Skip to content

PatchFlow CLI v0.1.5

Choose a tag to compare

View all tags
@malik111110 malik111110 released this 04 Jul 14:31
v0.1.5
ca94076

What's New

LICENSE File Crawling + Text-Based License Detection

When all registry API lookups fail or return uninformative results (NOASSERTION, Other, UNKNOWN), the CLI now fetches the raw LICENSE file directly from the source repository and identifies the license using text-based detection — similar to GitHub's licensee.

How it works

  1. Fetch: Downloads the raw LICENSE file from raw.githubusercontent.com — tries multiple file names (LICENSE, LICENSE.md, LICENSE.txt, COPYING, UNLICENSE, NOTICE) and multiple branches (main, master, HEAD, develop, trunk)
  2. Normalize: Lowercases the text, strips punctuation, removes copyright lines (which contain project-specific names/dates that reduce matching accuracy)
  3. Match: Compares against 35+ known license signatures using bigram n-gram similarity (Dice's coefficient)
  4. Result: Returns the SPDX identifier if confidence >= 50%

Supported licenses (text-based detection)

MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, GPL-2.0, GPL-3.0, LGPL-2.1, LGPL-3.0, AGPL-3.0, Unlicense, BSL-1.0, CC0-1.0, Zlib, WTFPL, Python-2.0, Ruby, EPL-1.0, EPL-2.0, CDDL-1.0, Artistic-2.0, PostgreSQL, OpenSSL, Vim, PHP-3.01, BUSL-1.1, SSPL-1.0, EUPL-1.2, AFL-3.0, CC-BY-4.0, CC-BY-SA-4.0, Beerware, 0BSD, BlueOak-1.0.0

Additional fallbacks

  • PyPI repository URL extraction: When PyPI has no license, extracts GitHub repo URL from project_urls (Homepage, Source, Repository)
  • RubyGems repository URL extraction: When RubyGems has no license, extracts GitHub repo URL from source_code_uri, homepage_uri, repository_uri
  • GitHub API + LICENSE crawl: When the GitHub API returns NOASSERTION, falls back to fetching the raw LICENSE file

Benchmark Results

Metric Original v0.1.4 v0.1.5 Total Improvement
Coverage 78.2% 89.6% 95.6% +17.4pp
Unknown licenses 733 353 156 78.7% reduction
License findings 736 363 184 75.0% reduction

v0.1.4 -> v0.1.5 alone: unknowns reduced by 55.8% (353 -> 156)

Per-project highlights (v0.1.4 -> v0.1.5)

Project v0.1.4 Unknown v0.1.5 Unknown Resolved
log4j-old (Java) 264 95 169 via LICENSE crawling
lodash (JS) 52 34 18 via LICENSE crawling
rails-v5.2.1 (Ruby) 24 14 10 via RubyGems repo URL + LICENSE crawling

Installation

# Homebrew
brew install patchflow-security/tap/patchflow

# Scoop (Windows)
scoop install patchflow

# Direct download
curl -fsSL https://raw.githubusercontent.com/Patchflow-security/patchflow-cli/main/scripts/install.sh | bash

Verify

patchflow version --json

Full Changelog: v0.1.4...v0.1.5

Assets 20
Loading