still_active 3.0.0.rc6 → 3.1.0

data/lib/still_active/sbom_reader.rb

@@ -4,6 +4,8 @@ require "json"
 require "uri"
 require "package_url"
 
+require_relative "helpers/sbom_graph"
+
 module StillActive
   # Reads a CycloneDX SBOM (e.g. produced by Syft) into a clean, normalized
   # dependency set -- the breadth input for non-Ruby ecosystems, where the
@@ -63,12 +65,19 @@ module StillActive
 
       deps = []
       unassessable = []
+      entries_by_ref = {}
       components.each do |component|
         kind, entry = classify(component)
         entry[:production] = !dev_signal?(component) if kind == :dependency && marks_dev
-        deps << entry if kind == :dependency
+        if kind == :dependency
+          ref = component["bom-ref"]
+          entries_by_ref[ref] = entry if ref.is_a?(String)
+          deps << entry
+        end
         unassessable << entry if kind == :unassessable
       end
+      drop_project_components(doc, deps, entries_by_ref)
+      attach_dependency_graph(doc, deps, entries_by_ref)
       # uniq collapses a package that a generator lists more than once (e.g. Syft's
       # per-location entries); `production` is derived from each component's own
       # signal, so duplicates of the same name+version dedup cleanly unless a
@@ -80,6 +89,92 @@ module StillActive
 
     private
 
+    # A Syft SBOM lists the scanned project as an ordinary library component with a
+    # purl, so it was classified as one of its own dependencies and assessed: no
+    # registry entry, therefore no releases, therefore reported as critically stale.
+    # That is a confident false verdict about the user's own code, on the workflow
+    # the README recommends, and it trips --fail-if-critical.
+    #
+    # The project is dropped rather than surfaced as unassessable: it is not a
+    # dependency we failed to assess, it is not a dependency, which is the same
+    # treatment CI actions and opaque binaries already get. Nothing changes for an
+    # SBOM with no dependency graph, and the rule needs the project to actually
+    # depend on something, so a dependency with a missing parent edge is never
+    # dropped for looking parentless.
+    def drop_project_components(doc, deps, entries_by_ref)
+      return if entries_by_ref.empty?
+
+      roots = SbomGraph.project_refs(dependencies: doc["dependencies"], library_refs: entries_by_ref.keys.to_set)
+      return if roots.empty?
+
+      # Compared by identity, not value: two components can classify to equal
+      # hashes, and only the one the graph named as a root should be dropped.
+      dropped = roots.filter_map { |ref| entries_by_ref.delete(ref)&.object_id }.to_set
+      deps.reject! { |entry| dropped.include?(entry.object_id) }
+    end
+
+    # Place each package in the CycloneDX dependency graph, so a cross-ecosystem
+    # audit can say which packages you actually declared and, for the rest, the
+    # declared package that pulls each one in. Same contract as the native path:
+    # `direct` is a boolean, and `dependency_path` is present only for a transitive
+    # package, head-first so it names the dependency a maintainer can act on.
+    #
+    # Both fields are attached ONLY to packages the graph actually places. A
+    # generator can emit a near-empty graph (a Syft directory scan of a Ruby project
+    # produced one edge across 789 components), and stamping `direct: false` on
+    # everything it failed to mention would be the positive claim "none of these are
+    # yours" about a document that never said. Absent means unknown, which the
+    # renderers already treat correctly: they test `direct == false`, not falsiness.
+    def attach_dependency_graph(doc, deps, entries_by_ref)
+      return if entries_by_ref.empty?
+
+      placements = SbomGraph.resolve(
+        dependencies: doc["dependencies"],
+        root_ref: doc.dig("metadata", "component", "bom-ref"),
+        library_refs: entries_by_ref.keys.to_set
+      )
+      return if placements.nil?
+
+      identities = entries_by_ref.transform_values { |entry| "#{entry[:ecosystem]}/#{entry[:name]}" }
+      # Fold per package identity first. A generator may list one package under
+      # several bom-refs (Syft emits a component per location), and those copies are
+      # collapsed by `uniq` below; if they carried different placements they would
+      # stop being equal and the package would appear twice in the audit.
+      best = {}
+      entries_by_ref.each do |ref, entry|
+        placement = placements[ref]
+        next if placement.nil?
+
+        key = identity_key(entry)
+        best[key] = better_placement(best[key], placement)
+      end
+
+      deps.each do |entry|
+        placement = best[identity_key(entry)]
+        next if placement.nil?
+
+        entry[:direct] = placement[:direct]
+        next if placement[:direct]
+
+        path = Array(placement[:path]).filter_map { |ref| identities[ref] }
+        entry[:dependency_path] = path unless path.empty?
+      end
+    end
+
+    def identity_key(entry)
+      [entry[:ecosystem], entry[:name], entry[:version]]
+    end
+
+    # Declared beats pulled-in (you can act on it directly), and among transitive
+    # placements the shorter path wins, matching the native path's shortest-path BFS.
+    def better_placement(current, candidate)
+      return candidate if current.nil?
+      return current if current[:direct]
+      return candidate if candidate[:direct]
+
+      (Array(candidate[:path]).length < Array(current[:path]).length) ? candidate : current
+    end
+
     # Whether a component is marked dev/test-only. CycloneDX `scope` (excluded =
     # not part of the product, optional = not needed at runtime) is the standard;
     # tools that don't set scope may instead emit a property (cyclonedx-npm's
@@ -146,7 +241,12 @@ module StillActive
           return [:unassessable, {ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url}]
         end
 
-        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version}]
+        # The input's own PURL, kept verbatim rather than parsed-and-rebuilt. An
+        # enriched SBOM re-emits it unchanged, so whatever a consumer matched on
+        # the input it matches on our output, and no per-ecosystem PURL
+        # reconstruction (npm scopes, maven group:artifact, go module paths) can
+        # get it subtly wrong.
+        [:dependency, {ecosystem: ecosystem, name: full_name, version: parsed.version, purl: preserved_purl(purl)}]
       elsif NOISE_TYPES.include?(type)
         nil # CI actions / opaque binaries: not a package dependency
       else
@@ -161,6 +261,21 @@ module StillActive
       [:unassessable, {ecosystem: nil, name: name, reason: :malformed_purl}]
     end
 
+    # The input's PURL, kept for re-emission in an enriched SBOM, with Syft's
+    # `package-id` qualifier removed. That qualifier is Syft's internal per-location
+    # bookkeeping rather than part of the package's identity, and it is why the same
+    # package can appear twice under two different PURLs; dropping it is what lets
+    # those copies still collapse. Everything else is left byte-identical rather than
+    # re-serialized through PackageURL, so a consumer that matched the input PURL
+    # matches ours, with no chance of a normalization changing the encoding.
+    def preserved_purl(purl)
+      base, separator, query = purl.partition("?")
+      return purl if separator.empty?
+
+      kept = query.split("&").reject { |pair| pair.start_with?("package-id=") }
+      kept.empty? ? base : "#{base}?#{kept.join("&")}"
+    end
+
     # Whether a repository_url points at a known public registry. We only read the
     # host; we never connect to it (a lockfile/SBOM-derived URL is untrusted). An
     # unparseable or non-public host reads as private, failing safe.

data/lib/still_active/sbom_workflow.rb

@@ -3,8 +3,8 @@
 require_relative "ecosystem_lens"
 require_relative "ceiling_reconciler"
 require_relative "poison_security_correlator"
-require_relative "../helpers/python_helper"
-require_relative "../helpers/dotnet_helper"
+require_relative "helpers/python_helper"
+require_relative "helpers/dotnet_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -62,7 +62,7 @@ module StillActive
             # otherwise): absent stays "unknown", never a false that reads as test-only.
             result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
               EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, runtime_ranges: runtime_ranges)
-                .merge(dep.slice(:production))
+                .merge(dep.slice(:production, :direct, :dependency_path, :purl))
           rescue => e
             # One dependency's failure must not abort the audit, but it must not
             # disappear either: record it as an unassessable entry (same shape as
@@ -70,7 +70,7 @@ module StillActive
             # production rides along (when known, via slice) so a failed prod dep
             # stays distinguishable from a failed dev one.
             failures << {ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}"}
-              .merge(dep.slice(:production))
+              .merge(dep.slice(:production, :direct, :dependency_path, :purl))
             warn("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
           ensure
             completed += 1

data/lib/still_active/suppressions.rb

@@ -16,7 +16,7 @@ module StillActive
   # name an explicit advisory id, so a newly disclosed CVE on the same gem is
   # never pre-silenced.
   class Suppressions
-    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling].freeze
+    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling, :deprecated].freeze
 
     Entry = Struct.new(:gem, :advisory, :signal, :reason, :expires, keyword_init: true) do
       def whole_gem?
@@ -76,14 +76,16 @@ module StillActive
           return false
         end
         if signal && !GATEABLE_SIGNALS.include?(signal)
-          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected activity, vulnerability, libyear, or poison)"
+          # Listed from the constant rather than spelled out: the hand-written
+          # version had already drifted (it never mentioned language_ceiling).
+          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected #{GATEABLE_SIGNALS.join(", ")})"
           return false
         end
         if signal == :vulnerability && advisory.nil?
           warnings << "ignoring vulnerability suppression for #{label}: must name an advisory id so newly disclosed advisories still surface"
           return false
         end
-        if [:activity, :libyear, :poison].include?(signal) && gem.nil?
+        if [:activity, :libyear, :poison, :deprecated].include?(signal) && gem.nil?
           warnings << "ignoring #{signal} suppression: must name a gem"
           return false
         end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "3.0.0.rc6"
+  VERSION = "3.1.0"
 end

data/lib/still_active/workflow.rb

@@ -12,17 +12,17 @@ require_relative "forgejo_client"
 require_relative "github_client"
 require_relative "gitlab_client"
 require_relative "repository"
-require_relative "../helpers/activity_helper"
-require_relative "../helpers/alternatives_helper"
-require_relative "../helpers/catalog_index"
-require_relative "../helpers/constraint_helper"
-require_relative "../helpers/http_helper"
-require_relative "../helpers/libyear_helper"
-require_relative "../helpers/ruby_advisory_db"
-require_relative "../helpers/ruby_helper"
-require_relative "../helpers/runtime_ceiling_helper"
-require_relative "../helpers/version_helper"
-require_relative "../helpers/vulnerability_helper"
+require_relative "helpers/activity_helper"
+require_relative "helpers/alternatives_helper"
+require_relative "helpers/catalog_index"
+require_relative "helpers/constraint_helper"
+require_relative "helpers/http_helper"
+require_relative "helpers/libyear_helper"
+require_relative "helpers/ruby_advisory_db"
+require_relative "helpers/ruby_helper"
+require_relative "helpers/runtime_ceiling_helper"
+require_relative "helpers/version_helper"
+require_relative "helpers/vulnerability_helper"
 require "async"
 require "async/barrier"
 require "async/semaphore"
@@ -390,6 +390,12 @@ module StillActive
       {
         scorecard_score: scorecard&.dig(:score),
         scorecard_maintained: scorecard&.dig(:maintained),
+        # The maintainer's own "stop using this" declaration, from the same
+        # response as the advisories. RubyGems has no deprecation mechanism, so
+        # this is effectively always false for gems today; it is threaded anyway
+        # so the field means the same thing on both paths.
+        deprecated: info&.dig(:deprecated) == true,
+        deprecation_reason: info&.dig(:deprecation_reason),
         vulnerability_count: vulnerabilities.length,
         vulnerabilities: vulnerabilities
       }

data/still_active.gemspec

@@ -55,12 +55,12 @@ Gem::Specification.new do |spec|
   # carry an artificial floor.
   spec.add_runtime_dependency("async", ">= 2.2")
   spec.add_runtime_dependency("bundler", ">= 2.0")
-  # cvss-suite (CVSS v4.0 base-score from an OSV vector, for the CVSS-4-only advisory
-  # deps.dev can't score) is an OPTIONAL dependency, NOT declared here: it exact-pins
-  # bundler and caps bigdecimal, the poison-pill pattern still_active flags, so we
-  # won't force it on users or trip our own audit. CvssHelper soft-requires it; absent,
-  # the OSV/GHSA severity label still carries gating + level and the number is skipped.
-  # Install cvss-suite (or run the distribution that bundles it) to light up the number.
+  # CVSS base score from an OSV vector, for the CVSS-4-only advisory deps.dev can't
+  # score. 5.0 is the floor because it is the first release without the poison-pill
+  # constraints (a Ruby 2.6 floor, a bigdecimal cap, an exact bundler pin) that kept
+  # it optional through 3.0; 5.0 also adds base_score on CVSS 4.0, which is the API
+  # CvssHelper reads.
+  spec.add_runtime_dependency("cvss-suite", ">= 5.0")
   spec.add_runtime_dependency("faraday-retry")
   spec.add_runtime_dependency("gems")
   spec.add_runtime_dependency("octokit")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: still_active
 version: !ruby/object:Gem::Version
-  version: 3.0.0.rc6
+  version: 3.1.0
 platform: ruby
 authors:
 - Sean Floyd
@@ -37,6 +37,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: cvss-suite
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: faraday-retry
   requirement: !ruby/object:Gem::Requirement
@@ -133,38 +147,6 @@ files:
 - LICENSE.txt
 - README.md
 - bin/still_active
-- lib/helpers/activity_helper.rb
-- lib/helpers/alternatives_helper.rb
-- lib/helpers/ansi_helper.rb
-- lib/helpers/bot_context.rb
-- lib/helpers/bundler_helper.rb
-- lib/helpers/catalog_index.rb
-- lib/helpers/constraint_helper.rb
-- lib/helpers/cvss_helper.rb
-- lib/helpers/cyclonedx_helper.rb
-- lib/helpers/dependency_helper.rb
-- lib/helpers/diff_markdown_helper.rb
-- lib/helpers/dotnet_helper.rb
-- lib/helpers/emoji_helper.rb
-- lib/helpers/endoflife_helper.rb
-- lib/helpers/http_helper.rb
-- lib/helpers/libyear_helper.rb
-- lib/helpers/lockfile_dependency_parser.rb
-- lib/helpers/lockfile_indexer.rb
-- lib/helpers/markdown_escape.rb
-- lib/helpers/markdown_helper.rb
-- lib/helpers/pep440_helper.rb
-- lib/helpers/python_helper.rb
-- lib/helpers/ruby_advisory_db.rb
-- lib/helpers/ruby_helper.rb
-- lib/helpers/runtime_ceiling_helper.rb
-- lib/helpers/sarif_helper.rb
-- lib/helpers/semver_satisfaction.rb
-- lib/helpers/status_helper.rb
-- lib/helpers/summary_helper.rb
-- lib/helpers/terminal_helper.rb
-- lib/helpers/version_helper.rb
-- lib/helpers/vulnerability_helper.rb
 - lib/still_active.rb
 - lib/still_active/artifactory_client.rb
 - lib/still_active/ceiling_reconciler.rb
@@ -181,6 +163,39 @@ files:
 - lib/still_active/forgejo_client.rb
 - lib/still_active/github_client.rb
 - lib/still_active/gitlab_client.rb
+- lib/still_active/helpers/activity_helper.rb
+- lib/still_active/helpers/alternatives_helper.rb
+- lib/still_active/helpers/ansi_helper.rb
+- lib/still_active/helpers/bot_context.rb
+- lib/still_active/helpers/bundler_helper.rb
+- lib/still_active/helpers/catalog_index.rb
+- lib/still_active/helpers/constraint_helper.rb
+- lib/still_active/helpers/cvss_helper.rb
+- lib/still_active/helpers/cyclonedx_helper.rb
+- lib/still_active/helpers/dependency_helper.rb
+- lib/still_active/helpers/diff_markdown_helper.rb
+- lib/still_active/helpers/dotnet_helper.rb
+- lib/still_active/helpers/emoji_helper.rb
+- lib/still_active/helpers/endoflife_helper.rb
+- lib/still_active/helpers/http_helper.rb
+- lib/still_active/helpers/libyear_helper.rb
+- lib/still_active/helpers/lockfile_dependency_parser.rb
+- lib/still_active/helpers/lockfile_indexer.rb
+- lib/still_active/helpers/markdown_escape.rb
+- lib/still_active/helpers/markdown_helper.rb
+- lib/still_active/helpers/pep440_helper.rb
+- lib/still_active/helpers/python_helper.rb
+- lib/still_active/helpers/ruby_advisory_db.rb
+- lib/still_active/helpers/ruby_helper.rb
+- lib/still_active/helpers/runtime_ceiling_helper.rb
+- lib/still_active/helpers/sarif_helper.rb
+- lib/still_active/helpers/sbom_graph.rb
+- lib/still_active/helpers/semver_satisfaction.rb
+- lib/still_active/helpers/status_helper.rb
+- lib/still_active/helpers/summary_helper.rb
+- lib/still_active/helpers/terminal_helper.rb
+- lib/still_active/helpers/version_helper.rb
+- lib/still_active/helpers/vulnerability_helper.rb
 - lib/still_active/options.rb
 - lib/still_active/osv_client.rb
 - lib/still_active/poison_security_correlator.rb

data/lib/helpers/cvss_helper.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module StillActive
-  # Computes a CVSS score from a vector string, across v2/v3/v4. deps.dev stores only
-  # CVSS 3.x, so a CVSS-4-only advisory (the flagship protobuf case) arrives with no
-  # numeric score; OSV carries the v4 vector, and this turns it into the number the
-  # SARIF security-severity and CycloneDX rating want.
-  #
-  # cvss-suite is an OPTIONAL, undeclared dependency: it over-constrains its own deps
-  # (an exact `bundler` pin, a `bigdecimal ~> 3.1` cap), the poison-pill pattern
-  # still_active itself flags, so hard-requiring it would force that liability on every
-  # user and trip our own audit. CvssHelper soft-requires it; install cvss-suite (or run
-  # the distribution that bundles it) to light it up.
-  #
-  # Returns cvss-suite's `overall_score`: for the base-only vectors OSV publishes that
-  # IS the base score, but a vector carrying threat/environmental metrics would fold
-  # those in -- which is why the severity band floors at the authoritative GHSA label
-  # (VulnerabilityHelper.advisory_severity) and this number never lowers it: the label
-  # drives gating and SARIF level, the number only sharpens display. Fails safe: an
-  # absent gem or an absent/unparseable vector yields nil, never a crash.
-  module CvssHelper
-    extend self
-
-    def score(vector)
-      return unless available?
-      return if vector.nil? || vector.to_s.empty?
-
-      cvss = CvssSuite.new(vector.to_s)
-      cvss.valid? ? cvss.overall_score : nil
-    rescue => e
-      # We only reach here with cvss-suite loaded (available?), so a raise is the
-      # installed gem failing this call site -- an incompatible version, a renamed
-      # `overall_score` -- not a bad vector, which cvss-suite reports via valid?.
-      # Fail safe to nil (the number is display-only, never gates), but don't
-      # swallow it: an opted-in-but-broken scorer that emitted nothing would read
-      # as "no advisories are scored". Warn once per run (not per advisory),
-      # matching OsvClient.enrich rather than staying silent.
-      warn_scorer_failed(e)
-      nil
-    end
-
-    # Memoized soft-require: true once cvss-suite loads, false when it isn't installed.
-    def available?
-      return @available unless @available.nil?
-
-      @available = begin
-        require "cvss_suite"
-        true
-      rescue LoadError
-        false
-      end
-    end
-
-    private
-
-    def warn_scorer_failed(error)
-      return if @warned
-
-      @warned = true
-      warn("warning: cvss-suite scoring failed: #{error.class} (#{error.message}); CVSS numbers unavailable this run, check your cvss-suite version")
-    end
-  end
-end