bibliothecary 8.0.0 → 8.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50ba5ddf48a3b7d1051272fef2bcef8ca7bca465b13e251fe9656ae8751f1353
-  data.tar.gz: 40b88cb18308c0d624f00eedb67d1a5a946e42d2f3e242436fa376dd54b2c55a
+  metadata.gz: 7ed029f460ea32073ccc2d06f6fb297926686064554b1447a7014ff8588382f1
+  data.tar.gz: 70482eb3f0cfe7afb13124904b1e713596d92e92d90cd6267153ff4319e9d356
 SHA512:
-  metadata.gz: 51675c6be455da5a996fe92f703245aac5f3a148eb65aed33bc48675e1a94677da65e3de1651d28cc511391d241e44bc774b287ff6ae2b27d7494037389f0391
-  data.tar.gz: 74ceaa45f07deaa972be3a50e5da4e91b2507be75f6a8cf7b46cd8c02319690063e4a6f52f394fafe918debba2af765efceb13e78195de8a827997a343b8128c
+  metadata.gz: b8a243cb926cf8e49835f11db86199f8fe8d45dc53b1f80a17c9b3c941bb5935e4c8b8c1a897b40704d8c6c3ddc271fd5d3139aa9373a8328eea3a538c383fac
+  data.tar.gz: d6dd8f873e0ce3cabf3f526e4e50393c36c1e3c6aacb7b1581bc7720bc022670ecd0cc96114df8d3dcc561341e3ee920d401a578eaf7fe5b066f64a33306d730

data/lib/bibliothecary/multi_parsers/cyclonedx.rb

@@ -39,8 +39,13 @@ module Bibliothecary
 
         attr_reader :manifests
 
-        def initialize
+        def initialize(parse_queue:)
           @manifests = {}
+
+          # Instead of recursing, we'll work through a queue of components
+          # to process, letting the different parser add components to the
+          # queue however they need to  pull them from the source document.
+          @parse_queue = parse_queue
         end
 
         def <<(purl)
@@ -55,6 +60,23 @@ module Bibliothecary
           }
         end
 
+        # Iterates over each manifest entry in the parse_queue, and accepts a block which will
+        # be called on each component. The block has two jobs: 1) add more sub-components
+        # to parse (if they exist), and 2) return the components purl.
+        def parse!(&block)
+          while @parse_queue.length > 0
+            component = @parse_queue.shift
+
+            purl_text = block.call(component, @parse_queue)
+
+            next unless purl_text
+
+            purl = PackageURL.parse(purl_text)
+
+            self << purl
+          end
+        end
+
         def [](key)
           @manifests[key]&.to_a
         end
@@ -94,14 +116,12 @@ module Bibliothecary
 
         raise NoComponents unless manifest["components"]
 
-        entries = ManifestEntries.new
-
-        manifest["components"].each_with_object(entries) do |component, obj|
-          next unless component["purl"]
+        entries = ManifestEntries.new(parse_queue: manifest["components"])
 
-          purl = PackageURL.parse(component["purl"])
+        entries.parse! do |component, parse_queue|
+          parse_queue.concat(component["components"]) if component["components"]
 
-          obj << purl
+          component["purl"]
         end
 
         entries[platform_name.to_sym]
@@ -119,16 +139,14 @@ module Bibliothecary
 
         raise NoComponents unless root.locate('components').first
 
-        entries = ManifestEntries.new
-
-        root.locate('components/*').each_with_object(entries) do |component, obj|
-          purl_node = component.locate("purl").first
-
-          next unless purl_node
+        entries = ManifestEntries.new(parse_queue: root.locate('components/*'))
 
-          purl = PackageURL.parse(purl_node.text)
+        entries.parse! do |component, parse_queue|
+          # #locate returns an empty array if nothing is found, so we can
+          # always safely concatenate it to the parse queue.
+          parse_queue.concat(component.locate('components/*'))
 
-          obj << purl
+          component.locate("purl").first&.text
         end
 
         entries[platform_name.to_sym]

data/lib/bibliothecary/version.rb

@@ -1,3 +1,3 @@
 module Bibliothecary
-  VERSION = "8.0.0"
+  VERSION = "8.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bibliothecary
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.1.0
 platform: ruby
 authors:
 - Andrew Nesbitt
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-04-25 00:00:00.000000000 Z
+date: 2022-04-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tomlrb