1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
# GitLab License Management
[](https://gitlab.com/gitlab-org/security-products/license-management/commits/master)
[](https://gitlab.com/gitlab-org/security-products/license-management/commits/master)
GitLab tool for detecting licenses of the dependencies used by the provided source.
It is currently based on [License Finder](https://gitlab.com/gitlab-org/security-products/license-management)
only, but this may change in the future.
## How to use
1. `cd` into the directory of the source code you want to scan
1. Run the Docker image:
```sh
docker run \
--volume "$PWD":/code \
--rm \
registry.gitlab.com/gitlab-org/security-products/license-management:latest analyze /code
```
1. The results will be stored in the `gl-license-management-report.json` file in the application directory. `gl-license-management-report.html` is also available with a human readable report.
## Development
### Running the application
License Management is a Docker image, you can build it like any Docker image like so in the
project root:
```sh
docker build -t license-management .
```
You can then run License Management on some target directory:
```sh
docker run --rm --volume "/path/to/my/project":/code license-management analyze /code
```
You can run integration tests on the image like this:
```sh
./bin/test_all
```
where:
- `project_name` is the project slug among the
[test projects for security products](https://gitlab.com/gitlab-org/security-products/tests/) (e.g. `java-maven`)
- `git_ref` is the Git ref to checkout and scan against (e.g. `master`)
### Updating the SPDX index
We will need to periodically update the SPDX index. This can be achieved with
the following command.
```bash
$ wget --timestamping https://spdx.org/licenses/licenses.json
```
## Supported languages and package managers
The following table shows which languages and package managers are supported.
| Language | Package managers |
|------------|-------------------------------------------------------------------|
| JavaScript | [Bower](https://bower.io/), [npm](https://www.npmjs.com/) |
| Go | [Godep](https://github.com/tools/godep), go get |
| Java | [Gradle](https://gradle.org/), [Maven](https://maven.apache.org/) |
| .NET | [Nuget](https://www.nuget.org/) |
| Python | [pip](https://pip.pypa.io/en/stable/) |
| Ruby | [gem](https://rubygems.org/) |
Inject `SETUP_CMD` to the docker command to override the given package managers
and run your custom command to setup your environment with a custom package manager.
```sh
docker run \
--volume "$PWD":/code \
--env "SETUP_CMD=./my-custom-install-script.sh" \
--rm \
registry.gitlab.com/gitlab-org/security-products/license-management:latest analyze /code
```
## Settings
The License Management tool can be customized with environments variables for some project types.
| Environment variable | Project type | Function |
|----------------------|--------------|----------|
| MAVEN_CLI_OPTS | Java (Maven) | Additional arguments for the mvn executable. If not supplied, defaults to `-DskipTests`. |
| LM_JAVA_VERSION | Java (Maven) | Version of Java. If set to `11`, Maven and Gradle use Java 11 instead of Java 8. |
| LM_PYTHON_VERSION | Python | Version of Python. If set to `3`, dependencies are installed using Python 3 instead of Python 2.7. |
| FEATURE_RUBY_REPORT | * | Feature toggle to control how reports are produced. This must be enabled to generate version `1.1`+ reports. (temporary) |
| LM_REPORT_VERSION | * | Version of the report schema to generate (`1.0`, `1.1`, `2.0`). (experimental) |
| LM_V1_CANONICALIZE | * | Use canonicalized license names sourced from `normalized-licenses.yml`. (experimental)|
| SETUP_CMD | * | This variable can be used to bypass the automatic dependency installation with a custom setup. (experimental) |
Inject the required environment variables to the docker command using the [`--env` option flag](https://docs.docker.com/engine/reference/commandline/run/#set-environment-variables--e---env---env-file)
or its shorthand form (`--env MY_SETTING_VAR`) if the configuration comes from an external environment.
*Caution:* if you supply the `MAVEN_CLI_OPTS` for a Maven project, don't forget to append `-DskipTests` to save time by skipping the test suite.
*Tip:* in case you still need to run tests during license management check, supply `MAVEN_CLI_OPTS=-DskipTests=false`
to the docker command.
## Versioning and release process
Please check the [Release Process documentation](https://gitlab.com/gitlab-org/security-products/release/blob/master/docs/release_process.md).
# Contributing
If you want to help, read the [contribution guidelines](CONTRIBUTING.md).
|
