Package: leafhopper
leafhopperDo you get asked by your employer to provide a list of open source libraries that you use in the project for legal review?leafhopperis a command line tool used for generating a table of dependencies for a project, including their licenses, so that you don't have to manually maintain such a list for every release of your project.How it worksThe tool parses the project descriptor, based on different project types (poetry/maven/vcpkgare supported currently), and generates a table of dependencies. When some critical information, such as license, is not available in the project descriptor,leafhopperwill test if this is a github/sourceforge project and try loading relevant information fromgithub.com/sourceforge.net.Featuresparse multiple different project types to generate a table of dependencies from themload license information from github/sourceforgesupport overriding the list of dependencies from the project descriptor when you cannot get correct information from the project descriptorsupport customizing the output columnsmultiple outout formatsgenerate a combined license file from all the licenses of the dependenciesgithub token can be provided in environment variable to avoid github API rate limitingInstallationpip install leafhopperUsageleafhopper /path/to/project/descriptorarguments--format: the format of the output. Possible values aremarkdown/html/json/latex/csv. Default ismarkdown.--output: the output file path. If not specified, the output will be printed to stdout.--columns: the output table header columns. It is a comma separated string. Default value isname,version,homepage,license,description. You can change the order of columns or add empty columns by changing the value. For example,name,license,homepage,componentadd a new empty column calledcomponentand reorder the columns as well.--logging-level: the logging level. Possible values aredebug/info/warning/error/critical. Default isinfo.Set the logging level to aboveinfo(e.g.error) to supress non critical messages so that only table is printed to stdout (if no output file is specified).Set the logging level todebugto enable debug messages.--extra: the file path to a JSON file path containing extra package information to override the information parsed from project descriptors. Theoverridesproperty in JSON file is an array of objects with the following properties (here is anexample):nameversion, optionallicense, optionalhomepage, optionaldescription, optionaldisclosed_source, optional, a url to the discolosed source for some license requirement such as MPL--combine: whether to generate a combined license file. Usetrue/falseto toggle it. Default is false.--help: show the help messageexamplesextractpyproject.tomldependencies with markdown format and save it intodependencies.mdfileleafhopper /path/to/pyproject.toml --output=dependencies.mdextractpom.xmldependencies with html formatleaphopper /path/to/pom.xml --format=htmlsuppress logging and output to stdout and use CLI toolglowto display itleafhopper /path/to/vcpkg.json --format md --logging-level error | glow -use custom columns to change the column order and add an empty column calledcomponent, which you can fill later onleaphopper /path/to/pom.xml --columns name,component,version,license,homepage,descriptionuse an extra JSON file to override the information parsed from project descriptorsleaphopper /path/to/pom.xml --extra=tests/data/extra.jsongenerate a combined license file so that you can put it as part of your projectleaphopper /path/to/pom.xml --combine=trueIt will generate a file calledLICENSES.txtwith all the licenses information of the dependencies.[advanced] when providing both--extraand--columns, you can get any information from the extra JSON file to be shown in the output table. For example, if you would like to add adisclosed_sourcecolumn, you can specify this property in theextra.jsonfile and specify thedisclosed_sourcecolumn in the--columnsargument.leaphopper /path/to/vcpkg.json --extra=/extra/with/disclosed/sources/extra.json --columns name,version,homepage,license,description,disclosed_sourceSupported formatsmarkdownLaTexhtmljsoncsvsample outputmarkdown format output# Package Dependencies|      name       |version|           homepage            | license  |                               description                               |
|-----------------|-------|-------------------------------|----------|-------------------------------------------------------------------------|
|simdjson         |2.2.0  |https://simdjson.org/          |Apache-2.0|A extremely fast JSON library that can parse gigabytes of JSON per second|
|pcre             |   8.45|https://www.pcre.org/          |          |Perl Compatible Regular Expressions                                      |
|pugixml          |1.12.1 |https://github.com/zeux/pugixml|MIT       |Light-weight, simple and fast XML parser for C++ with XPath support      |
|arrow            |8.0.0  |https://arrow.apache.org       |Apache-2.0|Cross-language development platform for in-memory analytics              |Supported project typespoetry project described bypyproject.tomlhttps://python-poetry.org/docs/pyproject/maven project described bypom.xmlhttps://maven.apache.org/pom.htmlpom.xmlwith or without Maven XML namespace are supported.vcpkg project described byvcpkg.jsonhttps://vcpkg.readthedocs.io/en/latest/specifications/manifests/more project types such as npm will be supported in the futureGithub API rating limitIf you have a really large project, you may encounter github API rate limiting. You can provide a github personal token in the environment variables to avoid this:LEAFHOPPER_GITHUB_USERNAMELEAFHOPPER_GITHUB_PASSWORDYou can export these variables to your shell environment like this:export LEAFHOPPER_GITHUB_USERNAME={your_github_user_name}
export LEAFHOPPER_GITHUB_PASSWORD={your_personal_token} # something like `ghp_pciFGDQlXAqDGNBXHsUbHHHZly7cf71ZKEVg`To create a Github personal token, follow the instructionshereUnless you need to access some private project information in Github, you can keep the personal token's permission minimal in Github since it only needs to be authencated against Github so that you can use higher the rate limit (see more detailshere).ChangelogChangelogKnown issuesSome open source libraries, doesn't have the license information available in the project descriptor (or ingithub.com/sourceforge.net), and the cell will be blank and you have to manually fill it.TODOSupport more project types, such asnpm'spackage.jsonandpip'srequirements.txt