datetime import datetime
|
|
11
|
+
import logging
|
|
12
|
+
import fosslight_dependency.constant as const
|
|
13
|
+
from collections import defaultdict
|
|
14
|
+
from fosslight_util.set_log import init_log
|
|
15
|
+
import fosslight_util.constant as constant
|
|
16
|
+
from fosslight_dependency._analyze_dependency import analyze_dependency
|
|
17
|
+
from fosslight_util.output_format import check_output_formats_v2, write_output_file
|
|
18
|
+
from fosslight_util.oss_item import ScannerItem
|
|
19
|
+
from fosslight_dependency._graph_convertor import GraphConvertor
|
|
20
|
+
from fosslight_util.exclude import get_excluded_paths
|
|
21
|
+
|
|
22
|
+
# Package Name
|
|
23
|
+
_PKG_NAME = "fosslight_dependency"
|
|
24
|
+
logger = logging.getLogger(constant.LOGGER_NAME)
|
|
25
|
+
warnings.filterwarnings("ignore", category=FutureWarning)
|
|
26
|
+
_sheet_name = "DEP_FL_Dependency"
|
|
27
|
+
EXTENDED_HEADER = {_sheet_name: ['ID', 'Package URL', 'OSS Name',
|
|
28
|
+
'OSS Version', 'License', 'Download Location',
|
|
29
|
+
'Homepage', 'Copyright Text', 'Exclude',
|
|
30
|
+
'Comment', 'Depends On']}
|
|
31
|
+
|
|
32
|
+
|
|
33
|
+
def find_package_manager(input_dir, path_to_exclude=[], manifest_file_name=[], recursive=False, excluded_files=[]):
|
|
34
|
+
ret = True
|
|
35
|
+
if not manifest_file_name:
|
|
36
|
+
for value in const.SUPPORT_PACKAE.values():
|
|
37
|
+
if isinstance(value, list):
|
|
38
|
+
manifest_file_name.extend(value)
|
|
39
|
+
else:
|
|
40
|
+
manifest_file_name.append(value)
|
|
41
|
+
|
|
42
|
+
found_manifest_file = []
|
|
43
|
+
found_manifest_set = set()
|
|
44
|
+
suggested_files = []
|
|
45
|
+
for parent, dirs, files in os.walk(input_dir):
|
|
46
|
+
rel_parent = os.path.relpath(parent, input_dir)
|
|
47
|
+
if rel_parent != '.' and rel_parent in path_to_exclude:
|
|
48
|
+
dirs[:] = []
|
|
49
|
+
continue
|
|
50
|
+
for file in files:
|
|
51
|
+
file_path = os.path.join(parent, file)
|
|
52
|
+
rel_file_path = os.path.relpath(file_path, input_dir)
|
|
53
|
+
if rel_file_path in excluded_files:
|
|
54
|
+
continue
|
|
55
|
+
if file in manifest_file_name:
|
|
56
|
+
candidate = os.path.join(parent, file)
|
|
57
|
+
norm_candidate = os.path.normpath(candidate)
|
|
58
|
+
if norm_candidate not in found_manifest_set:
|
|
59
|
+
found_manifest_set.add(norm_candidate)
|
|
60
|
+
found_manifest_file.append(candidate)
|
|
61
|
+
for manifest_f in manifest_file_name:
|
|
62
|
+
candidate = os.path.join(parent, manifest_f)
|
|
63
|
+
norm_candidate = os.path.normpath(candidate)
|
|
64
|
+
if norm_candidate in found_manifest_set:
|
|
65
|
+
continue
|
|
66
|
+
rel_candidate = os.path.relpath(candidate, input_dir)
|
|
67
|
+
if rel_candidate in excluded_files:
|
|
68
|
+
logger.debug(f'Skipping excluded manifest: {rel_candidate}')
|
|
69
|
+
continue
|
|
70
|
+
if os.path.exists(candidate):
|
|
71
|
+
found_manifest_set.add(norm_candidate)
|
|
72
|
+
found_manifest_file.append(candidate)
|
|
73
|
+
if file in const.SUGGESTED_PACKAGE.keys():
|
|
74
|
+
suggested_files.append(os.path.join(parent, file))
|
|
75
|
+
|
|
76
|
+
for dir in dirs:
|
|
77
|
+
for manifest_f in manifest_file_name:
|
|
78
|
+
manifest_l = manifest_f.split(os.path.sep)
|
|
79
|
+
if len(manifest_l) > 1 and manifest_l[0] == dir:
|
|
80
|
+
candidate = os.path.join(parent, manifest_f)
|
|
81
|
+
norm_candidate = os.path.normpath(candidate)
|
|
82
|
+
if norm_candidate in found_manifest_set:
|
|
83
|
+
continue
|
|
84
|
+
rel_candidate = os.path.relpath(candidate, input_dir)
|
|
85
|
+
if rel_candidate in excluded_files:
|
|
86
|
+
logger.debug(f'Skipping excluded manifest in dir: {rel_candidate}')
|
|
87
|
+
continue
|
|
88
|
+
if os.path.exists(candidate):
|
|
89
|
+
found_manifest_set.add(norm_candidate)
|
|
90
|
+
found_manifest_file.append(candidate)
|
|
91
|
+
|
|
92
|
+
if not recursive:
|
|
93
|
+
if len(found_manifest_file) > 0:
|
|
94
|
+
input_dir = parent
|
|
95
|
+
break
|
|
96
|
+
|
|
97
|
+
found_package_manager = defaultdict(lambda: defaultdict(list))
|
|
98
|
+
for f_with_path in found_manifest_file:
|
|
99
|
+
f_name = os.path.basename(f_with_path)
|
|
100
|
+
dir_path = os.path.dirname(f_with_path)
|
|
101
|
+
for key, value in const.SUPPORT_PACKAE.items():
|
|
102
|
+
manifest_patterns = value if isinstance(value, list) else [value]
|
|
103
|
+
|
|
104
|
+
for pattern in manifest_patterns:
|
|
105
|
+
if os.path.sep not in pattern:
|
|
106
|
+
if f_name == pattern:
|
|
107
|
+
if pattern not in found_package_manager[key][dir_path]:
|
|
108
|
+
found_package_manager[key][dir_path].append(pattern)
|
|
109
|
+
else:
|
|
110
|
+
rel_dir, rel_file = os.path.split(pattern)
|
|
111
|
+
expected_path = os.path.join(dir_path, rel_file)
|
|
112
|
+
|
|
113
|
+
if f_name == rel_file:
|
|
114
|
+
candidate = os.path.join(os.path.dirname(dir_path), rel_dir, rel_file) if rel_dir else expected_path
|
|
115
|
+
if os.path.normpath(candidate) == os.path.normpath(f_with_path):
|
|
116
|
+
if pattern not in found_package_manager[key][dir_path]:
|
|
117
|
+
found_package_manager[key][dir_path].append(pattern)
|
|
118
|
+
found_package_manager = {k: dict(v) for k, v in found_package_manager.items()}
|
|
119
|
+
|
|
120
|
+
# both npm and pnpm are detected, remove npm.
|
|
121
|
+
if 'npm' in found_package_manager.keys() and 'pnpm' in found_package_manager.keys():
|
|
122
|
+
del found_package_manager['npm']
|
|
123
|
+
|
|
124
|
+
# both npm and yarn are detected, check which one to use based on lock file
|
|
125
|
+
if 'npm' in found_package_manager.keys() and 'yarn' in found_package_manager.keys():
|
|
126
|
+
# Remove npm from directories where yarn.lock exists
|
|
127
|
+
dirs_to_remove_from_npm = []
|
|
128
|
+
for yarn_dir in found_package_manager['yarn'].keys():
|
|
129
|
+
if yarn_dir in found_package_manager['npm']:
|
|
130
|
+
dirs_to_remove_from_npm.append(yarn_dir)
|
|
131
|
+
|
|
132
|
+
for dir_to_remove in dirs_to_remove_from_npm:
|
|
133
|
+
del found_package_manager['npm'][dir_to_remove]
|
|
134
|
+
|
|
135
|
+
# If npm has no directories left, remove it entirely
|
|
136
|
+
if not found_package_manager['npm']:
|
|
137
|
+
del found_package_manager['npm']
|
|
138
|
+
|
|
139
|
+
if len(found_package_manager) >= 1:
|
|
140
|
+
log_lines = ["\nDetected Manifest Files automatically"]
|
|
141
|
+
log_lines = print_package_info(found_package_manager, log_lines)
|
|
142
|
+
logger.info('\n'.join(log_lines))
|
|
143
|
+
else:
|
|
144
|
+
ret = False
|
|
145
|
+
logger.info("Cannot find the manifest file.")
|
|
146
|
+
|
|
147
|
+
return ret, found_package_manager, input_dir, suggested_files
|
|
148
|
+
|
|
149
|
+
|
|
150
|
+
def print_package_info(pm, log_lines, status=''):
|
|
151
|
+
if pm:
|
|
152
|
+
if status:
|
|
153
|
+
status = f"[{status}] "
|
|
154
|
+
for pm, dir_dict in pm.items():
|
|
155
|
+
log_lines.append(f"- {status} {pm}:")
|
|
156
|
+
for path, files in dir_dict.items():
|
|
157
|
+
file_list = ', '.join(files)
|
|
158
|
+
log_lines.append(f" {path}: {file_list}")
|
|
159
|
+
return log_lines
|
|
160
|
+
|
|
161
|
+
|
|
162
|
+
def run_dependency_scanner(package_manager='', input_dir='', output_dir_file='', pip_activate_cmd='',
|
|
163
|
+
pip_deactivate_cmd='', output_custom_dir='', app_name=const.default_app_name,
|
|
164
|
+
github_token='', formats=[], direct=True, path_to_exclude=[], graph_path='',
|
|
165
|
+
graph_size=(600, 600), recursive=False, all_exclude_mode=()):
|
|
166
|
+
global logger
|
|
167
|
+
|
|
168
|
+
ret = True
|
|
169
|
+
_json_ext = ".json"
|
|
170
|
+
_start_time = datetime.now().strftime('%y%m%d_%H%M')
|
|
171
|
+
scan_item = ScannerItem(_PKG_NAME, _start_time)
|
|
172
|
+
|
|
173
|
+
success, msg, output_path, output_files, output_extensions, formats = check_output_formats_v2(output_dir_file, formats)
|
|
174
|
+
if success:
|
|
175
|
+
if output_path == "":
|
|
176
|
+
output_path = os.getcwd()
|
|
177
|
+
else:
|
|
178
|
+
output_path = os.path.abspath(output_path)
|
|
179
|
+
|
|
180
|
+
if not output_files:
|
|
181
|
+
while len(output_files) < len(output_extensions):
|
|
182
|
+
output_files.append(None)
|
|
183
|
+
to_remove = [] # elements of spdx format on windows that should be removed
|
|
184
|
+
for i, output_extension in enumerate(output_extensions):
|
|
185
|
+
if formats:
|
|
186
|
+
if formats[i].startswith('spdx') or formats[i].startswith('cyclonedx'):
|
|
187
|
+
if platform.system() == 'Windows':
|
|
188
|
+
logger.warning(f'{formats[i]} is not supported on Windows.Please remove {formats[i]} from format.')
|
|
189
|
+
to_remove.append(i)
|
|
190
|
+
else:
|
|
191
|
+
if formats[i].startswith('spdx'):
|
|
192
|
+
output_files[i] = f"fosslight_spdx_dep_{_start_time}"
|
|
193
|
+
elif formats[i].startswith('cyclonedx'):
|
|
194
|
+
output_files[i] = f'fosslight_cyclonedx_dep_{_start_time}'
|
|
195
|
+
else:
|
|
196
|
+
if output_extension == _json_ext:
|
|
197
|
+
output_files[i] = f"fosslight_opossum_dep_{_start_time}"
|
|
198
|
+
else:
|
|
199
|
+
output_files[i] = f"fosslight_report_dep_{_start_time}"
|
|
200
|
+
else:
|
|
201
|
+
if output_extension == _json_ext:
|
|
202
|
+
output_files[i] = f"fosslight_opossum_dep_{_start_time}"
|
|
203
|
+
else:
|
|
204
|
+
output_files[i] = f"fosslight_report_dep_{_start_time}"
|
|
205
|
+
for index in sorted(to_remove, reverse=True):
|
|
206
|
+
# remove elements of spdx format on windows
|
|
207
|
+
del output_files[index]
|
|
208
|
+
del output_extensions[index]
|
|
209
|
+
del formats[index]
|
|
210
|
+
if len(output_extensions) < 1:
|
|
211
|
+
sys.exit(0)
|
|
212
|
+
else:
|
|
213
|
+
logger.error(msg)
|
|
214
|
+
sys.exit(1)
|
|
215
|
+
|
|
216
|
+
logger, _result_log = init_log(os.path.join(output_path, "fosslight_log_dep_" + _start_time + ".txt"),
|
|
217
|
+
True, logging.INFO, logging.DEBUG, _PKG_NAME, "", path_to_exclude)
|
|
218
|
+
|
|
219
|
+
logger.info(f"Tool Info : {_result_log['Tool Info']}")
|
|
220
|
+
|
|
221
|
+
if not success:
|
|
222
|
+
logger.error(msg)
|
|
223
|
+
return False, scan_item
|
|
224
|
+
|
|
225
|
+
if input_dir:
|
|
226
|
+
if os.path.isdir(input_dir):
|
|
227
|
+
os.chdir(input_dir)
|
|
228
|
+
input_dir = os.getcwd()
|
|
229
|
+
else:
|
|
230
|
+
logger.error(f"(-p option) You entered the wrong input path({input_dir}) to run the script.")
|
|
231
|
+
logger.error("Please enter the existed input path with '-p' option.")
|
|
232
|
+
return False, scan_item
|
|
233
|
+
else:
|
|
234
|
+
input_dir = os.getcwd()
|
|
235
|
+
os.chdir(input_dir)
|
|
236
|
+
|
|
237
|
+
autodetect = True
|
|
238
|
+
found_package_manager = {}
|
|
239
|
+
if package_manager:
|
|
240
|
+
scan_item.set_cover_comment(f"Manual detect mode (-m {package_manager})")
|
|
241
|
+
autodetect = False
|
|
242
|
+
support_packagemanager = list(const.SUPPORT_PACKAE.keys())
|
|
243
|
+
|
|
244
|
+
if package_manager not in support_packagemanager:
|
|
245
|
+
logger.error(f"(-m option) You entered the unsupported package manager({package_manager}).")
|
|
246
|
+
logger.error("Please enter the supported package manager({0}) with '-m' option."
|
|
247
|
+
.format(", ".join(support_packagemanager)))
|
|
248
|
+
return False, scan_item
|
|
249
|
+
manifest_file_name = []
|
|
250
|
+
value = const.SUPPORT_PACKAE[package_manager]
|
|
251
|
+
if isinstance(value, list):
|
|
252
|
+
manifest_file_name.extend(value)
|
|
253
|
+
else:
|
|
254
|
+
manifest_file_name.append(value)
|
|
255
|
+
else:
|
|
256
|
+
manifest_file_name = []
|
|
257
|
+
|
|
258
|
+
try:
|
|
259
|
+
if all_exclude_mode and len(all_exclude_mode) == 4:
|
|
260
|
+
excluded_path_with_default_exclusion, excluded_path_without_dot, excluded_files, _ = all_exclude_mode
|
|
261
|
+
else:
|
|
262
|
+
excluded_path_with_default_exclusion, excluded_path_without_dot, excluded_files, _ = (
|
|
263
|
+
get_excluded_paths(input_dir, path_to_exclude))
|
|
264
|
+
logger.debug(f"Skipped paths: {excluded_path_with_default_exclusion}")
|
|
265
|
+
|
|
266
|
+
scan_item.set_cover_pathinfo(input_dir, excluded_path_without_dot)
|
|
267
|
+
ret, found_package_manager, input_dir, suggested_files = find_package_manager(input_dir,
|
|
268
|
+
excluded_path_with_default_exclusion,
|
|
269
|
+
manifest_file_name,
|
|
270
|
+
recursive,
|
|
271
|
+
excluded_files)
|
|
272
|
+
except Exception as e:
|
|
273
|
+
if autodetect:
|
|
274
|
+
logger.error(f'Fail to find package manager: {e}')
|
|
275
|
+
ret = False
|
|
276
|
+
finally:
|
|
277
|
+
if not ret:
|
|
278
|
+
if not autodetect:
|
|
279
|
+
logger.info('Try to analyze dependency without manifest file. (Manual mode)')
|
|
280
|
+
found_package_manager[package_manager] = {}
|
|
281
|
+
else:
|
|
282
|
+
ret = False
|
|
283
|
+
if suggested_files:
|
|
284
|
+
suggested_files_str = []
|
|
285
|
+
suggested_files_str.append("Please check the following files and try again:")
|
|
286
|
+
for f in suggested_files:
|
|
287
|
+
pm = const.SUGGESTED_PACKAGE[f.split(os.path.sep)[-1]]
|
|
288
|
+
suggested_files_str.append(f"\t\t\t{f} ({pm}) detected, but {const.SUPPORT_PACKAE[pm]} missing.")
|
|
289
|
+
|
|
290
|
+
suggested_files_str.append("\t\t\tRefer: https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html.")
|
|
291
|
+
scan_item.set_cover_comment('\n'.join(suggested_files_str))
|
|
292
|
+
else:
|
|
293
|
+
scan_item.set_cover_comment("No Package manager detected.")
|
|
294
|
+
|
|
295
|
+
pass_key = ['PASS']
|
|
296
|
+
success_pm = defaultdict(lambda: defaultdict(list))
|
|
297
|
+
fail_pm = defaultdict(lambda: defaultdict(list))
|
|
298
|
+
cover_comment = ''
|
|
299
|
+
for pm, manifest_file_name_list in found_package_manager.items():
|
|
300
|
+
if not manifest_file_name_list and not autodetect:
|
|
301
|
+
ret, package_dep_item_list, cover_comment, actual_pm = analyze_dependency(pm, input_dir, output_path,
|
|
302
|
+
pip_activate_cmd, pip_deactivate_cmd,
|
|
303
|
+
output_custom_dir, app_name, github_token,
|
|
304
|
+
[], direct)
|
|
305
|
+
if ret:
|
|
306
|
+
success_pm[actual_pm][input_dir].extend(['manual mode (-m option)'])
|
|
307
|
+
scan_item.append_file_items(package_dep_item_list)
|
|
308
|
+
else:
|
|
309
|
+
fail_pm[actual_pm][input_dir].extend(['manual mode (-m option)'])
|
|
310
|
+
else:
|
|
311
|
+
for manifest_dir, manifest_file_name in manifest_file_name_list.items():
|
|
312
|
+
input_dir = manifest_dir
|
|
313
|
+
if manifest_file_name == pass_key:
|
|
314
|
+
continue
|
|
315
|
+
os.chdir(input_dir)
|
|
316
|
+
ret, package_dep_item_list, cover_comment, actual_pm = analyze_dependency(pm, input_dir, output_path,
|
|
317
|
+
pip_activate_cmd, pip_deactivate_cmd,
|
|
318
|
+
output_custom_dir, app_name,
|
|
319
|
+
github_token,
|
|
320
|
+
manifest_file_name, direct)
|
|
321
|
+
if ret:
|
|
322
|
+
success_pm[actual_pm][input_dir].extend(manifest_file_name)
|
|
323
|
+
scan_item.append_file_items(package_dep_item_list)
|
|
324
|
+
|
|
325
|
+
dup_pm = None
|
|
326
|
+
if actual_pm == const.GRADLE and const.ANDROID in found_package_manager:
|
|
327
|
+
dup_pm = const.ANDROID
|
|
328
|
+
elif actual_pm == const.ANDROID and const.GRADLE in found_package_manager:
|
|
329
|
+
dup_pm = const.GRADLE
|
|
330
|
+
|
|
331
|
+
if dup_pm:
|
|
332
|
+
if dup_pm in fail_pm and input_dir in fail_pm[dup_pm]:
|
|
333
|
+
fail_pm[dup_pm].pop(input_dir, None)
|
|
334
|
+
if not fail_pm[dup_pm]:
|
|
335
|
+
fail_pm.pop(dup_pm, None)
|
|
336
|
+
else:
|
|
337
|
+
found_package_manager[dup_pm][manifest_dir] = pass_key
|
|
338
|
+
else:
|
|
339
|
+
fail_pm[actual_pm][input_dir].extend(manifest_file_name)
|
|
340
|
+
|
|
341
|
+
success_pm = {k: dict(v) for k, v in success_pm.items()}
|
|
342
|
+
fail_pm = {k: dict(v) for k, v in fail_pm.items()}
|
|
343
|
+
if len(found_package_manager.keys()) > 0:
|
|
344
|
+
log_lines = ["Dependency Analysis Summary"]
|
|
345
|
+
if len(success_pm) > 0:
|
|
346
|
+
log_lines = print_package_info(success_pm, log_lines, 'Success')
|
|
347
|
+
if len(fail_pm) > 0:
|
|
348
|
+
log_lines = print_package_info(fail_pm, log_lines, 'Fail')
|
|
349
|
+
log_lines.append('If analysis fails, see fosslight_log*.txt and the prerequisite guide: '
|
|
350
|
+
'https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html#-prerequisite.')
|
|
351
|
+
scan_item.set_cover_comment('\n'.join(log_lines))
|
|
352
|
+
|
|
353
|
+
if ret and graph_path:
|
|
354
|
+
graph_path = os.path.abspath(graph_path)
|
|
355
|
+
try:
|
|
356
|
+
converter = GraphConvertor(scan_item.file_items[_PKG_NAME])
|
|
357
|
+
growth_factor_per_node = 10
|
|
358
|
+
node_count_threshold = 20
|
|
359
|
+
node_count = len(scan_item.file_items[_PKG_NAME])
|
|
360
|
+
if node_count > node_count_threshold:
|
|
361
|
+
new_size = tuple(x + (node_count * growth_factor_per_node) for x in graph_size)
|
|
362
|
+
else:
|
|
363
|
+
new_size = graph_size
|
|
364
|
+
new_size = tuple((((x + 99) // 100) * 100) for x in new_size)
|
|
365
|
+
converter.save(graph_path, new_size)
|
|
366
|
+
logger.info(f"Output graph image file: {graph_path}")
|
|
367
|
+
except Exception as e:
|
|
368
|
+
logger.error(f'Fail to make graph image: {e}')
|
|
369
|
+
|
|
370
|
+
if cover_comment:
|
|
371
|
+
scan_item.set_cover_comment(cover_comment)
|
|
372
|
+
|
|
373
|
+
combined_paths_and_files = [os.path.join(output_path, file) for file in output_files]
|
|
374
|
+
results = []
|
|
375
|
+
for i, output_extension in enumerate(output_extensions):
|
|
376
|
+
results.append(write_output_file(combined_paths_and_files[i], output_extension, scan_item,
|
|
377
|
+
EXTENDED_HEADER, '', formats[i]))
|
|
378
|
+
for success_write, err_msg, result_file in results:
|
|
379
|
+
if success_write:
|
|
380
|
+
if result_file:
|
|
381
|
+
logger.info(f"Output file: {result_file}")
|
|
382
|
+
else:
|
|
383
|
+
logger.warning(f"{err_msg}")
|
|
384
|
+
for i in scan_item.get_cover_comment():
|
|
385
|
+
if ret:
|
|
386
|
+
logger.info(i)
|
|
387
|
+
else:
|
|
388
|
+
logger.warning(i)
|
|
389
|
+
else:
|
|
390
|
+
ret = False
|
|
391
|
+
logger.error(f"Fail to generate result file. msg:({err_msg})")
|
|
392
|
+
|
|
393
|
+
return ret, scan_item
|
|
@@ -0,0 +1,213 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: fosslight_dependency
|
|
3
|
+
Version: 4.1.30
|
|
4
|
+
Summary: FOSSLight Dependency Scanner
|
|
5
|
+
Home-page: https://github.com/fosslight/fosslight_dependency_scanner
|
|
6
|
+
Download-URL: https://github.com/fosslight/fosslight_dependency_scanner
|
|
7
|
+
Author: LG Electronics
|
|
8
|
+
License: Apache-2.0
|
|
9
|
+
Classifier: License :: OSI Approved :: Apache Software License
|
|
10
|
+
Classifier: Programming Language :: Python :: 3
|
|
11
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
14
|
+
Requires-Python: >=3.10,<3.13
|
|
15
|
+
Description-Content-Type: text/markdown
|
|
16
|
+
License-File: LICENSE
|
|
17
|
+
License-File: LICENSES/Apache-2.0.txt
|
|
18
|
+
License-File: LICENSES/LicenseRef-3rd_party_licenses.txt
|
|
19
|
+
License-File: LICENSES/MIT.txt
|
|
20
|
+
Requires-Dist: openpyxl
|
|
21
|
+
Requires-Dist: beautifulsoup4
|
|
22
|
+
Requires-Dist: lxml
|
|
23
|
+
Requires-Dist: virtualenv
|
|
24
|
+
Requires-Dist: pyyaml
|
|
25
|
+
Requires-Dist: lastversion
|
|
26
|
+
Requires-Dist: fosslight_util>=2.1.37
|
|
27
|
+
Requires-Dist: PyGithub
|
|
28
|
+
Requires-Dist: requirements-parser
|
|
29
|
+
Requires-Dist: defusedxml
|
|
30
|
+
Requires-Dist: packageurl-python
|
|
31
|
+
Requires-Dist: igraph
|
|
32
|
+
Requires-Dist: matplotlib
|
|
33
|
+
Requires-Dist: pyaskalono
|
|
34
|
+
Dynamic: author
|
|
35
|
+
Dynamic: classifier
|
|
36
|
+
Dynamic: description
|
|
37
|
+
Dynamic: description-content-type
|
|
38
|
+
Dynamic: download-url
|
|
39
|
+
Dynamic: home-page
|
|
40
|
+
Dynamic: license
|
|
41
|
+
Dynamic: license-file
|
|
42
|
+
Dynamic: requires-dist
|
|
43
|
+
Dynamic: requires-python
|
|
44
|
+
Dynamic: summary
|
|
45
|
+
|
|
46
|
+
<!--
|
|
47
|
+
Copyright (c) 2021 LG Electronics
|
|
48
|
+
SPDX-License-Identifier: Apache-2.0
|
|
49
|
+
-->
|
|
50
|
+
|
|
51
|
+
# FOSSLight Dependency Scanner
|
|
52
|
+
|
|
53
|
+
<img src="https://img.shields.io/pypi/l/fosslight_dependency" alt="License" /> <a href="https://pypi.org/project/fosslight-dependency/"><img src="https://img.shields.io/pypi/v/fosslight_dependency" alt="Current python package version." /></a> <img src="https://img.shields.io/pypi/pyversions/fosslight_dependency" /> [](https://api.reuse.software/info/github.com/fosslight/fosslight_dependency_scanner)
|
|
54
|
+
|
|
55
|
+
## 💡 Introduction
|
|
56
|
+
|
|
57
|
+
This is the tool that supports the analysis of dependencies for multiple package managers. It detects the manifest file of package managers automatically and analyzes the dependencies with using open source tools. Then, it generates the report file that contains OSS information of dependencies.
|
|
58
|
+
|
|
59
|
+
## 📖 User Guide
|
|
60
|
+
|
|
61
|
+
We describe the user guide in the [**FOSSLight Guide page**](https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html).
|
|
62
|
+
In this user guide, you can see how to install the FOSSLight Dependency Scanner and how to set up the prerequisite step and run it according to the package manager of your project. Also, you can check the results of the FOSSLight Dependency Scanner.
|
|
63
|
+
|
|
64
|
+
## 👀 Package Support Level
|
|
65
|
+
|
|
66
|
+
<table>
|
|
67
|
+
<thead>
|
|
68
|
+
<tr>
|
|
69
|
+
<th>Language/<br>Project</th>
|
|
70
|
+
<th>Package Manager</th>
|
|
71
|
+
<th>Manifest file</th>
|
|
72
|
+
<th>Direct dependencies</th>
|
|
73
|
+
<th>Transitive dependencies</th>
|
|
74
|
+
<th>Relationship of dependencies<br>(Dependencies of each dependency)</th>
|
|
75
|
+
</tr>
|
|
76
|
+
</thead>
|
|
77
|
+
<tbody>
|
|
78
|
+
<tr>
|
|
79
|
+
<td rowspan="3">Javascript</td>
|
|
80
|
+
<td>Npm</td>
|
|
81
|
+
<td>package.json</td>
|
|
82
|
+
<td>O</td>
|
|
83
|
+
<td>O</td>
|
|
84
|
+
<td>O</td>
|
|
85
|
+
</tr>
|
|
86
|
+
<tr>
|
|
87
|
+
<td>Pnpm</td>
|
|
88
|
+
<td>pnpm-lock.yaml</td>
|
|
89
|
+
<td>O</td>
|
|
90
|
+
<td>O</td>
|
|
91
|
+
<td>O</td>
|
|
92
|
+
</tr>
|
|
93
|
+
<tr>
|
|
94
|
+
<td>Yarn</td>
|
|
95
|
+
<td>package.json</td>
|
|
96
|
+
<td>O</td>
|
|
97
|
+
<td>O</td>
|
|
98
|
+
<td>O</td>
|
|
99
|
+
</tr>
|
|
100
|
+
<tr>
|
|
101
|
+
<td rowspan="2">Java</td>
|
|
102
|
+
<td>Gradle</td>
|
|
103
|
+
<td>build.gradle</td>
|
|
104
|
+
<td>O</td>
|
|
105
|
+
<td>O</td>
|
|
106
|
+
<td>O</td>
|
|
107
|
+
</tr>
|
|
108
|
+
<tr>
|
|
109
|
+
<td>Maven</td>
|
|
110
|
+
<td>pom.xml</td>
|
|
111
|
+
<td>O</td>
|
|
112
|
+
<td>O</td>
|
|
113
|
+
<td>O</td>
|
|
114
|
+
</tr>
|
|
115
|
+
<tr>
|
|
116
|
+
<td>Java (Android)</td>
|
|
117
|
+
<td>Gradle</td>
|
|
118
|
+
<td>build.gradle</td>
|
|
119
|
+
<td>O</td>
|
|
120
|
+
<td>O</td>
|
|
121
|
+
<td>O</td>
|
|
122
|
+
</tr>
|
|
123
|
+
<tr>
|
|
124
|
+
<td rowspan="2">ObjC, Swift (iOS)</td>
|
|
125
|
+
<td>Cocoapods</td>
|
|
126
|
+
<td>Podfile.lock</td>
|
|
127
|
+
<td>O</td>
|
|
128
|
+
<td>O</td>
|
|
129
|
+
<td>O</td>
|
|
130
|
+
</tr>
|
|
131
|
+
<tr>
|
|
132
|
+
<td>Carthage</td>
|
|
133
|
+
<td>Cartfile.resolved</td>
|
|
134
|
+
<td>O</td>
|
|
135
|
+
<td>O</td>
|
|
136
|
+
<td>X</td>
|
|
137
|
+
</tr>
|
|
138
|
+
<tr>
|
|
139
|
+
<td>Swift (iOS)</td>
|
|
140
|
+
<td>Swift</td>
|
|
141
|
+
<td>Package.resolved</td>
|
|
142
|
+
<td>O</td>
|
|
143
|
+
<td>O</td>
|
|
144
|
+
<td>O</td>
|
|
145
|
+
</tr>
|
|
146
|
+
<tr>
|
|
147
|
+
<td>Dart, Flutter</td>
|
|
148
|
+
<td>Pub</td>
|
|
149
|
+
<td>pubspec.yaml</td>
|
|
150
|
+
<td>O</td>
|
|
151
|
+
<td>O</td>
|
|
152
|
+
<td>O</td>
|
|
153
|
+
</tr>
|
|
154
|
+
<tr>
|
|
155
|
+
<td>Go</td>
|
|
156
|
+
<td>Go</td>
|
|
157
|
+
<td>go.mod</td>
|
|
158
|
+
<td>O</td>
|
|
159
|
+
<td>O</td>
|
|
160
|
+
<td>O</td>
|
|
161
|
+
</tr>
|
|
162
|
+
<tr>
|
|
163
|
+
<td>Python</td>
|
|
164
|
+
<td>Pypi</td>
|
|
165
|
+
<td>requirements.txt, setup.py, pyproject.toml</td>
|
|
166
|
+
<td>O</td>
|
|
167
|
+
<td>O</td>
|
|
168
|
+
<td>O</td>
|
|
169
|
+
</tr>
|
|
170
|
+
<tr>
|
|
171
|
+
<td>.NET</td>
|
|
172
|
+
<td>Nuget</td>
|
|
173
|
+
<td>packages.config, obj/project.assets.json</td>
|
|
174
|
+
<td>O</td>
|
|
175
|
+
<td>O</td>
|
|
176
|
+
<td>O</td>
|
|
177
|
+
</tr>
|
|
178
|
+
<tr>
|
|
179
|
+
<td>Kubernetes</td>
|
|
180
|
+
<td>Helm</td>
|
|
181
|
+
<td>Chart.yaml</td>
|
|
182
|
+
<td>O</td>
|
|
183
|
+
<td>X</td>
|
|
184
|
+
<td>X</td>
|
|
185
|
+
</tr>
|
|
186
|
+
<tr>
|
|
187
|
+
<td>Unity</td>
|
|
188
|
+
<td>Unity</td>
|
|
189
|
+
<td>Library/PackageManager/ProjectCache</td>
|
|
190
|
+
<td>O</td>
|
|
191
|
+
<td>O</td>
|
|
192
|
+
<td>X</td>
|
|
193
|
+
</tr>
|
|
194
|
+
<tr>
|
|
195
|
+
<td>Rust</td>
|
|
196
|
+
<td>Cargo</td>
|
|
197
|
+
<td>Cargo.toml</td>
|
|
198
|
+
<td>O</td>
|
|
199
|
+
<td>O</td>
|
|
200
|
+
<td>O</td>
|
|
201
|
+
</tr>
|
|
202
|
+
</tbody>
|
|
203
|
+
</table>
|
|
204
|
+
|
|
205
|
+
## 👏 Contributing Guide
|
|
206
|
+
|
|
207
|
+
We always welcome your contributions.
|
|
208
|
+
Please see the [CONTRIBUTING guide](https://github.com/fosslight/fosslight_dependency_scanner/blob/main/CONTRIBUTING.md) for how to contribute.
|
|
209
|
+
|
|
210
|
+
## 📄 License
|
|
211
|
+
|
|
212
|
+
Copyright (c) 2020 LG Electronics, Inc.
|
|
213
|
+
FOSSLight Dependency Scanner is licensed under Apache-2.0, as found in the [LICENSE](https://github.com/fosslight/fosslight_dependency_scanner/blob/main/LICENSE) file.
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
fosslight_dependency/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
2
|
+
fosslight_dependency/_analyze_dependency.py,sha256=-iETqo4DNu_d8iJtC7Of0waY6YHjJ8OB8Lf_m-9WZXw,5888
|
|
3
|
+
fosslight_dependency/_graph_convertor.py,sha256=D8GwmJfuj9Wg3_DeKRPLGGdyHSLcoU2Q0VzKQbkJG4g,2267
|
|
4
|
+
fosslight_dependency/_help.py,sha256=1ER9CDiORhMdX1FYedPHcp2TRyvICPFGM1wxOOJ4PNE,3882
|
|
5
|
+
fosslight_dependency/_package_manager.py,sha256=-hEOG44AnBoSKjMM-WQAbZIXhD8kHc-EwkOl1aLu-CA,15824
|
|
6
|
+
fosslight_dependency/cli.py,sha256=A4SyAr9zfwI5cKPiWHsPvkD64HtUlpS3CRJ9DN3ytqo,4929
|
|
7
|
+
fosslight_dependency/constant.py,sha256=zaLjZsk4r5Gv6puCbV_Crt9pWrX_FEYzgEh0UQVIE4g,1291
|
|
8
|
+
fosslight_dependency/dependency_item.py,sha256=wNLWcsNycf3HQ5Pib2WrMeo2dn0eHCRg20NLcL95Qew,3345
|
|
9
|
+
fosslight_dependency/run_dependency_scanner.py,sha256=07HvKwmo1IQ--Nb8HWKZsDLNwuFV5XnA7CGFmnS4cs4,19029
|
|
10
|
+
fosslight_dependency/LICENSES/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
|
|
11
|
+
fosslight_dependency/LICENSES/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
|
|
12
|
+
fosslight_dependency/package_manager/Android.py,sha256=SgQyVxEYvAcCN3EgP9p4QOQZpLIGDahXRm8ntgoCM3c,3666
|
|
13
|
+
fosslight_dependency/package_manager/Cargo.py,sha256=cvAVtKeZSePFU1yRwYkfyZaxH_6D7Q_AnwLqQPHjOQE,5966
|
|
14
|
+
fosslight_dependency/package_manager/Carthage.py,sha256=VU506KafUiHBrr_62iOOXNI1fDOreOQgcC2EWM5PpQo,6122
|
|
15
|
+
fosslight_dependency/package_manager/Cocoapods.py,sha256=k_URV1ekMOU8l_y9_KIp_luu96ZGOl1xLIkH737VREA,8524
|
|
16
|
+
fosslight_dependency/package_manager/Go.py,sha256=eEWvPoE3Jd0lMJAxWMNdFcoi21fJF0EwtRbjBDHF8KQ,7309
|
|
17
|
+
fosslight_dependency/package_manager/Gradle.py,sha256=zTMvospDpfabl2DRk1jW316lW9BJfGtf05TBcna6E8E,4640
|
|
18
|
+
fosslight_dependency/package_manager/Helm.py,sha256=ucx2Y0tWX37UHIzIGaRyTe7uQ2vlu2nUuO09hOMq9ZU,4223
|
|
19
|
+
fosslight_dependency/package_manager/Maven.py,sha256=F1KQxR_LjSxl7ZgRS_W1TbuDpRERLoAVGLIUWOpjLmk,11046
|
|
20
|
+
fosslight_dependency/package_manager/Npm.py,sha256=6DSsRnk8tj8NUTjG4qFfybi9x-GW1I3FRGYbNn9IJpk,12300
|
|
21
|
+
fosslight_dependency/package_manager/Nuget.py,sha256=Q_pDGxsNOboVcA6KCEt2rAdFvTB46Z5sOvY4pKwNiHo,17290
|
|
22
|
+
fosslight_dependency/package_manager/Pnpm.py,sha256=LDKooFGQHui_Q5U7XqSJ8KcCPiLVndXf5oGKTJExh5w,7056
|
|
23
|
+
fosslight_dependency/package_manager/Pub.py,sha256=g4jqA19vf3jBdlmPLVZiIYMAQHNn3Y2I-_oq3vtpfv0,10372
|
|
24
|
+
fosslight_dependency/package_manager/Pypi.py,sha256=Ae-mFl9jSgc1XrUdzAuKGuZA4nduSsWaC-u6VVjFNtg,17187
|
|
25
|
+
fosslight_dependency/package_manager/Swift.py,sha256=8fdbdAXTNlp2NDoSqQXm48JGAg9UhxA91M1-NhHkT40,6752
|
|
26
|
+
fosslight_dependency/package_manager/Unity.py,sha256=n1006GZ6Qrk8wAdO6wla1Q-JD7Evin7REVj-HDeTARc,5142
|
|
27
|
+
fosslight_dependency/package_manager/Yarn.py,sha256=ZSi7_O5tMmS80Z58YOZxvai84_KyDpP8plo0x80YtVc,10069
|
|
28
|
+
fosslight_dependency/package_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
|
|
29
|
+
fosslight_dependency-4.1.30.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
|
|
30
|
+
fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/Apache-2.0.txt,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
|
|
31
|
+
fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
|
|
32
|
+
fosslight_dependency-4.1.30.dist-info/licenses/LICENSES/MIT.txt,sha256=9cx4CbArgByWvkoEZNqpzbpJgA9TUe2D62rMocQpgfs,1082
|
|
33
|
+
fosslight_dependency-4.1.30.dist-info/METADATA,sha256=-ge88XH9A8gLn5KC0lTD028fXrAL9nW2tp0rL27LnQs,5555
|
|
34
|
+
fosslight_dependency-4.1.30.dist-info/WHEEL,sha256=SmOxYU7pzNKBqASvQJ7DjX3XGUF92lrGhMb3R6_iiqI,91
|
|
35
|
+
fosslight_dependency-4.1.30.dist-info/entry_points.txt,sha256=bJlbAsDzlnvBYHImO0uVqbVXdaDcBzMu4i_X5M8Pd1w,71
|
|
36
|
+
fosslight_dependency-4.1.30.dist-info/top_level.txt,sha256=Jc0V7VcVCH0TEM8ksb8dwroTYz4AmRaQnlr3FB71Hcs,21
|
|
37
|
+
fosslight_dependency-4.1.30.dist-info/RECORD,,
|