aboutcode-org / aboutcode-org/scancode-toolkit

Resolve version numbers in .gemspec files

未关闭
#2,514 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Python
星标
2.6k
派生
791
平均合并
1 天 12 小时
30 天内合并 PR
5

描述

### How To Reproduce

> Tell us how to reproduce the issue.

Run [docker pipeline](https://scancodeio.readthedocs.io/en/latest/scanpipe-tutorial-1.html) in scancode.io on a docker image created by building from this Dockerfile:

```
FROM ubuntu:20.04
RUN apt-get update \
&& DEBIAN_FRONTEND=noninteractive apt-get install -y \
build-essential libyaml-dev libreadline-dev \
zlib1g-dev libncurses5-dev libffi-dev libgdbm6 \
libgdbm-dev libssl-dev libxext6 libxml2-dev \
binutils ca-cacert wget unzip
WORKDIR /tmp
RUN wget --no-check-certificate https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.2.zip \
&& unzip -q ruby-2.7.2.zip \
&& cd /tmp/ruby-2.7.2 \
&& bash configure && make && make install
RUN gem update --no-document --system && gem install --no-document bundle
```

This is essentially a bug in [this function](https://github.com/nexB/scancode-toolkit/blob/develop/src/packagedcode/rubygems.py#L603).

Sample .gemspec file for consideration, taken from extracting the dockerfile above (and extracting the layers inside)

```
/3eb57ed63b0d7a3361aa712aab3c84dd6fef617d0eebf11a1cc6c0930eb56124/layer/tmp/ruby-2.7.2/lib/csv/
```

csv.gemspec
```
# frozen_string_literal: true

begin
require_relative "lib/csv/version"
rescue LoadError
# for Ruby core repository
require_relative "version"
end

Gem::Specification.new do |spec|
spec.name = "csv"
spec.version = CSV::VERSION
spec.authors = ["James Edward Gray II", "Kouhei Sutou"]
spec.email = [nil, "kou@cozmixng.org"]

spec.summary = "CSV Reading and Writing"
spec.description = "The CSV library provides a complete interface to CSV files and data. It offers tools to enable you to read and write to and from Strings or IO objects, as needed."
spec.homepage = "https://github.com/ruby/csv"
spec.license = "BSD-2-Clause"

spec.files = [
"LICENSE.txt",
"NEWS.md",
"README.md",
"lib/csv.rb",
"lib/csv/core_ext/array.rb",
"lib/csv/core_ext/string.rb",
"lib/csv/delete_suffix.rb",
"lib/csv/fields_converter.rb",
"lib/csv/match_p.rb",
"lib/csv/parser.rb",
"lib/csv/row.rb",
"lib/csv/table.rb",
"lib/csv/version.rb",
"lib/csv/writer.rb",
]
spec.require_paths = ["lib"]
spec.required_ruby_version = ">= 2.3.0"

spec.add_development_dependency "bundler"
spec.add_development_dependency "rake"
spec.add_development_dependency "benchmark_driver"
spec.add_development_dependency "simplecov"
end
```

version.rb
```
# frozen_string_literal: true

class CSV
# The version of the installed library.
VERSION = "3.1.2"
end
```
Here the purl is detected as `pkg:gem/csv@CSV::VERSION`

Some other examples like this: `pkg:gem/fileutils@source_version`

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) Ubuntu20.04
* What version of scancode-toolkit was used to generate the scan file? 21.3.31
* What installation method was used to install/run scancode? via scancode.io installation

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。