Skip to content

Commit 2926fab

Browse files
authored
Merge pull request #40 from pmonks/dev
Release 2.0.264
2 parents 9d37a84 + 3904eab commit 2926fab

16 files changed

+119
-79
lines changed

.github/workflows/ci.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ jobs:
2424
with:
2525
distribution: 'temurin'
2626
java-version: ${{ matrix.java-version }}
27-
- uses: DeLaGuardo/setup-clojure@12.1
27+
- uses: DeLaGuardo/setup-clojure@12.5
2828
with:
2929
cli: latest
30-
- uses: actions/cache@v3
30+
- uses: actions/cache@v4
3131
with:
3232
path: |
3333
~/.m2/repository

.github/workflows/deploy.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: deploy
22
on:
33
push:
44
branches:
5-
- main
5+
- release
66

77
jobs:
88
deploy:
@@ -17,10 +17,10 @@ jobs:
1717
with:
1818
distribution: 'temurin'
1919
java-version: 21
20-
- uses: DeLaGuardo/setup-clojure@12.1
20+
- uses: DeLaGuardo/setup-clojure@12.5
2121
with:
2222
cli: latest
23-
- uses: actions/cache@v3
23+
- uses: actions/cache@v4
2424
with:
2525
path: |
2626
~/.m2/repository

.github/workflows/docs.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ name: docs
22
on:
33
push:
44
branches:
5-
- main
5+
- release
66

77
jobs:
88
docs:
@@ -14,10 +14,10 @@ jobs:
1414
with:
1515
distribution: 'temurin'
1616
java-version: 21
17-
- uses: DeLaGuardo/setup-clojure@12.1
17+
- uses: DeLaGuardo/setup-clojure@12.5
1818
with:
1919
cli: latest
20-
- uses: actions/cache@v3
20+
- uses: actions/cache@v4
2121
with:
2222
path: |
2323
~/.m2/repository

.github/workflows/vulnerabilities.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -28,10 +28,10 @@ jobs:
2828
with:
2929
distribution: 'temurin'
3030
java-version: 21
31-
- uses: DeLaGuardo/setup-clojure@12.1
31+
- uses: DeLaGuardo/setup-clojure@12.5
3232
with:
3333
cli: latest
34-
- uses: actions/cache@v3
34+
- uses: actions/cache@v4
3535
with:
3636
path: |
3737
~/.m2/repository
@@ -43,8 +43,8 @@ jobs:
4343
- name: Run NVD vulnerabilities check
4444
run: clojure -Srepro -J-Dclojure.main.report=stderr -T:build nvd
4545

46-
- name: Deploy NVD vulnerability report (main branch only)
47-
if: ${{ ( success() || failure() ) && github.ref == 'refs/heads/main' }} # Only deploy report from main branch, and regardless of whether the job succeeded or failed
46+
- name: Deploy NVD vulnerability report (release branch only)
47+
if: ${{ ( success() || failure() ) && github.ref == 'refs/heads/release' }} # Only deploy report from release branch, and regardless of whether the job succeeded or failed
4848
uses: peaceiris/actions-gh-pages@v3
4949
with:
5050
github_token: ${{ secrets.GITHUB_TOKEN }}

README.md

+12-12
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
11
| | | | |
22
|---:|:---:|:---:|:---:|
3-
| [**main**](https://github.com/pmonks/lice-comb/tree/main) | [![CI](https://github.com/pmonks/lice-comb/workflows/CI/badge.svg?branch=main)](https://github.com/pmonks/lice-comb/actions?query=workflow%3ACI+branch%3Amain) | [![Dependencies](https://github.com/pmonks/lice-comb/workflows/dependencies/badge.svg?branch=main)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Adependencies+branch%3Amain) | [![Vulnerabilities](https://github.com/pmonks/lice-comb/workflows/vulnerabilities/badge.svg?branch=main)](https://pmonks.github.io/lice-comb/nvd/dependency-check-report.html) |
4-
| [**dev**](https://github.com/pmonks/lice-comb/tree/dev) | [![CI](https://github.com/pmonks/lice-comb/workflows/CI/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3ACI+branch%3Adev) | [![Dependencies](https://github.com/pmonks/lice-comb/workflows/dependencies/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Adependencies+branch%3Adev) | [![Vulnerabilities](https://github.com/pmonks/lice-comb/workflows/vulnerabilities/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Avulnerabilities+branch%3Adev) |
3+
| [**release**](https://github.com/pmonks/lice-comb/tree/release) | [![CI](https://github.com/pmonks/lice-comb/actions/workflows/ci.yml/badge.svg?branch=release)](https://github.com/pmonks/lice-comb/actions?query=workflow%3ACI+branch%3Arelease) | [![Dependencies](https://github.com/pmonks/lice-comb/actions/workflows/dependencies.yml/badge.svg?branch=release)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Adependencies+branch%3Arelease) | [![Vulnerabilities](https://github.com/pmonks/lice-comb/actions/workflows/vulnerabilities.yml/badge.svg?branch=release)](https://pmonks.github.io/lice-comb/nvd/dependency-check-report.html) |
4+
| [**dev**](https://github.com/pmonks/lice-comb/tree/dev) | [![CI](https://github.com/pmonks/lice-comb/workflows/CI/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3ACI+branch%3Adev) | [![Dependencies](https://github.com/pmonks/lice-comb/actions/workflows/dependencies.yml/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Adependencies+branch%3Adev) | [![Vulnerabilities](https://github.com/pmonks/lice-comb/actions/workflows/vulnerabilities.yml/badge.svg?branch=dev)](https://github.com/pmonks/lice-comb/actions?query=workflow%3Avulnerabilities+branch%3Adev) |
55

6-
[![Latest Version](https://img.shields.io/clojars/v/com.github.pmonks/lice-comb)](https://clojars.org/com.github.pmonks/lice-comb/) [![Open Issues](https://img.shields.io/github/issues/pmonks/lice-comb.svg)](https://github.com/pmonks/lice-comb/issues) [![License](https://img.shields.io/github/license/pmonks/lice-comb.svg)](https://github.com/pmonks/lice-comb/blob/main/LICENSE)
6+
[![Latest Version](https://img.shields.io/clojars/v/com.github.pmonks/lice-comb)](https://clojars.org/com.github.pmonks/lice-comb/) [![Open Issues](https://img.shields.io/github/issues/pmonks/lice-comb.svg)](https://github.com/pmonks/lice-comb/issues) [![License](https://img.shields.io/github/license/pmonks/lice-comb.svg)](https://github.com/pmonks/lice-comb/blob/release/LICENSE)
77

8-
<img alt="lice-comb logo: a fine-toothed metal comb for removing headlice emblazoned with the OSI keyhole logo" align="right" width="25%" src="https://raw.githubusercontent.com/pmonks/lice-comb/main/lice-comb-logo.png">
8+
<img alt="lice-comb logo: a fine-toothed metal comb for removing headlice emblazoned with the OSI keyhole logo" align="right" width="25%" src="https://raw.githubusercontent.com/pmonks/lice-comb/release/lice-comb-logo.png">
99

1010
# lice-comb
1111

12-
A Clojure library for software *lice*nse detection. It does this by *comb*ing through tools.deps and Leiningen dependencies, directory structures, and JAR & ZIP files, attempting to detect what license(s) they contain, and then normalising them into [SPDX license expression(s)](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/).
12+
A Clojure library for software *lice*nse detection. It does this by *comb*ing through tools.deps and Leiningen dependencies, directory structures, and JAR & ZIP files, attempting to detect what license(s) they reference and/or contain, and then normalising them into [SPDX license expressions](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/).
1313

14-
This library leverages, and is inspired by, the *excellent* [SPDX project](https://spdx.dev/). It's a great shame that it doesn't have greater traction in the Java & Clojure (and wider open source) communities. If you're new to SPDX and would prefer to read a primer rather than dry specification documents, I can thoroughly recommend [David A. Wheeler's SPDX Tutorial](https://github.com/david-a-wheeler/spdx-tutorial#spdx-tutorial).
14+
This library leverages, and is inspired by, the *excellent* [SPDX project](https://spdx.dev/). It's a great shame that it doesn't have greater traction in the Java & Clojure (and wider open source) communities. If you're new to SPDX and would prefer to read a primer rather than dry specification documents, [David A. Wheeler's SPDX Tutorial](https://github.com/david-a-wheeler/spdx-tutorial#spdx-tutorial) is a good (albeit slightly outdated) intro.
1515

1616
## Disclaimer
1717

@@ -87,7 +87,7 @@ $ deps-try com.github.pmonks/lice-comb
8787
(lcmvn/gav->expressions "javax.mail" "mail")
8888
;=> #{"GPL-2.0-only WITH Classpath-exception-2.0" "CDDL-1.1"}
8989

90-
(lcmvn/pom->expressions (str (System/getProperty "user.home") "/.m2/repository/org/clojure/clojure/1.11.1/clojure-1.11.1.pom"))
90+
(lcmvn/pom->expressions (str (System/getProperty "user.home") "/.m2/repository/org/clojure/clojure/1.11.2/clojure-1.11.2.pom"))
9191
;=> #{"EPL-1.0"}
9292

9393
(lcmvn/pom->expressions "https://repo1.maven.org/maven2/org/springframework/spring-core/6.0.11/spring-core-6.0.11.pom")
@@ -107,7 +107,7 @@ $ deps-try com.github.pmonks/lice-comb
107107
(lcl/dep->expressions ['aopalliance/aopalliance "1.0"])
108108
;=> #{"LicenseRef-lice-comb-PUBLIC-DOMAIN"}
109109
; Also shows how lice-comb handles "public domain" attestations (which are not supported directly
110-
; by SPDX, as they're not a licensing mechanism)
110+
; by SPDX, since "public domain" is not a license)
111111

112112

113113
;; Information about matches (useful for better understanding how lice-comb arrived at a given set
@@ -170,17 +170,17 @@ The implementation of [issue #3](https://github.com/pmonks/lice-comb/issues/3) r
170170

171171
[Contributor FAQ](https://github.com/pmonks/lice-comb/wiki/FAQ#contributor-faqs)
172172

173-
[Contributing Guidelines](https://github.com/pmonks/lice-comb/blob/main/.github/CONTRIBUTING.md)
173+
[Contributing Guidelines](https://github.com/pmonks/lice-comb/blob/release/.github/CONTRIBUTING.md)
174174

175175
[Bug Tracker](https://github.com/pmonks/lice-comb/issues)
176176

177-
[Code of Conduct](https://github.com/pmonks/lice-comb/blob/main/.github/CODE_OF_CONDUCT.md)
177+
[Code of Conduct](https://github.com/pmonks/lice-comb/blob/release/.github/CODE_OF_CONDUCT.md)
178178

179179
### Developer Workflow
180180

181-
This project uses the [git-flow branching strategy](https://nvie.com/posts/a-successful-git-branching-model/), with the caveat that the permanent branches are called `main` and `dev`, and any changes to the `main` branch are considered a release and auto-deployed (JARs to Clojars, API docs to GitHub Pages, etc.).
181+
This project uses the [git-flow branching strategy](https://nvie.com/posts/a-successful-git-branching-model/), and the permanent branches are called `release` and `dev`. Any changes to the `release` branch are considered a release and auto-deployed (JARs to Clojars, API docs to GitHub Pages, etc.).
182182

183-
For this reason, **all development must occur either in branch `dev`, or (preferably) in temporary branches off of `dev`.** All PRs from forked repos must also be submitted against `dev`; the `main` branch is **only** updated from `dev` via PRs created by the core development team. All other changes submitted to `main` will be rejected.
183+
For this reason, **all development must occur either in branch `dev`, or (preferably) in temporary branches off of `dev`.** All PRs from forked repos must also be submitted against `dev`; the `release` branch is **only** updated from `dev` via PRs created by the core development team. All other changes submitted to `release` will be rejected.
184184

185185
### Build Tasks
186186

deps.edn

+5-5
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,17 @@
1818

1919
{:paths ["src" "resources"]
2020
:deps
21-
{org.clojure/tools.logging {:mvn/version "1.2.4"}
21+
{org.clojure/tools.logging {:mvn/version "1.3.0"}
2222
commons-validator/commons-validator {:mvn/version "1.8.0"}
23-
org.clojure/data.xml {:mvn/version "0.2.0-alpha8"}
23+
org.clojure/data.xml {:mvn/version "0.2.0-alpha9"}
2424
clj-xml-validation/clj-xml-validation {:mvn/version "1.0.2"}
2525
tolitius/xml-in {:mvn/version "0.1.1"}
2626
hato/hato {:mvn/version "0.9.0"}
2727
dev.weavejester/medley {:mvn/version "1.7.0"}
2828
miikka/clj-base62 {:mvn/version "0.1.1"}
29-
com.github.pmonks/clj-spdx {:mvn/version "1.0.126"}
30-
com.github.pmonks/rencg {:mvn/version "1.0.34"}
31-
com.github.pmonks/embroidery {:mvn/version "0.1.13"}}
29+
com.github.pmonks/clj-spdx {:mvn/version "1.0.145"}
30+
com.github.pmonks/rencg {:mvn/version "1.0.51"}
31+
com.github.pmonks/embroidery {:mvn/version "0.1.20"}}
3232
:aliases
3333
{:build {:deps {com.github.pmonks/pbr {:mvn/version "RELEASE"}}
3434
:ns-default pbr.build}}}

pbr.clj

+3-4
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,13 @@
2222
(assoc opts
2323
:lib 'com.github.pmonks/lice-comb
2424
:version (pbr/calculate-version 2 0)
25-
; :version (format "2.0.%s-RCx-SNAPSHOT" (b/git-count-revs nil))
25+
:prod-branch "release"
2626
:write-pom true
2727
:validate-pom true
2828
:pom {:description "A Clojure library for software license detection."
2929
:url "https://github.com/pmonks/lice-comb"
30-
:licenses [:license {:name "Apache License 2.0" :url "http://www.apache.org/licenses/LICENSE-2.0.html"}]
30+
:licenses [:license {:name "Apache-2.0" :url "http://www.apache.org/licenses/LICENSE-2.0.html"}]
3131
:developers [:developer {:id "pmonks" :name "Peter Monks" :email "pmonks+lice-comb@gmail.com"}]
3232
:scm {:url "https://github.com/pmonks/lice-comb" :connection "scm:git:git://github.com/pmonks/lice-comb.git" :developer-connection "scm:git:ssh://git@github.com/pmonks/lice-comb.git"}
3333
:issue-management {:system "github" :url "https://github.com/pmonks/lice-comb/issues"}}
34-
:codox {:namespaces ['lice-comb.deps 'lice-comb.files 'lice-comb.lein 'lice-comb.matching 'lice-comb.maven 'lice-comb.utils]}
35-
:eastwood {:exclude-linters [:unused-ret-vals-in-try :no-ns-form-found]}))
34+
:codox {:namespaces ['lice-comb.deps 'lice-comb.files 'lice-comb.lein 'lice-comb.matching 'lice-comb.maven 'lice-comb.utils]}))

src/lice_comb/impl/matching.clj

+24-21
Original file line numberDiff line numberDiff line change
@@ -121,44 +121,47 @@
121121
fix-mpl-2
122122
fix-license-id-with-exception-id))
123123

124-
(defmulti text->expressions
125-
"Returns an expressions-map for the given license text, or nil if no matches
126-
are found."
124+
(defmulti text->expressions-info
125+
"Returns an expressions-info map for the given license text, or nil if no
126+
matches are found."
127127
{:arglists '([text])}
128128
type)
129129

130-
(defmethod text->expressions java.lang.String
130+
(defmethod text->expressions-info java.lang.String
131131
[s]
132132
; clj-spdx's *-within-text APIs are *expensive* but support batching, so we check batches of ids in parallel
133133
(let [num-cpus (.availableProcessors (Runtime/getRuntime))
134134
license-id-batches (partition num-cpus @lcis/license-ids-d)
135135
exception-id-batches (partition num-cpus @lcis/exception-ids-d)
136136
license-ids-found (apply set/union (e/pmap* #(sm/licenses-within-text s %) license-id-batches))
137137
exception-ids-found (apply set/union (e/pmap* #(sm/exceptions-within-text s %) exception-id-batches))
138-
ids-found (set/union license-ids-found exception-ids-found)]
139-
(when ids-found
140-
; Note: we don't need to sexp/normalise the keys here, as we never detect an expression from a text
141-
(manual-fixes (into {} (map #(hash-map % (list {:id % :type :concluded :confidence :high :strategy :spdx-text-matching})) ids-found))))))
142-
143-
(defmethod text->expressions java.io.Reader
138+
expressions-found (if (and (= 1 (count license-ids-found))
139+
(= 1 (count exception-ids-found)))
140+
#{(str (first license-ids-found) " WITH " (first exception-ids-found))}
141+
(set/union license-ids-found exception-ids-found))]
142+
(when expressions-found
143+
; Note: we don't need to sexp/normalise the keys here, as the only expressions that can be returned are constructed correctly
144+
(manual-fixes (into {} (map #(hash-map % (list {:id % :type :concluded :confidence :high :strategy :spdx-matching-guidelines})) expressions-found))))))
145+
146+
(defmethod text->expressions-info java.io.Reader
144147
[r]
145148
(let [sw (java.io.StringWriter.)]
146149
(io/copy r sw)
147-
(text->expressions (str sw))))
150+
(text->expressions-info (str sw))))
148151

149-
(defmethod text->expressions java.io.InputStream
152+
(defmethod text->expressions-info java.io.InputStream
150153
[is]
151-
(text->expressions (io/reader is)))
154+
(text->expressions-info (io/reader is)))
152155

153-
(defmethod text->expressions :default
156+
(defmethod text->expressions-info :default
154157
[src]
155158
(when src
156159
(with-open [r (io/reader src)]
157-
(text->expressions r))))
160+
(text->expressions-info r))))
158161

159-
(defn uri->expressions
160-
"Returns an expressions-map for the given license uri, or nil if no matches
161-
are found."
162+
(defn uri->expressions-info
163+
"Returns an expressions-info map for the given license uri, or nil if no
164+
matches are found."
162165
[uri]
163166
(when-not (s/blank? uri)
164167
; We don't need to sexp/normalise the keys here, as we never detect an expression from a URI
@@ -171,8 +174,8 @@
171174

172175
; 2. attempt to retrieve the text/plain contents of the uri and perform license text matching on it
173176
(when-let [license-text (lcihttp/get-text uri)]
174-
(when-let [ids (text->expressions license-text)]
175-
ids))))))))
177+
(when-let [expressions (text->expressions-info license-text)]
178+
expressions))))))))
176179

177180
(defn- string->ids-info
178181
"Converts the given string (a fragment of a license name) into a sequence of
@@ -196,7 +199,7 @@
196199
(map #(hash-map % (list {:id % :type :concluded :confidence :high :strategy :spdx-listed-name :source (list s)})) ids))
197200

198201
; 3. Might it be a URI? (this is to handle some dumb corner cases that exist in pom.xml files hosted on Clojars & Maven Central)
199-
(when-let [ids (uri->expressions s)]
202+
(when-let [ids (uri->expressions-info s)]
200203
(map #(hash-map (key %) (val %)) ids))
201204

202205
; 4. Attempt regex name matching

0 commit comments

Comments
 (0)