[WIP] feat: `Builders.FromPath.LicenseEvidenceBuilder` #1158

jkowalleck · 2024-10-30T00:28:06Z

Note

refactored the evidence collection from our sister project https://github.com/CycloneDX/cyclonedx-webpack-plugin.

original:
https://github.com/CycloneDX/cyclonedx-webpack-plugin/blob/72700f06d00eac79fa3b91fe838bd78c583346a2/src/extractor.ts#L133-L173

the original file is under Apache-2.0 license, and rights owner is OWASP.
All the same applies to this very project. Therefore, no legal issues exist -> we are free to copy/paste/modify the code without the slightest concerns.

need to see if there are additional requirements from CycloneDX/cyclonedx-node-yarn#193

Signed-off-by: Jan Kowalleck <[email protected]>

codacy-production · 2024-10-30T00:32:36Z

Coverage summary from Codacy

See diff coverage on Codacy

Coverage variation	Diff coverage
✅ -0.63% (target: -1.00%)	❌ 75.56% (target: 90.00%)

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (`414ce5e`)	23742	23356	98.37%
Head commit (`4d9a100`)	24417 (+675)	23866 (+510)	97.74% (-0.63%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1158)	225	170	75.56%

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

See your quality gate settings Change summary preferences

_{Codacy stopped sending the deprecated coverage status on June 5th, 2024. Learn more}

jkowalleck · 2024-10-30T01:45:01Z

src/builders/fromPath.node.ts

+      lname = `file: ${file}`
+    } else {
+      // `file` could be absolute or relative path - lets resolve it anyway
+      file = resolve(relativeFrom, file)


unsure if this is a good idea ...

jkowalleck · 2024-10-30T01:45:06Z

src/builders/fromPath.node.ts

+  public * fromDir(dir: string, relativeFrom: string | undefined = undefined): Generator<NamedLicense> {
+    if ( relativeFrom !== undefined) {
+      // `dir` could be absolute or relative path - lets resolve it anyway
+      dir = resolve(relativeFrom, dir)


unsure if this is a good idea ...

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck · 2024-10-30T12:10:58Z

@AugustusKling,

this is the feature for license evidence builder.
Could I ask you for your opinion?

AugustusKling · 2024-10-30T19:25:33Z

@jkowalleck thanks for refactoring this to live in the library.

The code in this pull requests is can be consumed as long as packages are extracted into the file system before your code runs. This is not the case in the cyclonedx-node-yarn plugin which would mean it couldn't consume this part of the library.

Yarn supports 3 different linkers as explained in https://yarnpkg.com/features/linkers of which projects can freely choose:

pnp: Uses a loader to make package content available at runtime. Does not extract packages to files on the file system which makes it impossible to access package contents with the Node file system API.
pnpm: Uses a combination of symlinks and hard links as detailed in https://pnpm.io/symlinked-node-modules-structure. The Node file system API should work.
node-modules: The copies as NPM would produce when writing its node_modules folder.

In other words, I think the LicenseEvidenceBuilder and also the AttachmentFactory should work for the pnpm and node-modules linkers. They would not work using the pnp linker which is essential in a plugin for Yarn.

In the cyclonedx-node-yarn plugin I need to use Yarn's file system abstraction (FakeFS<PortablePath>) which allows to see package contents regardless of the used linker and regardless if a project was ever installed. Doing so I could get the file names and the contents of the files to feed into the CDX library.

What do you think about exposing a isLicenseFile(filename: string): boolean function and one to create a license instance as in makeLicense(filename: string, content: Buffer): CDX.Models.License?

src/builders/fromPath.node.ts

src/factories/fromPath.node.ts

jkowalleck · 2024-10-30T22:49:29Z

The work on this generalization with the goal to make it available in the library ...
it feels like premature.... There is just not enough specific code in the field to actually produce any generalized code worth shipping.

I will postpone it until additional art exists.

feat: builders.FromPath.LicenseEvidenceBuilder

6186d73

Signed-off-by: Jan Kowalleck <[email protected]>

jkowalleck added the enhancement New feature or request label Oct 30, 2024

jkowalleck changed the title ~~feat: builders.FromPath.LicenseEvidenceBuilder~~ [WIP] feat: builders.FromPath.LicenseEvidenceBuilder Oct 30, 2024

jkowalleck mentioned this pull request Oct 30, 2024

Extraction of license text from files. #33 CycloneDX/cyclonedx-node-yarn#193

Open

jkowalleck changed the title ~~[WIP] feat: builders.FromPath.LicenseEvidenceBuilder~~ [WIP] feat: Builders.FromPath.LicenseEvidenceBuilder Oct 30, 2024

jkowalleck commented Oct 30, 2024

View reviewed changes

jkowalleck added 10 commits October 30, 2024 04:01

feat

98973e5

Signed-off-by: Jan Kowalleck <[email protected]>

feat

30f1915

Signed-off-by: Jan Kowalleck <[email protected]>

feat

09cb566

Signed-off-by: Jan Kowalleck <[email protected]>

feat

e68b2bc

Signed-off-by: Jan Kowalleck <[email protected]>

feat

9a94456

Signed-off-by: Jan Kowalleck <[email protected]>

feat

3ec62c7

Signed-off-by: Jan Kowalleck <[email protected]>

feat

de97015

Signed-off-by: Jan Kowalleck <[email protected]>

feat

a9e5615

Signed-off-by: Jan Kowalleck <[email protected]>

feat

d80368c

Signed-off-by: Jan Kowalleck <[email protected]>

feat

4d9a100

Signed-off-by: Jan Kowalleck <[email protected]>

AugustusKling reviewed Oct 30, 2024

View reviewed changes

src/builders/fromPath.node.ts Show resolved Hide resolved

src/factories/fromPath.node.ts Show resolved Hide resolved

jkowalleck mentioned this pull request Nov 4, 2024

centralized license evidence gatrhering #1162

Open

jkowalleck closed this Nov 18, 2024

jkowalleck deleted the feat/builder_evidece_licenses branch November 18, 2024 09:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] feat: `Builders.FromPath.LicenseEvidenceBuilder` #1158

[WIP] feat: `Builders.FromPath.LicenseEvidenceBuilder` #1158

jkowalleck commented Oct 30, 2024 •

edited

Loading

codacy-production bot commented Oct 30, 2024 •

edited

Loading

jkowalleck Oct 30, 2024

jkowalleck Oct 30, 2024

jkowalleck commented Oct 30, 2024

AugustusKling commented Oct 30, 2024

jkowalleck commented Oct 30, 2024 •

edited

Loading

[WIP] feat: Builders.FromPath.LicenseEvidenceBuilder #1158

[WIP] feat: Builders.FromPath.LicenseEvidenceBuilder #1158

Conversation

jkowalleck commented Oct 30, 2024 • edited Loading

codacy-production bot commented Oct 30, 2024 • edited Loading

Coverage summary from Codacy

See diff coverage on Codacy

See your quality gate settings Change summary preferences

jkowalleck Oct 30, 2024

Choose a reason for hiding this comment

jkowalleck Oct 30, 2024

Choose a reason for hiding this comment

jkowalleck commented Oct 30, 2024

AugustusKling commented Oct 30, 2024

jkowalleck commented Oct 30, 2024 • edited Loading

[WIP] feat: `Builders.FromPath.LicenseEvidenceBuilder` #1158

[WIP] feat: `Builders.FromPath.LicenseEvidenceBuilder` #1158

jkowalleck commented Oct 30, 2024 •

edited

Loading

codacy-production bot commented Oct 30, 2024 •

edited

Loading

jkowalleck commented Oct 30, 2024 •

edited

Loading