summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2025-07-06feat: Implement binary index generation matching Ruby formatrsmo khan
- Add binary index file generation to `.index/` directory - Create 256 SHA1-based hash buckets (00-ff directories) - Write CSV data files with format: "name","version","license1- < /dev/null | -license2" - Generate binary .idx files with 4-byte little-endian offset integers - Sort entries by name-version for binary search compatibility - Match exact Ruby spandx output format for offline air-gap usage The build command now writes actual index files to disk instead of just storing in cache manager. Verified format matches Ruby version. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-06fix: Resolve 404 errors in RubyGems index buildingmo khan
- Fix parsing of RubyGems index format to extract all gem versions - Use actual version numbers instead of "latest" in API calls - Process every version of every gem as requested for complete offline cache - Fix unused variable warning in SPDX index builder 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-05feat: Implement offline package index buildingmo khan
Adds comprehensive build command functionality to create offline package indexes for air-gapped license scanning. Key features: - Fetch complete package catalogs from registries (187K+ RubyGems packages) - Concurrent license data retrieval with configurable workers (10 default) - Rate limiting and error handling for API requests - Store license data in binary-indexed cache system - Progress reporting for long-running builds - Support for multiple package managers (extensible architecture) Implementation details: - Uses semaphore-controlled concurrency to respect API limits - Gracefully handles 404s and 429 rate limit responses - Stores successful license fetches in hierarchical cache - Provides comprehensive logging and progress updates - Production-ready for building real offline indexes This enables the creation of comprehensive offline license databases for enterprise air-gapped environments and consistent compliance scanning. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-05feat: Connect scan command to license discovery systemmo khan
This major update integrates the gateway system with the scan command to fetch real license data from package registries, matching the behavior of the Ruby version. Key improvements: - Connect scan command to RubyGems gateway for license fetching - Add support for PATH specs in Gemfile.lock parsing - Normalize platform-specific gem versions for API lookup - Deduplicate platform variants in dependency output - Fix license format to use " AND " separator - Preserve license order from gemspec metadata - Add comprehensive cache integration with mutex handling The Rust version now produces output identical to the Ruby version, with exact package counts (69) and matching license information. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
2025-07-05initial port to rustmo khan
2024-12-31feat: Add support for Ruby 3.2+HEADv0.19.0mainmo khan
2021-12-16chore: refresh license cachev0.18.3mo khan
2021-12-16chore: update Gemfile.lockmo khan
2021-12-15chore: prep for releasemo khan
2021-12-15fix: fallback to latest versionmo khan
2021-10-01Delete dependabot.ymlmo khan
2021-10-01Merge pull request #107 from spandx/dependabot/bundler/nokogiri-1.12.5mo khan
chore(deps): bump nokogiri from 1.12.4 to 1.12.5
2021-09-27chore(deps): bump nokogiri from 1.12.4 to 1.12.5dependabot[bot]
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.4 to 1.12.5. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/v1.12.5/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.4...v1.12.5) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-09-17Merge pull request #104 from spandx/dependabot/bundler/oj-3.13.7mo khan
chore(deps): bump oj from 3.13.6 to 3.13.7
2021-09-17chore(deps): bump oj from 3.13.6 to 3.13.7dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.6 to 3.13.7. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.6...v3.13.7) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-09-13Merge pull request #102 from spandx/dependabot/bundler/oj-3.13.6mo khan
chore(deps): bump oj from 3.13.5 to 3.13.6
2021-09-13chore(deps): bump oj from 3.13.5 to 3.13.6dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.5 to 3.13.6. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.5...v3.13.6) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-09-09Merge pull request #100 from spandx/dependabot/bundler/oj-3.13.5mo khan
chore(deps): bump oj from 3.13.4 to 3.13.5
2021-09-09chore(deps): bump oj from 3.13.4 to 3.13.5dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.4 to 3.13.5. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.4...v3.13.5) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-09-07Merge pull request #98 from spandx/dependabot/bundler/oj-3.13.4mo khan
chore(deps): bump oj from 3.13.3 to 3.13.4
2021-09-06chore(deps): bump oj from 3.13.3 to 3.13.4dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.3 to 3.13.4. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.3...v3.13.4) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-31Merge pull request #97 from spandx/dependabot/bundler/bundler-audit-0.9.0.1mo khan
chore(deps-dev): bump bundler-audit from 0.8.0 to 0.9.0.1
2021-08-31chore(deps-dev): bump bundler-audit from 0.8.0 to 0.9.0.1dependabot[bot]
Bumps [bundler-audit](https://github.com/postmodern/bundler-audit) from 0.8.0 to 0.9.0.1. - [Release notes](https://github.com/postmodern/bundler-audit/releases) - [Changelog](https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md) - [Commits](https://github.com/postmodern/bundler-audit/compare/v0.8.0...v0.9.0.1) --- updated-dependencies: - dependency-name: bundler-audit dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-31Merge pull request #96 from spandx/dependabot/bundler/oj-3.13.3mo khan
chore(deps): bump oj from 3.13.2 to 3.13.3
2021-08-31chore(deps): bump oj from 3.13.2 to 3.13.3dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.2 to 3.13.3. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.2...v3.13.3) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-30Merge pull request #94 from spandx/dependabot/bundler/nokogiri-1.12.4mo khan
chore(deps): bump nokogiri from 1.12.3 to 1.12.4
2021-08-30chore(deps): bump nokogiri from 1.12.3 to 1.12.4dependabot[bot]
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.3 to 1.12.4. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.3...v1.12.4) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-17Merge pull request #92 from spandx/dependabot/bundler/oj-3.13.2mo khan
chore(deps): bump oj from 3.13.1 to 3.13.2
2021-08-17chore(deps): bump oj from 3.13.1 to 3.13.2dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.13.1 to 3.13.2. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.13.1...v3.13.2) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-11Merge pull request #91 from spandx/dependabot/bundler/nokogiri-1.12.3mo khan
chore(deps): bump nokogiri from 1.12.2 to 1.12.3
2021-08-11chore(deps): bump nokogiri from 1.12.2 to 1.12.3dependabot[bot]
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.2 to 1.12.3. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.2...v1.12.3) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-10Merge pull request #90 from spandx/dependabot/bundler/oj-3.13.1mo khan
chore(deps): bump oj from 3.12.2 to 3.13.1
2021-08-10chore(deps): bump oj from 3.12.2 to 3.13.1dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.12.2 to 3.13.1. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.12.2...v3.13.1) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-09Merge pull request #88 from spandx/dependabot/bundler/webmock-3.14.0mo khan
chore(deps-dev): bump webmock from 3.13.0 to 3.14.0
2021-08-05chore(deps-dev): bump webmock from 3.13.0 to 3.14.0dependabot[bot]
Bumps [webmock](https://github.com/bblimke/webmock) from 3.13.0 to 3.14.0. - [Release notes](https://github.com/bblimke/webmock/releases) - [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md) - [Commits](https://github.com/bblimke/webmock/compare/v3.13.0...v3.14.0) --- updated-dependencies: - dependency-name: webmock dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-04Merge pull request #87 from spandx/dependabot/bundler/nokogiri-1.12.2mo khan
chore(deps): bump nokogiri from 1.12.0 to 1.12.2
2021-08-04chore(deps): bump nokogiri from 1.12.0 to 1.12.2dependabot[bot]
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.0 to 1.12.2. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.0...v1.12.2) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-08-03Merge pull request #84 from spandx/dependabot/bundler/nokogiri-1.12.0mo khan
chore(deps): bump nokogiri from 1.11.7 to 1.12.0
2021-08-02chore(deps): bump nokogiri from 1.11.7 to 1.12.0dependabot[bot]
Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.11.7 to 1.12.0. - [Release notes](https://github.com/sparklemotion/nokogiri/releases) - [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md) - [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.11.7...v1.12.0) --- updated-dependencies: - dependency-name: nokogiri dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-26Merge pull request #83 from spandx/dependabot/bundler/oj-3.12.2mo khan
chore(deps): bump oj from 3.12.1 to 3.12.2
2021-07-26chore(deps): bump oj from 3.12.1 to 3.12.2dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.12.1 to 3.12.2. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.12.1...v3.12.2) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-11Merge pull request #81 from spandx/dependabot/bundler/oj-3.12.1mo khan
chore(deps): bump oj from 3.12.0 to 3.12.1
2021-07-11chore(deps): bump oj from 3.12.0 to 3.12.1dependabot[bot]
Bumps [oj](https://github.com/ohler55/oj) from 3.12.0 to 3.12.1. - [Release notes](https://github.com/ohler55/oj/releases) - [Changelog](https://github.com/ohler55/oj/blob/develop/CHANGELOG.md) - [Commits](https://github.com/ohler55/oj/compare/v3.12.0...v3.12.1) --- updated-dependencies: - dependency-name: oj dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-11Merge pull request #82 from spandx/dependabot/bundler/rake-13.0.6mo khan
chore(deps-dev): bump rake from 13.0.4 to 13.0.6
2021-07-09chore(deps-dev): bump rake from 13.0.4 to 13.0.6dependabot[bot]
Bumps [rake](https://github.com/ruby/rake) from 13.0.4 to 13.0.6. - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](https://github.com/ruby/rake/compare/v13.0.4...v13.0.6) --- updated-dependencies: - dependency-name: rake dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-06Merge pull request #76 from spandx/dependabot/bundler/addressable-2.8.0mo khan
chore(deps): bump addressable from 2.7.0 to 2.8.0
2021-07-06chore(deps): bump addressable from 2.7.0 to 2.8.0dependabot[bot]
Bumps [addressable](https://github.com/sporkmonger/addressable) from 2.7.0 to 2.8.0. - [Release notes](https://github.com/sporkmonger/addressable/releases) - [Changelog](https://github.com/sporkmonger/addressable/blob/main/CHANGELOG.md) - [Commits](https://github.com/sporkmonger/addressable/compare/addressable-2.7.0...addressable-2.8.0) --- updated-dependencies: - dependency-name: addressable dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-06Merge pull request #79 from spandx/dependabot/bundler/rake-13.0.4mo khan
chore(deps-dev): bump rake from 13.0.3 to 13.0.4
2021-07-06chore(deps-dev): bump rake from 13.0.3 to 13.0.4dependabot[bot]
Bumps [rake](https://github.com/ruby/rake) from 13.0.3 to 13.0.4. - [Release notes](https://github.com/ruby/rake/releases) - [Changelog](https://github.com/ruby/rake/blob/master/History.rdoc) - [Commits](https://github.com/ruby/rake/compare/v13.0.3...v13.0.4) --- updated-dependencies: - dependency-name: rake dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2021-07-06Merge pull request #78 from spandx/dependabot/bundler/oj-3.12.0mo khan
chore(deps): bump oj from 3.11.8 to 3.12.0
generated by cgit v1.2.3 (git 2.39.1) at 2026-02-02 02:34:26 +0000