cyclonedx-cocoapods 1.1.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d9413e8c99e608e82f87b4075e907eb9fd137fd9f67a2c00bb277cf5c7fc2e21
-  data.tar.gz: fd8be60d19ee1e2d84f53bbc16e66734eaffb9b2375f462219bd097fbdb7ef1c
+  metadata.gz: f9377b14e9d7b5f41db0b12693b58dd37367e05e72f8ab208178c6d79f38234b
+  data.tar.gz: a8402aabb0a9eb157bbbaab4782a3fc6ce731003b48037c54cb1dc7e2d5fb289
 SHA512:
-  metadata.gz: 8b1e44bed24cddcce4e550047b39c849167f60d4e3ac86006365a991e70de3de3634a9de0ef90df7e7a3f93a9c255b5df271526a3731b91739726cc400c23889
-  data.tar.gz: f8778db86758639e8c2888a0ccd67d9209d8dac2282e422d75c18a40831c3e89a8c0cac10d8392965b8a47c01341b197dc424912470bc300e06c355e76d76415
+  metadata.gz: 7fe8629cb7313126a55d2cbae4e7f69ea6fc365336b56093eab5a23e3a27d4fde848a892926ce2fc201509af9c9e4adb9cf59e0940841a03023e344817be2aa2
+  data.tar.gz: 8cc8b64ddcf4292e14c4698e55899a2b6c72de7ed1ed5ee7adcef316fa315286e52b108a5d000a5fa6f6e42333fd752633b7eeb0142fa603b615b05fef688c8e

data/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.0]
+
+### Added
+- Includes dependency relationship information for each of the components. ([Issue #58](https://github.com/CycloneDX/cyclonedx-cocoapods/issues/58)) [@fnxpt](https://github.com/fnxpt).
+
+### Changed
+- Components and dependencies are output in alphabetically sorted order by `purl` to increase reproducability of BOM generation. ([Issue #59](https://github.com/CycloneDX/cyclonedx-cocoapods/issues/59)) [@macblazer](https://github.com/macblazer).
+
 ## [1.1.2]
 
 ### Changed

data/lib/cyclonedx/cocoapods/bom_builder.rb

@@ -84,6 +84,7 @@ module CycloneDX
             end
           end
           xml.purl purl
+          xml.bomRef purl
           unless homepage.nil?
             xml.externalReferences do
               xml.reference(type: HOMEPAGE_REFERENCE_TYPE) do
@@ -119,10 +120,12 @@ module CycloneDX
     class BOMBuilder
       NAMESPACE = 'http://cyclonedx.org/schema/bom/1.4'
 
-      attr_reader :component, :pods
+      attr_reader :component, :pods, :dependencies
 
-      def initialize(component: nil, pods:)
-        @component, @pods = component, pods
+      def initialize(pods:, component: nil, dependencies: nil)
+        @pods = pods.sort_by(&:purl)
+        @component = component
+        @dependencies = dependencies&.sort
       end
 
       def bom(version: 1)
@@ -136,12 +139,26 @@ module CycloneDX
                 pod.add_to_bom(xml)
               end
             end
+
+            xml.dependencies do
+              bom_dependencies(xml, dependencies)
+            end
           end
         end.to_xml
       end
 
       private
 
+      def bom_dependencies(xml, dependencies)
+        dependencies&.each do |key, array|
+          xml.dependency(ref: key) do
+            array.sort.each do |value|
+              xml.dependency(ref: value)
+            end
+          end
+        end
+      end
+
       def bom_metadata(xml)
         xml.metadata do
           xml.timestamp Time.now.getutc.strftime('%Y-%m-%dT%H:%M:%SZ')

data/lib/cyclonedx/cocoapods/cli_runner.rb

@@ -40,10 +40,11 @@ module CycloneDX
 
           analyzer = PodfileAnalyzer.new(logger: @logger, exclude_test_targets: options[:exclude_test_targets])
           podfile, lockfile = analyzer.ensure_podfile_and_lock_are_present(options)
-          pods = analyzer.parse_pods(podfile, lockfile)
+          pods, dependencies = analyzer.parse_pods(podfile, lockfile)
           analyzer.populate_pods_with_additional_info(pods)
 
-          bom = BOMBuilder.new(component: component_from_options(options), pods: pods).bom(version: options[:bom_version] || 1)
+          builder = BOMBuilder.new(pods: pods, component: component_from_options(options), dependencies: dependencies)
+          bom = builder.bom(version: options[:bom_version] || 1)
           write_bom_to_file(bom: bom, options: options)
         rescue StandardError => e
           @logger.error ([e.message] + e.backtrace).join($/)

data/lib/cyclonedx/cocoapods/podfile_analyzer.rb

@@ -41,7 +41,7 @@ module CycloneDX
         podfile_contents = File.read(podfile_path)
         plugin_syntax = /\s*plugin\s+['"]([^'"]+)['"]/
         plugin_names = podfile_contents.scan(plugin_syntax).flatten
-      
+
         plugin_names.each do |plugin_name|
           @logger.debug("Loading plugin #{plugin_name}")
           begin
@@ -67,17 +67,32 @@ module CycloneDX
         lockfile = ::Pod::Lockfile.from_file(options[:podfile_lock_path])
         verify_synced_sandbox(lockfile)
         load_plugins(options[:podfile_path])
-        
+
         return ::Pod::Podfile.from_file(options[:podfile_path]), lockfile
       end
 
 
       def parse_pods(podfile, lockfile)
         @logger.debug "Parsing pods from #{podfile.defined_in_file}"
-        included_pods = create_list_of_included_pods(podfile, lockfile)
-        return lockfile.pod_names.select { |name| included_pods.include?(name) }.map do |name|
+        included_pods, dependencies = create_list_of_included_pods(podfile, lockfile)
+
+        pods = lockfile.pod_names.select { |name| included_pods.include?(name) }.map do |name|
           Pod.new(name: name, version: lockfile.version(name), source: source_for_pod(podfile, lockfile, name), checksum: lockfile.checksum(name))
         end
+
+        pod_dependencies = { }
+        dependencies.each {|key, value|
+          if lockfile.pod_names.include? key
+            pod = Pod.new(name: key, version: lockfile.version(key), source: source_for_pod(podfile, lockfile, key), checksum: lockfile.checksum(key))
+
+            pod_dependencies[pod.purl] = lockfile.pod_names.select { |name| value.include?(name) }.map do |name|
+              pod = Pod.new(name: name, version: lockfile.version(name), source: source_for_pod(podfile, lockfile, name), checksum: lockfile.checksum(name))
+              pod.purl
+            end
+          end
+        }
+
+        return pods, pod_dependencies
       end
 
 
@@ -89,7 +104,6 @@ module CycloneDX
         return pods
       end
 
-
       private
 
 
@@ -124,9 +138,12 @@ module CycloneDX
         pods_hash
       end
 
+
       def append_all_pod_dependencies(pods_used, pods_cache)
         result = pods_used
         original_number = 0
+        dependencies_hash = { }
+
         # Loop adding pod dependencies until we are not adding any more dependencies to the result
         # This brings in all the transitive dependencies of every top level pod.
         # Note this also handles two edge cases:
@@ -134,13 +151,20 @@ module CycloneDX
         #  2. Having a pod that has a platform-specific dependency that is unused for this Podfile.
         while result.length != original_number
           original_number = result.length
+
           pods_used.each { |pod_name|
-            result.push(*pods_cache[pod_name]) unless !pods_cache.key?(pod_name) || pods_cache[pod_name].empty?
+            if pods_cache.key?(pod_name)
+              result.push(*pods_cache[pod_name])
+              dependencies_hash[pod_name] = pods_cache[pod_name].empty? ? [] : pods_cache[pod_name]
+            end
           }
+
           result = result.uniq
+          # maybe additional dependency processing needed here???
           pods_used = result
         end
-        result
+
+        return result, dependencies_hash
       end
 
       def create_list_of_included_pods(podfile, lockfile)
@@ -152,9 +176,9 @@ module CycloneDX
 
         topLevelDeps = includedTargets.map(&:dependencies).flatten.uniq
         pods_used = topLevelDeps.map(&:name).uniq
-        pods_used = append_all_pod_dependencies(pods_used, pods_cache)
+        pods_used, dependencies = append_all_pod_dependencies(pods_used, pods_cache)
 
-        return pods_used.sort
+        return pods_used.sort, dependencies
       end
 
 

data/lib/cyclonedx/cocoapods/version.rb

@@ -21,6 +21,6 @@
 
 module CycloneDX
   module CocoaPods
-    VERSION = '1.1.2'
+    VERSION = '1.2.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cyclonedx-cocoapods
 version: !ruby/object:Gem::Version
-  version: 1.1.2
+  version: 1.2.0
 platform: ruby
 authors:
 - José González
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-06-16 00:00:00.000000000 Z
+date: 2024-01-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cocoapods