cyclonedx-cocoapods 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b02ca712eff5c74b3c7a4e3c59ab7a402a87cf2f3053be388f64a702ca0d3a1
-  data.tar.gz: ca6e3d81e4b255dfcd43add1017e1b5dc939274544b6bade803da0246c544ebc
+  metadata.gz: 4b3c1577d54844759e40218fb3b0876014aa8a2eac1a8ea2be2512cab13d79f9
+  data.tar.gz: dd99bd2aa09a1d6ecd956fdd3118a064df6662026b6816ee86f9a2f553347068
 SHA512:
-  metadata.gz: 74af3ed1ceded419670e4e4cc2b69a955730f963ef92510159505809a02681ae39347c91a24ac99d988f142f987465998fdd4bf4629e799d0dc33e01f96fbb9a
-  data.tar.gz: b1ce5ceae85c7b3ff993109203a53f9f7fa61397f8d58f6b18220ee2ed5e866ab1bc210b6ac48b375de3ec49e6928abe2245413fac56b437403317fb1c2ba783
+  metadata.gz: 5e82c25c27de0fbede464d04a06b9b7f06c3fc79550041835395c6fe5aa32a0f1c4bba1d391b988ff6d39107f696960f064730de43ef8c0f0e8000d576cd1010
+  data.tar.gz: '048fa99979dd4e606b4952412dad3675bad2ebe3e45eccd8513089f18908d5594213031cb85130434f002d7a8edbafbb67818e602c648b49137768e8085c445b'

data/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.4.0]
+
+### Added
+- Added `evidence` element to the component output to indicate that we are doing manifest analysis to generate the bom. ([Issue #69](https://github.com/CycloneDX/cyclonedx-cocoapods/issues/69)) [@macblazer](https://github.com/macblazer).
+
+### Fixed
+- Added top level dependencies when the metadata/component is specified (by using the `--name`, `--version`, and `--type` parameters). ([PR #70](https://github.com/CycloneDX/cyclonedx-cocoapods/pull/70)) [@fnxpt](https://github.com/fnxpt)
+- Properly concatenate paths to Podfile and Podfile.lock (with unit tests!). ([Issue #71](https://github.com/CycloneDX/cyclonedx-cocoapods/issues/71)) [@macblazer](https://github.com/macblazer).
+
 ## [1.3.0]
 
 ### Added

data/lib/cyclonedx/cocoapods/bom_builder.rb

@@ -104,10 +104,28 @@ module CycloneDX
         end
       end
 
-      def add_to_bom(xml, trim_strings_length = 0)
+      # Add evidence of the purl identity.
+      # See https://github.com/CycloneDX/guides/blob/main/SBOM/en/0x60-Evidence.md for more info
+      def xml_add_evidence(xml, manifest_path)
+        xml.evidence do
+          xml.identity do
+            xml.field 'purl'
+            xml.confidence '0.6'
+            xml.methods_ do
+              xml.method_ do
+                xml.technique 'manifest-analysis'
+                xml.confidence '0.6'
+                xml.value manifest_path
+              end
+            end
+          end
+        end
+      end
+
+      def add_to_bom(xml, manifest_path, trim_strings_length = 0)
         xml.component(type: 'library', 'bom-ref': purl) do
           xml_add_author(xml, trim_strings_length)
-          xml.name name
+          xml.name_ name
           xml.version version.to_s
           xml.description { xml.cdata description } unless description.nil?
           unless checksum.nil?
@@ -126,6 +144,8 @@ module CycloneDX
             xml.purl purl.slice(0, trim_strings_length)
           end
           xml_add_homepage(xml)
+
+          xml_add_evidence(xml, manifest_path)
         end
       end
 
@@ -133,7 +153,7 @@ module CycloneDX
         def add_to_bom(xml)
           xml.license do
             xml.id identifier if identifier_type == :id
-            xml.name identifier if identifier_type == :name
+            xml.name_ identifier if identifier_type == :name
             xml.text_ text unless text.nil?
             xml.url url unless url.nil?
           end
@@ -143,21 +163,23 @@ module CycloneDX
 
     class Component
       def add_to_bom(xml)
-        xml.component(type: type) do
+        xml.component(type: type, 'bom-ref': bomref) do
           xml.group group unless group.nil?
-          xml.name name
+          xml.name_ name
           xml.version version
         end
       end
     end
 
+    # Turns the internal model data into an XML bom.
     class BOMBuilder
       NAMESPACE = 'http://cyclonedx.org/schema/bom/1.5'
 
-      attr_reader :component, :pods, :dependencies
+      attr_reader :component, :pods, :manifest_path, :dependencies
 
-      def initialize(pods:, component: nil, dependencies: nil)
+      def initialize(pods:, manifest_path:, component: nil, dependencies: nil)
         @pods = pods.sort_by(&:purl)
+        @manifest_path = manifest_path
         @component = component
         @dependencies = dependencies&.sort
       end
@@ -184,17 +206,17 @@ module CycloneDX
           xml.bom(xmlns: NAMESPACE, version: version.to_i.to_s, serialNumber: "urn:uuid:#{SecureRandom.uuid}") do
             bom_metadata(xml)
 
-            bom_components(xml, pods, trim_strings_length)
+            bom_components(xml, pods, manifest_path, trim_strings_length)
 
             bom_dependencies(xml, dependencies)
           end
         end.to_xml
       end
 
-      def bom_components(xml, pods, trim_strings_length)
+      def bom_components(xml, pods, manifest_path, trim_strings_length)
         xml.components do
           pods.each do |pod|
-            pod.add_to_bom(xml, trim_strings_length)
+            pod.add_to_bom(xml, manifest_path, trim_strings_length)
           end
         end
       end
@@ -223,7 +245,7 @@ module CycloneDX
         xml.tools do
           xml.tool do
             xml.vendor 'CycloneDX'
-            xml.name 'cyclonedx-cocoapods'
+            xml.name_ 'cyclonedx-cocoapods'
             xml.version VERSION
           end
         end

data/lib/cyclonedx/cocoapods/cli_runner.rb

@@ -39,9 +39,9 @@ module CycloneDX
         setup_logger(verbose: options[:verbose])
         @logger.debug "Running cyclonedx-cocoapods with options: #{options}"
 
-        pods, dependencies = analyze(options)
+        component, pods, manifest_path, dependencies = analyze(options)
 
-        build_and_write_bom(options, pods, dependencies)
+        build_and_write_bom(options, component, pods, manifest_path, dependencies)
       rescue StandardError => e
         @logger.error ([e.message] + e.backtrace).join($INPUT_RECORD_SEPARATOR)
         exit 1
@@ -136,11 +136,26 @@ module CycloneDX
         pods, dependencies = analyzer.parse_pods(podfile, lockfile)
         analyzer.populate_pods_with_additional_info(pods)
 
-        [pods, dependencies]
+        component = component_from_options(options)
+
+        unless component.nil?
+          # add top level pods to main component
+          top_deps = analyzer.top_level_deps(podfile, lockfile)
+          dependencies[component.bomref] = top_deps
+        end
+
+        manifest_path = lockfile.defined_in_file
+        if manifest_path.absolute?
+          # Use the folder that we are building in, then the path to the manifest file
+          manifest_path = Pathname.pwd.basename + manifest_path.relative_path_from(Pathname.pwd)
+        end
+
+        [component, pods, manifest_path, dependencies]
       end
 
-      def build_and_write_bom(options, pods, dependencies)
-        builder = BOMBuilder.new(pods: pods, component: component_from_options(options), dependencies: dependencies)
+      def build_and_write_bom(options, component, pods, manifest_path, dependencies)
+        builder = BOMBuilder.new(pods: pods, manifest_path: manifest_path,
+                                 component: component, dependencies: dependencies)
         bom = builder.bom(version: options[:bom_version] || 1,
                           trim_strings_length: options[:trim_strings_length] || 0)
         write_bom_to_file(bom: bom, options: options)

data/lib/cyclonedx/cocoapods/component.rb

@@ -24,7 +24,7 @@ module CycloneDX
     class Component
       VALID_COMPONENT_TYPES = %w[application framework library container operating-system device firmware file].freeze
 
-      attr_reader :group, :name, :version, :type
+      attr_reader :group, :name, :version, :type, :bomref
 
       def initialize(name:, version:, type:, group: nil)
         raise ArgumentError, 'Group, if specified, must be non empty' if !group.nil? && group.to_s.strip.empty?
@@ -39,6 +39,11 @@ module CycloneDX
         @name = name
         @version = version
         @type = type
+        @bomref = "#{name}@#{version}"
+
+        return if group.nil?
+
+        @bomref = "#{group}/#{@bomref}"
       end
     end
   end

data/lib/cyclonedx/cocoapods/podfile_analyzer.rb

@@ -74,6 +74,11 @@ module CycloneDX
         pods
       end
 
+      def top_level_deps(podfile, lockfile)
+        pods_used = top_level_pods(podfile)
+        dependencies_for_pod(pods_used, podfile, lockfile)
+      end
+
       private
 
       def load_plugins(podfile_path)
@@ -137,6 +142,8 @@ module CycloneDX
       end
 
       def initialize_cocoapods_config(project_dir)
+        # First, reset the ::Pod::Config instance in case we need to use this analyzer on multiple pods
+        ::Pod::Config.instance = nil
         ::Pod::Config.instance.installation_root = project_dir
       end
 
@@ -204,15 +211,19 @@ module CycloneDX
         [result, dependencies_hash]
       end
 
-      def create_list_of_included_pods(podfile, lockfile)
-        pods_cache = simple_hash_of_lockfile_pods(lockfile)
-
+      def top_level_pods(podfile)
         included_targets = podfile.target_definition_list.select { |target| include_target_named(target.label) }
         included_target_names = included_targets.map(&:label)
         @logger.debug "Including all pods for targets: #{included_target_names}"
 
         top_level_deps = included_targets.map(&:dependencies).flatten.uniq
-        pods_used = top_level_deps.map(&:name).uniq
+        top_level_deps.map(&:name).uniq
+      end
+
+      def create_list_of_included_pods(podfile, lockfile)
+        pods_cache = simple_hash_of_lockfile_pods(lockfile)
+
+        pods_used = top_level_pods(podfile)
         pods_used, dependencies = append_all_pod_dependencies(pods_used, pods_cache)
 
         [pods_used.sort, dependencies]

data/lib/cyclonedx/cocoapods/version.rb

@@ -21,6 +21,6 @@
 
 module CycloneDX
   module CocoaPods
-    VERSION = '1.3.0'
+    VERSION = '1.4.0'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cyclonedx-cocoapods
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - José González
@@ -9,7 +9,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-02-08 00:00:00.000000000 Z
+date: 2024-10-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cocoapods
@@ -140,7 +140,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.4
+rubygems_version: 3.5.16
 signing_key:
 specification_version: 4
 summary: CycloneDX software bill-of-material (SBOM) generation utility