porscheinformatik / sonarqube-licensecheck

SonarQube Licensecheck Plugin
Apache License 2.0
156 stars 58 forks source link
hacktoberfest license-management open-source sonarqube

SonarQube License-Check

Sonarcloud Status

This SonarQube plugin ensures that projects use dependencies with compliant licenses. All dependencies and licenses can be viewed per projects and exported to Excel 2003 XML Format. This enables a simple governance of dependencies and licenses for the whole organization.

License

This software is licensed under the Apache Software License, Version 2.0

Table of Contents

Features

Analysis

The plugin scans for dependencies defined in your project including all transitive dependencies.

Currently, supported formats are:

Project Dashboard

The plugin contains a project dashboard showing a list of dependencies with version and a list of all used licences. Each table shows the status of the license (allowed, not allowed, not found). You can also export the data to Excel.

Project Dashboard

Compatibility

This plugin is compatible:

For all changes see CHANGELOG.md

Installation

Put the pre-built jar-file (from release downloads) in the directory $SONARQUBE_HOME/extensions/plugins and restart the server to install the plugin. Activate the rules of this plugin ("License is not allowed", "Dependency has unknown license") in your SonarQube quality profiles - otherwise the plugin is not executed.

Configuration

After booting the SonarQube Server with the License-Check Plugin be found in the tab Administration or also in the Configuration -> LicenseCheck drop down menu.

Configuration via Administration Tab

Configuration via License Menu

Administration -> Configuration(dropdown) -> License Check

alternative License Configuration1

Activation rules in Quality Profile

You have to activate the new rules in a (new) quality profile, for each supported language (Groovy, Kotlin, Java, JavaScript, TypeScript) And you have to use this profile for your project.

  1. Step 1

    activate 1

  2. Step 2

    activate 2

  3. Step 3

    activate 3

  4. Step 4

    activate 4

  5. Step 5

    activate 5

  6. Step 6

    activate 6

  7. Step 7

    activate 7

Execution

When a project is analyzed using the mvn sonar:sonar in command line the extension is started automatically.

Please make sure to have all dependencies installed before launching the SonarQube analysis. So your complete build should look something like this:

mvn -B org.jacoco:jacoco-maven-plugin:prepare-agent install org.jacoco:jacoco-maven-plugin:report
mvn -B sonar:sonar

Supported Languages

Groovy, Kotlin, Java, JavaScript, TypeScript

Supported Project Types

Maven + NPM

When using Maven and a Javascript Package Manager, define the sonar.sources property to point to the files which contain dependency information.

...
<properties>
  <sonar.sources>pom.xml,package.json</sonar.sources>
<properties>
...

Maven

Maven works if your project/module has a pom.xml on its root level (running with Maven, Gradle or SonarScanner).

NPM

NPM works if your project/module has a package.json on its root level (running with Maven, Gradle or SonarScanner).

Gradle

Gradle project should use JK1 plugin https://github.com/jk1/Gradle-License-Report

Note: Please check above link for instructions or follow as mentioned below

Step1: Update build.gradle file with following code for using JK1 plugin

import com.github.jk1.license.filter.LicenseBundleNormalizer
import com.github.jk1.license.render.JsonReportRenderer

plugins {
  id 'com.github.jk1.dependency-license-report' version '1.13'
}

licenseReport {
    allowedLicensesFile = new File("$projectDir/src/main/resources/licenses/allowed-licenses.json")
    renderers = new JsonReportRenderer('license-details.json', false)
    filters = [new LicenseBundleNormalizer()]
}

Step 2: Update build.gradle file with following code for using SonarQube plugin

plugins {
    id 'org.sonarqube' version "3.0"
}

jar {
    enabled = true
}

sonarqube {
    properties {
        property "sonar.host.url", "http://localhost:9000"
    }
}

Step 3: run following command to generate your report license-details.json in build/reports/dependency-license

> gradle generateLicenseReport

Step 4: run following command for SonarQube

> gradle sonarqube

Configuration via Sonar API

You can also use the Sonar API to configure the plugin.

Plugin Activation

Global License Settings

Project License Settings

curl -X GET -v -u USERNAME:PASSWORD "http://localhost:9000/api/settings/values?keys=licensecheck.project-license-set"

License Mapping

Dependency Mapping

NPM Transitive setting