Add support for luarocks spec

[shusriva]

Hello Scancode Team,

I wanted to generate SBOM for my kong source code using scancode tool.
But the output generated from the tool contains very few component (may be just 2 or 3). while the jsonpp output contains so many entries(it also scans all the lua file).

URL of the source code: https://github.com/Kong/kong/tree/3.3.0
Command which I used to scan the souce code and generate sbom:

scancode -n 12 -ip kong/ --json-pp kong-3.3.0.json --cyclonedx kong-3.3.0_cdxSBOM.json --classify --summary --consolidate  --full-root --mark-source

For the reference, I am attaching the SBOM as well as the jsonpp output.

kong-3.3.0.txt
kong-3.3.0_cdxSBOM.txt

Can you please have a look on this issue.

[pombredanne]

Note: we need to add support for Lua rock specs https://luarocks.org/ including specfiles as https://github.com/Kong/kong/blob/master/kong-3.5.0-0.rockspec See also #3249 (comment)

[pombredanne]

The balance between too many file details vs. just the packages is not trivial to achieve.
based on the JSON output what would you like to see in the CycloneDX output?

[shusriva]

The balance between too many file details vs. just the packages is not trivial to achieve. based on the JSON output what would you like to see in the CycloneDX output?

Our objective is to get the lua components entries and its transit dependencies in cycloneDX output

[SLASH217]

I've been studying the ScanCode codebase and reproduced the issue using Kong:

scancode -n 12 -ip kong/ --json-pp kong-3.3.0.json --cyclonedx kong-3.3.0_cdxSBOM.json

Confirmed: CycloneDX output has no Lua components, even though Kong has .rockspec files.

What I found: There's no handler in src/packagedcode/ for parsing .rockspec files.
I reviewed the rockspec format spec and studied npm.py and cargo.py to understand the pattern.

My plan: Create a LuarocksSpecHandler following the same pattern, with unit tests.

Question before I start: For parsing Lua table syntax, which would you prefer?

1. luadata library - handles all Lua syntax, adds one dependency
2. Custom regex - no new dependencies, handles common cases

With your guidance, I'd like to work on this as a GSOC 2026 project, and I'm ready to implement whichever approach you recommend!

[pombredanne]

@SLASH217 luadata looks fine, but unmaintained, so best is to fork and rename it to luadata2

[pombredanne]

@SLASH217 see also @boolangery https://github.com/boolangery/py-lua-parser/ that uses an Antlr grammar and sounds like a saner base to me than a handrolled state machine in luadata

[SLASH217]

I have tested https://github.com/boolangery/py-lua-parser/ and it works well for parsing rockspec files. I'm implementing the handler now and will follow up with a pull request soon.

[SLASH217]

@pombredanne I've implemented Lua rockspec package handler support as requested in #3526.
This enables ScanCode to detect and parse Lua package dependencies from rockspec files.
Ready for review!