bibliothecary 8.0.0 → 8.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50ba5ddf48a3b7d1051272fef2bcef8ca7bca465b13e251fe9656ae8751f1353
-  data.tar.gz: 40b88cb18308c0d624f00eedb67d1a5a946e42d2f3e242436fa376dd54b2c55a
+  metadata.gz: 4dfafc16f9be53462f1eca5e0fa5b09dcc0a5d92531570630c087773ff87d18c
+  data.tar.gz: 3d0045a95cc5cff513474aae337e0a032543130cc7b87144adad8033138c6e17
 SHA512:
-  metadata.gz: 51675c6be455da5a996fe92f703245aac5f3a148eb65aed33bc48675e1a94677da65e3de1651d28cc511391d241e44bc774b287ff6ae2b27d7494037389f0391
-  data.tar.gz: 74ceaa45f07deaa972be3a50e5da4e91b2507be75f6a8cf7b46cd8c02319690063e4a6f52f394fafe918debba2af765efceb13e78195de8a827997a343b8128c
+  metadata.gz: f984d7445345768463af5f2cb0906bf997e56ca03842ca538b65d95764ac427ed448a062593e293eeaa33779aaa2cb9b59b18f0715de813a6f018a815a03dc3f
+  data.tar.gz: 067f0a20d820635cd697b18c43254a818284a66b98a13367146a0f9063b63bfe9316427d32bf6b88d960f6283dd56adb4ad2f874c003c7e4c151d71181f3cd37

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -39,8 +39,13 @@ module Bibliothecary
 
         attr_reader :manifests
 
-        def initialize
+        def initialize(parse_queue:)
           @manifests = {}
+
+          # Instead of recursing, we'll work through a queue of components
+          # to process, letting the different parser add components to the
+          # queue however they need to  pull them from the source document.
+          @parse_queue = parse_queue.dup
         end
 
         def <<(purl)
@@ -55,6 +60,23 @@ module Bibliothecary
           }
         end
 
+        # Iterates over each manifest entry in the parse_queue, and accepts a block which will
+        # be called on each component. The block has two jobs: 1) add more sub-components
+        # to parse (if they exist), and 2) return the components purl.
+        def parse!(&block)
+          while @parse_queue.length > 0
+            component = @parse_queue.shift
+
+            purl_text = block.call(component, @parse_queue)
+
+            next unless purl_text
+
+            purl = PackageURL.parse(purl_text)
+
+            self << purl
+          end
+        end
+
         def [](key)
           @manifests[key]&.to_a
         end
@@ -94,14 +116,12 @@ module Bibliothecary
 
         raise NoComponents unless manifest["components"]
 
-        entries = ManifestEntries.new
-
-        manifest["components"].each_with_object(entries) do |component, obj|
-          next unless component["purl"]
+        entries = ManifestEntries.new(parse_queue: manifest["components"])
 
-          purl = PackageURL.parse(component["purl"])
+        entries.parse! do |component, parse_queue|
+          parse_queue.concat(component["components"]) if component["components"]
 
-          obj << purl
+          component["purl"]
         end
 
         entries[platform_name.to_sym]
@@ -119,16 +139,14 @@ module Bibliothecary
 
         raise NoComponents unless root.locate('components').first
 
-        entries = ManifestEntries.new
-
-        root.locate('components/*').each_with_object(entries) do |component, obj|
-          purl_node = component.locate("purl").first
-
-          next unless purl_node
+        entries = ManifestEntries.new(parse_queue: root.locate('components/*'))
 
-          purl = PackageURL.parse(purl_node.text)
+        entries.parse! do |component, parse_queue|
+          # #locate returns an empty array if nothing is found, so we can
+          # always safely concatenate it to the parse queue.
+          parse_queue.concat(component.locate('components/*'))
 
-          obj << purl
+          component.locate("purl").first&.text
         end
 
         entries[platform_name.to_sym]

data/lib/bibliothecary/parsers/maven.rb

@@ -12,6 +12,17 @@ module Bibliothecary
       # "|    \\--- com.google.guava:guava:23.5-jre (*)"
       GRADLE_DEP_REGEX = /(\+---|\\---){1}/
 
+      # Builtin methods: https://docs.gradle.org/current/userguide/java_plugin.html#tab:configurations
+      GRADLE_KTS_DEPENDENCY_METHODS = %w(api compile compileOnlyApi implementation runtimeOnly testCompileOnly testImplementation testRuntimeOnly)
+      
+      # An intentionally overly-simplified regex to scrape deps from build.gradle.kts files. 
+      # To be truly useful bibliothecary would need a full Kotlin parser that speaks Gradle, 
+      # because the Kotlin DSL has many dynamic ways of declaring dependencies.
+      GRADLE_KTS_SIMPLE_REGEX = /(#{GRADLE_KTS_DEPENDENCY_METHODS.join('|')})\s*\(\s*"([^"]+)"\s*\)/m
+      
+      # e.g. "group:artifactId:1.2.3"
+      GRADLE_KTS_GAV_REGEX = /([\w.-]+)\:([\w.-]+)(?:\:([\w.-]+))?/
+
       MAVEN_PROPERTY_REGEX = /\$\{(.+?)\}/
       MAX_DEPTH = 5
 
@@ -236,8 +247,17 @@ module Bibliothecary
       end
 
       def self.parse_gradle_kts(file_contents, options: {})
-        # TODO: the gradle-parser side needs to be implemented for this, coming soon.
-        []
+        file_contents
+          .scan(GRADLE_KTS_SIMPLE_REGEX)                                                   # match 'implementation("group:artifactId:version")'
+          .map { |(_type, dep_match)| GRADLE_KTS_GAV_REGEX.match(dep_match) }              # extract ["group", "artifactId", ?"version"]
+          .reject { |gav_match| gav_match.nil? || gav_match[1].nil? || gav_match[2].nil? } # remove any with missing group/artifactId
+          .map { |gav_match|
+            {
+              name: [gav_match[1], gav_match[2]].join(":"),
+              requirement: gav_match[3] || "*",
+              type: nil # TODO: we may be able to infer dep types using the _type var above.
+            }
+          }
       end
 
       def self.gradle_dependency_name(group, name)

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.0.0"
+  VERSION = "8.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.2.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-25 00:00:00.000000000 Z
+date: 2022-04-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb