gitmole 0.18.0__tar.gz → 0.20.0__tar.gz

{gitmole-0.18.0 → gitmole-0.20.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitmole
-Version: 0.18.0
+Version: 0.20.0
 Summary: Offline git repository analysis with a terminal report: hotspots, coupling, ownership, code age, secrets, repo health.
 License: MIT
 Project-URL: Homepage, https://github.com/antvinni/gitmole

{gitmole-0.18.0 → gitmole-0.20.0}/gitmole/__init__.py

@@ -1,3 +1,3 @@
 """gitmole: offline git repository analysis with a terminal report."""
 
-__version__ = "0.18.0"
+__version__ = "0.20.0"

{gitmole-0.18.0 → gitmole-0.20.0}/gitmole/cli.py

@@ -47,6 +47,7 @@ def parse_args(argv):
     p.add_argument("--fail-on", choices=findings.SEVERITIES, help="exit 3 if any finding is at this severity or worse")
     p.add_argument("--risk", metavar="BASE", help="score the files changed since BASE (merge base with HEAD) by their share of the repository's revisions × lines of code; needs a local path")
     p.add_argument("--risk-threshold", type=float, metavar="N", help="with --risk: exit 3 when the changed files hold more than N percent of the repository's revisions × lines of code")
+    p.add_argument("--sbom", metavar="PATH", help="write a CycloneDX 1.6 SBOM of every locked package to PATH, or - for stdout, from the osv-scanner step's package list")
     p.add_argument("--compare", metavar="BEFORE_JSON", help="add a 'Since last report' section against an earlier --json export of the same clone")
     p.add_argument("--hook", action="store_true", help="with --no-run: read an agent hook's JSON on stdin (or files after --), score the files it names like --risk, "
                                                        "print a summary the agent reads back, exit 2 when --risk-threshold is exceeded")
@@ -84,7 +85,7 @@ def main(argv=None, console: Console = None, tool_check=run.missing_tools, plann
     if args.clean:
         return _clean(args, console, ask or (lambda q: console.input(q, markup=False)))
     # When an export goes to stdout, everything else (banner, progress, report) moves to stderr.
-    quiet = "-" in (args.json, args.markdown, args.sarif)
+    quiet = "-" in (args.json, args.markdown, args.sarif, args.sbom)
     ui = Console(stderr=True) if quiet else console
 
     rc, now = _resolve_time(args, err, ui)
@@ -148,6 +149,7 @@ def _check_args(args, err, kind=None) -> int | None:
         bad = None
     else:
         bad = ("--compare needs one repository, not owner/*" if args.compare and kind == "org" else
+               "--sbom needs one repository, not owner/*" if args.sbom and kind == "org" else
                "--risk needs a local path" if args.risk else
                "--list-file-types needs a local path" if args.list_file_types else None)
     if bad:
@@ -598,7 +600,15 @@ def _render(out_dir: str, console: Console, ui: Console, args, err: Console) ->
     if args.sarif:
         from . import sarif
         _write(sarif.dumps(report, found, scope=args.sarif_scope), args.sarif, console)
-    if "-" not in (args.json, args.markdown, args.sarif):
+    if args.sbom:
+        from . import sbom
+        packages = sbom.read_packages(out_dir)
+        if packages is None:
+            err.print("[red]--sbom:[/red] no package list in the output directory; the osv-scanner step writes it, and did not "
+                      f"(dependencies: {(report.get('dependencies') or {}).get('status', 'not-run')}; run.log says why)", soft_wrap=True)
+            return 2
+        _write(sbom.dumps(report, packages), args.sbom, console)
+    if "-" not in (args.json, args.markdown, args.sarif, args.sbom):
         render.report(report, found, console, full=args.full, risk=risk, base=args.risk, compare=comparison)
     if args.fail_on and any(findings.SEVERITIES.index(f["severity"]) <= findings.SEVERITIES.index(args.fail_on) for f in found):
         return 3

{gitmole-0.18.0 → gitmole-0.20.0}/gitmole/deps.py

@@ -21,6 +21,12 @@ import subprocess
 import sys
 import tempfile
 
+try:
+    from . import imports, licences
+except ImportError:  # run as a script: the package directory is sys.path[0]
+    import imports
+    import licences
+
 ARGV = ["osv-scanner", "scan", "source", "-r", "--offline", "--format", "json", "--all-packages", "."]
 NO_SOURCES = 128           # osv-scanner: no lock file found
 NO_DATABASE = "no offline version of the OSV database"   # its message when the local copy is missing
@@ -141,8 +147,8 @@ def _label(score, vulns: list) -> str:
 
 def _relative(path: str, cwd: str) -> str:
     if os.path.isabs(path):
-        try:
-            rel = os.path.relpath(path, cwd)
+        try:   # real paths on both sides: osv-scanner may report /tmp/... for a cwd of /private/tmp/...
+            rel = os.path.relpath(os.path.realpath(path), os.path.realpath(cwd))
         except ValueError:
             return path
         return path if rel.startswith("..") else rel
@@ -174,6 +180,64 @@ def summarise(data: dict, cwd: str) -> dict:
     return {"status": "scanned", "sources": sources, "packages": packages, "vulnerable": vulnerable}
 
 
+PACKAGES = "packages.json"   # every locked package, for --sbom; not part of the report, which keeps the vulnerable ones
+
+
+def packages(data: dict, cwd: str) -> list:
+    """Every package the lock files pin, once per ecosystem, name and version, with the lock files that
+    pin it and the licence a lock file declares for it (package-lock.json, composer.lock), sorted."""
+    declared = {}
+    try:
+        for d in licences.lock_licences(cwd, [_relative(p, cwd) for p in _lock_paths(data)], every=True):
+            declared.setdefault((d["ecosystem"], d["name"], d["version"]), d["expression"])
+    except OSError:
+        pass
+    by_key = {}
+    for r in data.get("results") or []:
+        path = _relative((r.get("source") or {}).get("path") or "", cwd)
+        for p in r.get("packages") or []:
+            info = p.get("package") or {}
+            key = (info.get("ecosystem", ""), info.get("name", ""), info.get("version", ""))
+            row = by_key.setdefault(key, {"ecosystem": key[0], "name": key[1], "version": key[2], "sources": []})
+            if path not in row["sources"]:
+                row["sources"].append(path)
+    out = []
+    for key in sorted(by_key):
+        row = by_key[key]
+        row["sources"].sort()
+        if key in declared:
+            row["license"] = declared[key]
+        out.append(row)
+    return out
+
+
+def _lock_paths(data: dict) -> list:
+    return [(r.get("source") or {}).get("path") or "" for r in data.get("results") or []]
+
+
+# The same scan with the vulnerability matcher switched off: it reads every lock file and matches nothing,
+# so it needs no database. The flag is osv-scanner's experimental plugin switch (2.x); when it fails, there
+# is no package list and --sbom says so.
+LIST_ARGV = ARGV[:-1] + ["--experimental-disable-plugins", "vulnmatch/osvlocal", "."]
+
+
+def list_packages():
+    proc = subprocess.run(LIST_ARGV, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+    if proc.returncode not in (0, 1):
+        print(f"deps.py: listing the packages without the database: osv-scanner exited {proc.returncode}", file=sys.stderr)
+        return None
+    try:
+        data = json.loads(proc.stdout.decode("utf-8", "replace") or "{}")
+    except json.JSONDecodeError:
+        return None
+    return data if isinstance(data, dict) else None
+
+
+def write_packages(rows: list, target: str) -> None:
+    with open(target, "w", encoding="utf-8") as fh:
+        json.dump({"packages": rows}, fh, indent=0, sort_keys=True)
+
+
 def write(result: dict, target: str) -> None:
     fd, tmp = tempfile.mkstemp(dir=os.path.dirname(os.path.abspath(target)), prefix=".dependencies-", suffix=".json")
     try:
@@ -198,6 +262,9 @@ def main(argv=None) -> int:
         result = {"status": "no-sources"}
     elif NO_DATABASE in err:
         result = {"status": "no-database", "download": DOWNLOAD}
+        listed = list_packages()   # the package list for --sbom needs no database
+        if listed is not None:
+            write_packages(packages(listed, os.getcwd()), os.path.join(os.path.dirname(os.path.abspath(target)), PACKAGES))
     elif proc.returncode in (0, 1):   # 1: packages with vulnerabilities were found
         text = proc.stdout.decode("utf-8", "replace").strip()
         try:
@@ -208,6 +275,11 @@ def main(argv=None) -> int:
         result = summarise(data, os.getcwd())
         result["database_date"] = database_date()
         result["database_digest"] = database_digest()
+        try:
+            imports.annotate(result["vulnerable"], os.getcwd())
+        except OSError as e:   # the rows stand without it
+            print(f"deps.py: imports: {e}", file=sys.stderr)
+        write_packages(packages(data, os.getcwd()), os.path.join(os.path.dirname(os.path.abspath(target)), PACKAGES))
     else:
         print(f"deps.py: osv-scanner exited {proc.returncode}; no report written", file=sys.stderr)
         return proc.returncode

{gitmole-0.18.0 → gitmole-0.20.0}/gitmole/findings.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import re
 
-from . import classify, coupling, filetypes, hotspots, knowledge, leaks, loss, maat, textfmt, trend
+from . import classify, coupling, filetypes, hotspots, knowledge, leaks, licences, loss, maat, osps, textfmt, trend
 
 SEVERITIES = ["critical", "warning", "info"]
 
@@ -29,6 +29,8 @@ def _f(severity: str, title: str, statement: str, advice: str, rule: dict, evide
     between them a reader of the JSON can check the finding without reading this file."""
     if rule.get("id") in REFS and "ref" not in rule:
         rule = {**rule, "ref": REFS[rule["id"]]}
+    if rule.get("id") in osps.RULE_CONTROLS and "osps" not in rule:   # the OSPS Baseline controls it gives evidence for
+        rule = {**rule, "osps": list(osps.RULE_CONTROLS[rule["id"]])}
     return {"severity": severity, "title": title, "detail": f"{statement.rstrip()} {advice}", "advice": advice,
             "rule": rule, "evidence": evidence}
 
@@ -698,7 +700,8 @@ def _vuln_statement(rows: list, sources: int) -> str:
         if r.get("malicious"):
             score = ", malicious"
         fixed = f", fixed in {r['fixed']}" if r.get("fixed") else ", no fix yet"
-        return f"{r['name']} {r['version']} ({ref}{score}{fixed}) in {r['source']}"
+        loaded = ", imported by no tracked source" if r.get("imported") is False else ""
+        return f"{r['name']} {r['version']} ({ref}{score}{fixed}{loaded}) in {r['source']}"
     listed = "; ".join(one(r) for r in rows[:3])
     more = f" and {len(rows) - 3} more" if len(rows) > 3 else ""
     return f"{_plural(len(rows), 'vulnerable package')} in {_plural(sources, 'lock file')}: {listed}{more}."
@@ -740,7 +743,8 @@ def vulnerable_dependencies(report: dict) -> list:
                       evidence={"lock_files": sources,
                                 "packages": [{"name": r["name"], "version": r["version"], "source": r["source"], "score": r.get("score"),
                                               "fixed": r.get("fixed") or None, "ids": list(r.get("ids") or []),
-                                              "aliases": list(r.get("aliases") or []), "malicious": bool(r.get("malicious"))} for r in group[:10]]}))
+                                              "aliases": list(r.get("aliases") or []), "malicious": bool(r.get("malicious")),
+                                              "imported": r.get("imported", "unknown")} for r in group[:10]]}))
     return out
 
 
@@ -753,7 +757,8 @@ def hygiene_findings(report: dict) -> list:
     stands in for without the GitHub API. Nothing for an output directory from before the step."""
     h = report.get("hygiene") or {}
     out = []
-    for check in (_hygiene_actions, _hygiene_lockfiles, _hygiene_updates, _hygiene_presence, _hygiene_confusion, _hygiene_install, _hygiene_binaries, _hygiene_submodules, _hygiene_symlinks, _hygiene_trojan):
+    for check in (_hygiene_actions, _hygiene_lockfiles, _hygiene_updates, _hygiene_presence, _hygiene_confusion, _hygiene_install, _hygiene_binaries, _hygiene_submodules, _hygiene_symlinks, _hygiene_trojan,
+                  _hygiene_unused, _hygiene_licence, _hygiene_copyleft):
         check(h, out)
     return out
 
@@ -908,6 +913,59 @@ def _hygiene_trojan(h: dict, out: list) -> None:
                       evidence={"bidi": (tj.get("bidi") or [])[:10], "mixed_script": (tj.get("mixed_script") or [])[:10]}))
 
 
+def _hygiene_unused(h: dict, out: list) -> None:
+    im = h.get("imports") or {}
+    rows = im.get("unused") or []
+    if not rows:
+        return
+    by_manifest = {}
+    for r in rows:
+        by_manifest.setdefault(r["manifest"], []).append(r["package"])
+    listed = "; ".join(f"{_files_list(v)} in {k}" for k, v in list(by_manifest.items())[:3])
+    n = im.get("count", len(rows))
+    first = rows[0]
+    out.append(_f("info", "Declared dependencies nothing imports",
+                  f"{n} runtime {'dependency is' if n == 1 else 'dependencies are'} declared and never imported by a tracked file, nor named in a script or configuration: {listed}.",
+                  f"Remove {first['package']} from {first['manifest']} if nothing loads it at run time; an unused dependency is still installed, scanned and updated.",
+                  rule={"id": "unused_dependencies", "reads": "package.json dependencies, go.mod direct requirements, Cargo.toml [dependencies]"},
+                  evidence={"count": n, "manifests": im.get("manifests", 0), "unused": rows[:10]}))
+
+
+def _hygiene_licence(h: dict, out: list) -> None:
+    lic = h.get("licences") or {}
+    declared = lic.get("declared") or []
+    if lic.get("approved") is False or lic.get("mismatch"):
+        named = "; ".join(f"{d['source']} declares {d['expression']}" for d in declared)
+        parts = []
+        if lic.get("mismatch"):
+            parts.append(f"{named}, but {lic['files'][0]} is the {lic['file_licence']} text")
+        if lic.get("approved") is False:
+            parts.append(f"the declared licence ({textfmt.join_and([d['expression'] for d in declared] or [lic.get('file_licence') or ''])}) is not OSI- or FSF-approved")
+        out.append(_f("warning" if lic.get("approved") is False else "info", "Project licence as declared", "; ".join(parts) + ".",
+                      "Make the manifests and the licence file name the same licence; a packager reads the manifest, a lawyer the file." if lic.get("mismatch")
+                      else "Say so plainly in the README if the project is source-available rather than open source.",
+                      rule={"id": "project_licence", "reads": "root manifests and the licence file"},
+                      evidence={"declared": declared, "file": (lic.get("files") or [None])[0], "file_licence": lic.get("file_licence"),
+                                "approved": lic.get("approved"), "mismatch": bool(lic.get("mismatch"))}))
+
+
+def _hygiene_copyleft(h: dict, out: list) -> None:
+    lic = h.get("licences") or {}
+    strong = lic.get("strong") or []
+    if not strong or lic.get("project") != licences.PERMISSIVE:
+        return
+    n = lic.get("strong_count", len(strong))
+    listed = _files_list([f"{d['name']} {d['version']} ({d['expression']})" for d in strong])
+    own = textfmt.join_and(sorted({d["expression"] for d in lic.get("declared") or []} | ({lic["file_licence"]} if lic.get("file_licence") else set())))
+    weak = f" {lic['weak_count']} more declare{'s' if lic.get('weak_count') == 1 else ''} weak copyleft (LGPL, MPL, EPL), which a dependency usually may." if lic.get("weak_count") else ""
+    out.append(_f("warning", "Copyleft dependencies in a permissive project",
+                  f"The project declares {own}, and {n} runtime {'dependency' if n == 1 else 'dependencies'} in {textfmt.join_and(sorted({d['lockfile'] for d in strong}))} "
+                  f"{'declares' if n == 1 else 'declare'} a strong copyleft licence: {listed}.{weak} Declared, as the lock file records it, not read from the package's files.",
+                  f"Check whether {strong[0]['name']} is distributed with the project; if it is, its licence terms reach the whole work.",
+                  rule={"id": "copyleft_dependencies", "reads": "package-lock.json and composer.lock licence fields, runtime packages only"},
+                  evidence={"project": own, "count": n, "weak": lic.get("weak_count", 0), "dependencies": lic.get("dependencies", 0), "strong": strong[:10]}))
+
+
 def _aside_path(path: str) -> bool:
     return filetypes.is_test_path(path) or filetypes.is_sample_path(path) or filetypes.is_vendor_path(path)
 
@@ -1101,10 +1159,118 @@ def signoff_by_co_author(report: dict, min_commits: int = 2) -> list:
                evidence={"identities": rows[:10]})]
 
 
+def _pool_files(report: dict) -> list:
+    """The source files still in the tree that no classifier reason sets aside."""
+    from . import classify
+    cls = classify.Classifier(report)
+    return sorted(f for f in _tree(report) if cls.reason(f) is None)
+
+
+def _authors_of(report: dict, files: list, key: str = "is_author") -> dict:
+    wanted = set(files)
+    out = {f: set() for f in files}
+    for r in report.get("doa") or []:
+        if r["entity"] in wanted and r.get(key):
+            out[r["entity"]].add(r["author"])
+    return out
+
+
+def truck_factor(report: dict, min_files: int = 20, area_files: int = 10) -> list:
+    """Avelino et al.'s truck factor over the degree of authorship: how many people have to leave before
+    more than half the source files have no author. One is a warning, two a note. Changes rather than
+    lines, and a creator's bonus, so it can disagree with the surviving-code share, which the bus-factor
+    finding reads; the finding says so when it does. Also per area, and with knowledge halving every
+    five months."""
+    if not report.get("doa"):
+        return []
+    files = _pool_files(report)
+    authored = {f: a for f, a in _authors_of(report, files).items()}
+    if len(files) < min_files:
+        return []
+    tf, removed, share = knowledge.truck_factor(authored)
+    tf_d, removed_d, _ = knowledge.truck_factor(_authors_of(report, files, "is_author_decayed"))
+    depth = knowledge.depth_for(files)
+    areas = {}
+    for f in files:
+        areas.setdefault(knowledge._area(f, depth), []).append(f)
+    lone = []
+    for area, fs in sorted(areas.items()):
+        if len(fs) >= area_files and area != knowledge.ROOT:
+            n, who, _ = knowledge.truck_factor({f: authored[f] for f in fs})
+            if n == 1:
+                lone.append((area, who[0]))
+    if tf > 2 and not lone:
+        return []
+    orphans = round(share * len(files))
+    statement = (f"Truck factor {tf}: without {textfmt.join_and(removed)}, {orphans} of the {len(files)} source files ({_pct(orphans, len(files))}) "
+                 f"have no author left.")
+    if tf_d != tf:
+        statement += f" With knowledge halving every five months it is {tf_d} ({textfmt.join_and(removed_d)})."
+    if lone:
+        statement += " Areas with a truck factor of one: " + ", ".join(f"{a} ({w})" for a, w in lone[:5]) + (f" and {len(lone) - 5} more" if len(lone) > 5 else "") + "."
+    shares = report.get("theseus_authors") or {}
+    if shares and removed:
+        top, lines = max(shares.items(), key=lambda kv: kv[1])
+        if top != removed[0]:
+            statement += f" The surviving code's largest share is {top}'s ({_pct(lines, sum(shares.values()))}), which the bus-factor finding reads."
+    first_area = next((a for a, w in lone if w == removed[0]), lone[0][0] if lone else None)
+    advice = f"Pair someone with {removed[0]}" + (f" on {first_area}" if first_area else "") + " first; they author most of what would be left without an author."
+    return [_f("warning" if tf == 1 else "info", "Truck factor", statement, advice,
+               rule={"id": "truck_factor", "doa_author_share": 0.75, "doa_floor": 3.293, "orphan_share": 0.5, "decay_months": 5,
+                     "ref": "Avelino et al., ICPC 2016"},
+               evidence={"truck_factor": tf, "removed": removed, "truck_factor_decayed": tf_d, "removed_decayed": removed_d,
+                         "files": len(files), "orphaned": orphans, "areas": [{"area": a, "author": w} for a, w in lone[:10]]})]
+
+
+def authors_gone(report: dict, min_files: int = 5) -> list:
+    """Files whose every author by degree of authorship has stopped committing, while others still
+    change them: "creator left, editors remain", knowledge the blame share cannot show."""
+    if not report.get("doa"):
+        return []
+    months = report["meta"].get("gone_months", loss.DEFAULT_MONTHS)
+    gone = {g["name"] for g in loss.gone(report, months)}
+    fresh = {a["entity"] for a in report.get("age") or [] if a["age-months"] < 12}
+    files = [f for f in _pool_files(report) if f in fresh]
+    authored = _authors_of(report, files)
+    left = [(f, sorted(a)) for f, a in authored.items() if a and a <= gone]
+    if len(left) < min_files:
+        return []
+    listed = "; ".join(f"{f} ({textfmt.join_and(a)})" for f, a in left[:5]) + (f" and {len(left) - 5} more" if len(left) > 5 else "")
+    return [_f("info", "Files whose authors have left", f"{len(left)} source files changed in the last year have no author still committing: {listed}.",
+               f"Make the people who edit {left[0][0]} its authors: review its design with them and write down what only {left[0][1][0]} knew.",
+               rule={"id": "authors_gone", "gone_months": months, "min_files": min_files, "ref": "Avelino et al., ICPC 2016"},
+               evidence={"count": len(left), "files": [{"file": f, "authors": a} for f, a in left[:10]]})]
+
+
+def component_coupling(report: dict, min_degree: int = 30) -> list:
+    """Components (top-level directories, or the level below a lone src/) that change together in a
+    large share of their changes: coupling at the level of the architecture, where two files in one
+    directory is only a layout."""
+    rows = report.get("components") or []
+    if not rows:
+        return []
+    depth = knowledge.depth_for(list(_tree(report)) or [r["entity"] + "x" for r in rows])
+
+    def aside(c):
+        probe = c + "x.py"
+        return filetypes.is_test_path(probe) or filetypes.is_sample_path(probe) or filetypes.is_doc_path(probe) or filetypes.is_vendor_path(probe)
+    pairs = [r for r in rows if r["depth"] == depth and r["degree"] >= min_degree and not aside(r["entity"]) and not aside(r["coupled"])]
+    if not pairs:
+        return []
+    listed = "; ".join(f"{p['entity']} and {p['coupled']} change together in {p['degree']}% of their changes ({p['shared']} shared)" for p in pairs[:3])
+    more = f" ({len(pairs) - 3} more pairs)" if len(pairs) > 3 else ""
+    first = pairs[0]
+    return [_f("info", "Components that change together", f"{listed}{more}.",
+               f"Look at what {first['entity']} and {first['coupled']} share: a change that keeps landing in both is an interface nobody named.",
+               rule={"id": "component_coupling", "min_degree": min_degree, "depth": depth, "ref": "Tornhill, Your Code as a Crime Scene, 2024"},
+               evidence={"pairs": [{"a": p["entity"], "b": p["coupled"], "degree": p["degree"], "shared": p["shared"]} for p in pairs[:10]]})]
+
+
 RULES = [dormant, secrets_found, credential_files, vulnerable_dependencies, placeholder_identity, bus_factor, sizer_concerns, hotspot_dominance, bug_magnets,
          minor_contributors, reverts, brain_methods, complexity_growth, tight_coupling, duplication, stale_files, knowledge_islands, knowledge_loss,
          sweeping_commits, tangled_commits, hygiene_findings, debt_in_hotspots, deep_nesting, hidden_coupling, unreferenced_files,
-         agent_approval_disabled, agent_local_settings, mcp_literal_env, agent_instructions_drift, signoff_by_co_author]
+         agent_approval_disabled, agent_local_settings, mcp_literal_env, agent_instructions_drift, signoff_by_co_author,
+         truck_factor, authors_gone, component_coupling]
 
 
 def evaluate(report: dict) -> list:

{gitmole-0.18.0 → gitmole-0.20.0}/gitmole/hygiene.py

@@ -10,7 +10,8 @@ workflow's `uses:`, a lock file's name, `.gitmodules`, a symlink's mode) or on t
 - actions: `uses: owner/repo@ref` in .github/workflows where the ref is not a full commit SHA;
 - lockfiles: a manifest whose last commit is newer than its lock file's, or a manifest with none;
 - updates: the ecosystems whose lock files are tracked that dependabot.yml does not cover;
-- presence: a licence, a security policy, CODEOWNERS and the CODEOWNERS paths that match nothing;
+- presence: a licence, a security policy, a contribution guide, CODEOWNERS and the CODEOWNERS paths
+  that match nothing;
 - confusion: a scoped npm package resolved from a registry other than the one .npmrc declares for
   its scope, several registries in one lock file, a pip `extra-index-url`;
 - install: packages with install scripts in package-lock.json, lifecycle scripts in a tracked
@@ -20,7 +21,9 @@ workflow's `uses:`, a lock file's name, `.gitmodules`, a symlink's mode) or on t
 - submodules: plain http:// or git:// URLs, credentials in a URL, relative URLs, `branch =`;
 - symlinks: links that resolve outside the tree or into .git/;
 - trojan: bidirectional control characters (CVE-2021-42574) and identifiers that mix Latin with
-  Cyrillic, Greek or another confusable script, in source files."""
+  Cyrillic, Greek or another confusable script, in source files;
+- licences: the licences the project and its locked dependencies declare (licences.py);
+- imports: declared dependencies that nothing tracked imports (imports.py)."""
 from __future__ import annotations
 
 import ast
@@ -34,9 +37,11 @@ from collections import defaultdict
 from urllib.parse import urlsplit
 
 try:
-    from . import filetypes
+    from . import filetypes, imports, licences
 except ImportError:  # run as a script: the package directory is sys.path[0]
     import filetypes
+    import imports
+    import licences
 
 CAP = 50   # rows kept per list: the count says how many there were
 
@@ -197,8 +202,10 @@ def presence(repo: str) -> dict:
                 if p.startswith(prefix) and "/" not in p[len(prefix):] and re.match(names, p[len(prefix):], re.I):
                     return p
         return None
-    licence = next((p for p in tracked if "/" not in p and re.match(r"^(licen[cs]e|copying)(\.|-|$)", p, re.I)), None)
+    licence = next((p for p in tracked if "/" not in p and re.match(r"^(licen[cs]e|copying)(\.|-|$)", p, re.I)), None) \
+        or next(("LICENSES/" for p in tracked if p.startswith("LICENSES/")), None)   # the REUSE layout
     policy = first(r"^security(\.md|\.txt|\.rst)?$")
+    contributing = first(r"^contributing(\.md|\.txt|\.rst|\.adoc)?$")
     owners = first(r"^codeowners$")
     missing = []
     if owners:
@@ -209,7 +216,7 @@ def presence(repo: str) -> dict:
             pattern = line.split()[0]
             if not _codeowners_matches(pattern, tracked):
                 missing.append(pattern)
-    return {"license": licence, "security_policy": policy, "codeowners": owners, "codeowners_missing": missing[:CAP]}
+    return {"license": licence, "security_policy": policy, "contributing": contributing, "codeowners": owners, "codeowners_missing": missing[:CAP]}
 
 
 # --- dependency confusion -----------------------------------------------------------------------
@@ -483,7 +490,7 @@ def trojan_source(repo: str) -> dict:
 
 CHECKS = {"actions": actions_pinning, "lockfiles": lockfiles, "updates": dependency_updates, "presence": presence,
           "confusion": dependency_confusion, "install": install_scripts, "binaries": binaries, "submodules": submodules,
-          "symlinks": symlinks, "trojan": trojan_source}
+          "symlinks": symlinks, "trojan": trojan_source, "licences": licences.check, "imports": imports.unused}
 
 
 def main(argv=None) -> int: