Dependency Check Sonar Plugin

⚠️ This Plugin is deprecated - use https://github.com/porscheinformatik/sonarqube-licensecheck instead

This Sonar plugin ensures that projects in an organization adhere to a set of standard libraries and versions. This enables the governance of the used libraries and licences.

License

This software is licensed under the Apache Software License, Version 2.0, http://www.apache.org/licenses/LICENSE-2.0.txt

Compatibility

SonarQube >= 4.4 and < 5.0

Features

Analysis

During the project analysis all dependencies are checked against the defined list of allowed libraries. If a project uses an unlisted dependency, a violation with level "Blocker" will be added. If a project uses a listed dependency out of version range, a violation with level "Critical" will be added.

Dependecy Check Page

The plugin contains a page with all libraries (in form library:version), the licenses used and the status of this dependency. The view also displays a list of all used licences.

Example:

Lib	Version	Status
org.springframework:spring-core:3.2.1.RELEASE	Apache 2.0	OK
org.springframework:spring-beans:3.2.1.RELEASE	Apache 2.0	OK
commons-logging:commons-logging:1.1.1	Apache 2.0	Wrong version
net.sf.jopt-simple:jopt-simple:3.0	MIT	Unlisted

Licenses:

License	Description	URL
Apache 2.0	The Apache Software License, Version 2.0	http://www.apache.org/licenses/LICENSE-2.0.txt
MIT	The MIT License	http://www.opensource.org/licenses/mit-license.php

Configuration

Licenses

A list of licenses can be configured via Settings > Configuration.

License	Description	URL
Apache 2.0	The Apache Software License, Version 2.0	http://www.apache.org/licenses/LICENSE-2.0.txt
MIT	The MIT License	http://www.opensource.org/licenses/mit-license.php
LGPL 2.1	GNU Lesser General Public License (LGPL), Version 2.1	http://www.fsf.org/licensing/licenses/lgpl.txt

Libraries

The list of allowed dependencies with a given version range can be configured via Settings > Configuration.

Here is an example:

Lib	Allowed Versions	License
org.springframework:spring-core	[3.0,4.0)	Apache 2.0
commons-logging:commons-logging	1.1.3	Apache 2.0

The version ranges have to be specified in Maven syntax (see http://maven.apache.org/enforcer/enforcer-rules/versionRanges.html).

This list can be configured in general settings and can be customizable on a per-project basis (if only one project uses a certain library).