[fixed] govendor with empty sha causes bad path

- it used incorrectly trigger common paths optimization and derive a bad
path

[finish #160677014]

lib/license_finder/package_managers/govendor.rb

@@ -40,24 +40,34 @@ def packages_from_json(json_string)
       packages = data['package']
 
       packages_by_sha = {}
+      packages_with_no_sha = []
 
       packages.each do |package|
         package_path = package['path']
         package_revision = package['revision']
-        if packages_by_sha[package_revision].nil?
+
+        if !package_is_versioned?(package)
+          packages_with_no_sha << { sha: '', path: package_path }
+        elsif packages_by_sha[package_revision].nil?
           packages_by_sha[package_revision] = [package_path]
         else
           packages_by_sha[package_revision] << package_path
         end
       end
 
-      result = []
+      result = packages_with_no_sha
       packages_by_sha.each do |sha, paths|
         common_paths = CommonPathHelper.shortest_common_paths(paths)
         common_paths.each { |cp| result << { sha: sha, path: cp } }
       end
 
       result
     end
+
+    def package_is_versioned?(package)
+      package_revision = package['revision']
+
+      !package_revision.nil? && !package_revision.empty?
+    end
   end
 end

spec/lib/license_finder/package_managers/govendor_spec.rb

@@ -49,6 +49,47 @@ module LicenseFinder
           end
         end
       end
+
+      context 'when revisions are blank' do
+        let(:content) do
+          <<~PACKAGES
+            {
+              "package": [
+                {
+                  "path": "foo/Bowery/prompt",
+                  "revision": "",
+                  "revisionTime": "2017-02-19T07:16:37Z"
+                },
+                {
+                  "path": "foo/Bowery/safefile",
+                  "revision": "",
+                  "revisionTime": "2015-10-22T12:31:44+02:00"
+                }
+              ]
+            }
+          PACKAGES
+        end
+
+        before do
+          FakeFS.activate!
+          FileUtils.mkdir_p '/app/vendor'
+          File.write('/app/vendor/vendor.json', content)
+        end
+
+        after do
+          FakeFS.deactivate!
+        end
+
+        it 'should not mistake them as having common paths' do
+          expect(subject.current_packages.length).to eq 2
+
+          expect(subject.current_packages[0].name).to eq 'foo/Bowery/prompt'
+          expect(subject.current_packages[0].version).to eq ''
+
+          expect(subject.current_packages[1].name).to eq 'foo/Bowery/safefile'
+          expect(subject.current_packages[1].version).to eq ''
+        end
+      end
     end
 
     describe '.prepare_command' do