LicenseFinder dependency on bundler creates unexpected diffs

[pivotal]

LicenseFinder dependency on bundler creates unexpected diffs

[chulkilee]

It uses bundler as library - see lib/license_finder/package_managers/bundler.rb

[mainej]

@pivotalfish - one option is to add bundler to the "ignore_dependencies" config. But, to extend your point, arguably license_finder itself is a tool, not a dependency, so you shouldn't put it in your Gemfile. Issue #104 suggests updating license_finder's documentation to reflect this point.

@chulkilee - good point. Theoretically it would be possible to re-write LicenseFinder to use bundler as a command line tool (like lib/license_finder/package_managers/bower.rb) or to shell out to Ruby (like lib/license_finder/package_managers/pip.rb). Not much fun though - bundler doesn't seem to output JSON so you might have to parse Gemfile.lock.

[mainej]

@pivotalfish take a look at #126, a PR which would fix this problem. The changes that would affect you are:

1. LF wouldn't store bundler's version anywhere, so that wouldn't create diffs in the doc/dependencies.db file. In fact, that file wouldn't exist any more.
2. Running license_finder wouldn't change any files, so it wouldn't create diffs in the other doc/dependencies* files.

You would get diffs if you ran license_finder report > some_report_file.csv before every commit. But you could be more nuanced about the approach by, for example, only saving the report if license_finder says there are unapproved dependencies or if your version control suggests there are new dependencies.

What do you think? Feedback welcome.

[mainej]

Closing this with the release of 2.0. Fixing this kind of problem was a major motivation for the 2.0 work, so thanks for contributing to this discussion.