Include dependency license data in distributed packages

.licensed.yml

@@ -0,0 +1,7 @@
+allowed:
+  - mit
+  - apache-2.0
+
+reviewed:
+  bundler:
+    - pathname-common_prefix

docker/Dockerfile.build-linux

@@ -1,11 +1,14 @@
 FROM ruby:2.4-slim-stretch
 
 RUN apt-get update \
-    && apt-get install -y --no-install-recommends cmake make gcc pkg-config squashfs-tools git curl bison \
+    && apt-get install -y --no-install-recommends cmake make gcc pkg-config squashfs-tools git curl bison rsync \
     && rm -rf /var/lib/apt/lists/*
 
 RUN curl -L http://enclose.io/rubyc/rubyc-linux-x64.gz | gunzip > /usr/local/bin/rubyc \
     && chmod +x /usr/local/bin/rubyc
 
+RUN gem update --system && gem update bundler
+
 ENV CPPFLAGS="-P"
 ENV RUBYC="/usr/local/bin/rubyc"
+ENV LANG=C.UTF-8

lib/licensed/sources/bundler.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "delegate"
 begin
   require "bundler"
 rescue LoadError
@@ -36,6 +37,15 @@ def error
         end
       end
 
+      class BundlerSpecification < ::SimpleDelegator
+        def gem_dir
+          dir = super
+          return dir if File.exist?(dir)
+
+          File.join(Gem.dir, "gems", full_name)
+        end
+      end
+
       class Dependency < Licensed::Dependency
         attr_reader :loaded_from
 
@@ -141,7 +151,7 @@ def gem_spec(dependency)
         spec = definition.resolve.find { |s| s.satisfies?(dependency) }
 
         # a nil spec should be rare, generally only seen from bundler
-        return bundle_exec_gem_spec(dependency.name) if spec.nil?
+        return matching_spec(dependency) || bundle_exec_gem_spec(dependency.name) if spec.nil?
 
         # try to find a non-lazy specification that matches `spec`
         # spec.source.specs gives access to specifications with more
@@ -213,6 +223,21 @@ def bundle_exec_gem_spec(name)
         end
       end
 
+      # Loads a dependency specification using rubygems' built-in
+      # `Dependency#matching_specs` and `Dependency#to_spec`, from the original
+      # gem environment
+      def matching_spec(dependency)
+        begin
+          ::Bundler.with_original_env do
+            ::Bundler.rubygems.clear_paths
+            return unless dependency.matching_specs(true).any?
+            BundlerSpecification.new(dependency.to_spec)
+          end
+        ensure
+          ::Bundler.configure
+        end
+      end
+
       # Build the bundler definition
       def definition
         @definition ||= ::Bundler::Definition.build(gemfile_path, lockfile_path, nil)

script/packages/build

@@ -0,0 +1,92 @@
+#!/bin/bash
+#/ Usage: script/packages/build <RUBYC> [VERSION]
+#/
+#/ WARNING: Do not call this directly. Please create packages using
+#/ `script/package [platform]` or `bundle exec rake package[platform]`
+#/
+#/ Builds a distributable package for licensed for a given RUBYC compiler and licensed VERSION.
+#/ Packages are of the form licensed-$VERSION-$PLATFORM-x64.tar.gz and contain a `./licensed` executable
+#/ Built Packages are placed in the <root>/pkg/$VERSION directory.
+#/
+#/ OPTIONS:
+#/   <RUBYC>           The path to a rubyc compiler that should be used to compile the target executable
+#/   [VERSION]         (optional, default to current git branch or SHA1) version of licensed to build exe at
+#/
+#/ EXAMPLES:
+#/
+#/   Builds a package for version 1.1.0 using a local rubyc compiler
+#/     $ script/packages/build RUBYC="./rubyc-darwin" VERSION="1.1.0"
+#/
+
+set -euo pipefail
+
+BASE_DIR="$(cd "$(dirname $0)/../.." && pwd)"
+RUBYC=${RUBYC:=""}
+if [ ! -f "$RUBYC" ]; then
+  echo "Specify a rubyc compiler using the RUBYC environment variable" >&2
+  exit 127
+fi
+
+# if a version is not provided, get an identifier from the current HEAD
+VERSION=${VERSION:="$(git rev-parse --abbrev-ref HEAD)"}
+
+BUILD_DIR="$(mktemp -d)"
+COPY_DIR="$(mktemp -d)"
+trap "rm -rf $BUILD_DIR; rm -rf $COPY_DIR" EXIT
+
+# copy the repo to a separate directory.  determining license metadata
+# will require a clean environment with no Gemfile.lock.  using a work location
+# is preferred to messing with a development repository
+rsync -r --exclude="test/" --exclude=".licenses/" --exclude="vendor/" --exclude="Gemfile.lock" --exclude="pkg/" $BASE_DIR/ $COPY_DIR
+cd $COPY_DIR
+
+# ensure repo is at $VERSION and build executable, restoring the repo to previous
+# state after build.
+(
+  # run in a subshell for ease of returning to the current branch after building
+  # the executable
+  CURRENT_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+  if [[ "$VERSION" != "$CURRENT_BRANCH" ]]; then
+    git checkout "$VERSION"
+    trap "git checkout $CURRENT_BRANCH" EXIT
+  fi
+
+  # build the licensed rubyc executable
+  "$RUBYC" --clean-tmpdir -o "$BUILD_DIR/licensed" "$COPY_DIR/exe/licensed"
+  chmod +x $BUILD_DIR/licensed
+)
+
+# non-executable content will be stored in a `meta` directory
+mkdir -p "$BUILD_DIR/meta"
+
+# include dependency license data in package; run bundle update in temp work dir
+# and then run licensed on itself in that directory to grab license data
+# NOTE: this does not produce accurate license information if any licensed
+# depends on any platform-specific gems.
+(
+  # run in a subshell so that `unset BUNDLER_VERSION` is contained.  the ENV var
+  # is required to successfully build a distributable executable on
+  # dockerized linux
+  unset BUNDLER_VERSION
+
+  # determining dependency license data needs to be done from a clean environment
+  # without previous dependencies or a Gemfile.lock so as to pull in the latest
+  # bundler version, which is what the distributed executable uses
+  script/bootstrap
+  bundle exec exe/licensed cache
+  cp -R "$COPY_DIR/.licenses" "$BUILD_DIR/meta"
+)
+
+# copy static metadata to build directory
+mkdir -p "$BUILD_DIR/meta/ruby"
+curl -o "$BUILD_DIR/meta/ruby/license.txt" "https://www.ruby-lang.org/en/about/license.txt"
+cp "$BASE_DIR/LICENSE" "$BUILD_DIR/meta"
+cp "$BASE_DIR/README.md" "$BUILD_DIR/meta"
+
+# create release archive
+PLATFORM="$(uname -s | tr '[:upper:]' '[:lower:]')"
+TARGET="$BASE_DIR/pkg/$VERSION/licensed-$VERSION-$PLATFORM-x64.tar.gz"
+mkdir -p "$(dirname $TARGET)"
+tar -C "$BUILD_DIR" -czf "$TARGET" .
+
+echo "licensed package built to $TARGET"

script/packages/linux

@@ -27,21 +27,23 @@ build_linux_docker() {
     -v "$BASE_DIR":/var/licensed \
     -w /var/licensed \
     "$IMAGE" \
-    "script/build-rubyc-exe"
+    "script/packages/build"
 }
 
 build_linux_local() {
   sudo apt-get update && \
        apt-get install -y --no-install-recommends cmake make gcc pkg-config squashfs-tools curl bison git
 
-  if [ ! -f "$BASE_DIR/bin/rubyc-linux" ]; then
-    mkdir -p "$BASE_DIR/bin"
-    curl -L http://enclose.io/rubyc/rubyc-linux-x64.gz | gunzip > "$BASE_DIR/bin/rubyc-linux"
-    chmod +x "$BASE_DIR/bin/rubyc-linux"
+  RUBYC="$BASE_DIR/bin/rubyc-linux"
+  if [ ! -f "$RUBYC" ]; then
+    mkdir -p "$(dirname "$RUBYC")"
+    curl -L http://enclose.io/rubyc/rubyc-linux-x64.gz | gunzip > "$RUBYC"
+    chmod +x "$RUBYC"
   fi
 
   export CPPFLAGS="-P"
-  RUBYC="$BASE_DIR/bin/rubyc-linux" "$BASE_DIR"/script/build-rubyc-exe
+  export RUBYC
+  "$BASE_DIR"/script/packages/build
 }
 
 if [[ "$(uname -s)" != "Linux" ]]; then

script/packages/mac

@@ -22,14 +22,16 @@ if [[ "$(uname -s)" != "Darwin" ]]; then
 fi
 
 BASE_DIR="$(cd "$(dirname $0)/../.." && pwd)"
+RUBYC="$BASE_DIR/bin/rubyc-darwin"
 
 brew update
 brew list "squashfs" &>/dev/null || brew install "squashfs"
 
-if [ ! -f "$BASE_DIR/bin/rubyc-darwin" ]; then
-  mkdir -p "$BASE_DIR/bin"
-  curl -L http://enclose.io/rubyc/rubyc-darwin-x64.gz | gunzip > "$BASE_DIR/bin/rubyc-darwin"
-  chmod +x "$BASE_DIR/bin/rubyc-darwin"
+if [ ! -f "$RUBYC" ]; then
+  mkdir -p "$(dirname "$RUBYC")"
+  curl -L http://enclose.io/rubyc/rubyc-darwin-x64.gz | gunzip > "$RUBYC"
+  chmod +x "$RUBYC"
 fi
 
-RUBYC="$BASE_DIR/bin/rubyc-darwin" "$BASE_DIR"/script/build-rubyc-exe
+export RUBYC
+"$BASE_DIR"/script/packages/build