README.md in spandx-0.11.0 vs README.md in spandx-0.12.0

- old
+ new

@@ -1,11 +1,29 @@ -# Spandx +# Spandx ![badge](https://github.com/mokhan/spandx/workflows/ci/badge.svg) A ruby API for interacting with the https://spdx.org software license catalogue. +This gem includes a command line interface to scan a software project for the +software licenses that are associated with each dependency in the project. +`spandx` leverages an offline cache of software licenses for known dependencies. +The offline cache allows spandx to perform a truly airgap friendly scan of software +projects. -![badge](https://github.com/mokhan/spandx/workflows/ci/badge.svg) +### Supported project types +Spandx can work with following language's package managers. It utilises lock files generated by package managers to find dependencies. + +| Language | Package Manager | Tested in | +| ------------ | --------------- | -------: | +| Ruby | bundler | 1.17.3 | +| Js | Npm | 6.13.4 | +| Js | Yarn | 1.19.1 | +| Python | Pypi(pipenv) | v2018.11.26 | +| C# | nuget | <> | +| Java | Maven | 3.6.3 | +| Php | Composer | 1.10.5 | + + ## Installation Add this line to your application's Gemfile: ```ruby @@ -19,9 +37,48 @@ Or install it yourself as: $ gem install spandx ## Usage + +### Command line interface + +The command line interface supports operations to build and fetch the latest offline index. +See the help for each subcommand for more information on how to use the command. + +```bash +モ spandx +Commands: + spandx help [COMMAND] # Describe available commands or one specific command + spandx scan LOCKFILE # Scan a lockfile and list dependencies/licenses + spandx version # spandx version +``` + +To scan a specific project file use the `scan` command: + +```bash +モ spandx scan dotnet/application.sln +モ spandx scan java/pom.xml +モ spandx scan python/Pipfile.lock +モ spandx scan ruby/Gemfile.lock +``` + +To activate airgap mode use the `--airgap` option: + +```bash +モ spandx scan dotnet/application.sln --airgap +モ spandx scan ruby/Gemfile.lock --airgap +``` + +Airgap mode assumes that an offline cache has been placed in `$HOME/.local/share/`. + +To fetch the latest offline cache: + +```bash +モ spandx index update +``` + +### Ruby API To fetch the latest version of the catalogue data from [SPDX](https://spdx.org/licenses/licenses.json). ```ruby catalogue = Spandx::Spdx::Catalogue.latest