aboutcode-org / aboutcode-org/scancode-toolkit

Resolve version numbers in .gemspec files

Abierto
#2,514 0 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### How To Reproduce

> Tell us how to reproduce the issue.

Run [docker pipeline](https://scancodeio.readthedocs.io/en/latest/scanpipe-tutorial-1.html) in scancode.io on a docker image created by building from this Dockerfile:

```
FROM ubuntu:20.04
RUN apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y \
build-essential libyaml-dev libreadline-dev \
zlib1g-dev libncurses5-dev libffi-dev libgdbm6 \
libgdbm-dev libssl-dev libxext6 libxml2-dev \
binutils ca-cacert wget unzip
WORKDIR /tmp
RUN wget --no-check-certificate https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.2.zip \
&& unzip -q ruby-2.7.2.zip \
&& cd /tmp/ruby-2.7.2 \
&& bash configure && make && make install
RUN gem update --no-document --system && gem install --no-document bundle
```

This is essentially a bug in [this function](https://github.com/nexB/scancode-toolkit/blob/develop/src/packagedcode/rubygems.py#L603).

Sample .gemspec file for consideration, taken from extracting the dockerfile above (and extracting the layers inside)

```
/3eb57ed63b0d7a3361aa712aab3c84dd6fef617d0eebf11a1cc6c0930eb56124/layer/tmp/ruby-2.7.2/lib/csv/
```

csv.gemspec
```
# frozen_string_literal: true

begin
require_relative "lib/csv/version"
rescue LoadError
# for Ruby core repository
require_relative "version"
end

Gem::Specification.new do |spec|
spec.name = "csv"
spec.version = CSV::VERSION
spec.authors = ["James Edward Gray II", "Kouhei Sutou"]
spec.email = [nil, "kou@cozmixng.org"]

spec.summary = "CSV Reading and Writing"
spec.description = "The CSV library provides a complete interface to CSV files and data. It offers tools to enable you to read and write to and from Strings or IO objects, as needed."
spec.homepage = "https://github.com/ruby/csv"
spec.license = "BSD-2-Clause"

spec.files = [
"LICENSE.txt",
"NEWS.md",
"README.md",
"lib/csv.rb",
"lib/csv/core_ext/array.rb",
"lib/csv/core_ext/string.rb",
"lib/csv/delete_suffix.rb",
"lib/csv/fields_converter.rb",
"lib/csv/match_p.rb",
"lib/csv/parser.rb",
"lib/csv/row.rb",
"lib/csv/table.rb",
"lib/csv/version.rb",
"lib/csv/writer.rb",
]
spec.require_paths = ["lib"]
spec.required_ruby_version = ">= 2.3.0"

spec.add_development_dependency "bundler"
spec.add_development_dependency "rake"
spec.add_development_dependency "benchmark_driver"
spec.add_development_dependency "simplecov"
end
```

version.rb
```
# frozen_string_literal: true

class CSV
# The version of the installed library.
VERSION = "3.1.2"
end
```
Here the purl is detected as `pkg:gem/csv@CSV::VERSION`

Some other examples like this: `pkg:gem/fileutils@source_version`

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) Ubuntu20.04
* What version of scancode-toolkit was used to generate the scan file? 21.3.31
* What installation method was used to install/run scancode? via scancode.io installation

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.