main.py

#!/usr/bin/env python3
import os
import sys
import json
import re

cwd = os.path.dirname(os.path.realpath(__file__))
packages = set()
config: dict = dict()

header = """
THIRD PARTY NODEJS DEPENDENCIES LICENSES

This file was automatically generated by node-list-licenses. It contains all the
licensing information for all dependencies of the project, excluding
devDependencies, except for ones explicitly excluded through configuration. All
project-level files containing the words "license", "licence", "copying" and
"notice" are included in this file. As certain dependencies may be
development-time only, or may have been unused, there may be extraneous licenses
in this document.

INCLUSION OF A PACKAGE NAME IN THIS FILE DOES NOT NECESSARILY INDICATE THAT THE
COMPILED OUTPUT OF THE PACKAGE IS PART OF THE WEBSITE/PROJECT. NO PART OF THIS
FILE IS INTENDED TO SUGGEST ENDORSEMENT BY THE AUTHOR OF ANY OF THE NPM
PACKAGES.
"""

def is_package_excluded(package, parent):
    if "exclude" in config.keys():
        for r in config["exclude"]:
            if re.match("^" + r + "$", package[0]) != None:
                return True
    return False

def read_package_details(folder):
    with open(os.path.join(folder, "package.json")) as f:
        j = json.load(f)
        name = j['name']
        version = j['version']
        spdx = j.get('license', 'Not specified')
    
    if (name, version) not in packages:
        print("Package %s@%s has been ignored." % (name, version), file=sys.stderr)
        return ("", "", "", "")
    
    packages.remove((name, version))

    licenseTexts = []

    # check for LICENSE, NOTICE, COPYING
    for fileName in os.listdir(folder):
        if (("licence" in fileName.lower() or "license" in fileName.lower() or "notice" in fileName.lower() or "copying" in fileName.lower())
            and os.path.isfile(os.path.join(folder, fileName))):
            with open(os.path.join(folder, fileName)) as f:
                licenseTexts.append((fileName, f.read()))
    return (name, version, spdx, licenseTexts)

def get_package_list(tree, parent=("", "")):
    """
    Get list of packages recursively, ignoring packages that are specified for exclusion in config file
    """
    if "dependencies" in tree.keys():
        for packageName in tree["dependencies"]:
            package = tree["dependencies"][packageName]
            if "version" in package.keys():
                version = package["version"]
                if is_package_excluded((packageName, version), parent):
                    print("Package %s@%s, a dependency of %s@%s, has been excluded by config file" % (packageName, version, parent[0], parent[1]), file=sys.stderr)
                else:
                    packages.add((packageName, version))
                    get_package_list(package, (packageName, version))
            else:
                print("Warning: ignoring package %s - no version found, probably missing dependency" % packageName, file=sys.stderr)


if len(sys.argv) == 1:
    print("Usage: python3 main.py <node-folder> [<config>]", file=sys.stderr)
else:
    root_folder = sys.argv[1]
    if len(sys.argv) >= 3:
        configPath = sys.argv[2]
    else:
        configPath = os.path.join(cwd, "default.json")
    
    with open(configPath) as f:
        config = json.load(f)
    
    os.chdir(root_folder)
    os.system("npm list --json --prod > \"%s\"" % os.path.join(cwd, "tree.json"))
    os.system("npm list --parseable --prod > \"%s\"" % os.path.join(cwd, "paths.txt"))

    with open(os.path.join(cwd, "tree.json")) as f:
        j = json.load(f)
        get_package_list(j)

    with open(os.path.join(cwd, "paths.txt")) as f:
        folders = f.readlines()

    output = ""

    no_license = []

    for folder in folders:
        (name, version, spdx, licenseTexts) = read_package_details(folder.strip())
        if name == "":
            continue
        if len(licenseTexts) == 0:
            # try finding the license file in the custom directory
            if name.replace("/", "_")+"@"+version in os.listdir(os.path.join(cwd, "licenses")):
                print("Note: license for package %s@%s was manually specified" % (name, version), file=sys.stderr)
                with open(os.path.join(cwd, "licenses", name.replace("/", "_")+"@"+version)) as f2:
                    licenseTexts.append(("", f2.read()))
            else:
                no_license.append((name, version))
        output += "Package name: " + name + "\n"
        output += "Package version: " + version + "\n"
        if type(spdx) != type(""):
            print("Warning: package %s@%s contains deprecated license format: " % (name, version) + str(spdx), file=sys.stderr)
            output += "License field in package.json: " + json.dumps(spdx) + "\n"
        else:
            output += "SPDX identifier in package.json: " + str(spdx) + "\n"

        output += "-" * 80 + "\n"
        for (fileName, text) in licenseTexts:
            if fileName == "":
                output += "License from project files:"
            else:
                output += "Content of file %s:" % fileName + "\n"
            output += text + "\n"
            output += "-" * 80 + "\n"
        
        output += "\n" + "=" * 100 + "\n\n"

    for (name, version) in no_license:
        print("Warning: package %s@%s does not seem to contain a license file" % (name, version), file=sys.stderr)
    
    print(header)
    print("=" * 100 + "\n")
    print(output)