fosslight-dependency 3.13.9__py3-none-any.whl → 3.14.1__py3-none-any.whl

fosslight_dependency/_package_manager.py

@@ -13,6 +13,7 @@ import subprocess
 import shutil
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
+from packageurl.contrib import url2purl
 
 try:
     from github import Github
@@ -48,6 +49,7 @@ class PackageManager:
         self.manifest_file_name = []
         self.relation_tree = {}
         self.package_name = ''
+        self.purl_dict = {}
 
         self.platform = platform.system()
         self.license_scanner_bin = check_license_scanner(self.platform)
@@ -188,6 +190,38 @@ class PackageManager:
             logger.warning(f'Fail to parse gradle dependency tree:{e}')
 
 
+def get_url_to_purl(url, pkg_manager, oss_name='', oss_version=''):
+    purl_prefix = f'pkg:{pkg_manager}'
+    purl = str(url2purl.get_purl(url))
+    if not re.match(purl_prefix, purl):
+        match = re.match(constant.PKG_PATTERN.get(pkg_manager, 'not_support'), url)
+        try:
+            if match and (match != ''):
+                if pkg_manager == 'maven':
+                    purl = f'{purl_prefix}/{match.group(1)}/{match.group(2)}@{match.group(3)}'
+                elif pkg_manager == 'pub':
+                    purl = f'{purl_prefix}/{match.group(1)}@{match.group(2)}'
+                elif pkg_manager == 'cocoapods':
+                    match = re.match(r'([^\/]+)\/?([^\/]*)', oss_name)  # ex, GoogleUtilities/NSData+zlib
+                    purl = f'{purl_prefix}/{match.group(1)}@{oss_version}'
+                    if match.group(2):
+                        purl = f'{purl}#{match.group(2)}'
+                elif pkg_manager == 'go':
+                    purl = f'{purl_prefix}lang/{match.group(1)}@{match.group(2)}'
+            else:
+                if pkg_manager == 'swift':
+                    if oss_version:
+                        purl = f'{purl_prefix}/{oss_name}@{oss_version}'
+                    else:
+                        purl = f'{purl_prefix}/{oss_name}'
+                elif pkg_manager == 'carthage':
+                    if oss_version:
+                        purl = f'{purl}@{oss_version}'
+        except Exception:
+            logger.debug('Fail to get purl. So use the link purl({purl}).')
+    return purl
+
+
 def version_refine(oss_version):
     version_cmp = oss_version.upper()
 

fosslight_dependency/constant.py

@@ -25,7 +25,7 @@ HELM = 'helm'
 
 # Supported package name and manifest file
 SUPPORT_PACKAE = {
-    PYPI: ['requirements.txt', 'setup.py'],
+    PYPI: ['requirements.txt', 'setup.py', 'pyproject.toml'],
     NPM: 'package.json',
     MAVEN: 'pom.xml',
     GRADLE: 'build.gradle',

fosslight_dependency/package_manager/Android.py

@@ -7,7 +7,7 @@ import os
 import logging
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
-from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import PackageManager, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -49,6 +49,8 @@ class Android(PackageManager):
                     idx, manifest_file, oss_name, oss_version, license_name, dn_loc, homepage = split_str
                 else:
                     continue
+                purl = get_url_to_purl(dn_loc, 'maven')
+                self.purl_dict[f'{oss_name}({oss_version})'] = purl
 
                 comment_list = []
                 deps_list = []
@@ -69,6 +71,7 @@ class Android(PackageManager):
                 comment = ','.join(comment_list)
                 deps = ','.join(deps_list)
 
-                sheet_list.append([manifest_file, oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                                  '', '', comment, deps])
 
         return sheet_list

fosslight_dependency/package_manager/Carthage.py

@@ -9,9 +9,8 @@ import os
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import connect_github
-from fosslight_dependency._package_manager import get_github_license
-from fosslight_dependency._package_manager import check_and_run_license_scanner
+from fosslight_dependency._package_manager import connect_github, get_github_license, check_and_run_license_scanner
+from fosslight_dependency._package_manager import get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -60,9 +59,10 @@ class Carthage(PackageManager):
                     else:
                         homepage = oss_path
                     dn_loc = homepage
-
                     oss_version = re_result[0][2]
 
+                    purl = get_url_to_purl(homepage, self.package_manager_name, oss_origin_name, oss_version)
+
                     license_name = ''
                     find_license = False
                     if oss_origin_name in checkout_dir_list:
@@ -96,8 +96,8 @@ class Carthage(PackageManager):
                         else:
                             comment = 'transitive'
 
-                    sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                                      oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, ''])
+                    sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                                      '', '', comment, ''])
 
                 except Exception as e:
                     logger.warning(f"Failed to parse oss information: {e}")

fosslight_dependency/package_manager/Cocoapods.py

@@ -10,7 +10,7 @@ import yaml
 import re
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
-from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import PackageManager, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -86,7 +86,7 @@ class Cocoapods(PackageManager):
             try:
                 comment_list = []
                 deps_list = []
-                if self.direct_dep:
+                if self.direct_dep and (len(self.direct_dep_list) > 0):
                     if pod_oss_name_origin in self.direct_dep_list:
                         comment_list.append('direct')
                     else:
@@ -98,10 +98,12 @@ class Cocoapods(PackageManager):
                 comment = ','.join(comment_list)
                 deps = ','.join(deps_list)
 
+                oss_name_report = f'{self.package_manager_name}:{pod_oss_name_origin}'
                 pod_oss_name = pod_oss_name_origin
                 if '/' in pod_oss_name_origin:
                     pod_oss_name = pod_oss_name_origin.split('/')[0]
                 if pod_oss_name in external_source_list:
+                    oss_name_report = pod_oss_name_origin
                     podspec_filename = pod_oss_name + '.podspec.json'
                     spec_file_path = os.path.join("Pods", "Local Podspecs", podspec_filename)
                 else:
@@ -126,14 +128,17 @@ class Cocoapods(PackageManager):
                     spec_file_path = os.path.join(file_path_without_version, pod_oss_version, file_path[-1])
 
                 oss_name, oss_version, license_name, dn_loc, homepage = self.get_oss_in_podspec(spec_file_path)
+                purl = get_url_to_purl(homepage, self.package_manager_name, pod_oss_name_origin, oss_version)
+                self.purl_dict[f'{pod_oss_name_origin}({oss_version})'] = purl
+                if pod_oss_name in external_source_list:
+                    homepage = dn_loc
                 if oss_name == '':
                     continue
                 if pod_oss_version != oss_version:
                     logger.warning(f'{pod_oss_name_origin} has different version({pod_oss_version})\
                                    with spec version({oss_version})')
-                sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                                  f'{self.package_manager_name}:{pod_oss_name_origin}',
-                                   pod_oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name_report, pod_oss_version, license_name, dn_loc, homepage,
+                                  '', '', comment, deps])
             except Exception as e:
                 logger.warning(f"Fail to get {pod_oss_name_origin}:{e}")
 

fosslight_dependency/package_manager/Go.py

@@ -12,7 +12,7 @@ import urllib.request
 import re
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
-from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import PackageManager, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -107,6 +107,8 @@ class Go(PackageManager):
 
                 homepage_set = []
                 homepage = self.dn_url + package_path
+                purl = get_url_to_purl(f"{homepage}@{oss_version}", self.package_manager_name)
+                self.purl_dict[f'{package_path}({oss_version})'] = purl
 
                 if oss_origin_version:
                     tmp_homepage = f"{homepage}@{oss_origin_version}"
@@ -148,7 +150,7 @@ class Go(PackageManager):
 
             comment = ','.join(comment_list)
             deps = ','.join(deps_list)
-            sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                              oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+            sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                              '', '', comment, deps])
 
         return sheet_list

fosslight_dependency/package_manager/Gradle.py

@@ -9,7 +9,7 @@ import json
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import version_refine
+from fosslight_dependency._package_manager import version_refine, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -59,6 +59,7 @@ class Gradle(PackageManager):
             oss_version = version_refine(oss_ini_version)
 
             license_names = []
+            purl = ''
             try:
                 for licenses in d['licenses']:
                     if licenses['name'] != '':
@@ -73,6 +74,8 @@ class Gradle(PackageManager):
             else:
                 dn_loc = f"{self.dn_url}{group_id}/{artifact_id}/{oss_ini_version}"
                 homepage = f"{self.dn_url}{group_id}/{artifact_id}"
+                purl = get_url_to_purl(dn_loc, 'maven')
+                self.purl_dict[f'{oss_name}({oss_ini_version})'] = purl
 
             comment_list = []
             deps_list = []
@@ -90,8 +93,8 @@ class Gradle(PackageManager):
             comment = ','.join(comment_list)
             deps = ','.join(deps_list)
 
-            sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                              oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+            sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                              '', '', comment, deps])
 
         return sheet_list
 

fosslight_dependency/package_manager/Helm.py

@@ -10,7 +10,7 @@ import yaml
 import shutil
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
-from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import PackageManager, get_url_to_purl
 from fosslight_util.download import extract_compressed_dir
 
 logger = logging.getLogger(constant.LOGGER_NAME)
@@ -73,6 +73,7 @@ class Helm(PackageManager):
         for dep in dep_item_list:
             try:
                 f_path = os.path.join(self.tmp_charts_dir, dep, f_name)
+                purl = ''
                 with open(f_path, 'r', encoding='utf8') as yaml_fp:
                     yaml_f = yaml.safe_load(yaml_fp)
                     oss_name = f'{self.package_manager_name}:{yaml_f["name"]}'
@@ -85,6 +86,8 @@ class Helm(PackageManager):
                     if yaml_f.get('sources', '') != '':
                         dn_loc = yaml_f.get('sources', '')[0]
 
+                    purl = get_url_to_purl(dn_loc if dn_loc else homepage, self.package_manager_name)
+
                     license_name = ''
                     if yaml_f.get('annotations', '') != '':
                         license_name = yaml_f['annotations'].get('licenses', '')
@@ -96,7 +99,7 @@ class Helm(PackageManager):
                 logging.warning(f"Fail to parse chart info {dep}: {e}")
                 continue
 
-            sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                              oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, ''])
+            sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                              '', '', comment, ''])
 
         return sheet_list

fosslight_dependency/package_manager/Maven.py

@@ -13,7 +13,7 @@ import re
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import version_refine
+from fosslight_dependency._package_manager import version_refine, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -225,6 +225,8 @@ class Maven(PackageManager):
             oss_name = f"{groupid}:{artifactid}"
             dn_loc = f"{self.dn_url}{groupid}/{artifactid}/{version}"
             homepage = f"{self.dn_url}{groupid}/{artifactid}"
+            purl = get_url_to_purl(dn_loc, self.package_manager_name)
+            self.purl_dict[f'{oss_name}({oss_version})'] = purl
 
             licenses = d.find("licenses")
             if len(licenses):
@@ -253,7 +255,7 @@ class Maven(PackageManager):
             comment = ','.join(comment_list)
             deps = ','.join(deps_list)
 
-            sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                              oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+            sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                              '', '', comment, deps])
 
         return sheet_list

fosslight_dependency/package_manager/Npm.py

@@ -11,7 +11,7 @@ import shutil
 import re
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
-from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import PackageManager, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 node_modules = 'node_modules'
@@ -176,6 +176,8 @@ class Npm(PackageManager):
 
             homepage = self.dn_url + oss_init_name
             dn_loc = f"{self.dn_url}{oss_init_name}/v/{oss_version}"
+            purl = get_url_to_purl(dn_loc, self.package_manager_name)
+            self.purl_dict[f'{oss_init_name}({oss_version})'] = purl
             if d[_repository]:
                 dn_loc = d[_repository]
             elif private_pkg:
@@ -205,13 +207,13 @@ class Npm(PackageManager):
             deps = ','.join(deps_list)
             if multi_flag:
                 comment = f'{comment}, {license_comment}'
-                sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                                  oss_name, oss_version, multi_license, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name, oss_version, multi_license, dn_loc, homepage,
+                                  '', '', comment, deps])
             else:
                 license_name = license_name.replace(",", "")
                 license_name = check_unknown_license(license_name, manifest_file_path)
-                sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                                  oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                                  '', '', comment, deps])
 
         return sheet_list
 

fosslight_dependency/package_manager/Nuget.py

@@ -12,7 +12,7 @@ import requests
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import check_and_run_license_scanner
+from fosslight_dependency._package_manager import check_and_run_license_scanner, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -95,8 +95,11 @@ class Nuget(PackageManager):
                     else:
                         if dn_loc.endswith('.git'):
                             dn_loc = dn_loc[:-4]
+                    purl = get_url_to_purl(f'{homepage}/{oss_version}', self.package_manager_name)
                 else:
                     comment_list.append('Fail to response for nuget api')
+                    purl = f'pkg:nuget/{oss_origin_name}@{oss_version}'
+                self.purl_dict[f'{oss_origin_name}({oss_version})'] = purl
 
                 deps_list = []
                 if self.direct_dep and self.packageReference:
@@ -112,8 +115,7 @@ class Nuget(PackageManager):
 
                 comment = ','.join(comment_list)
                 deps = ','.join(deps_list)
-                sheet_list.append([','.join(self.input_package_list_file),
-                                  oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
 
             except Exception as e:
                 logger.warning(f"Failed to parse oss information: {e}")

fosslight_dependency/package_manager/Pub.py

@@ -13,7 +13,7 @@ import subprocess
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import check_and_run_license_scanner
+from fosslight_dependency._package_manager import check_and_run_license_scanner, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -124,6 +124,8 @@ class Pub(PackageManager):
                 if homepage is None:
                     homepage = ''
                 dn_loc = f"{self.dn_url}{oss_origin_name}/versions/{oss_version}"
+                purl = get_url_to_purl(dn_loc, self.package_manager_name)
+                self.purl_dict[f'{oss_origin_name}({oss_version})'] = purl
                 license_txt = json_data['license']
 
                 tmp_license_txt = open(tmp_license_txt_file_name, 'w', encoding='utf-8')
@@ -158,8 +160,8 @@ class Pub(PackageManager):
                         deps_list.extend(rel_items)
                 comment = ','.join(comment_list)
                 deps = ','.join(deps_list)
-                sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                                  oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+                sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                                  '', '', comment, deps])
         except Exception as e:
             logger.error(f"Fail to parse pub oss information: {e}")
 

fosslight_dependency/package_manager/Pypi.py

@@ -13,7 +13,7 @@ import re
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import check_and_run_license_scanner
+from fosslight_dependency._package_manager import check_and_run_license_scanner, get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -75,10 +75,10 @@ class Pypi(PackageManager):
         install_cmd_list = []
         for manifest_file in manifest_files:
             if os.path.exists(manifest_file):
-                if manifest_file == 'setup.py':
-                    install_cmd_list.append("pip install .")
-                elif manifest_file == 'requirements.txt':
+                if manifest_file == 'requirements.txt':
                     install_cmd_list.append("pip install -r requirements.txt")
+                else:
+                    install_cmd_list.append("pip install .")
             else:
                 manifest_files.remove(manifest_file)
                 self.set_manifest_file(manifest_files)
@@ -90,7 +90,7 @@ class Pypi(PackageManager):
             activate_cmd = os.path.join(self.venv_tmp_dir, "Scripts", "activate.bat")
             cmd_separator = "&"
         else:
-            create_venv_cmd = f"virtualenv -p python3 {self.venv_tmp_dir}"
+            create_venv_cmd = f"python3 -m venv {self.venv_tmp_dir}"
             activate_cmd = ". " + os.path.join(venv_path, "bin", "activate")
             cmd_separator = ";"
 
@@ -139,6 +139,7 @@ class Pypi(PackageManager):
         pip_licenses_default_options = ' --from=mixed --with-url --format=json --with-license-file'
         pip_licenses_system_option = ' --with-system -p '
         tmp_pip_list = "tmp_list.txt"
+        python_cmd = "python -m"
 
         if self.pip_activate_cmd.startswith("source "):
             tmp_activate = self.pip_activate_cmd[7:]
@@ -156,7 +157,7 @@ class Pypi(PackageManager):
             command_separator = ";"
 
         activate_command = pip_activate_cmd
-        pip_list_command = f"pip freeze > {tmp_pip_list}"
+        pip_list_command = f"{python_cmd} pip freeze > {tmp_pip_list}"
         deactivate_command = self.pip_deactivate_cmd
 
         command_list = [activate_command, pip_list_command, deactivate_command]
@@ -215,29 +216,29 @@ class Pypi(PackageManager):
         command_list = []
         command_list.append(activate_command)
         if not exists_pip_licenses:
-            install_pip_command = f"pip install {pip_licenses}"
+            install_pip_command = f"{python_cmd} pip install {pip_licenses}"
             command_list.append(install_pip_command)
 
         pip_licenses_command = f"{pip_licenses}{pip_licenses_default_options} > {self.tmp_file_name}"
         command_list.append(pip_licenses_command)
 
         if len(pip_license_pkg_list) != 0:
-            pip_licenses_info_command = pip_licenses + pip_licenses_default_options + pip_licenses_system_option
+            pip_licenses_info_command = f"{pip_licenses}{pip_licenses_default_options}{pip_licenses_system_option}"
             pip_licenses_info_command += " ".join(pip_license_pkg_list)
 
             pip_licenses_info_command += f" > {self.tmp_pip_license_info_file_name}"
             command_list.append(pip_licenses_info_command)
 
         if len(uninstall_pkg_list) > 0:
-            uninstall_pip_command = "pip uninstall -y "
+            uninstall_pip_command = f"{python_cmd} pip uninstall -y "
             uninstall_pip_command += ' '.join(uninstall_pkg_list)
             command_list.append(uninstall_pip_command)
 
         if not exists_pipdeptree:
-            install_deptree_command = f"pip install {pipdeptree}"
+            install_deptree_command = f"{python_cmd} pip install {pipdeptree}"
             command_list.append(install_deptree_command)
-            uninstall_deptree_command = f"pip uninstall -y {pipdeptree}"
-        pipdeptree_command = f"{pipdeptree} --local-only --json-tree -e pipdeptree > {self.tmp_deptree_file}"
+            uninstall_deptree_command = f"{python_cmd} pip uninstall -y {pipdeptree}"
+        pipdeptree_command = f"{pipdeptree} --json-tree -e 'pipdeptree,pip,wheel,setuptools' > {self.tmp_deptree_file}"
         command_list.append(pipdeptree_command)
         command_list.append(uninstall_deptree_command)
         command_list.append(deactivate_command)
@@ -247,8 +248,16 @@ class Pypi(PackageManager):
             cmd_ret = subprocess.call(command, shell=True)
             if cmd_ret == 0:
                 self.append_input_package_list_file(self.tmp_file_name)
+                with open(self.tmp_file_name, 'r', encoding='utf-8') as json_f:
+                    json_data = json.load(json_f)
+                    for d in json_data:
+                        self.total_dep_list.append(re.sub(r"[-_.]+", "-", d['Name']).lower())
                 if len(pip_license_pkg_list) != 0:
                     self.append_input_package_list_file(self.tmp_pip_license_info_file_name)
+                    with open(self.tmp_pip_license_info_file_name, 'r', encoding='utf-8') as json_f:
+                        json_data = json.load(json_f)
+                        for d in json_data:
+                            self.total_dep_list.append(re.sub(r"[-_.]+", "-", d['Name']).lower())
             else:
                 logger.error(f"Failed to run command: {command}")
                 ret = False
@@ -274,7 +283,8 @@ class Pypi(PackageManager):
                 homepage = check_UNKNOWN(d['URL'])
                 oss_version = d['Version']
                 dn_loc = f"{self.dn_url}{oss_init_name}/{oss_version}"
-
+                purl = get_url_to_purl(dn_loc, self.package_manager_name)
+                self.purl_dict[f'{oss_init_name}({oss_version})'] = purl
                 if license_name is not None:
                     license_name = license_name.replace(';', ',')
                 else:
@@ -287,7 +297,9 @@ class Pypi(PackageManager):
 
                 comment_list = []
                 deps_list = []
-                if self.direct_dep_list:
+                if oss_init_name == self.package_name:
+                    comment_list.append('root package')
+                elif self.direct_dep and len(self.direct_dep_list) > 0:
                     if f'{oss_init_name}({oss_version})' in self.direct_dep_list:
                         comment_list.append('direct')
                     else:
@@ -298,8 +310,7 @@ class Pypi(PackageManager):
                         deps_list.extend(rel_items)
                 comment = ','.join(comment_list)
                 deps = ','.join(deps_list)
-                sheet_list.append([', '.join(self.manifest_file_name),
-                                   oss_name, oss_version,
+                sheet_list.append([purl, oss_name, oss_version,
                                    license_name, dn_loc, homepage, '', '', comment, deps])
 
         except Exception as ex:
@@ -312,12 +323,12 @@ class Pypi(PackageManager):
         deps = 'dependencies'
         installed_ver = 'installed_version'
 
-        pkg_name = package[package_name]
+        pkg_name = re.sub(r"[-_.]+", "-", package[package_name]).lower()
         pkg_ver = package[installed_ver]
         dependency_list = package[deps]
         dependencies[f"{pkg_name}({pkg_ver})"] = []
         for dependency in dependency_list:
-            dep_name = dependency[package_name]
+            dep_name = re.sub(r"[-_.]+", "-", dependency[package_name]).lower()
             dep_version = dependency[installed_ver]
             dependencies[f"{pkg_name}({pkg_ver})"].append(f"{dep_name}({dep_version})")
             if dependency[deps] != []:
@@ -329,14 +340,28 @@ class Pypi(PackageManager):
         if not os.path.exists(self.tmp_deptree_file):
             self.direct_dep = False
             return
-
-        with open(self.tmp_deptree_file, 'r', encoding='utf8') as f:
-            json_f = json.load(f)
-            for package in json_f:
-                self.direct_dep_list.append(f"{package['package_name']}({package['installed_version']})")
-                if package['dependencies'] == []:
-                    continue
-                self.relation_tree = self.get_dependencies(self.relation_tree, package)
+        try:
+            with open(self.tmp_deptree_file, 'r', encoding='utf8') as f:
+                json_f = json.load(f)
+                root_package = json_f
+                if ('pyproject.toml' in self.manifest_file_name) or ('setup.py' in self.manifest_file_name):
+                    direct_without_system_package = 0
+                    for package in root_package:
+                        package_name = re.sub(r"[-_.]+", "-", package['package_name']).lower()
+                        if package_name in self.total_dep_list:
+                            direct_without_system_package += 1
+                    if direct_without_system_package == 1:
+                        self.package_name = re.sub(r"[-_.]+", "-", json_f[0]['package_name']).lower()
+                        root_package = json_f[0]['dependencies']
+
+                for package in root_package:
+                    package_name = re.sub(r"[-_.]+", "-", package['package_name']).lower()
+                    self.direct_dep_list.append(f"{package_name}({package['installed_version']})")
+                    if package['dependencies'] == []:
+                        continue
+                    self.relation_tree = self.get_dependencies(self.relation_tree, package)
+        except Exception as e:
+            logger.warning(f'Fail to parse direct dependency: {e}')
 
 
 def check_UNKNOWN(text):

fosslight_dependency/package_manager/Swift.py

@@ -10,8 +10,8 @@ import subprocess
 import fosslight_util.constant as constant
 import fosslight_dependency.constant as const
 from fosslight_dependency._package_manager import PackageManager
-from fosslight_dependency._package_manager import connect_github
-from fosslight_dependency._package_manager import get_github_license
+from fosslight_dependency._package_manager import connect_github, get_github_license
+from fosslight_dependency._package_manager import get_url_to_purl
 
 logger = logging.getLogger(constant.LOGGER_NAME)
 
@@ -134,6 +134,8 @@ class Swift(PackageManager):
             license_name = ''
 
             github_repo = "/".join(homepage.split('/')[-2:])
+            purl = get_url_to_purl(dn_loc, self.package_manager_name, github_repo, oss_version)
+            self.purl_dict[f'{oss_origin_name}({oss_version})'] = purl
             license_name = get_github_license(g, github_repo, self.platform, self.license_scanner_bin)
 
             comment_list = []
@@ -150,7 +152,7 @@ class Swift(PackageManager):
                     deps_list.extend(rel_items)
             comment = ','.join(comment_list)
             deps = ','.join(deps_list)
-            sheet_list.append([const.SUPPORT_PACKAE.get(self.package_manager_name),
-                              oss_name, oss_version, license_name, dn_loc, homepage, '', '', comment, deps])
+            sheet_list.append([purl, oss_name, oss_version, license_name, dn_loc, homepage,
+                              '', '', comment, deps])
 
         return sheet_list

fosslight_dependency/run_dependency_scanner.py

@@ -20,16 +20,17 @@ from fosslight_dependency._analyze_dependency import analyze_dependency
 from fosslight_util.output_format import check_output_format, write_output_file
 if platform.system() != 'Windows':
     from fosslight_util.write_spdx import write_spdx
+from fosslight_util.cover import CoverItem
 
 # Package Name
 _PKG_NAME = "fosslight_dependency"
 logger = logging.getLogger(constant.LOGGER_NAME)
 warnings.filterwarnings("ignore", category=FutureWarning)
 _sheet_name = "DEP_FL_Dependency"
-EXTENDED_HEADER = {_sheet_name: ['ID', 'Source Name or Path', 'OSS Name',
+EXTENDED_HEADER = {_sheet_name: ['ID', 'purl', 'OSS Name',
                                        'OSS Version', 'License', 'Download Location',
                                        'Homepage', 'Copyright Text', 'Exclude',
-                                       'Comment', 'Dependencies']}
+                                       'Comment', 'Depends On']}
 CUSTOMIZED_FORMAT = {'excel': '.xlsx', 'csv': '.csv', 'opossum': '.json', 'yaml': '.yaml',
                      'spdx-yaml': '.yaml', 'spdx-json': '.json', 'spdx-xml': '.xml',
                      'spdx-tag': '.tag'}
@@ -158,21 +159,40 @@ def run_dependency_scanner(package_manager='', input_dir='', output_dir_file='',
         finally:
             if not ret:
                 logger.warning("Dependency scanning terminated because the package manager was not found.")
-                return False, sheet_list
+                ret = False
     else:
         found_package_manager[package_manager] = ''
 
     pass_key = 'PASS'
+    success_pm = []
+    fail_pm = []
     for pm, manifest_file_name in found_package_manager.items():
         if manifest_file_name == pass_key:
             continue
         ret, package_sheet_list = analyze_dependency(pm, input_dir, output_path, pip_activate_cmd, pip_deactivate_cmd,
                                                      output_custom_dir, app_name, github_token, manifest_file_name, direct)
         if ret:
+            success_pm.append(f"{pm} ({', '.join(manifest_file_name)})")
             sheet_list[_sheet_name].extend(package_sheet_list)
             if pm == const.GRADLE:
                 if const.ANDROID in found_package_manager.keys():
                     found_package_manager[const.ANDROID] = pass_key
+        else:
+            fail_pm.append(f"{pm} ({', '.join(manifest_file_name)})")
+    cover = CoverItem(tool_name=_PKG_NAME,
+                      start_time=_start_time,
+                      input_path=input_dir)
+    cover_comment_arr = []
+    if len(found_package_manager.keys()) > 0:
+        if len(success_pm) > 0:
+            cover_comment_arr.append(f"Analyzed Package manager: {', '.join(success_pm)}")
+        if len(fail_pm) > 0:
+            info_msg = 'Check https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html#-prerequisite.'
+            cover_comment_arr.append(f"Analysis failed Package manager: {', '.join(fail_pm)} ({info_msg})")
+    else:
+        cover_comment_arr.append("No Package manager detected.")
+
+    cover.comment = ' / '.join(cover_comment_arr)
 
     output_file_without_ext = os.path.join(output_path, output_file)
     if format.startswith('spdx'):
@@ -184,12 +204,14 @@ def run_dependency_scanner(package_manager='', input_dir='', output_dir_file='',
             logger.error('Windows not support spdx format.')
     else:
         success_write, err_msg, result_file = write_output_file(output_file_without_ext, output_extension,
-                                                                sheet_list, EXTENDED_HEADER)
+                                                                sheet_list, EXTENDED_HEADER, '', cover)
     if success_write:
         if result_file:
-            logger.info(f"Writing Output file({result_file}), success:{success_write}")
+            logger.info(f"Output file: {result_file}")
         else:
             logger.warning(f"{err_msg}")
+        for i in cover_comment_arr:
+            logger.info(i.strip())
     else:
         ret = False
         logger.error(f"Fail to generate result file. msg:({err_msg})")

{fosslight_dependency-3.13.9.dist-info → fosslight_dependency-3.14.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fosslight-dependency
-Version: 3.13.9
+Version: 3.14.1
 Summary: FOSSLight Dependency Scanner
 Home-page: https://github.com/fosslight/fosslight_dependency_scanner
 Author: LG Electronics
@@ -20,10 +20,11 @@ Requires-Dist: lxml
 Requires-Dist: virtualenv
 Requires-Dist: pyyaml
 Requires-Dist: lastversion
-Requires-Dist: fosslight-util >=1.4.29
+Requires-Dist: fosslight-util >=1.4.40
 Requires-Dist: PyGithub
 Requires-Dist: requirements-parser
 Requires-Dist: defusedxml
+Requires-Dist: packageurl-python
 
 <!--
 Copyright (c) 2021 LG Electronics

fosslight_dependency-3.14.1.dist-info/RECORD

@@ -0,0 +1,33 @@
+fosslight_dependency/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+fosslight_dependency/_analyze_dependency.py,sha256=5fJ-eAkGUVsAo0Eks9l40zyWNBm7HxGQMWD2bAbOWa0,3710
+fosslight_dependency/_help.py,sha256=gBZfnYF8e4-WQnKa0z6zwXSRUKoIWtQyHbsvjvEFysE,2708
+fosslight_dependency/_package_manager.py,sha256=6U6V413HSZAChX64v3CfXBd6jyIkuaIW60pBfbCLSfQ,13700
+fosslight_dependency/constant.py,sha256=vj3YI1e1pesUoSW0wp0t9RFHCNjoKJZ6Fv4P8EAl6hU,953
+fosslight_dependency/run_dependency_scanner.py,sha256=S8PQMSdSvg6QaAtY1uuQ6a0apuwdeU3jU6RdBiz2PvU,12236
+fosslight_dependency/LICENSES/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+fosslight_dependency/LICENSES/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
+fosslight_dependency/package_manager/Android.py,sha256=lPL-B-qIr4Bg1Z-bT6hSwzYF0IqW3J32At8AJNg8P_w,3015
+fosslight_dependency/package_manager/Carthage.py,sha256=OZL0ssKvN6pze0VohZ-kMeM-g-V7f5VqumpEh3o3t-U,6106
+fosslight_dependency/package_manager/Cocoapods.py,sha256=X6UYX0-Tdfy_hkM0l5M54WHbhZNLLpFDzrGxeBjTmcY,8450
+fosslight_dependency/package_manager/Go.py,sha256=Ur7kH_alqV2o2t6Q5oP2UqmqfzdZ6l9yPuglTEOYrHU,6003
+fosslight_dependency/package_manager/Gradle.py,sha256=_gZjdmNDXdUEumVwwesbaCeJI5T90xzkwZy1ACFHeR8,4182
+fosslight_dependency/package_manager/Helm.py,sha256=FjzQilY3GJyX8thwMGY_Rr12kw-dbehxVk6jIJNb2-M,4024
+fosslight_dependency/package_manager/Maven.py,sha256=VlIc785CrFN3RBXHy80JSx2J5AlrbXhg5cquZA-qoLw,10261
+fosslight_dependency/package_manager/Npm.py,sha256=7gj-JrQKWRQUdWM-ly3HcIy1ioKny8jaeNohdBk7rfE,10557
+fosslight_dependency/package_manager/Nuget.py,sha256=1YGkGktShw6xj7NGvgL763jWsnN58JEX9szTggjU1EQ,9061
+fosslight_dependency/package_manager/Pub.py,sha256=u2Wsm8raxc8fYEchyUpSpiKi-1x8seE4f0zJHD8BrMI,8964
+fosslight_dependency/package_manager/Pypi.py,sha256=QakFlbGrb3oOXwRj498x5k2GFS1SgNeMpgMwUpBcwWU,15698
+fosslight_dependency/package_manager/Swift.py,sha256=9J-LDCn0_zDBuScUeCgZIq0BQcx4n_1fhshciF9byNE,6590
+fosslight_dependency/package_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+fosslight_dependency/third_party/askalono/askalono.exe,sha256=NyngElHbrg3zLFRVwn6fPDZE_EDAEb1N8tiwWoCm4pQ,4743680
+fosslight_dependency/third_party/askalono/askalono_macos,sha256=cYSNXhAQpkdd8lkgnY5skNeDmU_8DIuP84eFi0OXKkE,5589868
+fosslight_dependency/third_party/nomos/nomossa,sha256=oFF9I-fhug6AVNyFnWeVXwDRin6NWSvk1g7mHBotB3Q,866408
+fosslight_dependency-3.14.1.dist-info/Apache-2.0.txt,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+fosslight_dependency-3.14.1.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+fosslight_dependency-3.14.1.dist-info/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
+fosslight_dependency-3.14.1.dist-info/METADATA,sha256=MZk20jKRlLdfSLg3MGLqcxcWkinMHdJVJGqPc1_Z9F4,4636
+fosslight_dependency-3.14.1.dist-info/MIT.txt,sha256=9cx4CbArgByWvkoEZNqpzbpJgA9TUe2D62rMocQpgfs,1082
+fosslight_dependency-3.14.1.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+fosslight_dependency-3.14.1.dist-info/entry_points.txt,sha256=e1QZbnCrQvfbwe9L6PxXnkRZMhl-PSo0QyUes0dGjU8,91
+fosslight_dependency-3.14.1.dist-info/top_level.txt,sha256=Jc0V7VcVCH0TEM8ksb8dwroTYz4AmRaQnlr3FB71Hcs,21
+fosslight_dependency-3.14.1.dist-info/RECORD,,

{fosslight_dependency-3.13.9.dist-info → fosslight_dependency-3.14.1.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: bdist_wheel (0.42.0)
+Generator: bdist_wheel (0.43.0)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

fosslight_dependency-3.13.9.dist-info/RECORD

@@ -1,33 +0,0 @@
-fosslight_dependency/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-fosslight_dependency/_analyze_dependency.py,sha256=5fJ-eAkGUVsAo0Eks9l40zyWNBm7HxGQMWD2bAbOWa0,3710
-fosslight_dependency/_help.py,sha256=gBZfnYF8e4-WQnKa0z6zwXSRUKoIWtQyHbsvjvEFysE,2708
-fosslight_dependency/_package_manager.py,sha256=BtmwTAPwH38nVMTzaMbewsYYm8xn2spmbJPoIIgYOMQ,12085
-fosslight_dependency/constant.py,sha256=v4NisxQwmnhb3e1hIfAvwDr4i_v0euZWo3wcG7U81KM,935
-fosslight_dependency/run_dependency_scanner.py,sha256=YLCQ_6oI9usfvW0ap4nQDZoornL8LQKpjWyKRnTeY_Y,11275
-fosslight_dependency/LICENSES/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-fosslight_dependency/LICENSES/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
-fosslight_dependency/package_manager/Android.py,sha256=Up4Fv57kuqddZsD8vy5VRwQW7bNtDbqRatjP8MgzGR8,2849
-fosslight_dependency/package_manager/Carthage.py,sha256=GtJxBq_3cujbZoQC2KFdFQM4cEjcK_j9bsZaxEaZu6s,6075
-fosslight_dependency/package_manager/Cocoapods.py,sha256=vgp3SPcZOwYqGUHVUb5-w93TrQIk7eODhTG6RgqhfCs,8087
-fosslight_dependency/package_manager/Go.py,sha256=d3U_hRtcPWEYbT_JVHAB3jEUKLO4FodbF8hMEWS4JFM,5866
-fosslight_dependency/package_manager/Gradle.py,sha256=SVWjZM5LIVSaANQlU9W0eoDKKsK9UaG8S7Xz7RoAeYQ,4062
-fosslight_dependency/package_manager/Helm.py,sha256=ZXgbtwWNgJKRUikdtFycMIwdJPu4J7vPpVvzgNLk03Q,3925
-fosslight_dependency/package_manager/Maven.py,sha256=xlQXpm9Ur0DzWa5P9VesJxm-r-mQZ_hoXYWFu7oD1LA,10157
-fosslight_dependency/package_manager/Npm.py,sha256=0NUBSDBYs15H9lxqaLxh7PgxPI7ewyef8BKtVxeQg14,10495
-fosslight_dependency/package_manager/Nuget.py,sha256=CzYO548zetC1YNKskUpG1gSWPGF4QrrQz77VZJ5b3Eo,8866
-fosslight_dependency/package_manager/Pub.py,sha256=zRelrIAeDlLAd8uTUJzYWvLUJeOnzmGPzOx8pcMG55Y,8845
-fosslight_dependency/package_manager/Pypi.py,sha256=ussVudgZ1cE53z0CoFwbAVkn_B1LZBxwIgBE71Chm60,13831
-fosslight_dependency/package_manager/Swift.py,sha256=jHWor3dZzunwZt--8rdD42vDq4Z66m9fo5xFnIw5_cQ,6453
-fosslight_dependency/package_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-fosslight_dependency/third_party/askalono/askalono.exe,sha256=NyngElHbrg3zLFRVwn6fPDZE_EDAEb1N8tiwWoCm4pQ,4743680
-fosslight_dependency/third_party/askalono/askalono_macos,sha256=cYSNXhAQpkdd8lkgnY5skNeDmU_8DIuP84eFi0OXKkE,5589868
-fosslight_dependency/third_party/nomos/nomossa,sha256=oFF9I-fhug6AVNyFnWeVXwDRin6NWSvk1g7mHBotB3Q,866408
-fosslight_dependency-3.13.9.dist-info/Apache-2.0.txt,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-fosslight_dependency-3.13.9.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-fosslight_dependency-3.13.9.dist-info/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
-fosslight_dependency-3.13.9.dist-info/METADATA,sha256=Icw4wIrxEhpM_B-URmicp49Epme4uihsFAmJIaH0r-E,4603
-fosslight_dependency-3.13.9.dist-info/MIT.txt,sha256=9cx4CbArgByWvkoEZNqpzbpJgA9TUe2D62rMocQpgfs,1082
-fosslight_dependency-3.13.9.dist-info/WHEEL,sha256=oiQVh_5PnQM0E3gPdiz09WCNmwiHDMaGer_elqB3coM,92
-fosslight_dependency-3.13.9.dist-info/entry_points.txt,sha256=e1QZbnCrQvfbwe9L6PxXnkRZMhl-PSo0QyUes0dGjU8,91
-fosslight_dependency-3.13.9.dist-info/top_level.txt,sha256=Jc0V7VcVCH0TEM8ksb8dwroTYz4AmRaQnlr3FB71Hcs,21
-fosslight_dependency-3.13.9.dist-info/RECORD,,