aboutcode-org / aboutcode-org/scancode-toolkit
Missing infromation about GIT and PATH dependencies from Ruby package scan
- Lenguaje dominante
- Python
- Estrellas
- 2.6k
- Forks
- 791
- Merge medio
- 1 d 12 h
- PR fusionados (30 d)
- 5
Descripción
### Description
I need to parse Ruby dependencies from `Gemfile.lock`. For regular GEM dependencies, everything's ok, but for GIT and PATH dependencies, important information is missing from the generated output, such as a URL address to the git repository or information about the type of the dependency. Also, I'd expect that in the example below, purl for the Github dependency would start with this: `pkg:github`.
When I do the dependency parsing from Python interpreter by importing [gemfile_lock.py](https://github.com/nexB/scancode-toolkit/blob/develop/src/packagedcode/gemfile_lock.py) from this repo, I get all the necessary information that would be needed, so it seems to me that while the parsing module gathering data works properly, not all the information is shown to the user.
### How To Reproduce
Inside directory `testing/`, there is file Gemfile.lock with contents (I took two dependencies from [porta/Gemfile.lock](https://github.com/3scale/porta/blob/master/Gemfile.lock)):
```
GIT
remote: https://github.com/mikz/httpclient.git
revision: fec23fb32fb899b87a8b2c94e2d2069b6b4c633c
branch: ssl-env-cert
specs:
httpclient (2.8.3)
PATH
remote: lib/developer_portal
specs:
developer_portal (1.0.0)
liquid (~> 3.0.6)
railties (>= 3.2)
```
Running `scancode --package --json-pp out.json testing/` from the `testing/`s parent directory produces `out.json` file.
out.json excerpt:
```
{
"type": "gem",
"namespace": null,
"name": "httpclient",
"version": "fec23fb32fb899b87a8b2c94e2d2069b6b4c633c",
"qualifiers": {},
"subpath": null,
"primary_language": "Ruby",
"description": null,
"release_date": null,
"parties": [],
"keywords": [],
"homepage_url": null,
"download_url": null,
"size": null,
"sha1": null,
"md5": null,
"sha256": null,
"sha512": null,
"bug_tracking_url": null,
"code_view_url": null,
"vcs_url": null,
"copyright": null,
"license_expression": null,
"declared_license": null,
"notice_text": null,
"root_path": "testing",
"dependencies": [],
"contains_source_code": null,
"source_packages": [],
"extra_data": {},
"purl": "pkg:gem/httpclient@fec23fb32fb899b87a8b2c94e2d2069b6b4c633c",
"repository_homepage_url": "https://rubygems.org/gems/httpclient/versions/fec23fb32fb899b87a8b2c94e2d2069b6b4c633c",
"repository_download_url": "https://rubygems.org/downloads/httpclient-fec23fb32fb899b87a8b2c94e2d2069b6b4c633c.gem",
"api_data_url": "https://rubygems.org/api/v2/rubygems/httpclient/versions/fec23fb32fb899b87a8b2c94e2d2069b6b4c633c.json"
}
```
Notice that `"vcs_url": null,`, `repository_homepage` address is getting generated and purl format isn't what I'd expect.
### System configuration
> For bug reports, it really helps us to know:
* What OS are you running on? RHEL 8.5
* What version of scancode-toolkit was used to generate the scan file? 30.1.0
* What installation method was used to install/run scancode? pip
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.