@cdxgen/cdxgen 0.0.1 → 13.0.0

package/lib/validator/reporters/sarif.js

@@ -0,0 +1,184 @@
+/**
+ * SARIF 2.1.0 reporter — renders findings as a SARIF log suitable for upload
+ * to GitHub code scanning or any other SARIF-aware consumer.
+ *
+ * No external dependencies. Spec: https://docs.oasis-open.org/sarif/sarif/v2.1.0/
+ */
+
+const SARIF_VERSION = "2.1.0";
+const SARIF_SCHEMA =
+  "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/Schemata/sarif-schema-2.1.0.json";
+
+/**
+ * Map internal severity → SARIF `level` property.
+ *
+ * @param {string} severity
+ * @returns {"error" | "warning" | "note"}
+ */
+function severityToLevel(severity) {
+  switch (severity) {
+    case "critical":
+    case "high":
+      return "error";
+    case "medium":
+      return "warning";
+    default:
+      return "note";
+  }
+}
+
+/**
+ * Convert an internal location to a SARIF physicalLocation block. Returns null
+ * when there is no file context — the caller will fall back to a synthetic
+ * location.
+ *
+ * @param {object} loc
+ * @returns {object | null}
+ */
+function toSarifLocation(loc) {
+  if (!loc) return null;
+  if (loc.file) {
+    return {
+      physicalLocation: {
+        artifactLocation: { uri: loc.file },
+      },
+      logicalLocations: loc.bomRef
+        ? [{ fullyQualifiedName: loc.bomRef, kind: "package" }]
+        : undefined,
+    };
+  }
+  if (loc.purl || loc.bomRef) {
+    return {
+      logicalLocations: [
+        {
+          fullyQualifiedName: loc.purl || loc.bomRef,
+          kind: "package",
+        },
+      ],
+    };
+  }
+  return null;
+}
+
+/**
+ * Build the SARIF `rules` array from a catalogue of rule descriptors.
+ *
+ * @param {Array<object>} findings
+ * @returns {Array<object>}
+ */
+function deriveRules(findings) {
+  const byId = new Map();
+  for (const f of findings) {
+    if (byId.has(f.ruleId)) continue;
+    byId.set(f.ruleId, {
+      id: f.ruleId,
+      name: f.name || f.ruleId,
+      shortDescription: { text: f.name || f.ruleId },
+      fullDescription: {
+        text: f.description || f.name || f.ruleId,
+      },
+      defaultConfiguration: { level: severityToLevel(f.severity) },
+      properties: {
+        category: f.category,
+        standard: f.standard,
+        standardRefs: f.standardRefs || [],
+        scvsLevels: f.scvsLevels || [],
+        automatable: f.automatable !== false,
+        engine: f.engine,
+      },
+      help: f.mitigation
+        ? {
+            text: f.mitigation,
+            markdown: `**Remediation:** ${f.mitigation}`,
+          }
+        : undefined,
+    });
+  }
+  return [...byId.values()];
+}
+
+/**
+ * Convert one finding into a SARIF result.
+ *
+ * @param {object} f
+ * @returns {object}
+ */
+function toSarifResult(f) {
+  const locations = (f.locations || []).map(toSarifLocation).filter(Boolean);
+  if (locations.length === 0) {
+    locations.push({
+      logicalLocations: [{ fullyQualifiedName: f.ruleId, kind: "rule" }],
+    });
+  }
+  const result = {
+    ruleId: f.ruleId,
+    level: severityToLevel(f.severity),
+    message: { text: f.message || f.name || f.ruleId },
+    locations,
+    properties: {
+      status: f.status,
+      severity: f.severity,
+      standard: f.standard,
+      standardRefs: f.standardRefs || [],
+      scvsLevels: f.scvsLevels || [],
+      automatable: f.automatable !== false,
+      engine: f.engine,
+    },
+  };
+  if (f.evidence && typeof f.evidence === "object") {
+    result.properties.evidence = f.evidence;
+  }
+  return result;
+}
+
+/**
+ * Render a validation report as SARIF.
+ *
+ * @param {object} report Output of validateBomAdvanced().
+ * @param {object} [options]
+ * @param {string} [options.toolName]    Override driver name.
+ * @param {string} [options.toolVersion] Driver version to embed.
+ * @param {boolean} [options.includeManual] Include manual-review findings (default false).
+ * @returns {string}
+ */
+export function render(report, options = {}) {
+  const {
+    toolName = "cdx-validate",
+    toolVersion = "v13",
+    includeManual = false,
+  } = options;
+  const findings = (report.findings || []).filter((f) =>
+    includeManual ? true : f.status !== "manual",
+  );
+  const log = {
+    $schema: SARIF_SCHEMA,
+    version: SARIF_VERSION,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: toolName,
+            version: toolVersion,
+            informationUri: "https://cdxgen.github.io/cdxgen/",
+            rules: deriveRules(findings),
+          },
+        },
+        invocations: [
+          {
+            executionSuccessful:
+              report.summary?.fail === 0 && report.schemaValid !== false,
+          },
+        ],
+        results: findings.map(toSarifResult),
+        properties: {
+          schemaValid: report.schemaValid,
+          deepValid: report.deepValid,
+          signatureVerified: report.signatureVerified ?? null,
+          summary: report.summary,
+          benchmarks: report.benchmarks || [],
+        },
+      },
+    ],
+  };
+  return JSON.stringify(log, null, null);
+}

package/package.json

@@ -1,42 +1,225 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "0.0.1",
-  "description": "Name placeholder for cdxgen v13. Install @cyclonedx/cdxgen until v13.0.0 is released.",
-  "license": "Apache-2.0",
-  "author": "Prabhu Subramanian <prabhu@appthreat.com>",
-  "homepage": "https://cdxgen.github.io/cdxgen/",
+  "version": "13.0.0",
+  "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
+  "keywords": [
+    "sbom",
+    "bom",
+    "inventory",
+    "spdx",
+    "package-url",
+    "purl",
+    "owasp",
+    "component",
+    "dependency",
+    "appsec",
+    "scrm"
+  ],
+  "homepage": "http://github.com/cdxgen/cdxgen",
+  "bugs": {
+    "url": "https://github.com/cdxgen/cdxgen/issues"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/cdxgen/cdxgen.git"
   },
-  "bugs": {
-    "url": "https://github.com/cdxgen/cdxgen/issues"
-  },
+  "license": "Apache-2.0",
+  "author": "Prabhu Subramanian <prabhu@appthreat.com>",
+  "contributors": [
+    {
+      "name": "Erlend Oftedal"
+    },
+    {
+      "name": "Steve Springett",
+      "email": "steve.springett@owasp.org",
+      "url": "https://about.me/stevespringett"
+    },
+    {
+      "name": "Prabhu Subramanian",
+      "url": "https://github.com/prabhu"
+    },
+    {
+      "name": "Adam Setch",
+      "url": "https://github.com/setchy"
+    },
+    {
+      "name": "Roland Asmann",
+      "url": "https://github.com/malice00"
+    }
+  ],
   "type": "module",
   "exports": {
     ".": {
-      "types": "./mod.d.ts",
-      "default": "./mod.js"
+      "import": "./lib/cli/index.js",
+      "types": "./types/lib/cli/index.d.ts",
+      "require": "./index.cjs"
+    },
+    "./evinser/*": {
+      "import": "./lib/evinser/*.js",
+      "types": "./types/lib/evinser/*.d.ts"
+    },
+    "./core/*": {
+      "import": "./lib/core/*.js",
+      "types": "./types/lib/core/*.d.ts"
+    },
+    "./ecosystems/*": {
+      "import": "./lib/ecosystems/*.js",
+      "types": "./types/lib/ecosystems/*.d.ts"
+    },
+    "./inventory/*": {
+      "import": "./lib/inventory/*.js",
+      "types": "./types/lib/inventory/*.d.ts"
+    },
+    "./helpers/*": {
+      "import": "./lib/helpers/*.js",
+      "types": "./types/lib/helpers/*.d.ts"
+    },
+    "./managers/*": {
+      "import": "./lib/managers/*.js",
+      "types": "./types/lib/managers/*.d.ts"
+    },
+    "./parsers/*": {
+      "import": "./lib/parsers/*.js",
+      "types": "./types/lib/parsers/*.d.ts"
+    },
+    "./stages/postgen/*": {
+      "import": "./lib/stages/postgen/*.js",
+      "types": "./types/lib/stages/postgen/*.d.ts"
+    },
+    "./stages/pregen/*": {
+      "import": "./lib/stages/pregen/*.js",
+      "types": "./types/lib/stages/pregen/*.d.ts"
     }
   },
+  "types": "./types/lib/cli/index.d.ts",
+  "bin": {
+    "aibom": "bin/cdxgen.js",
+    "cbom": "bin/cdxgen.js",
+    "cdx-audit": "bin/audit.js",
+    "cdx-convert": "bin/convert.js",
+    "cdx-validate": "bin/validate.js",
+    "cdx-verify": "bin/verify.js",
+    "cdx-sign": "bin/sign.js",
+    "cdxgen": "bin/cdxgen.js",
+    "cdxgen-secure": "bin/cdxgen.js",
+    "cdxi": "bin/repl.js",
+    "evinse": "bin/evinse.js",
+    "hbom": "bin/hbom.js",
+    "obom": "bin/cdxgen.js",
+    "tracebom": "bin/tracebom.js",
+    "saasbom": "bin/cdxgen.js",
+    "spdxgen": "bin/cdxgen.js"
+  },
   "files": [
-    "mod.js",
-    "mod.d.ts",
-    "README.md",
-    "LICENSE"
+    "*.js",
+    "lib/**",
+    "bin/",
+    "!bin/*.poku.js",
+    "!lib/**/*.poku.js",
+    "!lib/third-party/arborist/snapshots/",
+    "data/",
+    "types/",
+    "!types/*.tsbuildinfo",
+    "index.cjs"
   ],
+  "dependencies": {
+    "@babel/parser": "8.0.4",
+    "@babel/traverse": "8.0.4",
+    "@cdxgen/cdx-purl": "0.0.5",
+    "@iarna/toml": "2.2.5",
+    "@isaacs/string-locale-compare": "1.1.0",
+    "@npmcli/fs": "6.0.0",
+    "@npmcli/map-workspaces": "6.0.0",
+    "@npmcli/name-from-folder": "5.0.0",
+    "@npmcli/package-json": "8.0.0",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "common-ancestor-path": "2.0.0",
+    "edn-data": "1.2.2",
+    "glob": "13.0.6",
+    "node-stream-zip": "1.16.0",
+    "npm-package-arg": "14.0.0",
+    "parse-conflict-json": "6.0.0",
+    "semver": "7.8.5",
+    "ssri": "14.0.0",
+    "tar": "7.5.22",
+    "treeverse": "3.0.0",
+    "undici": "8.10.0",
+    "walk-up-path": "4.0.0",
+    "yaml": "2.9.0",
+    "yargs": "18.1.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.7",
+    "esmock": "2.7.6",
+    "poku": "4.5.0",
+    "sinon": "22.1.0",
+    "typescript": "^7.0.2"
+  },
+  "optionalDependencies": {
+    "@appthreat/atom": "3.1.1",
+    "@appthreat/atom-parsetools": "1.3.0",
+    "@bufbuild/protobuf": "2.13.0",
+    "@cdxgen/cdx-hbom": "0.5.1",
+    "@cdxgen/cdx-proto": "2.2.0",
+    "@cdxgen/cdxgen-plugins-bin": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "3.0.3",
+    "@cdxgen/safer-exec": "0.15.0",
+    "body-parser": "2.3.0",
+    "compression": "1.8.1",
+    "connect": "3.7.0",
+    "jsonata": "2.2.2"
+  },
   "engines": {
-    "node": ">=24"
+    "node": ">=24",
+    "pnpm": ">=11"
   },
-  "publishConfig": {
-    "access": "public",
-    "tag": "placeholder"
+  "devEngines": {
+    "runtime": [
+      {
+        "name": "node",
+        "version": ">=24",
+        "onFail": "ignore"
+      },
+      {
+        "name": "bun",
+        "version": "1.3.14",
+        "onFail": "ignore"
+      },
+      {
+        "name": "deno",
+        "version": "2.8.3",
+        "onFail": "ignore"
+      }
+    ]
   },
-  "keywords": [
-    "sbom",
-    "cyclonedx",
-    "cdxgen",
-    "placeholder"
-  ],
-  "types": "./mod.d.ts"
-}
+  "scripts": {
+    "check:boundaries": "node contrib/check-boundaries.js",
+    "check:lib-paths": "node contrib/check-lib-paths.js",
+    "check:validators": "node contrib/gen-validators.mjs --check",
+    "check:vendor-arborist": "node contrib/check-vendored-arborist.js",
+    "gen-types": "pnpm exec tsc",
+    "gen:validators": "node contrib/gen-validators.mjs",
+    "install:frozen": "pnpm install --config.strict-dep-builds=true --frozen-lockfile --package-import-method copy",
+    "install:prod": "pnpm install --config.strict-dep-builds=true --frozen-lockfile --package-import-method copy --prod",
+    "lint": "biome check --write",
+    "lint:check": "biome check",
+    "lint:errors": "biome check --diagnostic-level=error",
+    "test": "poku",
+    "test:bun": "node contrib/alt-runtime-tests.js bun",
+    "test:deno": "deno task test",
+    "test:deno:unit": "node contrib/alt-runtime-tests.js deno",
+    "test:golden": "node contrib/golden-runner.js && node contrib/mutation-tests.js && node contrib/shuffle-tests.js && node contrib/cassette-metadata-tests.js && node contrib/fetch-parity-test.js",
+    "test:rs-disable": "node contrib/rs-disable-golden-test.js",
+    "watch": "poku --watch"
+  }
+}

package/types/bin/audit.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=audit.d.ts.map

package/types/bin/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../bin/audit.js"],"names":[],"mappings":""}

package/types/bin/cdxgen.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cdxgen.d.ts.map

package/types/bin/cdxgen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdxgen.d.ts","sourceRoot":"","sources":["../../bin/cdxgen.js"],"names":[],"mappings":""}

package/types/bin/convert.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=convert.d.ts.map

package/types/bin/convert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"convert.d.ts","sourceRoot":"","sources":["../../bin/convert.js"],"names":[],"mappings":""}

package/types/bin/evinse.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=evinse.d.ts.map

package/types/bin/evinse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evinse.d.ts","sourceRoot":"","sources":["../../bin/evinse.js"],"names":[],"mappings":""}

package/types/bin/hbom.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=hbom.d.ts.map

package/types/bin/hbom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hbom.d.ts","sourceRoot":"","sources":["../../bin/hbom.js"],"names":[],"mappings":""}

package/types/bin/repl.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export declare const importSbom: (sbomOrPath: any) => Promise<void>;
+//# sourceMappingURL=repl.d.ts.map

package/types/bin/repl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repl.d.ts","sourceRoot":"","sources":["../../bin/repl.js"],"names":[],"mappings":";AAmaA,eAAO,MAAM,UAAU,oCAyEtB,CAAC"}

package/types/bin/sign.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=sign.d.ts.map

package/types/bin/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../bin/sign.js"],"names":[],"mappings":""}

package/types/bin/tracebom.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=tracebom.d.ts.map

package/types/bin/tracebom.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tracebom.d.ts","sourceRoot":"","sources":["../../bin/tracebom.js"],"names":[],"mappings":""}

package/types/bin/validate.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * cdx-validate CLI — structural, deep, and compliance validation for
+ * CycloneDX SBOMs.
+ *
+ * Exit codes:
+ *   0 — all checks pass (or no findings >= --fail-severity).
+ *   1 — configuration error (bad input, missing file, unknown reporter).
+ *   2 — schema validation failed (in --strict mode).
+ *   3 — compliance findings at or above --fail-severity.
+ *   4 — signature verification was requested and failed.
+ */
+export {};
+//# sourceMappingURL=validate.d.ts.map

package/types/bin/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../bin/validate.js"],"names":[],"mappings":";AAEA;;;;;;;;;;GAUG"}

package/types/bin/verify.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verify.d.ts.map

package/types/bin/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../bin/verify.js"],"names":[],"mappings":""}