Spandx is a ruby API for interacting with the spdx.org software license catalogue. This gem includes a command line interface to scan a software project for the software licenses that are associated with each dependency in the project. Spandx also allows you to hook additional information for each dependency found. For instance, you can add plugin to Spandx to find and report vulnerabilities for the dependencies it found.(more details coming). Spandx leverages an offline cache of software licenses for known dependencies. The offline cache allows Spandx to perform a truly airgap friendly scan of software projects.
Supported language package managers
Spandx can work with following language’s package managers. It utilises lock files generated by package managers to find dependencies.
|Language||Package Manager||Tested in|
How to install it
Add this line to your application’s Gemfile:
And then execute:
Or install it yourself as:
$ gem install spandx
How to use as command line tool
The command line interface supports operations to build and fetch the latest offline index. See the help for each subcommand for more information on how to use the command.
モ spandx Commands: spandx help [COMMAND] # Describe available commands or one specific command spandx scan LOCKFILE # Scan a lockfile and list dependencies/licenses spandx version # spandx version
To scan a specific project file use the
モ spandx scan dotnet/application.sln モ spandx scan java/pom.xml モ spandx scan python/Pipfile.lock モ spandx scan ruby/Gemfile.lock
To activate airgap mode use the
モ spandx scan dotnet/application.sln --airgap モ spandx scan ruby/Gemfile.lock --airgap
How can use Spanx as Ruby API
To fetch the latest version of the catalogue data from SPDX.
catalogue = Spandx::Spdx::Catalogue.latest catalogue.each do |license| puts license.inspect end
To load an offline copy of the data.
path = File.join(Dir.pwd, 'licenses.json') catalogue = Spandx::Spdx::Catalogue.from_file(path) catalogue.each do |license| puts license.inspect end
After checking out the repo, run
bin/setup to install dependencies. Then, run
bin/cibuild to run the tests. You can also run
bin/console for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run
bundle exec rake install. To release a new version, update the version number in
version.rb, and then run
bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the
.gem file to rubygems.org.
How can I contribute?
You can contribute to this project in different ways
- We put our feature ideas into Spandx’s dashboard you can pick one idea and create PR for it ٩(●ᴗ●)۶
- Implement support for new package manager (∩_∩)
- Make performance improvements to existing code ٩(^ᴗ^)۶
- If you see a problem create an issue (^_^)v
The gem is available as open source under the terms of the MIT License.