Spandx is a ruby API for interacting with the spdx.org software license catalogue. This gem includes a command line interface to scan a software project for the software licenses that are associated with each dependency in the project. Spandx also allows you to hook additional information for each dependency found. For instance, you can add plugin to Spandx to find and report vulnerabilities for the dependencies it found.(more details coming). Spandx leverages an offline cache of software licenses for known dependencies. The offline cache allows Spandx to perform a truly airgap friendly scan of software projects.

Supported language package managers

Spandx can work with following language’s package managers. It utilises lock files generated by package managers to find dependencies.

How to install it

Add this line to your application’s Gemfile:

gem 'spandx'

And then execute:

$ bundle

Or install it yourself as:

$ gem install spandx

How to use as command line tool

The command line interface supports operations to build and fetch the latest offline index. See the help for each subcommand for more information on how to use the command.

モ spandx
Commands:
  spandx help [COMMAND]      # Describe available commands or one specific command
  spandx scan LOCKFILE       # Scan a lockfile and list dependencies/licenses
  spandx version             # spandx version

To scan a specific project file use the scan command:

モ spandx scan dotnet/application.sln
モ spandx scan java/pom.xml
モ spandx scan python/Pipfile.lock
モ spandx scan ruby/Gemfile.lock

To activate airgap mode use the --airgap option:

モ spandx scan dotnet/application.sln --airgap
モ spandx scan ruby/Gemfile.lock --airgap

How can use Spanx as Ruby API

To fetch the latest version of the catalogue data from SPDX.

catalogue = Spandx::Spdx::Catalogue.latest
catalogue.each do |license|
  puts license.inspect
end

To load an offline copy of the data.

path = File.join(Dir.pwd, 'licenses.json')
catalogue = Spandx::Spdx::Catalogue.from_file(path)
catalogue.each do |license|
  puts license.inspect
end

Development

After checking out the repo, run bin/setup to install dependencies. Then, run bin/cibuild to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

How can I contribute?

You can contribute to this project in different ways

• We put our feature ideas into Spandx’s dashboard you can pick one idea and create PR for it ٩(●ᴗ●)۶
• Implement support for new package manager (∩_∩)
• Make performance improvements to existing code ٩(^ᴗ^)۶
• If you see a problem create an issue (^_^)v

License

The gem is available as open source under the terms of the MIT License.