@cdxgen/cdxgen 13.0.0 → 13.0.1

package/lib/ecosystems/utils.js

@@ -1,7 +1,7 @@
 /**
  * Deprecated re-export barrel.
  *
- * `utils.js` declares nothing of its own. It re-exports the 261 public names that
+ * `utils.js` declares nothing of its own. It re-exports every public name that
  * used to live here so existing imports keep working for one major version. Each
  * implementation, and its JSDoc, now lives in the leaf module it was moved to
  * (`purl.js`, `spdx.js`, `deps.js`, `ecosystems.js`, `parsers-*.js`, `core-*.js`,
@@ -191,11 +191,13 @@ import {
 import { getMavenCommand, getMillCommand } from "./gradleutils.js";
 import { createNpmWorkspacePurl } from "./npmutils.js";
 import {
+  getCentralPackageVersions,
   getPropertyGroupTextNodes,
   parseCsPkgData,
   parseCsPkgLockData,
   parseCsProjAssetsData,
   parseCsProjData,
+  parseDirectoryPackagesProps,
   parseNupkg,
   parseNuspecData,
   parsePaketLockData,
@@ -220,12 +222,14 @@ import {
   parsePackageJsonName,
   parsePkgJson,
   parsePkgLock,
+  parsePnpmAliasRef,
   parsePnpmLock,
   parsePnpmWorkspace,
   parseYarnLock,
   parseYarnWorkspace,
   pnpmMetadata,
   splitCommandArgs,
+  stripPnpmPeerSuffix,
   yarnLockToIdentMap,
 } from "./parsers-js.js";
 import {
@@ -369,6 +373,7 @@ export {
   getAllFiles,
   getAllFilesWithIgnore,
   getAtomCommand,
+  getCentralPackageVersions,
   getCratesMetadata,
   getDartMetadata,
   getDefaultBomAuditCategories,
@@ -465,6 +470,7 @@ export {
   parseCsProjAssetsData,
   parseCsProjData,
   parseCUsageSlice,
+  parseDirectoryPackagesProps,
   parseEdnData,
   parseFlakeLock,
   parseFlakeNix,
@@ -503,6 +509,7 @@ export {
   parsePixiTomlFile,
   parsePkgJson,
   parsePkgLock,
+  parsePnpmAliasRef,
   parsePnpmLock,
   parsePnpmWorkspace,
   parsePodfileLock,
@@ -565,6 +572,7 @@ export {
   shouldFetchVCS,
   shouldRunPredictiveBomAudit,
   splitCommandArgs,
+  stripPnpmPeerSuffix,
   TABLE_BORDER_STYLE,
   TIMEOUT_MS,
   toCamel,

package/lib/inventory/envcontext.js

@@ -31,6 +31,7 @@ import {
   safeExistsSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
 import { applyPurl, tryBuildPurl } from "./purl.js";
 
@@ -919,9 +920,12 @@ export function bundleInstallWithDocker(rubyVersion, cdxgenGemHome, filePath) {
     "install",
   ];
   console.log(`Performing bundle install with: ${ociCmd}`);
+  // The container's own output is a diagnostic. Inheriting stdout would let it
+  // interleave with the BOM document when the caller asked for `-o -`, so the
+  // child's stdout is pointed at the diagnostic stream instead.
   const result = safeSpawnSync(ociCmd, ociArgs, {
     shell: isWin,
-    stdio: "inherit",
+    stdio: ["inherit", diagnosticStream, "inherit"],
   });
   if (result.error || result.status !== 0) {
     return false;

package/lib/inventory/osinfo.js

@@ -86,6 +86,112 @@ export const OS_DISTRO_ALIAS = {
   "red hat enterprise linux 10": "rhel-10",
 };
 
+/**
+ * Canonical purl namespace for distro vendors that are published under more
+ * than one spelling. Both the os-release path (`getDistroInfo`) and the trivy
+ * passthrough in `lib/managers/binary.js` route through this single map so the
+ * two paths cannot drift apart again.
+ *
+ * Azure Linux 2.0 is CBL-Mariner 2.0 — Microsoft renamed the product — and the
+ * OSV feed publishes `pkg:rpm/azure-linux/<name>` for every generation
+ * (ecosystems "Azure Linux:2" and "Azure Linux:3"), so the historical
+ * spellings azurelinux, cbl-mariner and mariner all canonicalise to
+ * "azure-linux". rhel/ol/amzn/opensuse-* are the cases previously inlined in
+ * getDistroInfo(); alma/rocky-linux were previously inlined in binary.js.
+ *
+ * Amazon Linux canonicalises to "amazon", the spelling the vulnerability feeds
+ * publish (AppThreat vuln-list `amazon`): the os-release ID is `amzn` and
+ * trivy emits `amazon`, and the previous `amazonlinux` mapping here matched
+ * neither, so live-host Amazon Linux purls matched nothing at all.
+ */
+export const OS_NAMESPACE_ALIAS = {
+  alma: "almalinux",
+  amazonlinux: "amazon",
+  amzn: "amazon",
+  azurelinux: "azure-linux",
+  "cbl-mariner": "azure-linux",
+  mariner: "azure-linux",
+  ol: "oracle",
+  "opensuse-leap": "opensuse",
+  "opensuse-tumbleweed": "opensuse",
+  rhel: "redhat",
+  "rocky-linux": "rocky",
+};
+
+/**
+ * Vendor prefixes that `distro` qualifier values are canonicalised for, so one
+ * release has exactly one qualifier value no matter which side produced it.
+ *
+ * trivy stamps the qualifier from its own distro table while cdxgen stamps it
+ * from os-release, and the two disagree: an Oracle Linux 9.8 image came out
+ * with `oracle-9.8` on 99 components and `ol-9.8` on 43, and a RHEL 9.8 image
+ * with namespace `redhat` but qualifier `rhel-9.8`. Canonicalising both sides
+ * through this map collapses each release onto the vendor its purl namespace
+ * already uses.
+ *
+ * SUSE is deliberately absent. `sles-15.6`, `opensuse-leap-15.6` and
+ * `opensuse-tumbleweed-<snapshot>` are the values consumers derive the release
+ * channel from (vulnerability-db maps them to per-release channels), and both
+ * sides already agree on them; folding Leap and Tumbleweed onto a bare
+ * `opensuse-` vendor would destroy exactly the distinction that matters.
+ *
+ * Keys are matched longest-first so `cbl-mariner-2.0` resolves against the
+ * full vendor segment rather than a shorter prefix.
+ */
+export const OS_DISTRO_QUALIFIER_ALIAS = {
+  alma: "almalinux",
+  amazonlinux: "amazon",
+  amzn: "amazon",
+  azurelinux: "azure-linux",
+  "cbl-mariner": "azure-linux",
+  mariner: "azure-linux",
+  ol: "oracle",
+  rhel: "redhat",
+  "rocky-linux": "rocky",
+};
+
+// A distro qualifier reaches a purl verbatim, so anything outside the purl
+// qualifier charset makes the whole purl — and with it the whole BOM —
+// invalid. trivy emits Amazon Linux as
+// `amazon-2023.12.20260727+(Amazon Linux)`, which failed cdxgen's own schema
+// validation and cost the entire SBOM.
+const SAFE_DISTRO_QUALIFIER = /^[A-Za-z0-9._-]+$/;
+
+/**
+ * Whether a `distro` qualifier value is safe to place in a purl unencoded.
+ *
+ * @param {string} qualifier - distro qualifier value
+ * @returns {boolean} true when the value contains only purl-safe characters
+ */
+export function isCleanDistroQualifier(qualifier) {
+  return !!qualifier && SAFE_DISTRO_QUALIFIER.test(qualifier);
+}
+
+const OS_DISTRO_QUALIFIER_ALIAS_KEYS = Object.keys(
+  OS_DISTRO_QUALIFIER_ALIAS,
+).sort((a, b) => b.length - a.length);
+
+/**
+ * Canonicalise the vendor prefix of a `distro` qualifier value
+ * (e.g. "cbl-mariner-2.0" or "mariner-2.0" -> "azure-linux-2.0") so a release
+ * has exactly one qualifier spelling regardless of which tool emitted it.
+ * Values without a known vendor prefix are returned unchanged.
+ *
+ * @param {string} qualifier - distro qualifier value such as "azurelinux-3.0"
+ * @returns {string} canonical qualifier value
+ */
+export function canonicalDistroQualifier(qualifier) {
+  if (!qualifier) {
+    return qualifier;
+  }
+  for (const key of OS_DISTRO_QUALIFIER_ALIAS_KEYS) {
+    if (qualifier.startsWith(`${key}-`)) {
+      return `${OS_DISTRO_QUALIFIER_ALIAS[key]}${qualifier.slice(key.length)}`;
+    }
+  }
+  return qualifier;
+}
+
 // ---------------------------------------------------------------------------
 // Raw os-release cache — keyed by the osRelease file path so the live-host
 // cache (/etc/os-release) and any container rootfs path are kept separate.
@@ -151,8 +257,10 @@ export function _resetOsReleaseCache() {
  *
  * Returns an object with:
  *   - purlType    {string}  "deb" | "apk" | "rpm"
- *   - namespace   {string}  purl namespace (e.g. "ubuntu", "alpine", "fedora")
- *   - distroId    {string}  ID + "-" + VERSION_ID  (e.g. "ubuntu-22.04")
+ *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
+ *                           "azure-linux" for both Azure Linux and CBL-Mariner)
+ *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
  *   - distroName  {string}  codename/alias          (e.g. "jammy")
  *
  * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
@@ -193,6 +301,9 @@ export function getDistroInfo(root = "/") {
     case "centos":
     case "rocky":
     case "almalinux":
+    case "azurelinux":
+    case "cbl-mariner":
+    case "mariner":
     case "oracle":
     case "ol":
     case "amzn":
@@ -216,19 +327,10 @@ export function getDistroInfo(root = "/") {
       break;
   }
 
-  // Determine the purl namespace (vendor)
-  let namespace = rawId;
-  if (rawId === "rhel") {
-    namespace = "redhat";
-  } else if (rawId === "ol") {
-    namespace = "oracle";
-  } else if (rawId === "amzn") {
-    namespace = "amazonlinux";
-  } else if (rawId === "opensuse-leap" || rawId === "opensuse-tumbleweed") {
-    namespace = "opensuse";
-  } else if (rawId === "almalinux") {
-    namespace = "almalinux";
-  } else if (!rawId) {
+  // Determine the purl namespace (vendor), canonicalising vendors that are
+  // published under several spellings (e.g. mariner -> azure-linux)
+  let namespace = OS_NAMESPACE_ALIAS[rawId] || rawId;
+  if (!rawId) {
     // Fallback via ID_LIKE
     if (idLike.includes("rhel") || idLike.includes("centos")) {
       namespace = "redhat";
@@ -245,8 +347,12 @@ export function getDistroInfo(root = "/") {
     }
   }
 
-  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17")
+  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17"),
+  // canonicalising the vendor prefix so one release has a single qualifier
+  // value (e.g. "mariner-2.0" and "azurelinux-3.0" -> "azure-linux-2.0"/
+  // "azure-linux-3.0")
   let distroId = versionId ? `${rawId}-${versionId}` : rawId;
+  distroId = canonicalDistroQualifier(distroId);
 
   // Special-case Alpine: truncate to major.minor
   if (purlType === "apk" && versionId) {

package/lib/inventory/table.js

@@ -2,6 +2,7 @@ import process from "node:process";
 
 import { readEnvironmentVariable } from "../core/activity.js";
 import { TABLE_BORDER_STYLE } from "../core/env.js";
+import { diagnosticStream } from "../core/logger.js";
 import {
   alignText,
   stringWidth,
@@ -218,7 +219,10 @@ export function table(rows, config = {}) {
 }
 
 /**
- * Create a streaming table writer that renders rows to stdout incrementally.
+ * Create a streaming table writer that renders rows incrementally.
+ *
+ * Rows go to the diagnostic stream: a rendered table is human-readable output,
+ * and writing it to stdout corrupted the BOM document under `-o -`.
  *
  * @param {Object} [config={}] Table configuration (header, columns, border style)
  * @returns {{write(row: *): void, end(): void}} Writer whose `end()` emits the bottom border
@@ -242,21 +246,21 @@ export function createStream(config = {}) {
         const topBorder = drawBorder(columns, borderChars, "top");
         middleBorder = drawBorder(columns, borderChars, "mid");
         bottomBorder = drawBorder(columns, borderChars, "bottom");
-        process.stdout.write(`${topBorder}\n`);
+        diagnosticStream.write(`${topBorder}\n`);
       }
       if (hasRows) {
-        process.stdout.write(`${middleBorder}\n`);
+        diagnosticStream.write(`${middleBorder}\n`);
       }
       const safeRow = Array.isArray(row) ? row : [row];
       const rendered = renderRow(safeRow, columns, borderChars);
-      process.stdout.write(`${rendered.join("\n")}\n`);
+      diagnosticStream.write(`${rendered.join("\n")}\n`);
       hasRows = true;
     },
     end() {
       if (!columns || closed) {
         return;
       }
-      process.stdout.write(`${bottomBorder}\n`);
+      diagnosticStream.write(`${bottomBorder}\n`);
       closed = true;
     },
   };

package/lib/managers/binary.js

@@ -37,7 +37,13 @@ import {
   extractToolRefs,
 } from "../inventory/evidenceUtils.js";
 import { createGtfoBinsProperties } from "../inventory/gtfobins.js";
-import { OS_DISTRO_ALIAS, readOsRelease } from "../inventory/osinfo.js";
+import {
+  canonicalDistroQualifier,
+  isCleanDistroQualifier,
+  OS_DISTRO_ALIAS,
+  OS_NAMESPACE_ALIAS,
+  readOsRelease,
+} from "../inventory/osinfo.js";
 import {
   collectExecutables,
   collectSharedLibs,
@@ -57,13 +63,6 @@ import { getDirs } from "./containerutils.js";
 
 const isWin = _platform() === "win32";
 const OS_PURL_TYPES = ["deb", "apk", "rpm", "alpm", "qpkg"];
-// Canonical distro vendor namespace. Trivy emits pkg:rpm/alma/... but the
-// vulnerability feeds (AppThreat vuln-list / dep-scan) key AlmaLinux under
-// "almalinux"; align so the purls match. Rocky is emitted as "rocky" already.
-const OS_DISTRO_NAMESPACE_ALIAS = {
-  alma: "almalinux",
-  "rocky-linux": "rocky",
-};
 const pluginRuntime = setPluginsPathEnv(resolveCdxgenPlugins());
 const platform = pluginRuntime.platform;
 const CDXGEN_PLUGINS_DIR = pluginRuntime.pluginsDir;
@@ -555,6 +554,173 @@ export function executeSourcekitten(args) {
   return undefined;
 }
 
+/**
+ * Canonicalise the distro vendor namespace of an OS package component
+ * produced by trivy, regardless of whether trivy expressed the vendor via the
+ * purl namespace or the component group (it is inconsistent between
+ * packages). e.g. pkg:rpm/alma/... -> pkg:rpm/almalinux/... and
+ * pkg:rpm/cbl-mariner/... -> pkg:rpm/azure-linux/... so the purls match the
+ * vulnerability feeds. Also aligns the ``distro`` qualifier vendor prefix
+ * (alma-9.8 -> almalinux-9.8, mariner-2.0 -> azure-linux-2.0), including
+ * spellings that disagree with the namespace, and rebuilds ``group`` and
+ * ``bom-ref`` from the rewritten purl.
+ *
+ * The namespace table is OS_NAMESPACE_ALIAS from lib/inventory/osinfo.js so
+ * the trivy path and the os-release path (getDistroInfo) cannot drift apart.
+ *
+ * A `distro` qualifier that is not purl-safe (trivy emits Amazon Linux as
+ * `amazon-2023.12.20260727+(Amazon Linux)`) is replaced with the os-release
+ * derived value, or dropped when there is none: an unusable qualifier
+ * invalidates the purl and fails validation for the whole BOM.
+ *
+ * @param {Object} comp trivy OS package component (mutated in place)
+ * @param {Object} purlObj parsed PackageURL of comp.purl (mutated in place)
+ * @param {string} name component package name (basename form)
+ * @param {string} group component group derived from the trivy component name
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {string} the canonicalised group
+ */
+export function canonicaliseOsPackageNamespace(
+  comp,
+  purlObj,
+  name,
+  group,
+  distroId,
+) {
+  if (!purlObj || !OS_PURL_TYPES.includes(purlObj.type)) {
+    return group;
+  }
+  const os_ns = purlObj.namespace || group || "";
+  const os_ns_alias = OS_NAMESPACE_ALIAS[os_ns];
+  const distroQual = purlObj.qualifiers?.distro;
+  let canonicalDistroQual = distroQual;
+  if (os_ns_alias && distroQual?.startsWith(`${os_ns}-`)) {
+    canonicalDistroQual = `${os_ns_alias}-${distroQual.slice(os_ns.length + 1)}`;
+  }
+  canonicalDistroQual = canonicalDistroQualifier(canonicalDistroQual);
+  if (canonicalDistroQual && !isCleanDistroQualifier(canonicalDistroQual)) {
+    canonicalDistroQual = isCleanDistroQualifier(distroId)
+      ? distroId
+      : undefined;
+  }
+  if (!os_ns_alias && canonicalDistroQual === distroQual) {
+    return group;
+  }
+  group = os_ns_alias || purlObj.namespace || group || "";
+  comp.group = group;
+  purlObj.namespace = group;
+  if (canonicalDistroQual !== distroQual) {
+    if (canonicalDistroQual) {
+      purlObj.qualifiers.distro = canonicalDistroQual;
+    } else {
+      delete purlObj.qualifiers.distro;
+    }
+  }
+  comp.purl = build({
+    type: purlObj.type,
+    namespace: purlObj.namespace || null,
+    name: name,
+    version: purlObj.version || null,
+    qualifiers: purlObj.qualifiers || null,
+    subpath: purlObj.subpath || null,
+  });
+  comp["bom-ref"] = decodeURIComponent(comp.purl);
+  return group;
+}
+
+/**
+ * Repair a `distro` qualifier that cannot survive purl parsing, in place.
+ *
+ * trivy stamps Amazon Linux with the full pretty version — the qualifier
+ * arrives as `distro=amazon-2023.12.20260727+%28Amazon+Linux%29`, whose spaces
+ * and parentheses `Purl.parse` rejects outright ("Invalid character in
+ * qualifier distro"). The component then bypasses every canonicalisation below
+ * (they all need a parsed purl) and reaches the BOM verbatim, where schema
+ * validation fails and the *entire* SBOM is discarded — an Amazon Linux scan
+ * produces no output at all today.
+ *
+ * The release is already known from os-release, so the unusable value is
+ * swapped for it; with no usable replacement the qualifier is dropped, since a
+ * missing qualifier costs one matching hint while an invalid one costs the
+ * whole document.
+ *
+ * @param {Object} comp component whose purl may carry an unusable qualifier
+ * @param {string} [distroId] canonical os-release distro id, e.g. "amazon-2023"
+ * @returns {Object} the same component
+ */
+export function repairOsComponentPurl(comp, distroId) {
+  const purl = comp?.purl;
+  if (!purl?.includes("distro=")) {
+    return comp;
+  }
+  const match = /([?&]distro=)([^&]*)/.exec(purl);
+  if (!match) {
+    return comp;
+  }
+  let decoded = match[2];
+  try {
+    decoded = decodeURIComponent(match[2].replace(/\+/g, " "));
+  } catch (_err) {
+    // A value that cannot even be decoded is definitely not purl-safe
+  }
+  if (isCleanDistroQualifier(decoded)) {
+    return comp;
+  }
+  const replacement = isCleanDistroQualifier(distroId)
+    ? `${match[1]}${distroId}`
+    : "";
+  comp.purl = purl.replace(match[0], replacement).replace(/\?&/, "?");
+  if (comp.purl.endsWith("?")) {
+    comp.purl = comp.purl.slice(0, -1);
+  }
+  comp["bom-ref"] = decodeURIComponent(comp.purl);
+  return comp;
+}
+
+/**
+ * Drop source-package shadow components that duplicate a real installed
+ * package, in place.
+ *
+ * A shadow is emitted whenever an rpm/deb declares a source name different
+ * from its own (bzip2-libs -> bzip2) so that scanners keying on source names
+ * still match. When the source package is *itself* installed at the same
+ * version, the shadow's purl is identical to the real component's and the two
+ * collapse in trimComponents() — which keeps whichever was seen first and
+ * never merges `tags`. Seen-first is trivy's listing order, so the outcome is
+ * arbitrary: when the shadow wins, a genuinely installed package is reported
+ * with `tags: ["source"]` and identity confidence 0, the very marker the
+ * shadow carries so consumers can filter shadows out. That turns a real
+ * package into a filtered-away one.
+ *
+ * Dropping the redundant shadow is loss-free: it duplicates the real
+ * component's purl (so nothing that matches on purl changes) and its bom-ref
+ * is byte-identical, so no dependency reference can dangle.
+ *
+ * @param {Array} pkgList component list, mutated in place
+ * @returns {Array} the same list, for convenience
+ */
+export function dropRedundantSourceComponents(pkgList) {
+  if (!Array.isArray(pkgList) || !pkgList.length) {
+    return pkgList;
+  }
+  const installedPurls = new Set();
+  for (const comp of pkgList) {
+    if (comp?.purl && !comp?.tags?.includes("source")) {
+      installedPurls.add(comp.purl);
+    }
+  }
+  if (!installedPurls.size) {
+    return pkgList;
+  }
+  for (let i = pkgList.length - 1; i >= 0; i--) {
+    const comp = pkgList[i];
+    if (comp?.tags?.includes("source") && installedPurls.has(comp.purl)) {
+      pkgList.splice(i, 1);
+    }
+  }
+  return pkgList;
+}
+
 /**
  * Get the packages installed in the container image filesystem.
  *
@@ -739,6 +905,11 @@ export async function getOSPackages(src, imageConfig, options = {}) {
           distro_codename = OS_DISTRO_ALIAS[distro_id];
         }
       }
+      // Canonicalise the distro qualifier vendor (e.g. "mariner-2.0" ->
+      // "azure-linux-2.0") so every spelling of one release yields a single
+      // qualifier value. This runs before distro_id is used to overwrite
+      // trivy's own qualifier below.
+      distro_id = canonicalDistroQualifier(distro_id);
       const tmpDependencies = {};
       tools = enrichToolComponents(
         (Array.isArray(tmpBom?.metadata?.tools)
@@ -768,42 +939,23 @@ export async function getOSPackages(src, imageConfig, options = {}) {
             comp.group = group;
             comp.name = name;
             const modularityLabel = extractModularityLabel(comp);
+            repairOsComponentPurl(comp, distro_id);
             try {
               purlObj = Purl.parse(comp.purl);
               purlObj.qualifiers = purlObj.qualifiers || {};
             } catch (_err) {
               // continue regardless of error
             }
-            // Canonicalise the distro vendor namespace for every OS component,
-            // regardless of whether trivy expressed the vendor via the purl
-            // namespace or the component group (it is inconsistent between
-            // packages). e.g. pkg:rpm/alma/... -> pkg:rpm/almalinux/... so the
-            // purls match the vulnerability feeds. Also aligns the ``distro``
-            // qualifier vendor prefix (alma-9.8 -> almalinux-9.8).
-            if (purlObj && OS_PURL_TYPES.includes(purlObj.type)) {
-              const os_ns = purlObj.namespace || group || "";
-              const os_ns_alias = OS_DISTRO_NAMESPACE_ALIAS[os_ns];
-              if (os_ns_alias) {
-                group = os_ns_alias;
-                comp.group = os_ns_alias;
-                purlObj.namespace = os_ns_alias;
-                const distroQual = purlObj.qualifiers?.distro;
-                if (distroQual?.startsWith(`${os_ns}-`)) {
-                  purlObj.qualifiers.distro = `${os_ns_alias}-${distroQual.slice(
-                    os_ns.length + 1,
-                  )}`;
-                }
-                comp.purl = build({
-                  type: purlObj.type,
-                  namespace: os_ns_alias || null,
-                  name: name,
-                  version: purlObj.version || null,
-                  qualifiers: purlObj.qualifiers || null,
-                  subpath: purlObj.subpath || null,
-                });
-                comp["bom-ref"] = decodeURIComponent(comp.purl);
-              }
-            }
+            // Canonicalise the distro vendor namespace (see
+            // canonicaliseOsPackageNamespace) before any later bom-ref
+            // rebuild so the rewritten purl, group and bom-ref stay in sync.
+            group = canonicaliseOsPackageNamespace(
+              comp,
+              purlObj,
+              name,
+              group,
+              distro_id,
+            );
             if (
               group === "" &&
               purlObj &&
@@ -812,8 +964,7 @@ export async function getOSPackages(src, imageConfig, options = {}) {
               try {
                 if (purlObj?.namespace && purlObj.namespace !== "") {
                   group =
-                    OS_DISTRO_NAMESPACE_ALIAS[purlObj.namespace] ||
-                    purlObj.namespace;
+                    OS_NAMESPACE_ALIAS[purlObj.namespace] || purlObj.namespace;
                   comp.group = group;
                   purlObj.namespace = group;
                 }
@@ -1107,6 +1258,7 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       }
     }
   }
+  dropRedundantSourceComponents(pkgList);
   const rootfsRepositoryInventory = await collectRootfsRepositoryInventory(
     src,
     options,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cdxgen/cdxgen",
-  "version": "13.0.0",
+  "version": "13.0.1",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "keywords": [
     "sbom",
@@ -162,17 +162,17 @@
     "@bufbuild/protobuf": "2.13.0",
     "@cdxgen/cdx-hbom": "0.5.1",
     "@cdxgen/cdx-proto": "2.2.0",
-    "@cdxgen/cdxgen-plugins-bin": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "3.0.3",
-    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "3.0.3",
+    "@cdxgen/cdxgen-plugins-bin": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-darwin-amd64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-darwin-arm64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linux-amd64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linux-arm64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linux-ppc64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-amd64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-linuxmusl-arm64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-windows-amd64": "3.0.4",
+    "@cdxgen/cdxgen-plugins-bin-windows-arm64": "3.0.4",
     "@cdxgen/safer-exec": "0.15.0",
     "body-parser": "2.3.0",
     "compression": "1.8.1",

package/types/lib/cli/bomAssembly.d.ts

@@ -180,8 +180,22 @@ export declare function determinePackageType(pkg: any): any;
 export declare function processHashes(pkg: any, component: any): void;
 /**
  * Adds a hash to component.
+ *
+ * Registries hand out digests in hex or in the base64 form npm uses for
+ * `integrity`, and both are accepted. A digest that is neither, or that decodes
+ * to the wrong length for its algorithm, is dropped rather than copied through:
+ * CycloneDX constrains `hash.content` to a hex digest, so emitting it anyway
+ * fails schema validation for the whole document over one bad package.
  */
 export declare function addComponentHash(alg: any, digest: any, component: any): void;
+/**
+ * Normalize a digest to the lower-case hex form CycloneDX requires.
+ *
+ * @param {string} alg Hash algorithm name
+ * @param {string} digest Digest in hex or base64
+ * @returns {string|undefined} Hex digest, or undefined when it cannot be trusted
+ */
+export declare function normalizeHashContent(alg: string, digest: string): string | undefined;
 /**
  * Return the BOM in json format including any namespace mapping
  *

package/types/lib/cli/bomAssembly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AA+DF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAiPlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA8B3C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAetD;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA6FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}
+{"version":3,"file":"bomAssembly.d.ts","sourceRoot":"","sources":["../../../lib/cli/bomAssembly.js"],"names":[],"mappings":"AA8DA;;;;;;;;;GASG;AACH,eAAO,MAAM,2BAA2B,aAJ7B,MAAM,qBACN,MAAM,EAAE,KACN,OAsBZ,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAFf,MAG8E,CAAC;AAEzF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,0CAH9B,MAAM;;;;;CAwChB,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB,YAJ1B,MAAM,KACJ,MAAM,GAAC,SAyBnB,CAAC;AAoEF;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,YALjB,MAAM,YACN,MAAM,KACJ;IAAE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CA+CrD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAH3B,MAAM,KACJ,MAQZ,CAAC;AAEF;;;;;;;GAOG;AAGH,eAAO,MAAM,oBAAoB,SALtB,MAAM,KACJ,MAwBZ,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,YAHnB,MAAM,KACJ,MAAM,EAgBlB,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,YAHtB,MAAM,UAwBhB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,eAAe,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;;;qBAzJhD,MAAM,EAAE;gBAAU,MAAM,EAAE;;;;EA0gBrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAH/B,QAAQ,MAGuB,SAyCzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAN3B,MAM2B,EAAE,UAAU,EALvC,MAKuC,EAAE,GAAG,EAJ5C,MAI4C,EAAE,KAAK,GAHnD,MAG2D,GAFzD,MAAM,EAAE,CAcpB;AAED;;;;GAIG;AAEH,eAAO,MAAM,cAAc,EAHjB,MAAM,EAGqD,CAAC;AAEtE;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAFxB,MAEyC,CAAC;AAEpD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAJjC,MAIiC,EAAE,YAAY,EAH/C,MAG+C,GAF7C,MAAM,EAAE,CASpB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAHnC,MAGmC,GAFjC,MAAM,EAAE,CAOpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAHlC,MAGkC,GAFhC,GAAG,CAAC,MAAM,CAAC,CA6BvB;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,EAJxC,MAIwC,EAAE,GAAG,EAH7C,MAG6C,GAF3C,OAAO,CAiBnB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,KAAA,EACP,UAAU,KAAA,EACV,GAAG,KAAA,EACH,KAAK,KAAA,EACL,OAAO,KAAA,EACP,SAAS,UAAQ,QAiPlB;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,KAAA,OA+EvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,KAAA,EAAE,SAAS,KAAA,QA6B3C;AAuBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,KAAA,EAAE,MAAM,KAAA,EAAE,SAAS,KAAA,QAMtD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAJ7B,MAI6B,EAAE,MAAM,EAHrC,MAGqC,GAFnC,MAAM,GAAC,SAAS,CAoB5B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAPhB,MAAM,WACN,MAAM,SACN,MAAM,WACN,MAAM,KAEJ,MA6FZ,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAJ1B,MAI0B,EAAE,OAAO,EAHnC,MAGmC,GAFjC,MAAM,GAAC,SAAS,CAI5B;AAiDD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAJzB,MAIyB,EAAE,OAAO,EAHlC,MAGkC,GAFhC,MAAM,GAAC,SAAS,CAyB5B;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAHzC,MAGyC,GAFvC,MAAM,EAAE,CAMpB;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAMpB;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,wBAAwB,EALf,MAAM,EAKS,EACxB,wBAAwB,EALf,MAAM,EAKS,GAJb,MAAM,EAAE,CASpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAHxC,MAGwC,GAFtC,MAAM,EAAE,CAyBpB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAHpC,MAGoC,GAFlC,MAAM,GAAC,SAAS,CAS5B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,wBAAwB,EAHtD,MAAM,EAGgD,GAFpD,OAAO,CAInB;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EALvC,MAAM,EAKiC,EAAE,aAAa,EAJtD,MAIsD,EAAE,OAAO,EAH/D,GAAG,CAAC,MAAM,CAGqD,GAF7D,MAAM,EAAE,CAgBpB;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAH9C,MAAM,EAGwC,GAF5C,MAAM,EAAE,CAQpB;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EALvC,MAKuC,EAAE,KAAK,EAJ9C,MAI8C,EAAE,QAAQ,EAHxD,MAAM,EAGkD,GAFtD,MAAM,CAIlB;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAJvC,MAIuC,EAAE,aAAa,EAHtD,MAGsD,GAFpD,IAAI,CAyDhB;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAPtB,MAOsB,EAAE,UAAU,OAAA,EAAE,eAAe,EALnD,MAKmD,EAAE,YAAY,OAAA,GAF/D,MAAM,CA8ClB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,YAJjC,MAAM,mBACN,MAAM,KACJ,OAYZ,CAAC"}