Add support for Swift package manager

CHANGELOG.rst

@@ -34,6 +34,15 @@ v33.0.0 (next next, roadmap)
   of these in other summary plugins.
   See https://github.com/nexB/scancode-toolkit/issues/1745
 
+- We now support parsing the Swift manifest JSON dump and the ``Package.resolved`` file https://github.com/nexB/scancode-toolkit/issues/2657.
+- Run the commands below on your local Swift project before running the scan.
+  - ::
+
+      swift package dump-package > Package.swift.json
+  - ::
+
+      swift package resolve
+
 v32.1.0 (next, roadmap)
 ----------------------------
 

docs/source/reference/available_package_parsers.rst

@@ -233,6 +233,7 @@ parsers in scancode-toolkit during documentation builds.
      - https://r-pkgs.org/description.html
    * - Debian control file - extracted layout
      - ``*/control.tar.gz-extract/control``
+       ``*/control.tar.xz-extract/control``
      - ``deb``
      - ``debian_control_extracted_deb``
      - None
@@ -716,6 +717,19 @@ parsers in scancode-toolkit during documentation builds.
      - ``rpm_installed_database_sqlite``
      - None
      - https://fedoraproject.org/wiki/Changes/Sqlite_Rpmdb
+   * - RPM mariner distroless package manifest
+     - ``*var/lib/rpmmanifest/container-manifest-2``
+     - ``rpm``
+     - ``rpm_mariner_manifest``
+     - None
+     - https://github.com/microsoft/marinara/
+   * - RPM mariner distroless package license files
+     - ``*usr/share/licenses/*/COPYING*``
+       ``*usr/share/licenses/*/LICENSE*``
+     - ``rpm``
+     - ``rpm_package_licenses``
+     - None
+     - https://github.com/microsoft/marinara/
    * - RPM specfile
      - ``*.spec``
      - ``rpm``
@@ -734,6 +748,18 @@ parsers in scancode-toolkit during documentation builds.
      - ``squashfs_disk_image``
      - None
      - https://en.wikipedia.org/wiki/SquashFS
+   * - json dump of swift manifest
+     - ``*/Package.swift.json``
+     - ``swift``
+     - ``swift_package_manifest_json``
+     - swift
+     - https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html
+   * - resolved dependency for swift package
+     - ``*/Package.resolved``
+     - ``swift``
+     - ``swift_package_resolved``
+     - swift
+     - https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html#package-dependency
    * - Java Web Application Archive
      - ``*.war``
      - ``war``

src/packagedcode/__init__.py

@@ -39,6 +39,7 @@
 from packagedcode import readme
 from packagedcode import rpm
 from packagedcode import rubygems
+from packagedcode import swift
 from packagedcode import win_pe
 from packagedcode import windows
 
@@ -196,6 +197,9 @@
     rubygems.GemspecInExtractedGemHandler,
     rubygems.GemspecHandler,
 
+    swift.SwiftManifestJsonHandler,
+    swift.SwiftPackageResolvedHandler,
+
     windows.MicrosoftUpdateManifestHandler,
 
     win_pe.WindowsExecutableHandler,

src/packagedcode/swift.py

@@ -0,0 +1,283 @@
+# Copyright (c) nexB Inc. and others. All rights reserved.
+# ScanCode is a trademark of nexB Inc.
+# SPDX-License-Identifier: Apache-2.0
+# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
+# See https://github.com/nexB/scancode-toolkit for support or download.
+# See https://aboutcode.org for more information about nexB OSS projects.
+#
+
+import io
+import json
+import logging
+import os
+from urllib import parse
+
+from packagedcode import models
+from packageurl import PackageURL
+
+"""
+Handle the resolved file and JSON dump of the manifest for Swift packages.
+https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html
+
+Run the commands below before running the scan:
+``swift package dump-package > Package.swift.json``
+``swift package resolve``
+"""
+
+
+SCANCODE_DEBUG_PACKAGE = os.environ.get("SCANCODE_DEBUG_PACKAGE", False)
+
+TRACE = SCANCODE_DEBUG_PACKAGE
+
+
+def logger_debug(*args):
+    pass
+
+
+logger = logging.getLogger(__name__)
+
+if TRACE:
+    import sys
+
+    logging.basicConfig(stream=sys.stdout)
+    logger.setLevel(logging.DEBUG)
+
+    def logger_debug(*args):
+        return logger.debug(" ".join(isinstance(a, str) and a or repr(a) for a in args))
+
+
+class SwiftManifestJsonHandler(models.DatafileHandler):
+    datasource_id = "swift_package_manifest_json"
+    path_patterns = ("*/Package.swift.json",)
+    default_package_type = "swift"
+    default_primary_language = "swift"
+    description = "json dump of swift manifest"
+    documentation_url = "https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html"
+
+    @classmethod
+    def _parse(cls, swift_manifest, package_only=False):
+
+        if TRACE:
+            logger_debug(
+                f"SwiftManifestJsonHandler: manifest: package: {swift_manifest}"
+            )
+
+        dependencies = get_dependencies(swift_manifest.get("dependencies"))
+
+        package_data = dict(
+            datasource_id=cls.datasource_id,
+            type=cls.default_package_type,
+            primary_language=cls.default_primary_language,
+            namespace=None,
+            name=swift_manifest.get("name"),
+            dependencies=dependencies,
+        )
+
+        return models.PackageData.from_data(package_data, package_only)
+
+    @classmethod
+    def parse(cls, location, package_only=False):
+        with io.open(location, encoding="utf-8") as loc:
+            swift_manifest = json.load(loc)
+
+        yield cls._parse(swift_manifest, package_only)
+
+    @classmethod
+    def assemble(
+        cls,
+        package_data,
+        resource,
+        codebase,
+        package_adder=models.add_to_package,
+    ):
+        """
+        Use the dependencies from `Package.resolved` to create the
+        top-level package with resolved dependencies.
+        """
+        siblings = resource.siblings(codebase)
+        swift_resolved_package_resource = [
+            r for r in siblings if r.name == "Package.resolved"
+        ]
+        dependencies_from_manifest = package_data.dependencies
+
+        processed_dependencies = []
+        if swift_resolved_package_resource:
+            swift_resolved_package_resource = swift_resolved_package_resource[0]
+            swift_resolved_package_data = swift_resolved_package_resource.package_data
+
+            for package in swift_resolved_package_data:
+                version = package.get("version")
+                name = package.get("name")
+
+                purl = PackageURL(
+                    type=cls.default_package_type, name=name, version=version
+                )
+                processed_dependencies.append(
+                    models.DependentPackage(
+                        purl=purl.to_string(),
+                        scope="install",
+                        is_runtime=True,
+                        is_optional=False,
+                        is_resolved=True,
+                        extracted_requirement=version,
+                    )
+                )
+
+                for dependency in dependencies_from_manifest[:]:
+                    dependency_purl = PackageURL.from_string(dependency.purl)
+
+                    if dependency_purl.name == name:
+                        dependencies_from_manifest.remove(dependency)
+
+        processed_dependencies.extend(dependencies_from_manifest)
+
+        datafile_path = resource.path
+        if package_data.purl:
+            package = models.Package.from_package_data(
+                package_data=package_data,
+                datafile_path=datafile_path,
+            )
+
+            if swift_resolved_package_resource:
+                package.datafile_paths.append(swift_resolved_package_resource.path)
+                package.datasource_ids.append(SwiftPackageResolvedHandler.datasource_id)
+
+            package.populate_license_fields()
+            yield package
+
+            parent = resource.parent(codebase)
+            cls.assign_package_to_resources(
+                package=package,
+                resource=parent,
+                codebase=codebase,
+                package_adder=package_adder,
+            )
+
+        if processed_dependencies:
+            yield from models.Dependency.from_dependent_packages(
+                dependent_packages=processed_dependencies,
+                datafile_path=datafile_path,
+                datasource_id=package_data.datasource_id,
+                package_uid=package.package_uid,
+            )
+        yield resource
+
+
+class SwiftPackageResolvedHandler(models.DatafileHandler):
+    datasource_id = "swift_package_resolved"
+    path_patterns = ("*/Package.resolved",)
+    default_package_type = "swift"
+    default_primary_language = "swift"
+    description = "resolved dependency for swift package"
+    documentation_url = (
+        "https://docs.swift.org/package-manager/PackageDescription/"
+        "PackageDescription.html#package-dependency"
+    )
+
+    @classmethod
+    def parse(cls, location, package_only=False):
+        with io.open(location, encoding="utf-8") as loc:
+            package_resolved = json.load(loc)
+
+        pinned = package_resolved.get("pins", [])
+
+        for dependency in pinned:
+            name = dependency.get("identity")
+            kind = dependency.get("kind")
+            location = dependency.get("location")
+            state = dependency.get("state", {})
+            version = None
+
+            if location and kind == "remoteSourceControl":
+                name = get_canonical_name(location)
+
+            version = state.get("version")
+
+            if not version:
+                version = state.get("revision")
+
+            package_data = dict(
+                datasource_id=cls.datasource_id,
+                type=cls.default_package_type,
+                primary_language=cls.default_primary_language,
+                namespace=None,
+                name=name,
+                version=version,
+            )
+            yield models.PackageData.from_data(package_data, package_only)
+
+    @classmethod
+    def assemble(
+        cls, package_data, resource, codebase, package_adder=models.add_to_package
+    ):
+        siblings = resource.siblings(codebase)
+        swift_manifest_resource = [
+            r for r in siblings if r.name == "Package.swift.json"
+        ]
+
+        # Skip the assembly if the ``Package.swift.json`` manifest is present.
+        # SwiftManifestJsonHandler's assembly will take care of the resolved
+        # dependencies from Package.resolved file.
+        if swift_manifest_resource:
+            return []
+
+        yield from super(SwiftPackageResolvedHandler, cls).assemble(
+            package_data=package_data,
+            resource=resource,
+            codebase=codebase,
+            package_adder=package_adder,
+        )
+
+
+def get_dependencies(dependencies):
+    dependent_packages = []
+    for dependency in dependencies or []:
+        source = dependency.get("sourceControl")
+        if not source:
+            continue
+
+        source = source[0]
+        name = source.get("identity")
+        version = None
+        is_resolved = False
+
+        location = source.get("location")
+        if remote := location.get("remote"):
+            name = get_canonical_name(remote[0].get("urlString"))
+
+        requirement = source.get("requirement")
+        if exact := requirement.get("exact"):
+            version = exact[0]
+            is_resolved = True
+        elif range := requirement.get("range"):
+            bound = range[0]
+            lower_bound = bound.get("lowerBound")
+            upper_bound = bound.get("upperBound")
+            version = f"vers:swift/>={lower_bound}|<{upper_bound}"
+
+        purl = PackageURL(
+            type="swift",
+            name=name,
+            version=version if is_resolved else None,
+        )
+
+        dependent_packages.append(
+            models.DependentPackage(
+                purl=purl.to_string(),
+                scope="install",
+                is_runtime=True,
+                is_optional=False,
+                is_resolved=is_resolved,
+                extracted_requirement=version,
+            )
+        )
+    return dependent_packages
+
+
+def get_canonical_name(url):
+    parsed_url = parse.urlparse(url)
+    hostname = parsed_url.hostname
+    path = parsed_url.path.removesuffix(".git")
+
+    return parse.quote(hostname + path, safe="")
+

tests/packagedcode/data/plugin/help.txt

@@ -804,6 +804,20 @@ Package type:  squashfs
   description:       Squashfs disk image
   path_patterns:    
 --------------------------------------------
+Package type:  swift
+  datasource_id:     swift_package_manifest_json
+  documentation URL: https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html
+  primary language:  swift
+  description:       json dump of swift manifest
+  path_patterns:    '*/Package.swift.json'
+--------------------------------------------
+Package type:  swift
+  datasource_id:     swift_package_resolved
+  documentation URL: https://docs.swift.org/package-manager/PackageDescription/PackageDescription.html#package-dependency
+  primary language:  swift
+  description:       resolved dependency for swift package
+  path_patterns:    '*/Package.resolved'
+--------------------------------------------
 Package type:  war
   datasource_id:     java_war_archive
   documentation URL: https://en.wikipedia.org/wiki/WAR_(file_format)