gosupplychain

package module
v0.0.0-...-f2a1d7d Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 31, 2017 License: MIT Imports: 22 Imported by: 0

README

gosupplychain

Tools to help audit dependencies, check licenses, and create bill-of-materials

Go Report Card

Sub-packages

golist is wrappers around the command "go list". It is meant to be generic.

Libraries
  • go-license golang package to detect OSS licenses
Services
  • goreportcard Online service to evaluate golang packages
  • libraries.io Allows searching and filtering of golang libraries by license type
  • github v3 API Github provides an API to guess the license of a repo blog
Tools
  • godep golang tool to do "vendoring"
  • licentia Manage and update license files
  • anderson tool to white and blacklist licenses in your golang project
Specs

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var LegalFileSubstring = []string{
	"legal",
	"notice",
	"disclaimer",
	"patent",
	"third-party",
	"thirdparty",
}

LegalFileSubstring are substrings that indicate the file is likely to contain some type of legal declaration. "legal" is often used that it might moved to LicenseFilePrefix

View Source 
var LicenseFilePrefix = []string{
	"licence",
	"license",
	"copying",
	"unlicense",
	"copyright",
	"copyleft",
}

LicenseFilePrefix is a list of filename prefixes that indicate it might contain a software license

View Source 
var Meta = map[string]LicenseMeta{
	"Apache-2.0": {
		FullName:      "Apache License 2.0",
		LinkOriginal:  "http://www.apache.org/licenses/license-2.0",
		LinkOSI:       "http://opensource.org/licenses/Apache-2.0",
		LinkCAL:       "http://choosealicense.com/licenses/apache-2.0/",
		LinkTLDR:      "https://tldrlegal.com/license/apache-license-2.0-(apache-2.0)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/Apache_License",
	},
	"NewBSD": {
		FullName:      "BSD 3-Clause License",
		LinkOSI:       "http://opensource.org/licenses/BSD-3-Clause",
		LinkCAL:       "http://choosealicense.com/licenses/bsd-3-clause/",
		LinkTLDR:      "https://tldrlegal.com/license/bsd-3-clause-license-(revised)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/BSD_licenses",
	},
	"FreeBSD": {
		FullName:      "BSD 2-Clause License",
		LinkOSI:       "http://opensource.org/licenses/BSD-2-Clause",
		LinkCAL:       "http://choosealicense.com/licenses/bsd-2-clause/",
		LinkTLDR:      "https://tldrlegal.com/license/bsd-2-clause-license-(freebsd)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/BSD_licenses",
	},
	"GPL-2.0": {
		FullName:      "GNU General Public License v2",
		LinkOriginal:  "http://www.gnu.org/licenses/old-licenses/gpl-2.0.html",
		LinkOSI:       "http://opensource.org/licenses/GPL-2.0",
		LinkCAL:       "http://choosealicense.com/licenses/gpl-2.0/",
		LinkTLDR:      "https://tldrlegal.com/license/gnu-general-public-license-v2",
		LinkWikipedia: "https://en.wikipedia.org/wiki/GNU_General_Public_License",
	},
	"GPL-3.0": {
		FullName:      "GNU General Public License v3",
		LinkOriginal:  "http://www.gnu.org/licenses/gpl.html",
		LinkOSI:       "http://opensource.org/licenses/GPL-3.0",
		LinkCAL:       "http://choosealicense.com/licenses/gpl-3.0/",
		LinkTLDR:      "https://tldrlegal.com/license/gnu-general-public-license-v3-(gpl-3)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/GNU_General_Public_License",
	},
	"LGPL-2.1": {
		FullName:      "GNU Lesser General Public License v2.1",
		LinkOriginal:  "http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html",
		LinkOSI:       "http://opensource.org/licenses/LGPL-2.1",
		LinkCAL:       "http://choosealicense.com/licenses/lgpl-2.1/",
		LinkTLDR:      "https://tldrlegal.com/license/gnu-lesser-general-public-license-v2.1-(lgpl-2.1)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License",
	},
	"LGPL-3.0": {
		FullName:      "GNU Lesser General Public License v3.0",
		LinkOriginal:  "http://www.gnu.org/licenses/lgpl.html",
		LinkOSI:       "http://opensource.org/licenses/LGPL-3.0",
		LinkCAL:       "http://choosealicense.com/licenses/lgpl-3.0/",
		LinkTLDR:      "https://tldrlegal.com/license/gnu-general-public-license-v3-(gpl-3)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License",
	},
	"MIT": {
		FullName:      "MIT License",
		LinkOSI:       "http://opensource.org/licenses/MIT",
		LinkCAL:       "http://choosealicense.com/licenses/mit/",
		LinkTLDR:      "https://tldrlegal.com/license/mit-license",
		LinkWikipedia: "https://en.wikipedia.org/wiki/MIT_License",
	},
	"MPL-2.0": {
		FullName:      "Mozilla Public License 2.0",
		LinkOriginal:  "https://www.mozilla.org/en-US/MPL/2.0/",
		LinkOSI:       "http://opensource.org/licenses/MPL-2.0",
		LinkCAL:       "http://choosealicense.com/licenses/mpl-2.0/",
		LinkTLDR:      "https://tldrlegal.com/license/mozilla-public-license-2.0-(mpl-2)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/Mozilla_Public_License",
	},
	"AGPL-3.0": {
		FullName:      "GNU Affero General Public License",
		LinkOriginal:  "http://www.gnu.org/licenses/agpl.html",
		LinkOSI:       "http://opensource.org/licenses/AGPL-3.0",
		LinkCAL:       "http://choosealicense.com/licenses/agpl-3.0/",
		LinkWikipedia: "https://en.wikipedia.org/wiki/Affero_General_Public_License",
	},
	"WTFPL-2.0": {
		FullName:      "Do What The Fuck You Want To Public License",
		LinkOriginal:  "http://www.wtfpl.net/txt/copying/",
		LinkTLDR:      "https://tldrlegal.com/license/do-wtf-you-want-to-public-license-v2-(wtfpl-2.0)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/WTFPL",
	},
	"CDDL-1.0": {
		FullName:      "Common Development and Distribution License",
		LinkTLDR:      "https://tldrlegal.com/license/common-development-and-distribution-license-(cddl-1.0)-explained",
		LinkWikipedia: "https://en.wikipedia.org/wiki/Common_Development_and_Distribution_License",
	},
	"EPL-1.0": {
		FullName:      "Eclipse Public License 1.0",
		LinkOriginal:  "https://www.eclipse.org/legal/epl-v10.html",
		LinkTLDR:      "https://tldrlegal.com/license/eclipse-public-license-1.0-(epl-1.0)",
		LinkWikipedia: "https://en.wikipedia.org/wiki/Eclipse_Public_License",
	},
	"Unlicense": {
		FullName:     "Unlicense",
		LinkOriginal: "http://unlicense.org",
	},
}

Meta is a mapping from license tokens to meta data.

View Source 
var ShowCmd bool

ShowCmd controls whether VCS commands are printed.

View Source 
var Verbose bool

Verbose enables verbose operation logging.

Functions

func GetLicense 

func GetLicense(path string) license.License

GetLicense returns licensing info

func GitCommitsBehind 

func GitCommitsBehind(dir string, hash string) (int, error)

GitCommitsBehind counts the number of commits a directory is behind master

func GoPkgInToGitHub 

func GoPkgInToGitHub(name string) string

GoPkgInToGitHub converts a "gopkg.in" to a github repo link

func IsLegalFile 

func IsLegalFile(filename string) bool

IsLegalFile returns true if the file is likely to contain some type of of legal declaration or licensing information

func IsLicenseFile 

func IsLicenseFile(filename string) bool

IsLicenseFile returns true if the filename might be contain a software license

func LinkToFile 

func LinkToFile(pkg, file, rev string) string

LinkToFile returns a URL that links to particular revision of a file or empty

Types

type Cmd 

type Cmd struct {
	Name string
	Cmd  string // name of binary to invoke command

	CreateCmd      string   // command to download a fresh copy of a repository
	TagLookupCmd   []TagCmd // commands to lookup tags before running tagSyncCmd
	TagSyncCmd     string   // command to sync to specific tag
	TagSyncDefault string   // command to sync to default tag
	LogCmd         string   // command to list repository changelogs in an XML format
}

Cmd is a bad abstraction around a VCS command

func ByCmd 

func ByCmd(cmd string) *Cmd

ByCmd returns the version control system for the given command name (hg, git, svn, bzr).

func (*Cmd) Create 

func (v *Cmd) Create(dir, repo string, depth int) error

Create creates a new copy of repo in dir. The parent of dir must exist; dir must not.

func (*Cmd) Log 

func (v *Cmd) Log(dir string, logTemplate string, limit int) ([]byte, error)

Log logs the changes for the repo in dir. dir must be a valid VCS repo compatible with v.

WARNING: this does not issue a "download" or "sync" command.

func (*Cmd) LogAtRev 

func (v *Cmd) LogAtRev(dir, rev, logTemplate string) ([]byte, error)

LogAtRev logs the change for repo in dir at the rev revision. dir must be a valid VCS repo compatible with v. rev must be a valid revision for the repo in dir.

WARNING: this does not issue a "download" or "sync" command. 

unlike the tools/vcs

func (*Cmd) TagSync 

func (v *Cmd) TagSync(dir, tag string) error

TagSync syncs the repo in dir to the named tag, which either is a tag returned by tags or is v.TagDefault. dir must be a valid VCS repo compatible with v and the tag must exist.

type Commit 

type Commit struct {
	Commit  string
	Author  string
	Date    string
	Message string
}

Commit contains meta data about a single commit

func GetLastCommit 

func GetLastCommit(dir string) (Commit, error)

GetLastCommit returns meta data on the last commit

func GitLogAtRev 

func GitLogAtRev(cmd *Cmd, rootdir, rev string) ([]Commit, error)

GitLogAtRev is a special function to parse GitHub commits TODO clearly the CMD would be better as a interface.

type CommitMini 

type CommitMini struct {
	SHA string
	Msg string
}

type Dependency 

type Dependency struct {
	golist.Package
	Commit  Commit
	License license.License
	Project Project
}

Dependency contains meta data on a external dependency

func LoadDependencies 

func LoadDependencies(pkgs []string, ignores []string) ([]Dependency, error)

LoadDependencies is not done

type GitHub 

type GitHub struct {
	Client *github.Client
}

GitHub is a VCS

func NewGitHub 

func NewGitHub(oauthToken string) GitHub

NewGitHub creates a github client using oauth token

func (GitHub) GetFileContents 

func (gh GitHub) GetFileContents(owner, repo, tree, filepath string) (string, error)

GetFileContents down loads a file

func (GitHub) GetFileContentsURL 

func (gh GitHub) GetFileContentsURL(owner, repo, sha, filepath string) string

GetFileContentsURL generates a download URL

func (GitHub) GetTreeFiles 

func (gh GitHub) GetTreeFiles(owner string, repo string, sha string) ([]GitHubFile, error)

GetTreeFiles returns the list of files given a tree.

sha must be a valid git sha value or "master"

func (GitHub) GuessLicenseFromRepo 

func (gh GitHub) GuessLicenseFromRepo(owner string, repo string, sha string) (license.License, error)

GuessLicenseFromRepo attempts to determine a license

func (GitHub) SearchByUsers 

func (gh GitHub) SearchByUsers(oauthToken string, searchQuery string, users []string) ([]User, error)

SearchByUsers performs a search on multiple users

type GitHubFile 

type GitHubFile struct {
	Owner string
	Repo  string
	Path  string
	Tree  string
	SHA   string
}

GitHubFile is contains everything needed to represent a file at a point in time 

Likely to be generalized later

func (GitHubFile) RawURL 

func (file GitHubFile) RawURL() string

RawURL returns a URL to the raw content, without formatting

func (GitHubFile) WebURL 

func (file GitHubFile) WebURL() string

WebURL returns a human-friend URL to github

type GoDepDependency 

type GoDepDependency struct {
	ImportPath string
	Comment    string `json:",omitempty"` // Description of commit, if present.
	Rev        string // VCS-specific commit ID.
}

A GoDepDependency is a specific revision of a package.

type Godeps 

type Godeps struct {
	ImportPath string
	GoVersion  string
	Packages   []string `json:",omitempty"` // Arguments to save, if any.
	Deps       []GoDepDependency
}

Godeps describes what a package needs to be rebuilt reproducibly. It's the same information stored in file Godeps.

func LoadGodepsFile 

func LoadGodepsFile(path string) (Godeps, error)

LoadGodepsFile loads a godeps file

type ImportStatus 

type ImportStatus struct {
	Root    string       // root import
	Status  string       // ahead, or behind
	Commits []CommitMini // specific
}

func Behind 

func Behind(githubToken string, godepFile string) []ImportStatus

Behind takes a github token and a godep file 

and returns a list of dependencies and if they are out of date

type LicenseMeta 

type LicenseMeta struct {
	FullName      string // Full name in English
	LinkOriginal  string // Link to original license source
	LinkOSI       string // Link to The Open Source Initiative, http://opensource.org
	LinkOSIAlt    string // Alternate link for The Open Source Initiative (normally old)
	LinkCAL       string // Link to "Choose a License"
	LinkTLDR      string // Link to "TLDR;Legal"
	LinkWikipedia string // Link to Wikipedia
}

LicenseMeta is struct containing various meta data about a license including names and links to other websites.

type MetaGoImport 

type MetaGoImport struct {
	ProjectRoot string
	Vcs         string
	Repo        string
}

MetaGoImport represents the values in a go-import meta tag.

type MetaGoSource 

type MetaGoSource struct {
	ProjectRoot  string
	ProjectURL   string
	DirTemplate  string
	FileTemplate string
}

MetaGoSource represents the values in a go-source meta tag.

func (MetaGoSource) DirURL 

func (mgs MetaGoSource) DirURL(dir string) string

DirURL returns a URL pointing to the VCS directory

func (MetaGoSource) FileURL 

func (mgs MetaGoSource) FileURL(dir, file string) string

FileURL returns a URL points to the VCS File

type Project 

type Project struct {
	VcsName     string
	VcsCmd      string
	Repo        string
	LicenseLink string
}

Project contains VCS project data Notes: 

go-source meta tag:  https://github.com/golang/gddo/wiki/Source-Code-Links
   https://github.com/golang/gddo/blob/master/gosrc/gosrc.go

Project contains an amalgamation of package, commit, repo, and license information

type Repo 

type Repo struct {
	Name        string
	Description string
	Updated     time.Time
}

Repo describes a repo basic NOTE: likely to be replaced with a larger structure

type TagCmd 

type TagCmd struct {
	Cmd     string // command to list tags
	Pattern string // regexp to extract tags from list
}

A TagCmd describes a command to list available tags that can be passed to Cmd.TagSyncCmd.

type User 

type User struct {
	Name  string
	Repos []Repo
}

User is the top level GitHub user (maybe be a company or user) NOTE: like to be replaced with a larger structure

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.