Sonar Dependency Check Plugin
This Plugin is deprecated - use https://github.com/porscheinformatik/sonarqube-licensecheck instead
This Sonar plugin ensures that projects in an organization adhere to a set of standard libraries and versions. This enables the governance of the used libraries and licences.
This software is licensed under the Apache Software License, Version 2.0, http://www.apache.org/licenses/LICENSE-2.0.txt
SonarQube >= 4.4 and < 5.0
During the project analysis all dependencies are checked against the defined list of allowed libraries. If a project uses an unlisted dependency, a violation with level “Blocker” will be added. If a project uses a listed dependency out of version range, a violation with level “Critical” will be added.
The plugin contains a page with all libraries (in form library:version), the licenses used and the status of this dependency. The view also displays a list of all used licences.
Example:
| Lib | Version | Status |
|---|---|---|
| org.springframework:spring-core:3.2.1.RELEASE | Apache 2.0 | OK |
| org.springframework:spring-beans:3.2.1.RELEASE | Apache 2.0 | OK |
| commons-logging:commons-logging:1.1.1 | Apache 2.0 | Wrong version |
| net.sf.jopt-simple:jopt-simple:3.0 | MIT | Unlisted |
Licenses:
| License | Description | URL |
|---|---|---|
| Apache 2.0 | The Apache Software License, Version 2.0 | http://www.apache.org/licenses/LICENSE-2.0.txt |
| MIT | The MIT License | http://www.opensource.org/licenses/mit-license.php |
A list of licenses can be configured via Settings > Configuration.
| License | Description | URL |
|---|---|---|
| Apache 2.0 | The Apache Software License, Version 2.0 | http://www.apache.org/licenses/LICENSE-2.0.txt |
| MIT | The MIT License | http://www.opensource.org/licenses/mit-license.php |
| LGPL 2.1 | GNU Lesser General Public License (LGPL), Version 2.1 | http://www.fsf.org/licensing/licenses/lgpl.txt |
The list of allowed dependencies with a given version range can be configured via Settings > Configuration.
Here is an example:
| Lib | Allowed Versions | License |
|---|---|---|
| org.springframework:spring-core | [3.0,4.0) | Apache 2.0 |
| commons-logging:commons-logging | 1.1.3 | Apache 2.0 |
The version ranges have to be specified in Maven syntax (see http://maven.apache.org/enforcer/enforcer-rules/versionRanges.html).
This list can be configured in general settings and can be customizable on a per-project basis (if only one project uses a certain library).