Skip to content

Commit ba0ea5a

Browse files
Prakash-Mishra-9ghzPrakash-Mishra-9ghz
committed
feat(scanner): Add Nomos plugin for license scanning
Signed-off-by: Prakash Mishra <[email protected]>
1 parent 2384720 commit ba0ea5a

File tree

5 files changed

+346
-0
lines changed

5 files changed

+346
-0
lines changed

‎plugins/scanners/nomos/build.gradle.kts‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
* Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
* SPDX-License-Identifier: Apache-2.0
17+
* License-Filename: LICENSE
18+
*/
19+
20+
plugins {
21+
id("org.jetbrains.kotlin.plugin.serialization") version "1.9.0"
22+
id("ort-plugin-conventions")
23+
}
24+
25+
dependencies {
26+
api(projects.model)
27+
api(projects.scanner)
28+
29+
implementation(projects.utils.commonUtils)
30+
31+
implementation(projects.utils.ortUtils)
32+
implementation(projects.utils.spdxUtils)
33+
34+
ksp(projects.scanner)
35+
36+
implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.9.0")
37+
}

‎plugins/scanners/nomos/src/main/kotlin/Nomossa.kt‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
/*
2+
* Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
* SPDX-License-Identifier: Apache-2.0
17+
* License-Filename: LICENSE
18+
*/
19+
20+
package org.ossreviewtoolkit.plugins.scanners.nomos
21+
22+
import java.io.File
23+
import java.time.Instant
24+
25+
import org.apache.logging.log4j.kotlin.logger
26+
27+
import org.ossreviewtoolkit.model.ScanSummary
28+
import org.ossreviewtoolkit.model.ScannerDetails
29+
import org.ossreviewtoolkit.plugins.api.OrtPlugin
30+
import org.ossreviewtoolkit.plugins.api.PluginDescriptor
31+
import org.ossreviewtoolkit.scanner.LocalPathScannerWrapper
32+
import org.ossreviewtoolkit.scanner.ScanContext
33+
import org.ossreviewtoolkit.scanner.ScannerMatcher
34+
import org.ossreviewtoolkit.scanner.ScannerWrapperFactory
35+
import org.ossreviewtoolkit.utils.common.CommandLineTool
36+
import org.ossreviewtoolkit.utils.common.ProcessCapture
37+
38+
object NomossaCommand : CommandLineTool {
39+
override fun command(workingDir: File?): String {
40+
return listOfNotNull(workingDir, "nomossa").joinToString(File.separator)
41+
}
42+
43+
override fun transformVersion(output: String): String {
44+
// Example output: nomossasa build version: 4.5.1.1 r(ff4fa7)
45+
val versionRegex = Regex("""(\d+\.\d+\.\d+)(?:\.\d+)?""")
46+
return versionRegex.find(output)?.groupValues?.get(1).orEmpty() // Returns 4.5.1
47+
}
48+
49+
override fun getVersionArguments() = "-V"
50+
}
51+
52+
/**
53+
* A wrapper for [Nomossa](https://github.com/fossology/fossology).
54+
*
55+
* This plugin integrates FOSSology's Nomossa scanner into ORT by calling its CLI
56+
* and mapping its output to ORT's scan result format.
57+
*/
58+
@OrtPlugin(
59+
displayName = "Nomossa",
60+
description = "A wrapper for [Nomossa](https://github.com/fossology/fossology).",
61+
factory = ScannerWrapperFactory::class
62+
)
63+
class Nomossa(
64+
override val descriptor: PluginDescriptor = NomossaFactory.descriptor,
65+
private val config: NomossaConfig
66+
) : LocalPathScannerWrapper() {
67+
68+
private val commandLineOptions by lazy { getCommandLineOptions() }
69+
70+
internal fun getCommandLineOptions(): List<String> {
71+
val options = LinkedHashSet(config.additionalOptions)
72+
options.add("-J")
73+
options.add("-l")
74+
options.add("-n")
75+
options.add(config.cpuCount.toString())
76+
return options.toList()
77+
}
78+
79+
override val configuration by lazy {
80+
config.additionalOptions.joinToString(" ")
81+
}
82+
83+
override val matcher by lazy { ScannerMatcher.create(details, config) }
84+
85+
override val version by lazy {
86+
require(NomossaCommand.isInPath()) {
87+
"The '${NomossaCommand.command()}' command is not available in the PATH environment."
88+
}
89+
90+
NomossaCommand.getVersion()
91+
}
92+
93+
override val readFromStorage = config.readFromStorage
94+
override val writeToStorage = config.writeToStorage
95+
96+
override fun runScanner(path: File, context: ScanContext): String {
97+
val process = runNomossa(path)
98+
99+
val resultText = process.stdout
100+
logger.info { "Nomossa raw output:\n$resultText" }
101+
102+
return with(process) {
103+
if (isError && stdout.isNotBlank()) logger.debug { stdout }
104+
if (stderr.isNotBlank()) logger.debug { stderr }
105+
106+
stdout
107+
}
108+
}
109+
110+
override fun parseDetails(result: String): ScannerDetails {
111+
return ScannerDetails(
112+
name = descriptor.id,
113+
version = version,
114+
configuration = config.additionalOptions.joinToString(" ")
115+
)
116+
}
117+
118+
override fun createSummary(result: String, startTime: Instant, endTime: Instant): ScanSummary =
119+
parseNomossaResult(result).toScanSummary(startTime, endTime)
120+
121+
/**
122+
* Execute Nomossa with the configured arguments to scan the given [path] and produce [resultFile].
123+
*/
124+
internal fun runNomossa(path: File): ProcessCapture =
125+
ProcessCapture(
126+
NomossaCommand.command(),
127+
*commandLineOptions.toTypedArray(),
128+
"-d", path.absolutePath // Scan this directory
129+
)
130+
}

‎plugins/scanners/nomos/src/main/kotlin/NomossaConfig.kt‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
/*
2+
* Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
* SPDX-License-Identifier: Apache-2.0
17+
* License-Filename: LICENSE
18+
*/
19+
20+
package org.ossreviewtoolkit.plugins.scanners.nomos
21+
22+
import org.ossreviewtoolkit.plugins.api.OrtPluginOption
23+
import org.ossreviewtoolkit.scanner.ScannerMatcherCriteria
24+
25+
/**
26+
* Configuration options for the Nomossa scanner.
27+
*/
28+
data class NomossaConfig(
29+
/**
30+
* Command line options that affect scan results. These are used when matching stored results.
31+
*/
32+
@OrtPluginOption(defaultValue = "-J,-l")
33+
val additionalOptions: List<String>,
34+
35+
/**
36+
* The scanner name pattern used when looking up scan results from storage.
37+
*/
38+
override val regScannerName: String?,
39+
40+
/**
41+
* The minimum version of scan results to use from storage.
42+
*/
43+
override val minVersion: String?,
44+
45+
/**
46+
* The maximum version of scan results to use from storage.
47+
*/
48+
override val maxVersion: String?,
49+
50+
/**
51+
* The configuration string for identifying matching scan results in storage.
52+
*/
53+
override val configuration: String?,
54+
55+
/**
56+
* Whether to read scan results from storage.
57+
*/
58+
@OrtPluginOption(defaultValue = "false")
59+
val readFromStorage: Boolean,
60+
61+
/**
62+
* Whether to write scan results to storage.
63+
*/
64+
@OrtPluginOption(defaultValue = "false")
65+
val writeToStorage: Boolean
66+
) : ScannerMatcherCriteria {
67+
68+
/**
69+
* Number of CPU processes Nomossa should use.
70+
*/
71+
@OrtPluginOption(defaultValue = "2")
72+
val cpuCount: Int = 2
73+
}

‎plugins/scanners/nomos/src/main/kotlin/NomossaResultExtensions.kt‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
/*
2+
* Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
* SPDX-License-Identifier: Apache-2.0
17+
* License-Filename: LICENSE
18+
*/
19+
20+
package org.ossreviewtoolkit.plugins.scanners.nomos
21+
22+
import java.time.Instant
23+
24+
import org.ossreviewtoolkit.model.LicenseFinding
25+
import org.ossreviewtoolkit.model.ScanSummary
26+
import org.ossreviewtoolkit.model.TextLocation
27+
28+
internal fun NomossaResult.toScanSummary(startTime: Instant, endTime: Instant): ScanSummary {
29+
val licenseFindings = results.flatMap { fileResult ->
30+
fileResult.licenses.map { rawLicense ->
31+
32+
val safeLicense = if (rawLicense.matches(Regex("^[A-Za-z0-9.\\-+]+$"))) {
33+
rawLicense
34+
} else {
35+
"LicenseRef-Nomossa-${rawLicense.replace(Regex("[^A-Za-z0-9.+-]"), "-")}" // License not found
36+
}
37+
38+
LicenseFinding(
39+
license = safeLicense, // use raw string
40+
location = TextLocation(
41+
path = fileResult.file,
42+
startLine = 1,
43+
endLine = 1
44+
)
45+
)
46+
}
47+
}.toSortedSet(
48+
compareBy(
49+
{ it.license.toString() },
50+
{ it.location.path },
51+
{ it.location.startLine }
52+
)
53+
)
54+
55+
return ScanSummary(
56+
startTime = startTime,
57+
endTime = endTime,
58+
licenseFindings = licenseFindings,
59+
issues = emptyList(), // no SPDX parsing issues anymore
60+
copyrightFindings = sortedSetOf()
61+
)
62+
}

‎plugins/scanners/nomos/src/main/kotlin/NomossaResultParser.kt‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
/*
2+
* Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*
16+
* SPDX-License-Identifier: Apache-2.0
17+
* License-Filename: LICENSE
18+
*/
19+
20+
package org.ossreviewtoolkit.plugins.scanners.nomos
21+
22+
import kotlinx.serialization.Serializable
23+
import kotlinx.serialization.decodeFromString
24+
import kotlinx.serialization.json.Json
25+
26+
@Serializable
27+
internal data class NomossaResult(
28+
val results: List<NomossaFileResult>
29+
)
30+
31+
@Serializable
32+
internal data class NomossaFileResult(
33+
val file: String,
34+
val licenses: List<String>
35+
)
36+
37+
private val json = Json {
38+
ignoreUnknownKeys = true
39+
}
40+
41+
/**
42+
* Parses the JSON result string returned by Nomossa into a [NomossaResult] object.
43+
*/
44+
internal fun parseNomossaResult(result: String): NomossaResult = json.decodeFromString(result)

0 commit comments

Comments
 (0)