Metadata-Version: 2.3
Name: purl-license-checker
Version: 0.0.2
Summary: Retrieve licenses for purl documented dependencies.
License: MIT
Keywords: security,cli,license,purl,opensource,utility
Author: jboursier
Author-email: jboursier@malwarebytes.com
Requires-Python: >=3.12,<4
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Natural Language :: English
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Utilities
Requires-Dist: bs4 (>=0.0.2,<0.0.3)
Requires-Dist: click (>=8.1.7,<9.0.0)
Requires-Dist: configparser
Requires-Dist: logging (>=0.4.9.6,<0.5.0.0)
Requires-Dist: packageurl-python (>=0.15.6,<0.16.0)
Requires-Dist: python-magic
Requires-Dist: requests
Requires-Dist: urllib3 (>=1.26.12,<3.0.0)
Project-URL: Documentation, https://github.com/Malwarebytes/purl-license-checker/wiki
Project-URL: Homepage, https://github.com/Malwarebytes/purl-license-checker
Project-URL: Repository, https://github.com/Malwarebytes/purl-license-checker
Description-Content-Type: text/markdown

# purl-license-checker

Retrieve missing licenses for `purl` documented dependencies.


[![CodeQL](https://github.com/Malwarebytes/purl-license-checker/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/Malwarebytes/purl-license-checker/actions/workflows/codeql.yml)
[![Downloads](https://static.pepy.tech/personalized-badge/purl-license-checker?period=total&units=international_system&left_color=grey&right_color=blue&left_text=Downloads)](https://pepy.tech/project/purl-license-checker)
[![Supported Versions](https://img.shields.io/pypi/pyversions/purl-license-checker.svg)](https://pypi.org/project/purl-license-checker)
[![Contributors](https://img.shields.io/github/contributors/malwarebytes/purl-license-checker.svg)](https://github.com/malwarebytes/purl-license-checker/graphs/contributors)


This cli utility takes one or more purl formatted urls from stdin and will try to find the license attached to each of them, by querying various package managers databases.

This is particularly useful to fill GitHub's Dependabot gap of missing 90% of licenses when working at scale with [ghas-cli](https://github.com/Malwarebytes/ghas-cli
) for instance.



## Installation

Builds are available in the [`Releases`](https://github.com/Malwarebytes/purl-license-checker/releases) tab and on [Pypi](https://pypi.org/project/purl-license-checker/)

* Pypi:

```bash
pip install purl-license-checker
```

* Manually:

```bash
python -m pip install /full/path/to/purl-license-checker-xxx.whl

# e.g: python3 -m pip install Downloads/purl-license-checker-0.5.0-none-any.whl
```

## Usage

`purl-license-checker -h` or see the [wiki](https://github.com/Malwarebytes/purl-license-checker/wiki).

## Development

### Build

[Install Poetry](https://python-poetry.org/docs/#installation) first, then:

```bash
make dev
```

### Bump the version number

* Bump the version number: `poetry version x.x.x`
* Update the `__version__` field in `src/cli.py` accordingly.

### Publish a new version

**Requires `syft` to be installed to generate the sbom.**

1. Bump the version number as described above
2. `make deps` to update the dependencies
3. `make release` to build the packages
4. `git commit -a -S Bump to version 1.1.2` and `git tag -s v1.1.2 -m "1.1.2"`
5. Upload `dist/*`, `checksums.sha512` and `checksums.sha512.asc` to a new release in GitHub.




# Miscellaneous

This repository is provided as-is and isn't bound to Malwarebytes' SLA.

