license-radar 0.1.0__tar.gz

license_radar-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 license-radar contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

license_radar-0.1.0/PKG-INFO

@@ -0,0 +1,77 @@
+Metadata-Version: 2.4
+Name: license-radar
+Version: 0.1.0
+Summary: Scan project dependency manifests for license compliance risk (GPL/AGPL/LGPL exposure) before it becomes a legal problem.
+Author: license-radar
+License: MIT
+Keywords: license,compliance,sca,dependencies,security,gpl,audit
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# license-radar
+
+Scan a project's dependency manifests (`requirements.txt`, `pyproject.toml`,
+`package.json`) for license compliance risk before a GPL/AGPL dependency
+turns into a legal problem for a closed-source product.
+
+## Why
+
+Pulling in a GPL- or AGPL-licensed dependency can obligate a company to open
+its own source, or expose it to a lawsuit — and it usually happens by
+accident, several dependency layers deep. Existing SCA/security scanners
+focus on vulnerabilities; license risk is often an afterthought bolted onto
+an expensive enterprise product. This is a small, focused tool that does
+just the license check, fast, in CI.
+
+## Install
+
+```bash
+pip install license-radar
+```
+
+## Usage
+
+```bash
+license-radar scan .                 # scan a directory (auto-detects manifests)
+license-radar scan requirements.txt   # scan a single manifest
+license-radar scan . --online         # also query PyPI/npm for packages not in the local DB
+license-radar scan . --json           # machine-readable output for CI
+license-radar scan . --policy policy.json
+```
+
+Exit code is `1` if any dependency violates the policy (useful as a CI gate),
+`0` otherwise.
+
+### Policy
+
+By default, any `strong-copyleft` (GPL/AGPL/SSPL) or `unknown` license is a
+violation. Override with a JSON file:
+
+```json
+{
+  "fail_at_or_above": "weak-copyleft",
+  "treat_unknown_as_violation": false
+}
+```
+
+## How it classifies
+
+Licenses are normalized to an SPDX id and bucketed into four tiers:
+`permissive` < `weak-copyleft` < `strong-copyleft` < `unknown`. See
+`license_radar/classify.py` for the exact lists.
+
+## Limitations
+
+The offline database (`license_radar/license_db.py`) is a small, hand-curated
+table of common packages, not a registry mirror — use `--online` for full
+coverage against live PyPI/npm metadata (adds a network dependency and is
+not covered by the deterministic test suite).
+
+## License
+
+MIT

license_radar-0.1.0/README.md

@@ -0,0 +1,62 @@
+# license-radar
+
+Scan a project's dependency manifests (`requirements.txt`, `pyproject.toml`,
+`package.json`) for license compliance risk before a GPL/AGPL dependency
+turns into a legal problem for a closed-source product.
+
+## Why
+
+Pulling in a GPL- or AGPL-licensed dependency can obligate a company to open
+its own source, or expose it to a lawsuit — and it usually happens by
+accident, several dependency layers deep. Existing SCA/security scanners
+focus on vulnerabilities; license risk is often an afterthought bolted onto
+an expensive enterprise product. This is a small, focused tool that does
+just the license check, fast, in CI.
+
+## Install
+
+```bash
+pip install license-radar
+```
+
+## Usage
+
+```bash
+license-radar scan .                 # scan a directory (auto-detects manifests)
+license-radar scan requirements.txt   # scan a single manifest
+license-radar scan . --online         # also query PyPI/npm for packages not in the local DB
+license-radar scan . --json           # machine-readable output for CI
+license-radar scan . --policy policy.json
+```
+
+Exit code is `1` if any dependency violates the policy (useful as a CI gate),
+`0` otherwise.
+
+### Policy
+
+By default, any `strong-copyleft` (GPL/AGPL/SSPL) or `unknown` license is a
+violation. Override with a JSON file:
+
+```json
+{
+  "fail_at_or_above": "weak-copyleft",
+  "treat_unknown_as_violation": false
+}
+```
+
+## How it classifies
+
+Licenses are normalized to an SPDX id and bucketed into four tiers:
+`permissive` < `weak-copyleft` < `strong-copyleft` < `unknown`. See
+`license_radar/classify.py` for the exact lists.
+
+## Limitations
+
+The offline database (`license_radar/license_db.py`) is a small, hand-curated
+table of common packages, not a registry mirror — use `--online` for full
+coverage against live PyPI/npm metadata (adds a network dependency and is
+not covered by the deterministic test suite).
+
+## License
+
+MIT

license_radar-0.1.0/license_radar/__init__.py

@@ -0,0 +1,3 @@
+"""license-radar: scan project dependency manifests for license compliance risk."""
+
+__version__ = "0.1.0"

license_radar-0.1.0/license_radar/classify.py

@@ -0,0 +1,68 @@
+"""Classify an SPDX license identifier into a compliance risk tier."""
+
+PERMISSIVE = {
+    "MIT", "ISC", "BSD-2-Clause", "BSD-3-Clause", "Apache-2.0", "HPND",
+    "Python-2.0", "Unlicense", "0BSD", "Zlib", "BSL-1.0",
+}
+
+WEAK_COPYLEFT = {
+    "MPL-2.0", "LGPL-2.1-only", "LGPL-2.1-or-later",
+    "LGPL-3.0-only", "LGPL-3.0-or-later", "EPL-1.0", "EPL-2.0",
+}
+
+STRONG_COPYLEFT = {
+    "GPL-2.0-only", "GPL-2.0-or-later", "GPL-3.0-only", "GPL-3.0-or-later",
+    "AGPL-3.0-only", "AGPL-3.0-or-later", "SSPL-1.0",
+}
+
+TIER_PERMISSIVE = "permissive"
+TIER_WEAK_COPYLEFT = "weak-copyleft"
+TIER_STRONG_COPYLEFT = "strong-copyleft"
+TIER_UNKNOWN = "unknown"
+
+_RANK = {
+    TIER_PERMISSIVE: 0,
+    TIER_WEAK_COPYLEFT: 1,
+    TIER_STRONG_COPYLEFT: 2,
+    TIER_UNKNOWN: 3,
+}
+
+# Loose aliases seen in free-text "license" fields returned by registry
+# APIs (as opposed to a strict SPDX id from our own curated DB).
+_ALIASES = {
+    "MIT LICENSE": "MIT",
+    "BSD": "BSD-3-Clause",
+    "BSD LICENSE": "BSD-3-Clause",
+    "APACHE SOFTWARE LICENSE": "Apache-2.0",
+    "APACHE 2.0": "Apache-2.0",
+    "GPLV3": "GPL-3.0-only",
+    "GPL V3": "GPL-3.0-only",
+    "GPL-3.0": "GPL-3.0-only",
+    "GPL-2.0": "GPL-2.0-only",
+    "LGPLV3": "LGPL-3.0-only",
+    "LGPL-3.0": "LGPL-3.0-only",
+    "AGPLV3": "AGPL-3.0-only",
+    "AGPL-3.0": "AGPL-3.0-only",
+}
+
+
+def _normalize(spdx: str) -> str:
+    key = spdx.strip().upper()
+    return _ALIASES.get(key, spdx.strip())
+
+
+def classify_license(spdx: str | None) -> str:
+    if not spdx:
+        return TIER_UNKNOWN
+    normalized = _normalize(spdx)
+    if normalized in PERMISSIVE:
+        return TIER_PERMISSIVE
+    if normalized in WEAK_COPYLEFT:
+        return TIER_WEAK_COPYLEFT
+    if normalized in STRONG_COPYLEFT:
+        return TIER_STRONG_COPYLEFT
+    return TIER_UNKNOWN
+
+
+def tier_rank(tier: str) -> int:
+    return _RANK.get(tier, _RANK[TIER_UNKNOWN])

license_radar-0.1.0/license_radar/cli.py

@@ -0,0 +1,68 @@
+"""Command-line entry point: `license-radar scan <path>`."""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from license_radar.policy import load_policy, violates
+from license_radar.scanner import scan_path
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="license-radar")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+
+    scan = subparsers.add_parser("scan", help="Scan a project for license risk")
+    scan.add_argument("path", type=Path, help="Directory or manifest file to scan")
+    scan.add_argument("--policy", type=Path, default=None, help="Path to a JSON policy file")
+    scan.add_argument("--json", action="store_true", help="Emit machine-readable JSON")
+    scan.add_argument(
+        "--online", action="store_true",
+        help="Query PyPI/npm registries for packages missing from the local DB",
+    )
+
+    return parser
+
+
+def run_scan(args) -> int:
+    findings = scan_path(args.path, online=args.online)
+    policy = load_policy(args.policy)
+
+    rows = [
+        {
+            "ecosystem": f.ecosystem,
+            "package": f.package,
+            "license": f.license or "UNKNOWN",
+            "tier": f.tier,
+            "violation": violates(f, policy),
+        }
+        for f in findings
+    ]
+    has_violation = any(row["violation"] for row in rows)
+
+    if args.json:
+        print(json.dumps({"findings": rows, "violation": has_violation}, indent=2))
+    else:
+        if not rows:
+            print("No dependencies found.")
+        for row in rows:
+            flag = " !!" if row["violation"] else ""
+            print(f"[{row['ecosystem']}] {row['package']}: {row['license']} ({row['tier']}){flag}")
+        print()
+        print("VIOLATIONS FOUND" if has_violation else "OK — no policy violations")
+
+    return 1 if has_violation else 0
+
+
+def main(argv=None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    if args.command == "scan":
+        return run_scan(args)
+    parser.print_help()
+    return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

license_radar-0.1.0/license_radar/license_db.py

@@ -0,0 +1,88 @@
+"""Static package -> SPDX license lookup table.
+
+This is a small, hand-curated offline database used when no network lookup
+is available (or desired, e.g. in CI). Entries are keyed by
+``(ecosystem, normalized_package_name)``. Ecosystem is one of "pypi" or
+"npm". Package names are lowercased and, for pypi, normalized by replacing
+``_``/``.`` with ``-`` per PEP 503.
+
+A handful of entries with the ``test-`` prefix are synthetic fixtures used
+only by the test suite to exercise the strong-copyleft / unknown-license
+code paths without asserting real-world facts about a live package's
+license.
+"""
+
+PYPI_LICENSES = {
+    "requests": "Apache-2.0",
+    "flask": "BSD-3-Clause",
+    "django": "BSD-3-Clause",
+    "numpy": "BSD-3-Clause",
+    "pandas": "BSD-3-Clause",
+    "pytest": "MIT",
+    "click": "BSD-3-Clause",
+    "pyyaml": "MIT",
+    "sqlalchemy": "MIT",
+    "celery": "BSD-3-Clause",
+    "scrapy": "BSD-3-Clause",
+    "twisted": "MIT",
+    "pillow": "HPND",
+    "setuptools": "MIT",
+    "wheel": "MIT",
+    "six": "MIT",
+    "certifi": "MPL-2.0",
+    "idna": "BSD-3-Clause",
+    "urllib3": "MIT",
+    "jinja2": "BSD-3-Clause",
+    "markupsafe": "BSD-3-Clause",
+    "itsdangerous": "BSD-3-Clause",
+    "werkzeug": "BSD-3-Clause",
+    "gunicorn": "MIT",
+    "redis": "MIT",
+    "boto3": "Apache-2.0",
+    "botocore": "Apache-2.0",
+    "pyqt5": "GPL-3.0-only",
+    "psycopg2": "LGPL-3.0-only",
+    "paramiko": "LGPL-2.1-only",
+    "chardet": "LGPL-2.1-only",
+    # synthetic fixtures (not a claim about any real package)
+    "test-strong-copyleft-pkg": "AGPL-3.0-only",
+    "test-weak-copyleft-pkg": "MPL-2.0",
+    "test-permissive-pkg": "MIT",
+    "test-proprietary-pkg": "LicenseRef-Proprietary",
+}
+
+NPM_LICENSES = {
+    "react": "MIT",
+    "lodash": "MIT",
+    "express": "MIT",
+    "axios": "MIT",
+    "moment": "MIT",
+    "chalk": "MIT",
+    "commander": "MIT",
+    "webpack": "MIT",
+    "eslint": "MIT",
+    "typescript": "Apache-2.0",
+    "rxjs": "Apache-2.0",
+    "core-js": "MIT",
+    "sqlite3": "BSD-3-Clause",
+    # synthetic fixtures (not a claim about any real package)
+    "test-strong-copyleft-pkg": "GPL-3.0-only",
+    "test-weak-copyleft-pkg": "LGPL-3.0-only",
+    "test-permissive-pkg": "ISC",
+}
+
+_DB = {
+    "pypi": PYPI_LICENSES,
+    "npm": NPM_LICENSES,
+}
+
+
+def normalize_pypi_name(name: str) -> str:
+    return name.strip().lower().replace("_", "-").replace(".", "-")
+
+
+def lookup(ecosystem: str, name: str) -> str | None:
+    """Return the SPDX license id for a package, or None if unknown."""
+    table = _DB.get(ecosystem, {})
+    key = normalize_pypi_name(name) if ecosystem == "pypi" else name.strip().lower()
+    return table.get(key)

license_radar-0.1.0/license_radar/parsers.py

@@ -0,0 +1,72 @@
+"""Extract dependency names from common manifest file formats."""
+
+import json
+import re
+import tomllib
+from pathlib import Path
+
+_REQ_LINE_RE = re.compile(r"^\s*([A-Za-z0-9._-]+)")
+
+
+def parse_requirements_txt(path: Path) -> list[str]:
+    names = []
+    for raw_line in path.read_text().splitlines():
+        line = raw_line.split("#", 1)[0].strip()
+        if not line or line.startswith(("-", "--")):
+            continue
+        match = _REQ_LINE_RE.match(line)
+        if match:
+            names.append(match.group(1))
+    return names
+
+
+def parse_pyproject_toml(path: Path) -> list[str]:
+    data = tomllib.loads(path.read_text())
+    names = []
+
+    project_deps = data.get("project", {}).get("dependencies", [])
+    for dep in project_deps:
+        match = _REQ_LINE_RE.match(dep.strip())
+        if match:
+            names.append(match.group(1))
+
+    poetry_deps = (
+        data.get("tool", {}).get("poetry", {}).get("dependencies", {})
+    )
+    for name in poetry_deps:
+        if name.lower() != "python":
+            names.append(name)
+
+    return names
+
+
+def parse_package_json(path: Path) -> list[str]:
+    data = json.loads(path.read_text())
+    names = []
+    for section in ("dependencies", "devDependencies"):
+        names.extend(data.get(section, {}).keys())
+    return names
+
+
+def _matches_manifest(name: str) -> tuple[str, object] | None:
+    if name == "pyproject.toml":
+        return "pypi", parse_pyproject_toml
+    if name == "package.json":
+        return "npm", parse_package_json
+    if name.startswith("requirements") and name.endswith(".txt"):
+        return "pypi", parse_requirements_txt
+    return None
+
+
+def discover_manifests(root: Path) -> list[Path]:
+    if root.is_file():
+        return [root] if _matches_manifest(root.name) else []
+    return sorted(p for p in root.iterdir() if p.is_file() and _matches_manifest(p.name))
+
+
+def parse_manifest(path: Path) -> tuple[str, list[str]]:
+    match = _matches_manifest(path.name)
+    if match is None:
+        raise ValueError(f"unrecognized manifest file: {path.name}")
+    ecosystem, parser = match
+    return ecosystem, parser(path)

license_radar-0.1.0/license_radar/policy.py

@@ -0,0 +1,31 @@
+"""Decide pass/fail for a scan based on a configurable risk policy.
+
+The default policy fails a scan (non-zero exit code) if any dependency
+falls into the "strong-copyleft" or "unknown" tier. This mirrors the most
+common compliance requirement for closed-source commercial projects.
+"""
+
+import json
+from pathlib import Path
+
+from license_radar.classify import tier_rank
+
+DEFAULT_POLICY = {
+    "fail_at_or_above": "strong-copyleft",
+    "treat_unknown_as_violation": True,
+}
+
+
+def load_policy(path: Path | None) -> dict:
+    if path is None:
+        return dict(DEFAULT_POLICY)
+    policy = dict(DEFAULT_POLICY)
+    policy.update(json.loads(path.read_text()))
+    return policy
+
+
+def violates(finding, policy: dict) -> bool:
+    if finding.tier == "unknown":
+        return bool(policy.get("treat_unknown_as_violation", True))
+    threshold = policy.get("fail_at_or_above", "strong-copyleft")
+    return tier_rank(finding.tier) >= tier_rank(threshold)

license_radar-0.1.0/license_radar/remote.py

@@ -0,0 +1,58 @@
+"""Optional live license lookup against public registry APIs.
+
+Used only when the caller passes --online, since it requires network
+access and is therefore excluded from the deterministic offline test
+suite. Falls back to None (unknown) on any network or parsing error —
+a scan should degrade gracefully, not crash, when a registry is
+unreachable.
+"""
+
+import json
+import urllib.parse
+import urllib.request
+
+_TIMEOUT = 5.0
+
+
+def fetch_pypi_license(name: str) -> str | None:
+    url = f"https://pypi.org/pypi/{name}/json"
+    try:
+        with urllib.request.urlopen(url, timeout=_TIMEOUT) as resp:
+            data = json.loads(resp.read())
+    except (OSError, ValueError):
+        return None
+
+    info = data.get("info", {})
+    license_field = (info.get("license") or "").strip()
+    if license_field and len(license_field) < 40:
+        return license_field
+
+    for classifier in info.get("classifiers", []):
+        if classifier.startswith("License :: OSI Approved ::"):
+            return classifier.rsplit("::", 1)[-1].strip()
+
+    return None
+
+
+def fetch_npm_license(name: str) -> str | None:
+    url = f"https://registry.npmjs.org/{urllib.parse.quote(name, safe='')}"
+    try:
+        with urllib.request.urlopen(url, timeout=_TIMEOUT) as resp:
+            data = json.loads(resp.read())
+    except (OSError, ValueError):
+        return None
+
+    license_field = data.get("license")
+    if isinstance(license_field, str):
+        return license_field
+    if isinstance(license_field, dict):
+        return license_field.get("type")
+    return None
+
+
+def fetch_remote_license(ecosystem: str, name: str) -> str | None:
+    if ecosystem == "pypi":
+        return fetch_pypi_license(name)
+    if ecosystem == "npm":
+        return fetch_npm_license(name)
+    return None

license_radar-0.1.0/license_radar/scanner.py

@@ -0,0 +1,36 @@
+"""Combine parsing, license lookup, and risk classification into a report."""
+
+from dataclasses import dataclass
+from pathlib import Path
+
+from license_radar import license_db
+from license_radar.classify import classify_license
+from license_radar.parsers import discover_manifests, parse_manifest
+
+
+@dataclass
+class Finding:
+    ecosystem: str
+    package: str
+    license: str | None
+    tier: str
+
+
+def scan_manifest(path: Path, online: bool = False) -> list[Finding]:
+    ecosystem, names = parse_manifest(path)
+    findings = []
+    for name in names:
+        spdx = license_db.lookup(ecosystem, name)
+        if spdx is None and online:
+            from license_radar.remote import fetch_remote_license
+
+            spdx = fetch_remote_license(ecosystem, name)
+        findings.append(Finding(ecosystem, name, spdx, classify_license(spdx)))
+    return findings
+
+
+def scan_path(root: Path, online: bool = False) -> list[Finding]:
+    findings = []
+    for manifest in discover_manifests(root):
+        findings.extend(scan_manifest(manifest, online=online))
+    return findings

license_radar-0.1.0/license_radar.egg-info/PKG-INFO

@@ -0,0 +1,77 @@
+Metadata-Version: 2.4
+Name: license-radar
+Version: 0.1.0
+Summary: Scan project dependency manifests for license compliance risk (GPL/AGPL/LGPL exposure) before it becomes a legal problem.
+Author: license-radar
+License: MIT
+Keywords: license,compliance,sca,dependencies,security,gpl,audit
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# license-radar
+
+Scan a project's dependency manifests (`requirements.txt`, `pyproject.toml`,
+`package.json`) for license compliance risk before a GPL/AGPL dependency
+turns into a legal problem for a closed-source product.
+
+## Why
+
+Pulling in a GPL- or AGPL-licensed dependency can obligate a company to open
+its own source, or expose it to a lawsuit — and it usually happens by
+accident, several dependency layers deep. Existing SCA/security scanners
+focus on vulnerabilities; license risk is often an afterthought bolted onto
+an expensive enterprise product. This is a small, focused tool that does
+just the license check, fast, in CI.
+
+## Install
+
+```bash
+pip install license-radar
+```
+
+## Usage
+
+```bash
+license-radar scan .                 # scan a directory (auto-detects manifests)
+license-radar scan requirements.txt   # scan a single manifest
+license-radar scan . --online         # also query PyPI/npm for packages not in the local DB
+license-radar scan . --json           # machine-readable output for CI
+license-radar scan . --policy policy.json
+```
+
+Exit code is `1` if any dependency violates the policy (useful as a CI gate),
+`0` otherwise.
+
+### Policy
+
+By default, any `strong-copyleft` (GPL/AGPL/SSPL) or `unknown` license is a
+violation. Override with a JSON file:
+
+```json
+{
+  "fail_at_or_above": "weak-copyleft",
+  "treat_unknown_as_violation": false
+}
+```
+
+## How it classifies
+
+Licenses are normalized to an SPDX id and bucketed into four tiers:
+`permissive` < `weak-copyleft` < `strong-copyleft` < `unknown`. See
+`license_radar/classify.py` for the exact lists.
+
+## Limitations
+
+The offline database (`license_radar/license_db.py`) is a small, hand-curated
+table of common packages, not a registry mirror — use `--online` for full
+coverage against live PyPI/npm metadata (adds a network dependency and is
+not covered by the deterministic test suite).
+
+## License
+
+MIT

license_radar-0.1.0/license_radar.egg-info/SOURCES.txt

@@ -0,0 +1,19 @@
+LICENSE
+README.md
+pyproject.toml
+license_radar/__init__.py
+license_radar/classify.py
+license_radar/cli.py
+license_radar/license_db.py
+license_radar/parsers.py
+license_radar/policy.py
+license_radar/remote.py
+license_radar/scanner.py
+license_radar.egg-info/PKG-INFO
+license_radar.egg-info/SOURCES.txt
+license_radar.egg-info/dependency_links.txt
+license_radar.egg-info/entry_points.txt
+license_radar.egg-info/top_level.txt
+tests/test_classify.py
+tests/test_parsers.py
+tests/test_scanner.py

license_radar-0.1.0/license_radar.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

license_radar-0.1.0/license_radar.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+license-radar = license_radar.cli:main

license_radar-0.1.0/license_radar.egg-info/top_level.txt

@@ -0,0 +1 @@
+license_radar

license_radar-0.1.0/pyproject.toml

@@ -0,0 +1,24 @@
+[project]
+name = "license-radar"
+version = "0.1.0"
+description = "Scan project dependency manifests for license compliance risk (GPL/AGPL/LGPL exposure) before it becomes a legal problem."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "MIT" }
+authors = [{ name = "license-radar" }]
+keywords = ["license", "compliance", "sca", "dependencies", "security", "gpl", "audit"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "License :: OSI Approved :: MIT License",
+    "Topic :: Software Development :: Quality Assurance",
+]
+
+[project.scripts]
+license-radar = "license_radar.cli:main"
+
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[tool.setuptools]
+packages = ["license_radar"]

license_radar-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

license_radar-0.1.0/tests/test_classify.py

@@ -0,0 +1,25 @@
+from license_radar.classify import classify_license, tier_rank
+
+def test_permissive():
+    assert classify_license("MIT") == "permissive"
+    assert classify_license("Apache-2.0") == "permissive"
+
+def test_weak_copyleft():
+    assert classify_license("MPL-2.0") == "weak-copyleft"
+    assert classify_license("LGPL-3.0-only") == "weak-copyleft"
+
+def test_strong_copyleft():
+    assert classify_license("GPL-3.0-only") == "strong-copyleft"
+    assert classify_license("AGPL-3.0-only") == "strong-copyleft"
+
+def test_unknown():
+    assert classify_license(None) == "unknown"
+    assert classify_license("LicenseRef-Proprietary") == "unknown"
+
+def test_aliases_from_free_text_registry_fields():
+    assert classify_license("MIT License") == "permissive"
+    assert classify_license("GPLv3") == "strong-copyleft"
+    assert classify_license("BSD") == "permissive"
+
+def test_tier_rank_orders_by_risk():
+    assert tier_rank("permissive") < tier_rank("weak-copyleft") < tier_rank("strong-copyleft") < tier_rank("unknown")

license_radar-0.1.0/tests/test_parsers.py

@@ -0,0 +1,32 @@
+from pathlib import Path
+
+from license_radar.parsers import discover_manifests, parse_manifest
+
+FIXTURES = Path(__file__).parent / "fixtures"
+
+
+def test_parse_requirements_txt():
+    ecosystem, names = parse_manifest(FIXTURES / "pypi_project" / "requirements.txt")
+    assert ecosystem == "pypi"
+    assert "requests" in names
+    assert "flask" in names
+    assert "pyqt5" in names
+    assert len(names) == 13
+
+
+def test_parse_package_json():
+    ecosystem, names = parse_manifest(FIXTURES / "npm_project" / "package.json")
+    assert ecosystem == "npm"
+    assert "react" in names
+    assert "eslint" in names
+    assert len(names) == 7
+
+
+def test_discover_manifests_in_directory():
+    found = discover_manifests(FIXTURES / "pypi_project")
+    found_names = {p.name for p in found}
+    assert found_names == {"requirements.txt"}
+
+    found = discover_manifests(FIXTURES / "npm_project")
+    found_names = {p.name for p in found}
+    assert found_names == {"package.json"}

license_radar-0.1.0/tests/test_scanner.py

@@ -0,0 +1,103 @@
+"""Accuracy validation against a hand-labeled ground-truth fixture set.
+
+This is the numeric check required by the project's "definition of done":
+it measures how well the offline scanner (no --online network lookups)
+reproduces known-correct license tiers and policy violation calls.
+"""
+
+from pathlib import Path
+
+from license_radar.policy import load_policy, violates
+from license_radar.scanner import scan_manifest
+
+FIXTURES = Path(__file__).parent / "fixtures"
+
+# ground truth: (ecosystem, package) -> (expected_tier, expected_violation)
+GROUND_TRUTH = {
+    ("pypi", "requests"): ("permissive", False),
+    ("pypi", "flask"): ("permissive", False),
+    ("pypi", "numpy"): ("permissive", False),
+    ("pypi", "pytest"): ("permissive", False),
+    ("pypi", "pyyaml"): ("permissive", False),
+    ("pypi", "certifi"): ("weak-copyleft", False),
+    ("pypi", "psycopg2"): ("weak-copyleft", False),
+    ("pypi", "pyqt5"): ("strong-copyleft", True),
+    ("pypi", "unlisted-package-not-in-db"): ("unknown", True),
+    ("pypi", "test-strong-copyleft-pkg"): ("strong-copyleft", True),
+    ("pypi", "test-weak-copyleft-pkg"): ("weak-copyleft", False),
+    ("pypi", "test-permissive-pkg"): ("permissive", False),
+    ("pypi", "test-proprietary-pkg"): ("unknown", True),
+    ("npm", "react"): ("permissive", False),
+    ("npm", "lodash"): ("permissive", False),
+    ("npm", "axios"): ("permissive", False),
+    ("npm", "test-strong-copyleft-pkg"): ("strong-copyleft", True),
+    ("npm", "eslint"): ("permissive", False),
+    ("npm", "typescript"): ("permissive", False),
+    ("npm", "unlisted-dev-package"): ("unknown", True),
+}
+
+
+def _run_scan():
+    policy = load_policy(None)
+    findings = []
+    findings.extend(scan_manifest(FIXTURES / "pypi_project" / "requirements.txt"))
+    findings.extend(scan_manifest(FIXTURES / "npm_project" / "package.json"))
+    return findings, policy
+
+
+def test_ground_truth_coverage_is_complete():
+    findings, _ = _run_scan()
+    keys = {(f.ecosystem, f.package) for f in findings}
+    assert keys == set(GROUND_TRUTH.keys()), "fixture files and ground truth table drifted apart"
+
+
+def test_tier_classification_accuracy():
+    findings, _ = _run_scan()
+    correct = 0
+    for f in findings:
+        expected_tier, _ = GROUND_TRUTH[(f.ecosystem, f.package)]
+        if f.tier == expected_tier:
+            correct += 1
+    accuracy = correct / len(findings)
+    assert accuracy == 1.0, f"tier classification accuracy was {accuracy:.2%}, expected 100%"
+
+
+def test_policy_violation_precision_and_recall():
+    findings, policy = _run_scan()
+
+    tp = fp = fn = tn = 0
+    for f in findings:
+        _, expected_violation = GROUND_TRUTH[(f.ecosystem, f.package)]
+        predicted_violation = violates(f, policy)
+        if predicted_violation and expected_violation:
+            tp += 1
+        elif predicted_violation and not expected_violation:
+            fp += 1
+        elif not predicted_violation and expected_violation:
+            fn += 1
+        else:
+            tn += 1
+
+    precision = tp / (tp + fp) if (tp + fp) else 1.0
+    recall = tp / (tp + fn) if (tp + fn) else 1.0
+
+    assert precision == 1.0, f"precision was {precision:.2%} (fp={fp})"
+    assert recall == 1.0, f"recall was {recall:.2%} (fn={fn})"
+
+
+def test_local_db_coverage_on_fixture_set():
+    """What fraction of fixture packages resolve to a known license without --online.
+
+    This is the honest limitation metric: the static DB is a small
+    curated table (~40 packages), not a full registry mirror. Packages
+    outside it report as 'unknown' unless --online is used.
+    """
+    findings, _ = _run_scan()
+    known = sum(1 for f in findings if f.license is not None)
+    coverage = known / len(findings)
+    # 18 of 20 fixture packages resolve to a license string in the static
+    # DB by construction (test-proprietary-pkg has a non-SPDX license
+    # string but is still "known"); only the two deliberately
+    # unlisted-* packages are missing. This documents that ratio rather
+    # than aspiring to 100%.
+    assert coverage == 18 / 20