Resolve version numbers in .gemspec files

[AyanSinhaMahapatra]

How To Reproduce

Tell us how to reproduce the issue.

Run docker pipeline in scancode.io on a docker image created by building from this Dockerfile:

FROM ubuntu:20.04
RUN apt-get update \
    && DEBIAN_FRONTEND=noninteractive apt-get install -y \
	build-essential libyaml-dev libreadline-dev \
        zlib1g-dev libncurses5-dev libffi-dev libgdbm6 \
        libgdbm-dev libssl-dev libxext6 libxml2-dev \
        binutils ca-cacert wget unzip
WORKDIR /tmp
RUN wget --no-check-certificate https://cache.ruby-lang.org/pub/ruby/2.7/ruby-2.7.2.zip \
    && unzip -q ruby-2.7.2.zip \
    && cd /tmp/ruby-2.7.2 \
    && bash configure && make && make install
RUN gem update --no-document --system && gem install --no-document bundle

This is essentially a bug in this function.

Sample .gemspec file for consideration, taken from extracting the dockerfile above (and extracting the layers inside)

/3eb57ed63b0d7a3361aa712aab3c84dd6fef617d0eebf11a1cc6c0930eb56124/layer/tmp/ruby-2.7.2/lib/csv/

csv.gemspec

# frozen_string_literal: true

begin
  require_relative "lib/csv/version"
rescue LoadError
  # for Ruby core repository
  require_relative "version"
end

Gem::Specification.new do |spec|
  spec.name          = "csv"
  spec.version       = CSV::VERSION
  spec.authors       = ["James Edward Gray II", "Kouhei Sutou"]
  spec.email         = [nil, "kou@cozmixng.org"]

  spec.summary       = "CSV Reading and Writing"
  spec.description   = "The CSV library provides a complete interface to CSV files and data. It offers tools to enable you to read and write to and from Strings or IO objects, as needed."
  spec.homepage      = "https://github.com/ruby/csv"
  spec.license       = "BSD-2-Clause"

  spec.files         = [
    "LICENSE.txt",
    "NEWS.md",
    "README.md",
    "lib/csv.rb",
    "lib/csv/core_ext/array.rb",
    "lib/csv/core_ext/string.rb",
    "lib/csv/delete_suffix.rb",
    "lib/csv/fields_converter.rb",
    "lib/csv/match_p.rb",
    "lib/csv/parser.rb",
    "lib/csv/row.rb",
    "lib/csv/table.rb",
    "lib/csv/version.rb",
    "lib/csv/writer.rb",
  ]
  spec.require_paths = ["lib"]
  spec.required_ruby_version = ">= 2.3.0"

  spec.add_development_dependency "bundler"
  spec.add_development_dependency "rake"
  spec.add_development_dependency "benchmark_driver"
  spec.add_development_dependency "simplecov"
end

version.rb

# frozen_string_literal: true

class CSV
  # The version of the installed library.
  VERSION = "3.1.2"
end

Here the purl is detected as pkg:gem/csv@CSV::VERSION

Some other examples like this: pkg:gem/fileutils@source_version

System configuration

For bug reports, it really helps us to know:

• What OS are you running on? (Windows/MacOS/Linux) Ubuntu20.04
• What version of scancode-toolkit was used to generate the scan file? 21.3.31
• What installation method was used to install/run scancode? via scancode.io installation