actions/dependency-review-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Handle complex licenses (e.g. X AND Y)

Browse Source 
There are many packages that are dual-licensed, offering a choice
of licenses (e.g. `MIT OR Apache-2.0`). There are some that include
code from multiple sources and require multiple licenses
(e.g. `MIT AND Apache-2.0`). There are also complex combinations that
can exist for a variety of reasons, such as
`MIT AND (Apache-2.0 OR BSD-3-Clause)`.

The most straightforward approach to handle these is to have an
allow list. As long as the licenses on the allow list can satisfy
the license expression of the package in question, it should pass.

To implement this, I the newest release of spdx-satisfies
which changed the interface to be exactly as described
`satisfies(license, allowList)` (see
https://github.com/jslicense/spdx-satisfies.js/pull/17).

Fixes https://github.com/actions/dependency-review-action/issues/263
This commit is contained in:
Kevin Dangoor
2025-05-05 19:06:50 -04:00
parent a87294d992
commit 3a2b68706a
9 changed files with 258 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
__tests__/licenses.test.ts
View File

@@ -74,6 +74,32 @@ const pipChange: Change = {
]
}
const complexLicenseChange: Change = {
change_type: 'added',
manifest: 'requirements.txt',
ecosystem: 'pip',
name: 'package-1',
version: '1.1.1',
package_url: 'pkg:pypi/package-1@1.1.1',
license: 'MIT AND Apache-2.0',
source_repository_url: 'github.com/some-repo',
scope: 'runtime',
vulnerabilities: [
{
severity: 'moderate',
advisory_ghsa_id: 'second-random_string',
advisory_summary: 'not so dangerous',
advisory_url: 'github.com/future-funk'
},
{
severity: 'low',
advisory_ghsa_id: 'third-random_string',
advisory_summary: 'dont page me',
advisory_url: 'github.com/future-funk'
}
]
}
jest.mock('@actions/core')
const mockOctokit = {
@@ -129,6 +155,30 @@ test('it adds license inside the deny list to forbidden changes', async () => {
expect(forbidden.length).toEqual(1)
})
test('it handles allowed complex licenses', async () => {
const changes: Changes = [
complexLicenseChange // MIT AND Apache-2.0 license
]
const {forbidden} = await getInvalidLicenseChanges(changes, {
allow: ['MIT', 'Apache-2.0']
})
expect(forbidden.length).toEqual(0)
})
test('it handles complex licenses not all on the allow list', async () => {
const changes: Changes = [
complexLicenseChange // MIT AND Apache-2.0 license
]
const {forbidden} = await getInvalidLicenseChanges(changes, {
allow: ['MIT']
})
expect(forbidden.length).toEqual(1)
})
test('it does not add license outside the allow list to forbidden changes if it is in removed changes', async () => {
const changes: Changes = [
{...npmChange, change_type: 'removed'},

32
__tests__/spdx.test.ts
View File

@@ -145,47 +145,47 @@ describe('satisfies', () => {
const units = [
{
candidate: 'MIT',
constraint: 'MIT',
allowList: ['MIT'],
expected: true
},
{
candidate: 'Apache-2.0',
constraint: 'MIT',
allowList: ['MIT'],
expected: false
},
{
candidate: 'MIT OR Apache-2.0',
constraint: 'MIT',
allowList: ['MIT'],
expected: true
},
{
candidate: 'MIT OR Apache-2.0',
constraint: 'Apache-2.0',
allowList: ['Apache-2.0'],
expected: true
},
{
candidate: 'MIT OR Apache-2.0',
constraint: 'BSD-3-Clause',
allowList: ['BSD-3-Clause'],
expected: false
},
{
candidate: 'MIT OR Apache-2.0',
constraint: 'Apache-2.0 OR BSD-3-Clause',
allowList: ['Apache-2.0', 'BSD-3-Clause'],
expected: true
},
{
candidate: 'MIT AND Apache-2.0',
constraint: 'MIT AND Apache-2.0',
allowList: ['MIT', 'Apache-2.0'],
expected: true
},
{
candidate: 'MIT OR Apache-2.0',
constraint: 'MIT AND Apache-2.0',
expected: false
allowList: ['MIT', 'Apache-2.0'],
expected: true
},
{
candidate: 'ISC OR (MIT AND Apache-2.0)',
constraint: 'MIT AND Apache-2.0',
allowList: ['MIT', 'Apache-2.0'],
expected: true
},
@@ -193,29 +193,29 @@ describe('satisfies', () => {
// or unknown licenses will return 'false'
{
candidate: 'MIT',
constraint: 'MiT',
allowList: ['MiT'],
expected: false
},
{
candidate: 'MIT AND (ISC OR',
constraint: 'MIT',
allowList: ['MIT'],
expected: false
},
{
candidate: 'MIT OR ISC OR Apache-2.0',
constraint: '',
allowList: [],
expected: false
},
{
candidate: '',
constraint: '(BSD-3-Clause AND ISC) OR MIT',
allowList: ['BSD-3-Clause', 'ISC', 'MIT'],
expected: false
}
]
for (const unit of units) {
const got: boolean = spdx.satisfies(unit.candidate, unit.constraint)
test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.constraint}")`, () => {
const got: boolean = spdx.satisfies(unit.candidate, unit.allowList)
test(`should return ${unit.expected} for ("${unit.candidate}", "${unit.allowList}")`, () => {
expect(got).toBe(unit.expected)
})
}

161
dist/index.js generated vendored
View File

@@ -435,7 +435,7 @@ function getInvalidLicenseChanges(changes, licenses) {
try {
if (allow !== undefined) {
if (spdx.isValid(license)) {
const found = spdx.satisfiesAny(license, allow);
const found = spdx.satisfies(license, allow);
validityCache.set(license, found);
}
else {
@@ -1382,6 +1382,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.isValid = exports.satisfiesAll = exports.satisfiesAny = exports.satisfies = void 0;
const spdxlib = __importStar(__nccwpck_require__(1452));
const spdx_satisfies_1 = __importDefault(__nccwpck_require__(5131));
const spdx_expression_parse_1 = __importDefault(__nccwpck_require__(3326));
/*
* NOTE: spdx-license-satisfies methods depend on spdx-expression-parse
@@ -1391,9 +1392,9 @@ const spdx_expression_parse_1 = __importDefault(__nccwpck_require__(3326));
*/
// accepts a pair of well-formed SPDX expressions. the
// candidate is tested against the constraint
function satisfies(candidateExpr, constraintExpr) {
function satisfies(candidateExpr, allowList) {
try {
return spdxlib.satisfies(candidateExpr, constraintExpr);
return (0, spdx_satisfies_1.default)(candidateExpr, allowList);
}
catch (_) {
return false;
@@ -21950,6 +21951,155 @@ module.exports = function (source) {
}
/***/ }),
/***/ 5131:
/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
var compare = __nccwpck_require__(7369)
var parse = __nccwpck_require__(3326)
var ranges = __nccwpck_require__(9344)
function rangesAreCompatible (first, second) {
return (
first.license === second.license ||
ranges.some(function (range) {
return (
licenseInRange(first.license, range) &&
licenseInRange(second.license, range)
)
})
)
}
function licenseInRange (license, range) {
return (
range.indexOf(license) !== -1 ||
range.some(function (element) {
return (
Array.isArray(element) &&
element.indexOf(license) !== -1
)
})
)
}
function identifierInRange (identifier, range) {
return (
identifier.license === range.license ||
compare.gt(identifier.license, range.license) ||
compare.eq(identifier.license, range.license)
)
}
function licensesAreCompatible (first, second) {
if (first.exception !== second.exception) {
return false
} else if (second.hasOwnProperty('license')) {
if (second.hasOwnProperty('plus')) {
if (first.hasOwnProperty('plus')) {
// first+, second+
return rangesAreCompatible(first, second)
} else {
// first, second+
return identifierInRange(first, second)
}
} else {
if (first.hasOwnProperty('plus')) {
// first+, second
return identifierInRange(second, first)
} else {
// first, second
return first.license === second.license
}
}
}
}
function replaceGPLOnlyOrLaterWithRanges (argument) {
var license = argument.license
if (license) {
if (endsWith(license, '-or-later')) {
argument.license = license.replace('-or-later', '')
argument.plus = true
} else if (endsWith(license, '-only')) {
argument.license = license.replace('-only', '')
delete argument.plus
}
} else if (argument.left && argument.right) {
argument.left = replaceGPLOnlyOrLaterWithRanges(argument.left)
argument.right = replaceGPLOnlyOrLaterWithRanges(argument.right)
}
return argument
}
function endsWith (string, substring) {
return string.indexOf(substring) === string.length - substring.length
}
function licenseString (e) {
if (e.hasOwnProperty('noassertion')) return 'NOASSERTION'
if (e.license) {
return (
e.license +
(e.plus ? '+' : '') +
(e.exception ? ('WITH ' + e.exception) : '')
)
}
}
// Expand the given expression into an equivalent array where each member is an array of licenses AND'd
// together and the members are OR'd together. For example, `(MIT OR ISC) AND GPL-3.0` expands to
// `[[GPL-3.0 AND MIT], [ISC AND MIT]]`. Note that within each array of licenses, the entries are
// normalized (sorted) by license name.
function expand (expression) {
return sort(expandInner(expression))
}
function expandInner (expression) {
if (!expression.conjunction) return [{ [licenseString(expression)]: expression }]
if (expression.conjunction === 'or') return expandInner(expression.left).concat(expandInner(expression.right))
if (expression.conjunction === 'and') {
var left = expandInner(expression.left)
var right = expandInner(expression.right)
return left.reduce(function (result, l) {
right.forEach(function (r) { result.push(Object.assign({}, l, r)) })
return result
}, [])
}
}
function sort (licenseList) {
var sortedLicenseLists = licenseList
.filter(function (e) { return Object.keys(e).length })
.map(function (e) { return Object.keys(e).sort() })
return sortedLicenseLists.map(function (list, i) {
return list.map(function (license) { return licenseList[i][license] })
})
}
function isANDCompatible (parsedExpression, parsedLicenses) {
return parsedExpression.every(function (element) {
return parsedLicenses.some(function (approvedLicense) {
return licensesAreCompatible(element, approvedLicense)
})
})
}
function satisfies (spdxExpression, arrayOfLicenses) {
var parsedExpression = expand(replaceGPLOnlyOrLaterWithRanges(parse(spdxExpression)))
var parsedLicenses = arrayOfLicenses.map(function (l) { return replaceGPLOnlyOrLaterWithRanges(parse(l)) })
for (const parsed of parsedLicenses) {
if (parsed.hasOwnProperty('conjunction')) {
throw new Error('Approved licenses cannot be AND or OR expressions.')
}
}
return parsedExpression.some(function (o) { return isANDCompatible(o, parsedLicenses) })
}
module.exports = satisfies
/***/ }),
/***/ 770:
@@ -50345,6 +50495,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
Object.defineProperty(exports, "__esModule", ({ value: true }));
exports.isValid = exports.satisfiesAll = exports.satisfiesAny = exports.satisfies = void 0;
const spdxlib = __importStar(__nccwpck_require__(1452));
const spdx_satisfies_1 = __importDefault(__nccwpck_require__(5131));
const spdx_expression_parse_1 = __importDefault(__nccwpck_require__(3326));
/*
* NOTE: spdx-license-satisfies methods depend on spdx-expression-parse
@@ -50354,9 +50505,9 @@ const spdx_expression_parse_1 = __importDefault(__nccwpck_require__(3326));
*/
// accepts a pair of well-formed SPDX expressions. the
// candidate is tested against the constraint
function satisfies(candidateExpr, constraintExpr) {
function satisfies(candidateExpr, allowList) {
try {
return spdxlib.satisfies(candidateExpr, constraintExpr);
return (0, spdx_satisfies_1.default)(candidateExpr, allowList);
}
catch (_) {
return false;

2
dist/index.js.map generated vendored
View File

File diff suppressed because one or more lines are too long

25
dist/licenses.txt generated vendored
View File

@@ -1646,6 +1646,31 @@ The above copyright notice and this permission notice shall be included in all c
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
spdx-satisfies
MIT
The MIT License
Copyright (c) spdx-satisfies.js contributors
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included
in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
OTHER DEALINGS IN THE SOFTWARE.
tunnel
MIT
The MIT License (MIT)

8
package-lock.json generated
View File

@@ -20,7 +20,7 @@
"jest": "^29.7.0",
"octokit": "^3.1.2",
"spdx-expression-parse": "^3.0.1",
"spdx-satisfies": "^5.0.1",
"spdx-satisfies": "^6.0.0",
"ts-jest": "^29.2.5",
"yaml": "^2.3.4",
"zod": "^3.24.1"
@@ -7372,9 +7372,9 @@
"integrity": "sha512-mcdpQFV7UDAgLpXEE/jOMqvK4LBoO0uTQg0uvXUewmEFhpiZx5yJSZITHB8w1ZahKdhfZqP5GPEOKLyEq5p8XA=="
},
"node_modules/spdx-satisfies": {
"version": "5.0.1",
"resolved": "https://registry.npmjs.org/spdx-satisfies/-/spdx-satisfies-5.0.1.tgz",
"integrity": "sha512-Nwor6W6gzFp8XX4neaKQ7ChV4wmpSh2sSDemMFSzHxpTw460jxFYeOn+jq4ybnSSw/5sc3pjka9MQPouksQNpw==",
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/spdx-satisfies/-/spdx-satisfies-6.0.0.tgz",
"integrity": "sha512-oOWQocnRbFVtBnBITfFgzjhnOklHossTvI+6C1hB2slvp3HgTsfru5wuo8HY2rQpwSm5JuIhNzIuqOfR5IuojQ==",
"dependencies": {
"spdx-compare": "^1.0.0",
"spdx-expression-parse": "^3.0.0",

4
package.json
View File

@@ -36,7 +36,7 @@
"jest": "^29.7.0",
"octokit": "^3.1.2",
"spdx-expression-parse": "^3.0.1",
"spdx-satisfies": "^5.0.1",
"spdx-satisfies": "^6.0.0",
"ts-jest": "^29.2.5",
"yaml": "^2.3.4",
"zod": "^3.24.1"
@@ -63,4 +63,4 @@
"cross-spawn": ">=7.0.5",
"@octokit/request-error@5.0.1": "5.1.1"
}
}
}

2
src/licenses.ts
View File

@@ -88,7 +88,7 @@ export async function getInvalidLicenseChanges(
try {
if (allow !== undefined) {
if (spdx.isValid(license)) {
const found = spdx.satisfiesAny(license, allow)
const found = spdx.satisfies(license, allow)
validityCache.set(license, found)
} else {
invalidLicenseChanges.unresolved.push(change)

8
src/spdx.ts
View File

@@ -1,4 +1,5 @@
import * as spdxlib from '@onebeyond/spdx-license-satisfies'
import spdxSatisfies from 'spdx-satisfies'
import parse from 'spdx-expression-parse'
/*
@@ -10,12 +11,9 @@ import parse from 'spdx-expression-parse'
// accepts a pair of well-formed SPDX expressions. the
// candidate is tested against the constraint
export function satisfies(
candidateExpr: string,
constraintExpr: string
): boolean {
export function satisfies(candidateExpr: string, allowList: string[]): boolean {
try {
return spdxlib.satisfies(candidateExpr, constraintExpr)
return spdxSatisfies(candidateExpr, allowList)
} catch (_) {
return false
}