dominikb/composer-license-checker

Cache key length must be greater than zero.

Opened this issue · 2 comments

cy2-alex commented

./vendor/bin/composer-license-checker report --show-packages errors with "Cache key length must be greater than zero".

If it helps, the output until it failed was:

Looking up Apache-2.0 ...
Looking up MIT ...
Looking up  ...
dominikb commented

Thanks for reporting the bug. This is related to #28 because the raw license is currently used as a cache key. I've not gotten around to fixing/refactoring this yet.

If you can help me out, here is where the change needs to be made:

composer-license-checker/src/LicenseLookup.php

Lines 36 to 49 in 02bb3c4

public function lookUp(string $licenseName): License
{
return $this->cache->get($licenseName, function () use ($licenseName) {
try {
$detailsPageUrl = $this->queryForDetailPageUrl($licenseName);
$license = $this->resolveLicenseInformation($licenseName, $detailsPageUrl);
} catch (NoLookupPossibleException $exception) {
$license = new NoLookupLicenses($licenseName);
}
return $license;
});
}

Instead of $this->cache->get($licenseName, ...) we'd need a hash of some kind that conforms to the PSR-6 key definition. Maybe $this->cache->get(md5($licenseName), ...)` would be sufficient.

It'd also be nice to determine which license is causing the issue. If you can, please run ./vendor/bin/composer licenses manually and post the result.

  • 👍1
cy2-alex commented

One of our dependencies does not have a license name set. It's actually an internal one, so I'll get that resolved. For your project, I guess you just need to handle that possibility.

This is what it looks like when a dependency has no license:

  15 => Dominikb\ComposerLicenseChecker\Dependency^ {#154
    -name: "***redacted***"
    -version: "dev-develop - none"
    -licenses: array:1 [
      0 => ""
    ]
  }

This then gets pushed into the array of dependencies in \Dominikb\ComposerLicenseChecker\ReportCommand::groupDependenciesByLicense as $grouped[""] => array

The license field is optional, but recommended. https://getcomposer.org/doc/04-schema.md#license

This does feel more like we're misusing your tool, so feel free to close of course, but maybe it is also a good idea to handle this edge case as the license field is optional.

FWIW, composer itself reports the dependencies that have no license field set as "none" in the output of ./vendor/bin/composer licenses. I'm afraid I can't show the full output as it would reveal some packages that are private.

  • ❤️1