ecosystems-bibliothecary 15.2.0 → 15.4.0

data/lib/bibliothecary/parsers/deno.rb

@@ -52,16 +52,30 @@ module Bibliothecary
         manifest = JSON.parse(file_contents)
         source = options.fetch(:filename, nil)
 
+        # Build integrity lookup from jsr and npm sections
+        integrity_map = {}
+        manifest.fetch("jsr", {}).each do |key, value|
+          integrity_map["jsr:#{key}"] = value["integrity"] if value.is_a?(Hash) && value["integrity"]
+        end
+        manifest.fetch("npm", {}).each do |key, value|
+          integrity_map["npm:#{key}"] = value["integrity"] if value.is_a?(Hash) && value["integrity"]
+        end
+
         dependencies = manifest.fetch("specifiers", {}).map do |specifier, resolved_version|
           name, _requirement = parse_specifier(specifier)
           next unless name
 
+          # Determine protocol (npm: or jsr:) and build lookup key
+          protocol = specifier.start_with?("jsr:") ? "jsr" : "npm"
+          integrity_key = "#{protocol}:#{name}@#{resolved_version}"
+
           Dependency.new(
             name: name,
             requirement: resolved_version,
             type: "runtime",
             source: source,
-            platform: platform_name
+            platform: platform_name,
+            integrity: integrity_map[integrity_key]
           )
         end.compact
 

data/lib/bibliothecary/parsers/dub.rb

@@ -18,10 +18,12 @@ module Bibliothecary
           match_filename("dub.json") => {
             kind: "manifest",
             parser: :parse_json_manifest,
+            can_have_lockfile: false,
           },
           match_filename("dub.sdl") => {
             kind: "manifest",
             parser: :parse_sdl_manifest,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/dvc.rb

@@ -14,7 +14,7 @@ module Bibliothecary
           match_filename("dvc.yaml") => {
             kind: 'manifest',
             parser: :parse_dvc_yaml,
-            related_to: [ 'manifest' ]
+            can_have_lockfile: false,
           }
         }
       end

data/lib/bibliothecary/parsers/go.rb

@@ -209,10 +209,12 @@ module Bibliothecary
             requirement: match[2].strip.split("/").first,
             type: "runtime",
             source: options.fetch(:filename, nil),
-            platform: platform_name
+            platform: platform_name,
+            integrity: match[3].strip
           )
         end
-        dependencies = deps.uniq
+        # Dedupe by name+requirement, keeping the first occurrence (h1 hash, not go.mod hash)
+        dependencies = deps.uniq { |d| [d.name, d.requirement] }
         ParserResult.new(dependencies: dependencies)
       end
 

data/lib/bibliothecary/parsers/hackage.rb

@@ -12,8 +12,8 @@ module Bibliothecary
       # Matches build-tool-depends format: package:tool == version
       BUILD_TOOL_REGEXP = /^\s*([a-zA-Z][a-zA-Z0-9-]*):[a-zA-Z][a-zA-Z0-9-]*\s*((?:[<>=!]+\s*[\d.*]+(?:\s*&&\s*[<>=!]+\s*[\d.*]+)*)?)/
 
-      # Matches stack.yaml.lock hackage entries like: hackage: fuzzyset-0.2.4@sha256:...
-      STACK_LOCK_REGEXP = /hackage:\s*([a-zA-Z0-9-]+)-([0-9.]+)@/
+      # Matches stack.yaml.lock hackage entries like: hackage: fuzzyset-0.2.4@sha256:hash,size
+      STACK_LOCK_REGEXP = /hackage:\s*([a-zA-Z0-9-]+)-([0-9.]+)@sha256:([a-f0-9]+)/
 
       def self.file_patterns
         ["*.cabal", "*cabal.config", "stack.yaml.lock", "cabal.project.freeze"]
@@ -198,7 +198,8 @@ module Bibliothecary
             name: match[1],
             requirement: match[2],
             type: "runtime",
-            source: source
+            source: source,
+            integrity: "sha256=#{match[3]}"
           )
         end
 

data/lib/bibliothecary/parsers/haxelib.rb

@@ -16,6 +16,7 @@ module Bibliothecary
           match_filename("haxelib.json") => {
             kind: "manifest",
             parser: :parse_manifest,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/hex.rb

@@ -5,13 +5,15 @@ module Bibliothecary
     class Hex
       include Bibliothecary::Analyser
 
-      # Matches mix.lock entries: "name": {:hex, :name, "version", ...
+      # Matches mix.lock entries: "name": {:hex, :name, "version", "hash", ...
       # or "name": {:git, "url", "ref", ...
-      HEX_LOCK_REGEXP = /"([^"]+)":\s*\{:hex,\s*:[^,]+,\s*"([^"]+)"/
+      HEX_LOCK_REGEXP = /"([^"]+)":\s*\{:hex,\s*:[^,]+,\s*"([^"]+)",\s*"([^"]+)"/
       GIT_LOCK_REGEXP = /"([^"]+)":\s*\{:git,\s*"([^"]+)",\s*"([^"]+)"/
 
       # Matches rebar.lock entries: {<<"name">>,{pkg,<<"name">>,<<"version">>},N}
       REBAR_LOCK_REGEXP = /\{<<"([^"]+)">>,\{pkg,<<"[^"]+">>,<<"([^"]+)">>},\d+\}/
+      # Matches rebar.lock pkg_hash entries: {<<"name">>, <<"HASH">>}
+      REBAR_PKG_HASH_REGEXP = /\{<<"([^"]+)">>,\s*<<"([A-F0-9]+)">>}/
 
       def self.file_patterns
         ["mix.exs", "mix.lock", "gleam.toml", "manifest.toml", "rebar.lock"]
@@ -74,14 +76,15 @@ module Bibliothecary
         source = options.fetch(:filename, "mix.lock")
         deps = []
 
-        # Match hex packages: "name": {:hex, :name, "version", ...
-        file_contents.scan(HEX_LOCK_REGEXP) do |name, version|
+        # Match hex packages: "name": {:hex, :name, "version", "hash", ...
+        file_contents.scan(HEX_LOCK_REGEXP) do |name, version, hash|
           deps << Dependency.new(
             platform: platform_name,
             name: name,
             requirement: version,
             type: "runtime",
-            source: source
+            source: source,
+            integrity: "sha256=#{hash}"
           )
         end
 
@@ -135,12 +138,14 @@ module Bibliothecary
         manifest.fetch("packages", []).each do |pkg|
           next unless pkg["source"] == "hex"
 
+          checksum = pkg["outer_checksum"]
           deps << Dependency.new(
             platform: platform_name,
             name: pkg["name"],
             requirement: pkg["version"],
             type: "runtime",
-            source: source
+            source: source,
+            integrity: checksum ? "sha256=#{checksum.downcase}" : nil
           )
         end
 
@@ -151,13 +156,23 @@ module Bibliothecary
         source = options.fetch(:filename, "rebar.lock")
         deps = []
 
+        # Parse pkg_hash section to build lookup table
+        pkg_hashes = {}
+        pkg_hash_section = file_contents[/\{pkg_hash,\s*\[(.*?)\]\}/m, 1]
+        if pkg_hash_section
+          pkg_hash_section.scan(REBAR_PKG_HASH_REGEXP) do |name, hash|
+            pkg_hashes[name] = "sha256=#{hash.downcase}"
+          end
+        end
+
         file_contents.scan(REBAR_LOCK_REGEXP) do |name, version|
           deps << Dependency.new(
             platform: platform_name,
             name: name,
             requirement: version,
             type: "runtime",
-            source: source
+            source: source,
+            integrity: pkg_hashes[name]
           )
         end
 

data/lib/bibliothecary/parsers/luarocks.rb

@@ -14,6 +14,7 @@ module Bibliothecary
           match_extension(".rockspec") => {
             kind: "manifest",
             parser: :parse_rockspec,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/meteor.rb

@@ -16,6 +16,7 @@ module Bibliothecary
           match_filename("versions.json") => {
             kind: "manifest",
             parser: :parse_manifest,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/mlflow.rb

@@ -14,7 +14,7 @@ module Bibliothecary
           match_filename("MLmodel") => {
             kind: 'manifest',
             parser: :parse_mlmodel,
-            related_to: [ 'manifest' ]
+            can_have_lockfile: false,
           }
         }
       end

data/lib/bibliothecary/parsers/nimble.rb

@@ -18,6 +18,7 @@ module Bibliothecary
           match_extension(".nimble") => {
             kind: "manifest",
             parser: :parse_nimble,
+            can_have_lockfile: false,
           },
         }
       end

data/lib/bibliothecary/parsers/npm.rb

@@ -11,7 +11,7 @@ module Bibliothecary
       PACKAGE_LOCK_JSON_MAX_DEPTH = 10
 
       def self.file_patterns
-        ["package.json", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lock", "npm-ls.json"]
+        ["package.json", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "pnpm-workspace.yaml", "bun.lock", "npm-ls.json"]
       end
 
       def self.mapping
@@ -32,6 +32,11 @@ module Bibliothecary
             kind: "lockfile",
             parser: :parse_pnpm_lock,
           },
+          match_filename("pnpm-workspace.yaml") => {
+            kind: "manifest",
+            parser: :parse_pnpm_workspace,
+            related_to: ["lockfile"],
+          },
           match_filename("npm-ls.json") => {
             kind: "lockfile",
             parser: :parse_ls,
@@ -101,7 +106,8 @@ module Bibliothecary
               type: dep.fetch("dev", false) || dep.fetch("devOptional", false) ? "development" : "runtime",
               local: dep.fetch("link", false),
               source: source,
-              platform: platform_name
+              platform: platform_name,
+              integrity: dep["integrity"]
             )
           end
       end
@@ -122,7 +128,8 @@ module Bibliothecary
             requirement: version,
             type: type,
             source: source,
-            platform: platform_name
+            platform: platform_name,
+            integrity: requirement["integrity"]
           )] + child_dependencies
         end
       end
@@ -191,7 +198,8 @@ module Bibliothecary
             type: nil, # yarn.lock doesn't report on the type of dependency
             local: dep[:requirements]&.first&.start_with?("file:"),
             source: options.fetch(:filename, nil),
-            platform: platform_name
+            platform: platform_name,
+            integrity: dep[:integrity]
           )
         end
         ParserResult.new(dependencies: dependencies)
@@ -232,11 +240,23 @@ module Bibliothecary
 
       def self.parse_v2_yarn_lock(contents, source = nil)
         deps = []
-        # Match package blocks: "package@npm:req": followed by version: x.y.z
-        # Examples: "js-tokens@npm:^3.0.0 || ^4.0.0": or "pkg1@npm:req1, pkg2@npm:req2":
-        contents.scan(/^"([^"]+)":\s*\n\s+version:\s*([^\n]+)/m) do |packages_str, version|
+        # Split into blocks by double newlines or by unquoted key lines
+        # Each block starts with "package@npm:req": and continues until the next package
+        blocks = contents.split(/\n\n+/)
+
+        blocks.each do |block|
+          # Match the package header: "package@npm:...":\n  version: ...
+          match = block.match(/^"([^"]+)":\s*\n(.+)/m)
+          next unless match
+
+          packages_str = match[1]
+          body = match[2]
+
+          version = body[/version:\s*([^\n]+)/, 1]
+          checksum = body[/checksum:\s*([^\n]+)/, 1]
+
           # Skip workspace/local packages and patches
-          next if version.include?("use.local") && packages_str.include?("workspace")
+          next if version&.include?("use.local") && packages_str.include?("workspace")
           next if packages_str.include?("@patch:")
 
           packages = packages_str.split(", ")
@@ -251,6 +271,7 @@ module Bibliothecary
             original_requirement: alias_name.nil? ? nil : version.to_s,
             version: version.to_s,
             source: source,
+            integrity: checksum,
           }
         end
         deps
@@ -285,7 +306,8 @@ module Bibliothecary
               original_requirement: original_requirement,
               type: is_dev ? "development" : "runtime",
               source: source,
-              platform: platform_name
+              platform: platform_name,
+              integrity: details.dig("resolution", "integrity")
             )
           end
       end
@@ -322,7 +344,8 @@ module Bibliothecary
               original_requirement: original_requirement,
               type: is_dev ? "development" : "runtime",
               source: source,
-              platform: platform_name
+              platform: platform_name,
+              integrity: details.dig("resolution", "integrity")
             )
           end
       end
@@ -331,6 +354,7 @@ module Bibliothecary
         dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("dependencies", {})
         dev_dependencies = parsed_contents.fetch("importers", {}).fetch(".", {}).fetch("devDependencies", {})
         dependency_mapping = dependencies.merge(dev_dependencies)
+        packages = parsed_contents.fetch("packages", {})
 
         # "dependencies" is in "packages" for < v9 and in "snapshots" for >= v9
         # as of https://github.com/pnpm/pnpm/pull/7700.
@@ -364,6 +388,10 @@ module Bibliothecary
               dev_name == name && dev_details["version"] == version
             end
 
+            # In v9, integrity is stored in packages section, not snapshots
+            package_key = "#{name}@#{version}"
+            integrity = packages.dig(package_key, "resolution", "integrity")
+
             Dependency.new(
               name: name,
               requirement: version,
@@ -371,7 +399,8 @@ module Bibliothecary
               original_requirement: original_requirement,
               type: is_dev ? "development" : "runtime",
               source: source,
-              platform: platform_name
+              platform: platform_name,
+              integrity: integrity
             )
           end
       end
@@ -395,6 +424,45 @@ module Bibliothecary
         ParserResult.new(dependencies: dependencies)
       end
 
+      def self.parse_pnpm_workspace(contents, options: {})
+        parsed = YAML.load(contents)
+        source = options.fetch(:filename, nil)
+
+        dependencies = []
+
+        # Parse the default catalog (pnpm 9+)
+        if parsed["catalog"].is_a?(Hash)
+          parsed["catalog"].each do |name, requirement|
+            dependencies << Dependency.new(
+              name: name,
+              requirement: requirement,
+              type: "runtime",
+              source: source,
+              platform: platform_name
+            )
+          end
+        end
+
+        # Parse named catalogs (pnpm 9+)
+        if parsed["catalogs"].is_a?(Hash)
+          parsed["catalogs"].each do |_catalog_name, catalog_deps|
+            next unless catalog_deps.is_a?(Hash)
+
+            catalog_deps.each do |name, requirement|
+              dependencies << Dependency.new(
+                name: name,
+                requirement: requirement,
+                type: "runtime",
+                source: source,
+                platform: platform_name
+              )
+            end
+          end
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
       def self.parse_ls(file_contents, options: {})
         manifest = JSON.parse(file_contents)
 
@@ -425,7 +493,8 @@ module Bibliothecary
             type: dev_deps&.include?(name) ? "development" : "runtime",
             local: is_local,
             source: source,
-            platform: platform_name
+            platform: platform_name,
+            integrity: info[3]
           )
         end
         ParserResult.new(dependencies: dependencies)

data/lib/bibliothecary/parsers/ollama.rb

@@ -14,7 +14,7 @@ module Bibliothecary
           match_filename("Modelfile") => {
             kind: 'manifest',
             parser: :parse_modelfile,
-            related_to: [ 'manifest' ]
+            can_have_lockfile: false,
           }
         }
       end

data/lib/bibliothecary/parsers/packagist.rb

@@ -27,42 +27,39 @@ module Bibliothecary
 
       def self.parse_lockfile(file_contents, options: {})
         manifest = JSON.parse file_contents
-        dependencies = manifest.fetch("packages", []).map do |dependency|
-          requirement = dependency["version"]
-
-          # Store Drupal version if Drupal, but include the original manifest version for reference
-          if drupal_module?(dependency)
-            original_requirement = requirement
-            requirement = dependency.dig("source", "reference")
-          end
+        source = options.fetch(:filename, nil)
 
-          Dependency.new(
-            name: dependency["name"],
-            requirement: requirement,
-            type: "runtime",
-            original_requirement: original_requirement,
-            source: options.fetch(:filename, nil),
-            platform: platform_name
-          )
+        dependencies = manifest.fetch("packages", []).map do |dependency|
+          parse_composer_dependency(dependency, "runtime", source)
         end + manifest.fetch("packages-dev", []).map do |dependency|
-          requirement = dependency["version"]
+          parse_composer_dependency(dependency, "development", source)
+        end
+        ParserResult.new(dependencies: dependencies)
+      end
 
-          # Store Drupal version if Drupal, but include the original manifest version for reference
-          if drupal_module?(dependency)
-            original_requirement = requirement
-            requirement = dependency.dig("source", "reference")
-          end
+      def self.parse_composer_dependency(dependency, type, source)
+        requirement = dependency["version"]
+        original_requirement = nil
 
-          Dependency.new(
-            name: dependency["name"],
-            requirement: requirement,
-            type: "development",
-            original_requirement: original_requirement,
-            source: options.fetch(:filename, nil),
-            platform: platform_name
-          )
+        # Store Drupal version if Drupal, but include the original manifest version for reference
+        if drupal_module?(dependency)
+          original_requirement = requirement
+          requirement = dependency.dig("source", "reference")
         end
-        ParserResult.new(dependencies: dependencies)
+
+        # Extract shasum from dist if present and non-empty
+        shasum = dependency.dig("dist", "shasum")
+        integrity = shasum && !shasum.empty? ? "sha1=#{shasum}" : nil
+
+        Dependency.new(
+          name: dependency["name"],
+          requirement: requirement,
+          type: type,
+          original_requirement: original_requirement,
+          source: source,
+          platform: platform_name,
+          integrity: integrity
+        )
       end
 
       def self.parse_manifest(file_contents, options: {})

data/lib/bibliothecary/parsers/pypi.rb

@@ -131,12 +131,16 @@ module Bibliothecary
           name = block[/name\s*=\s*"([^"]+)"/, 1]
           version = block[/version\s*=\s*"([^"]+)"/, 1]
 
+          # Extract sdist hash: sdist = { url = "...", hash = "sha256:...", size = ... }
+          integrity = block[/^sdist\s*=\s*\{[^}]*hash\s*=\s*"([^"]+)"/m, 1]
+
           dependencies << Dependency.new(
             platform: platform_name,
             name: name,
             requirement: version,
             type: "runtime", # All dependencies are considered runtime
-            source: source
+            source: source,
+            integrity: integrity
           )
         end
         ParserResult.new(dependencies: dependencies)
@@ -306,6 +310,15 @@ module Bibliothecary
 
           groups = ["runtime"] if groups.empty?
 
+          # Extract sdist hash from files array (look for .tar.gz entry)
+          integrity = nil
+          if (files_match = block[/^files\s*=\s*\[(.*?)\]/m, 1])
+            # Match .tar.gz file entry and extract hash
+            if (sdist_match = files_match.match(/\{file\s*=\s*"[^"]+\.tar\.gz",\s*hash\s*=\s*"([^"]+)"\}/))
+              integrity = sdist_match[1]
+            end
+          end
+
           groups.each do |group|
             # Poetry lockfiles should already contain normalized names, but we'll
             # apply it here as well just to be consistent with pyproject.toml parsing.
@@ -316,7 +329,8 @@ module Bibliothecary
               requirement: version,
               type: group,
               source: options.fetch(:filename, nil),
-              platform: platform_name
+              platform: platform_name,
+              integrity: integrity
             )
           end
         end

data/lib/bibliothecary/parsers/rpm.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Bibliothecary
+  module Parsers
+    class Rpm
+      include Bibliothecary::Analyser
+
+      def self.file_patterns
+        ["*.spec"]
+      end
+
+      def self.mapping
+        {
+          match_extension(".spec") => {
+            kind: "manifest",
+            parser: :parse_spec,
+            can_have_lockfile: false,
+          },
+        }
+      end
+
+      def self.parse_spec(file_contents, options: {})
+        source = options.fetch(:filename, nil)
+        dependencies = []
+
+        # Parse BuildRequires (build dependencies)
+        file_contents.scan(/^BuildRequires:\s*(.+)$/i) do |match|
+          parse_dependency_line(match[0]).each do |dep|
+            dependencies << Dependency.new(
+              name: dep[:name],
+              requirement: dep[:requirement] || "*",
+              type: "build",
+              source: source,
+              platform: platform_name
+            )
+          end
+        end
+
+        # Parse Requires (runtime dependencies), including Requires(pre), Requires(post), etc.
+        file_contents.scan(/^Requires(?:\([^)]+\))?:\s*(.+)$/i) do |match|
+          parse_dependency_line(match[0]).each do |dep|
+            dependencies << Dependency.new(
+              name: dep[:name],
+              requirement: dep[:requirement] || "*",
+              type: "runtime",
+              source: source,
+              platform: platform_name
+            )
+          end
+        end
+
+        ParserResult.new(dependencies: dependencies)
+      end
+
+      def self.parse_dependency_line(line)
+        # Dependencies can be comma or whitespace separated
+        # Each dependency can have version constraints like: pkg >= 1.0
+        # Also filter out RPM macros like %{name}
+        deps = []
+
+        # Split on commas first, then handle each part
+        line.split(/,/).each do |part|
+          part = part.strip
+          next if part.empty?
+          next if part.start_with?("%") # Skip RPM macros
+          next if part.start_with?("/") # Skip file paths like /bin/sh
+
+          # Check for version constraint (pkg >= 1.0, pkg < 2.0, etc.)
+          if part =~ /^(\S+)\s+([<>=]+)\s*(\S+)$/
+            deps << { name: $1, requirement: "#{$2} #{$3}" }
+          elsif part =~ /^(\S+)$/
+            deps << { name: $1, requirement: nil }
+          end
+        end
+
+        deps
+      end
+    end
+  end
+end