FOSSLight Dependency Scanner

• Gradle (Java/Android)
• Maven (Java)
• NPM (Node.js)
• PyPi (Python)
• Pub (Dart with flutter)
• Cocoapods (Swift/Obj-C)
• Swift (Swift)
• Carthage (Carthage)
• Go (Go)
• Nuget (.NET)
• Helm (Kubernetes)
• Unity (Unity)
• Cargo (Rust)

1. Install the NPM License Checker to analyze the npm dependencies.

   $ npm install -g license-checker
   

   To install license-checker globally, ‘-g' option is required. If you do not have ‘sudo' access, then you can change default path to install global modules.

   $ npm set prefix ~/.npm
   $ PATH=~/.npm/bin:$PATH
   

2. Run the command to install the dependencies. (optional)

   $ npm install
   

   It can be skipped if the project meets any of the following cases.

   • If the ‘package.json' file exists in the input directory, it will be executed automatically by FOSSLight Dependency Scanner. So you can skip it.
   • If the ‘node_modules' directory already exists, you can run FOSSLight Dependency Scanner by setting the input directory to the path where node_modules is located.

1. Add the License Gradle Plugin in build.gradle file.

   plugins {
    id 'com.github.hierynomus.license' version '0.16.1' // If the gradle version is 6.x or lower, then add the '0.15.0' version instead of '0.16.1'.
   }
   downloadLicenses {
    includeProjectDependencies = true
    dependencyConfiguration = 'runtimeClasspath' // If the gradle version is 4.6 or lower, then add the 'runtime' instead of 'runtimeClasspath'.
   }
   

2. Run the ‘downloadLicenses' task.

   $ gradlew downloadLicenses
   

1. Add the android-dependency-scanning Plugin in build.gradle file.

   buildscript {
    repositories {
        mavenCentral()
    }
    dependencies {
        classpath 'org.fosslight:android-dependency-scanning:1.0.0'
    }
   }
   

2. Add the below line in build.gradle file in the app(your application name, default : app) directory. It must be added to the subline of the plugins block (or apply plugin:'com.android.application') to prevent an error from occurring.

   apply plugin: 'org.fosslight'
   

3. Run the ‘generateLicenseTxt' task.

   $ gradlew generateLicenseTxt
   

1. Install python3-venv.

   $ sudo apt-get install python3-venv
   

2. Create and activate the virtual environment

   // virtualenv example
   $ virtualenv -p /usr/bin/python3.7 venv
   $ source venv/bin/activate
   // conda example
   $ conda create --name {venv name}
   $ conda activate {venv name}
   

3. Install the packages that you use in the virtual environment.
4. You can add activate, deactivate command with ‘-a', ‘-d' option to run FOSSLight Dependency Scanner.

1. Add the license-maven-plugin into pom.xml file.

<project>
  ...
  <build>
  ...
    <plugins>
    ...
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>license-maven-plugin</artifactId>
        <version>2.0.0</version>
        <executions>
          <execution>
            <id>aggregate-download-licenses</id>
            <goals>
              <goal>aggregate-download-licenses</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
    ...
  </build>
  ...
</project>

2. Run the license-maven-plugin task.

$ mvnw license:aggregate-download-licenses

If the ‘flutter pub' command is not available in the environment where FOSSLight Dependency Scanner is running, please perform the following steps in advance in the environment where ‘flutter pub' is available.

1. Run flutter_oss_licenses with below command. (optional)

   $ flutter pub add dev:flutter_oss_licenses:'^2.0.1'
   $ flutter pub get
   $ flutter pub deps --json > tmp_deps.json
   $ flutter pub deps --no-dev -s compact > tmp_no_dev_deps.txt
   $ flutter pub run flutter_oss_licenses:generate.dart -o tmp_flutter_oss_licenses.json --json
   

2. Run FOSSLight Dependency Scanner in the path where the file generated in the result of step 1 exists.

1. Install the pod package through Podfile.

   $ pod install
   

1. Create a github personal access token and use it with ‘-t' option when running the FOSSLight dependency scanner. It needs the Github API to get the license information of the github repository.
   Please refer the github docs guide to create a token.

1. Create ‘Cartfile.resolved' by running the package installation command.

   $ carthage update
   

2. Create a github personal access token and use it with ‘-t' option when running the FOSSLight dependency scanner. It needs the Github API to get the license information of the github repository.
   Please refer the github docs guide to create a token.