fosslight-dependency 4.1.0__py3-none-any.whl → 4.1.2__py3-none-any.whl

fosslight_dependency/_analyze_dependency.py

@@ -19,6 +19,7 @@ from fosslight_dependency.package_manager.Go import Go
 from fosslight_dependency.package_manager.Nuget import Nuget
 from fosslight_dependency.package_manager.Helm import Helm
 from fosslight_dependency.package_manager.Unity import Unity
+from fosslight_dependency.package_manager.Cargo import Cargo
 import fosslight_util.constant as constant
 
 logger = logging.getLogger(constant.LOGGER_NAME)
@@ -57,6 +58,8 @@ def analyze_dependency(package_manager_name, input_dir, output_dir, pip_activate
         package_manager = Helm(input_dir, output_dir)
     elif package_manager_name == const.UNITY:
         package_manager = Unity(input_dir, output_dir)
+    elif package_manager_name == const.CARGO:
+        package_manager = Cargo(input_dir, output_dir)
     else:
         logger.error(f"Not supported package manager name: {package_manager_name}")
         ret = False

fosslight_dependency/_help.py

@@ -24,13 +24,15 @@ _HELP_MESSAGE_DEPENDENCY = """
         Nuget (.NET)
         Helm (Kubernetes)
         Unity (Unity)
+        Cargo (Rust)
 
     Options:
         Optional
             -h\t\t\t\t    Print help message.
             -v\t\t\t\t    Print the version of the script.
             -m <package_manager>\t    Enter the package manager.
-                                        \t(npm, maven, gradle, pypi, pub, cocoapods, android, swift, carthage, go, nuget, helm)
+                                        \t(npm, maven, gradle, pypi, pub, cocoapods, android, swift, carthage,
+                                        \t go, nuget, helm, unity, cargo)
             -p <input_path>\t\t    Enter the path where the script will be run.
             -e <exclude_path>\t\t    Enter the path where the analysis will not be performed.
             -o <output_path>\t\t    Output path

fosslight_dependency/_package_manager.py

@@ -286,6 +286,8 @@ def get_url_to_purl(url, pkg_manager, oss_name='', oss_version=''):
                 elif pkg_manager == 'carthage':
                     if oss_version:
                         purl = f'{purl}@{oss_version}'
+                elif pkg_manager == 'cargo':
+                    purl = f'{purl_prefix}/{oss_name}@{oss_version}'
         except Exception:
             logger.debug('Fail to get purl. So use the link purl({purl}).')
     return purl
@@ -303,7 +305,7 @@ def version_refine(oss_version):
 
 
 def connect_github(github_token):
-    if github_token is not None:
+    if len(github_token) > 0:
         g = Github(github_token)
     else:
         g = Github()

fosslight_dependency/constant.py

@@ -23,6 +23,7 @@ GO = 'go'
 NUGET = 'nuget'
 HELM = 'helm'
 UNITY = 'unity'
+CARGO = 'cargo'
 
 # Supported package name and manifest file
 SUPPORT_PACKAE = {
@@ -38,7 +39,8 @@ SUPPORT_PACKAE = {
     GO: 'go.mod',
     NUGET: ['packages.config', os.path.join('obj', 'project.assets.json')],
     HELM: 'Chart.yaml',
-    UNITY: os.path.join('Library', 'PackageManager', 'ProjectCache')
+    UNITY: os.path.join('Library', 'PackageManager', 'ProjectCache'),
+    CARGO: 'Cargo.toml'
 }
 
 # default android app name

fosslight_dependency/package_manager/Cargo.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+# Copyright (c) 2021 LG Electronics Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+import os
+import logging
+import json
+import re
+import subprocess
+import fosslight_util.constant as constant
+import fosslight_dependency.constant as const
+from fosslight_dependency._package_manager import PackageManager
+from fosslight_dependency._package_manager import get_url_to_purl
+from fosslight_dependency.dependency_item import DependencyItem, change_dependson_to_purl
+from fosslight_util.oss_item import OssItem
+logger = logging.getLogger(constant.LOGGER_NAME)
+
+
+class Cargo(PackageManager):
+    package_manager_name = const.CARGO
+
+    dn_url = 'https://crates.io/crates/'
+    input_file_name = 'tmp_cargo_fosslight_output.json'
+    tmp_input_file_flag = False
+    cur_path = ''
+    cargo_lock_f = 'Cargo.lock'
+
+    def __init__(self, input_dir, output_dir):
+        super().__init__(self.package_manager_name, self.dn_url, input_dir, output_dir)
+        self.append_input_package_list_file(self.input_file_name)
+
+    def __del__(self):
+        if self.tmp_input_file_flag:
+            os.remove(self.input_file_name)
+
+    def run_plugin(self):
+        if os.path.exists(self.input_file_name):
+            logger.info(f"Found {self.input_file_name}, skip the flutter cmd to analyze dependency.")
+            return True
+
+        if not os.path.exists(const.SUPPORT_PACKAE.get(self.package_manager_name)):
+            logger.error(f"Cannot find the file({const.SUPPORT_PACKAE.get(self.package_manager_name)})")
+            return False
+
+        if os.path.exists(self.cargo_lock_f):
+            cmd = f'cargo metadata --locked --format-version 1 > {self.input_file_name}'
+        else:
+            cmd = f'cargo metadata --format-version 1 > {self.input_file_name}'
+        ret = subprocess.call(cmd, shell=True)
+        if ret != 0:
+            logger.error(f"Failed to run: {cmd}")
+            os.chdir(self.cur_path)
+            return False
+        self.tmp_input_file_flag = True
+        return True
+
+    def parse_oss_information(self, f_name):
+        json_data = ''
+
+        with open(f_name, 'r', encoding='utf8') as cargo_file:
+            json_f = json.load(cargo_file)
+        try:
+            purl_dict = {}
+            workspace_members_key = 'workspace_members'
+            resolve_key = 'resolve'
+            root_key = 'root'
+            nodes_key = 'nodes'
+            workspace_members = []
+            root = ''
+            resolve_node = []
+
+            if workspace_members_key in json_f:
+                workspace_members = json_f[workspace_members_key]
+
+            if resolve_key in json_f:
+                if root_key in json_f[resolve_key]:
+                    root = json_f[resolve_key][root_key]
+                if nodes_key in json_f[resolve_key]:
+                    resolve_node = json_f[resolve_key][nodes_key]
+                if root and resolve_node:
+                    self.direct_dep_list.extend(get_matched_dependencies(root, resolve_node))
+            else:
+                self.direct_dep = False
+                logger.info('Cannot find dependencies relationship (no resolve nodes.)')
+
+            for json_data in json_f['packages']:
+                dep_item = DependencyItem()
+                oss_item = OssItem()
+                pkg_id = json_data['id']
+                oss_origin_name = json_data['name']
+
+                oss_item.name = f"{self.package_manager_name}:{oss_origin_name}"
+                oss_item.version = json_data['version']
+                oss_item.homepage = f"{self.dn_url}{oss_origin_name}"
+                oss_item.download_location = json_data['repository']
+                if oss_item.download_location is None:
+                    oss_item.download_location = oss_item.homepage
+                dep_item.purl = get_url_to_purl(oss_item.homepage, self.package_manager_name, oss_origin_name, oss_item.version)
+                purl_dict[f'{oss_origin_name}({oss_item.version})'] = dep_item.purl
+                if json_data['license'] is not None:
+                    oss_item.license = json_data['license']
+
+                if self.direct_dep:
+                    if pkg_id == root:
+                        oss_item.comment = 'root package'
+                    if pkg_id in workspace_members:
+                        oss_item.comment = 'local package'
+                    if len(self.direct_dep_list) > 0:
+                        if pkg_id != root:
+                            if f'{oss_origin_name}({oss_item.version})' in self.direct_dep_list:
+                                oss_item.comment = 'direct'
+                            else:
+                                oss_item.comment = 'transitive'
+                    dep_item.depends_on_raw.extend(get_matched_dependencies(pkg_id, resolve_node))
+
+                dep_item.oss_items.append(oss_item)
+                self.dep_items.append(dep_item)
+        except Exception as e:
+            logger.error(f"Fail to parse pub oss information: {e}")
+        if self.direct_dep:
+            self.dep_items = change_dependson_to_purl(purl_dict, self.dep_items)
+
+        return
+
+
+def get_matched_dependencies(match_id, resolve_node):
+    dependencies_list = []
+    for node in resolve_node:
+        if match_id == node['id']:
+            for dep_pkg in node['dependencies']:
+                try:
+                    match = re.findall(r'^.*#(\S*)@(\S*)', dep_pkg)
+                    dependencies_list.append(f'{match[0][0]}({match[0][1]})')
+                except:
+                    try:
+                        match = re.findall(r'^(\S*)\s(\S*)\s', dep_pkg)
+                        dependencies_list.append(f'{match[0][0]}({match[0][1]})')
+                    except:
+                        logger.info(f'cannot find name and version for dependencies: {match_id}')
+                        pass
+            break
+    return dependencies_list

fosslight_dependency/package_manager/Swift.py

@@ -98,7 +98,7 @@ class Swift(PackageManager):
         return ret
 
     def parse_oss_information(self, f_name):
-        json_ver = 1
+        json_ver = 2
         purl_dict = {}
 
         with open(f_name, 'r', encoding='utf8') as json_file:
@@ -107,11 +107,12 @@ class Swift(PackageManager):
 
             if json_ver == 1:
                 json_data = json_raw["object"]["pins"]
-            elif json_ver == 2:
+            elif json_ver == 2 or json_ver == 3:
                 json_data = json_raw["pins"]
             else:
-                logger.error(f'Not supported Package.resolved version {json_ver}')
-                return
+                logger.warning(f'Not supported Package.resolved version {json_ver}')
+                logger.warning('Try to parse as version 2(or 3)')
+                json_data = json_raw["pins"]
 
         g = connect_github(self.github_token)
 
@@ -121,7 +122,7 @@ class Swift(PackageManager):
             if json_ver == 1:
                 oss_origin_name = key['package']
                 oss_item.homepage = key['repositoryURL']
-            elif json_ver == 2:
+            else:
                 oss_origin_name = key['identity']
                 oss_item.homepage = key['location']
 

fosslight_dependency/run_dependency_scanner.py

@@ -156,7 +156,7 @@ def run_dependency_scanner(package_manager='', input_dir='', output_dir_file='',
         support_packagemanager = list(const.SUPPORT_PACKAE.keys())
 
         if package_manager not in support_packagemanager:
-            logger.error(f"You entered the unsupported package manager({package_manager}).")
+            logger.error(f"(-m option) You entered the unsupported package manager({package_manager}).")
             logger.error("Please enter the supported package manager({0}) with '-m' option."
                          .format(", ".join(support_packagemanager)))
             return False, scan_item
@@ -166,7 +166,7 @@ def run_dependency_scanner(package_manager='', input_dir='', output_dir_file='',
             os.chdir(input_dir)
             input_dir = os.getcwd()
         else:
-            logger.error(f"You entered the wrong input path({input_dir}) to run the script.")
+            logger.error(f"(-p option) You entered the wrong input path({input_dir}) to run the script.")
             logger.error("Please enter the existed input path with '-p' option.")
             return False, scan_item
     else:

{fosslight_dependency-4.1.0.dist-info → fosslight_dependency-4.1.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: fosslight-dependency
-Version: 4.1.0
+Version: 4.1.2
 Summary: FOSSLight Dependency Scanner
 Home-page: https://github.com/fosslight/fosslight_dependency_scanner
 Author: LG Electronics
@@ -32,23 +32,22 @@ Requires-Dist: matplotlib
 Copyright (c) 2021 LG Electronics
 SPDX-License-Identifier: Apache-2.0
  -->
-# FOSSLight Dependency Scanner
 
-<img src="https://img.shields.io/pypi/l/fosslight_dependency" alt="License" /> <a href="https://pypi.org/project/fosslight-dependency/"><img src="https://img.shields.io/pypi/v/fosslight_dependency" alt="Current python package version." /></a> <img src="https://img.shields.io/pypi/pyversions/fosslight_dependency" /> [![REUSE status](https://api.reuse.software/badge/github.com/fosslight/fosslight_dependency_scanner)](https://api.reuse.software/info/github.com/fosslight/fosslight_dependency_scanner)
+# FOSSLight Dependency Scanner
 
+`<img src="https://img.shields.io/pypi/l/fosslight_dependency" alt="License" />` `<a href="https://pypi.org/project/fosslight-dependency/"><img src="https://img.shields.io/pypi/v/fosslight_dependency" alt="Current python package version." />``</a>` `<img src="https://img.shields.io/pypi/pyversions/fosslight_dependency" />` [![REUSE status](https://api.reuse.software/badge/github.com/fosslight/fosslight_dependency_scanner)](https://api.reuse.software/info/github.com/fosslight/fosslight_dependency_scanner)
 
 ## 💡 Introduction
 
 This is the tool that supports the analysis of dependencies for multiple package managers. It detects the manifest file of package managers automatically and analyzes the dependencies with using open source tools. Then, it generates the report file that contains OSS information of dependencies.
 
-
 ## 📖 User Guide
 
-We describe the user guide in the [**FOSSLight Guide page**](https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html).  
+We describe the user guide in the [**FOSSLight Guide page**](https://fosslight.org/fosslight-guide-en/scanner/3_dependency.html).
 In this user guide, you can see how to install the FOSSLight Dependency Scanner and how to set up the prerequisite step and run it according to the package manager of your project. Also, you can check the results of the FOSSLight Dependency Scanner.
 
-
 ## 👀 Package Support Level
+
 <table>
 <thead>
   <tr>
@@ -163,19 +162,25 @@ In this user guide, you can see how to install the FOSSLight Dependency Scanner
     <td>O</td>
     <td>X</td>
   </tr>
+  <tr>
+    <td>Rust</td>
+    <td>Cargo</td>
+    <td>Cargo.toml</td>
+    <td>O</td>
+    <td>O</td>
+    <td>O</td>
+  </tr>
 </tbody>
 </table>
 
-
 ## 👏 Contributing Guide
 
-We always welcome your contributions.  
+We always welcome your contributions.
 Please see the [CONTRIBUTING guide](https://github.com/fosslight/fosslight_dependency_scanner/blob/main/CONTRIBUTING.md) for how to contribute.
 
-
 ## 📄 License
 
-Copyright (c) 2020 LG Electronics, Inc.  
+Copyright (c) 2020 LG Electronics, Inc.
 FOSSLight Dependency Scanner is licensed under Apache-2.0, as found in the [LICENSE](https://github.com/fosslight/fosslight_dependency_scanner/blob/main/LICENSE) file.
 
 

{fosslight_dependency-4.1.0.dist-info → fosslight_dependency-4.1.2.dist-info}/RECORD

@@ -1,14 +1,15 @@
 fosslight_dependency/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-fosslight_dependency/_analyze_dependency.py,sha256=gwdOrwn31sI9Fk5_ZBBbryA1-hCfHdtfqS8QePF7poo,4064
+fosslight_dependency/_analyze_dependency.py,sha256=uYbHDlFfEf-LsCWc6hTKN-QCD1T_2jaEgBf3z4M_4Lk,4226
 fosslight_dependency/_graph_convertor.py,sha256=D8GwmJfuj9Wg3_DeKRPLGGdyHSLcoU2Q0VzKQbkJG4g,2267
-fosslight_dependency/_help.py,sha256=EG-ojJ3Fyn3iYrd_4mGtyMLMefOqf7_AF21q3-jf2Y8,3258
-fosslight_dependency/_package_manager.py,sha256=_wwyTWSe8fKyMpFZh1BnhjTMAPG-5adhjBLqaxbdjZE,17154
-fosslight_dependency/constant.py,sha256=1mJGu1SYyxVKo0W_pCIt-ANp52E_I5ovXFvpl2OMmjU,1039
+fosslight_dependency/_help.py,sha256=INeP24fFfV2HPhZJMqk_KCu08X7nneAumBqMWQ7Sbw8,3336
+fosslight_dependency/_package_manager.py,sha256=TDYP0tlqr7A346BoC2EKEZSq7Eua2cWdJQ5YvMIc9Wc,17265
+fosslight_dependency/constant.py,sha256=FAkzrW1S6Ua_TAbvQ2y6d0dhEZcgonB11miKUj7lB98,1080
 fosslight_dependency/dependency_item.py,sha256=wNLWcsNycf3HQ5Pib2WrMeo2dn0eHCRg20NLcL95Qew,3345
-fosslight_dependency/run_dependency_scanner.py,sha256=K5H_GavKDF_ISIEKBX7Z5awwSDzY1X4pZtLOOZITxbg,15221
+fosslight_dependency/run_dependency_scanner.py,sha256=ybENV3yIzCo8PrJ-3J-1v1JkL0Jrjlzu-yCRKsEwnHs,15245
 fosslight_dependency/LICENSES/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
 fosslight_dependency/LICENSES/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
 fosslight_dependency/package_manager/Android.py,sha256=0UZFvbLxDIreerK4fR316YPyhUpPliV_kfZulrxkUyo,3218
+fosslight_dependency/package_manager/Cargo.py,sha256=I27IKtUFf2fOr9ZngB8T9x6pPYhpk1m5CxbwM1dw9rk,5898
 fosslight_dependency/package_manager/Carthage.py,sha256=qCHH6bhdowgPR5mS89AQLl_0Z5LRoyMZU4vAVHzPNCM,6390
 fosslight_dependency/package_manager/Cocoapods.py,sha256=k_URV1ekMOU8l_y9_KIp_luu96ZGOl1xLIkH737VREA,8524
 fosslight_dependency/package_manager/Go.py,sha256=O-6DTTRM2EoTpCVmlIPKFy8ZTz64EHTooOAoUimjeyk,6491
@@ -19,18 +20,18 @@ fosslight_dependency/package_manager/Npm.py,sha256=hwKC08m05KlHgfQpPX7lnDEJC-A7W
 fosslight_dependency/package_manager/Nuget.py,sha256=FGD5tV1mTBl3G9mxWWnoMwLZUiSW7VCcHS7FxhCqU1g,9334
 fosslight_dependency/package_manager/Pub.py,sha256=-cotOpPCmLMmLWwP0dF1hQ44CBzConjnDpJ1So0n7lo,9904
 fosslight_dependency/package_manager/Pypi.py,sha256=7eBB5ko4HhRhby5txo9NXZl6td1O_8k11v8R9FwxygU,16254
-fosslight_dependency/package_manager/Swift.py,sha256=Lw5kaubDlKIQjSHC5gZik4WfWBliMx8n6XW2vVPhd84,6700
+fosslight_dependency/package_manager/Swift.py,sha256=rAGecP705HJQGBQUj_4ssyty_lDF4YwTt7ymjso0-VQ,6793
 fosslight_dependency/package_manager/Unity.py,sha256=LoyWCMa6R3x0VCsTH1EEJ7FQmYsraCDnoHZUHCmYeiU,4708
 fosslight_dependency/package_manager/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 fosslight_dependency/third_party/askalono/askalono.exe,sha256=NyngElHbrg3zLFRVwn6fPDZE_EDAEb1N8tiwWoCm4pQ,4743680
 fosslight_dependency/third_party/askalono/askalono_macos,sha256=cYSNXhAQpkdd8lkgnY5skNeDmU_8DIuP84eFi0OXKkE,5589868
 fosslight_dependency/third_party/nomos/nomossa,sha256=oFF9I-fhug6AVNyFnWeVXwDRin6NWSvk1g7mHBotB3Q,866408
-fosslight_dependency-4.1.0.dist-info/Apache-2.0.txt,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-fosslight_dependency-4.1.0.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-fosslight_dependency-4.1.0.dist-info/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
-fosslight_dependency-4.1.0.dist-info/METADATA,sha256=1w54Oi2kfKgJtT1fjB4w_sHTEsvLVd39Rxn8PpkZMtQ,4844
-fosslight_dependency-4.1.0.dist-info/MIT.txt,sha256=9cx4CbArgByWvkoEZNqpzbpJgA9TUe2D62rMocQpgfs,1082
-fosslight_dependency-4.1.0.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
-fosslight_dependency-4.1.0.dist-info/entry_points.txt,sha256=e1QZbnCrQvfbwe9L6PxXnkRZMhl-PSo0QyUes0dGjU8,91
-fosslight_dependency-4.1.0.dist-info/top_level.txt,sha256=Jc0V7VcVCH0TEM8ksb8dwroTYz4AmRaQnlr3FB71Hcs,21
-fosslight_dependency-4.1.0.dist-info/RECORD,,
+fosslight_dependency-4.1.2.dist-info/Apache-2.0.txt,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+fosslight_dependency-4.1.2.dist-info/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+fosslight_dependency-4.1.2.dist-info/LicenseRef-3rd_party_licenses.txt,sha256=EcsFt7aE1rp3OXAdJgmXayfOZdpRdBMcmRnyoqWMCsw,95687
+fosslight_dependency-4.1.2.dist-info/METADATA,sha256=7AUZDIFshZXWyFbFnHcCpB7rgyu6rTgX8GsPnMGl6U4,4964
+fosslight_dependency-4.1.2.dist-info/MIT.txt,sha256=9cx4CbArgByWvkoEZNqpzbpJgA9TUe2D62rMocQpgfs,1082
+fosslight_dependency-4.1.2.dist-info/WHEEL,sha256=eOLhNAGa2EW3wWl_TU484h7q1UNgy0JXjjoqKoxAAQc,92
+fosslight_dependency-4.1.2.dist-info/entry_points.txt,sha256=e1QZbnCrQvfbwe9L6PxXnkRZMhl-PSo0QyUes0dGjU8,91
+fosslight_dependency-4.1.2.dist-info/top_level.txt,sha256=Jc0V7VcVCH0TEM8ksb8dwroTYz4AmRaQnlr3FB71Hcs,21
+fosslight_dependency-4.1.2.dist-info/RECORD,,