Ruby
FOSSA supports Ruby through RubyGems
.
Tool | Quick Import (app.fossa.com) | CLI (fossa-cli) |
---|---|---|
bundler | Gemfile , Gemfile.lock or *.gemspec | Gemfile , Gemfile.lock |
gem | Gemfile | Gemfile.lock |
Quick Import (app.fossa.com)
When Ruby code is imported, FOSSA will find and run any Gemfile
or *.gemspec
files and monitor dependency activity.
If a Gemfile.lock
is present, FOSSA will prefer that for dependency information.
CLI (fossa-cli)
To get started, install the latest release of fossa-cli
from our GitHub releases page:
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash
In CI/CD Scanning for Ruby, fossa analyze
will rely on the output of bundle list
to determine what was installed in your build environment. If bundle list
command cannot be executed successfully, it will parse Gemfile.lock
.
View extended documentation here.
Authentication
FOSSA supports fetching private Gems from custom or authenticated sources.
You can configure FOSSA's access to private Gem sources in your Ruby Language Settings found at Account Settings > Languages > Ruby:
Once configured, FOSSA will be able to resolve any previously unreachable Gems.
Package Data
For basic metadata, FOSSA will parse or evaluate all available metadata files for license and authorship information. This includes Gemfile
, Gemfile.lock
and *.gemspec
formats.
Since source is generally accessible, FOSSA supports full code auditing on RubyGems and will run license scans / code analysis across all files in a given Gem.
Updated 12 months ago