@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/inventory/osinfo.js

@@ -86,6 +86,112 @@ export const OS_DISTRO_ALIAS = {
   "red hat enterprise linux 10": "rhel-10",
 };
 
+/**
+ * Canonical purl namespace for distro vendors that are published under more
+ * than one spelling. Both the os-release path (`getDistroInfo`) and the trivy
+ * passthrough in `lib/managers/binary.js` route through this single map so the
+ * two paths cannot drift apart again.
+ *
+ * Azure Linux 2.0 is CBL-Mariner 2.0 — Microsoft renamed the product — and the
+ * OSV feed publishes `pkg:rpm/azure-linux/<name>` for every generation
+ * (ecosystems "Azure Linux:2" and "Azure Linux:3"), so the historical
+ * spellings azurelinux, cbl-mariner and mariner all canonicalise to
+ * "azure-linux". rhel/ol/amzn/opensuse-* are the cases previously inlined in
+ * getDistroInfo(); alma/rocky-linux were previously inlined in binary.js.
+ *
+ * Amazon Linux canonicalises to "amazon", the spelling the vulnerability feeds
+ * publish (AppThreat vuln-list `amazon`): the os-release ID is `amzn` and
+ * trivy emits `amazon`, and the previous `amazonlinux` mapping here matched
+ * neither, so live-host Amazon Linux purls matched nothing at all.
+ */
+export const OS_NAMESPACE_ALIAS = {
+  alma: "almalinux",
+  amazonlinux: "amazon",
+  amzn: "amazon",
+  azurelinux: "azure-linux",
+  "cbl-mariner": "azure-linux",
+  mariner: "azure-linux",
+  ol: "oracle",
+  "opensuse-leap": "opensuse",
+  "opensuse-tumbleweed": "opensuse",
+  rhel: "redhat",
+  "rocky-linux": "rocky",
+};
+
+/**
+ * Vendor prefixes that `distro` qualifier values are canonicalised for, so one
+ * release has exactly one qualifier value no matter which side produced it.
+ *
+ * trivy stamps the qualifier from its own distro table while cdxgen stamps it
+ * from os-release, and the two disagree: an Oracle Linux 9.8 image came out
+ * with `oracle-9.8` on 99 components and `ol-9.8` on 43, and a RHEL 9.8 image
+ * with namespace `redhat` but qualifier `rhel-9.8`. Canonicalising both sides
+ * through this map collapses each release onto the vendor its purl namespace
+ * already uses.
+ *
+ * SUSE is deliberately absent. `sles-15.6`, `opensuse-leap-15.6` and
+ * `opensuse-tumbleweed-<snapshot>` are the values consumers derive the release
+ * channel from (vulnerability-db maps them to per-release channels), and both
+ * sides already agree on them; folding Leap and Tumbleweed onto a bare
+ * `opensuse-` vendor would destroy exactly the distinction that matters.
+ *
+ * Keys are matched longest-first so `cbl-mariner-2.0` resolves against the
+ * full vendor segment rather than a shorter prefix.
+ */
+export const OS_DISTRO_QUALIFIER_ALIAS = {
+  alma: "almalinux",
+  amazonlinux: "amazon",
+  amzn: "amazon",
+  azurelinux: "azure-linux",
+  "cbl-mariner": "azure-linux",
+  mariner: "azure-linux",
+  ol: "oracle",
+  rhel: "redhat",
+  "rocky-linux": "rocky",
+};
+
+// A distro qualifier reaches a purl verbatim, so anything outside the purl
+// qualifier charset makes the whole purl — and with it the whole BOM —
+// invalid. trivy emits Amazon Linux as
+// `amazon-2023.12.20260727+(Amazon Linux)`, which failed cdxgen's own schema
+// validation and cost the entire SBOM.
+const SAFE_DISTRO_QUALIFIER = /^[A-Za-z0-9._-]+$/;
+
+/**
+ * Whether a `distro` qualifier value is safe to place in a purl unencoded.
+ *
+ * @param {string} qualifier - distro qualifier value
+ * @returns {boolean} true when the value contains only purl-safe characters
+ */
+export function isCleanDistroQualifier(qualifier) {
+  return !!qualifier && SAFE_DISTRO_QUALIFIER.test(qualifier);
+}
+
+const OS_DISTRO_QUALIFIER_ALIAS_KEYS = Object.keys(
+  OS_DISTRO_QUALIFIER_ALIAS,
+).sort((a, b) => b.length - a.length);
+
+/**
+ * Canonicalise the vendor prefix of a `distro` qualifier value
+ * (e.g. "cbl-mariner-2.0" or "mariner-2.0" -> "azure-linux-2.0") so a release
+ * has exactly one qualifier spelling regardless of which tool emitted it.
+ * Values without a known vendor prefix are returned unchanged.
+ *
+ * @param {string} qualifier - distro qualifier value such as "azurelinux-3.0"
+ * @returns {string} canonical qualifier value
+ */
+export function canonicalDistroQualifier(qualifier) {
+  if (!qualifier) {
+    return qualifier;
+  }
+  for (const key of OS_DISTRO_QUALIFIER_ALIAS_KEYS) {
+    if (qualifier.startsWith(`${key}-`)) {
+      return `${OS_DISTRO_QUALIFIER_ALIAS[key]}${qualifier.slice(key.length)}`;
+    }
+  }
+  return qualifier;
+}
+
 // ---------------------------------------------------------------------------
 // Raw os-release cache — keyed by the osRelease file path so the live-host
 // cache (/etc/os-release) and any container rootfs path are kept separate.
@@ -151,8 +257,10 @@ export function _resetOsReleaseCache() {
  *
  * Returns an object with:
  *   - purlType    {string}  "deb" | "apk" | "rpm"
- *   - namespace   {string}  purl namespace (e.g. "ubuntu", "alpine", "fedora")
- *   - distroId    {string}  ID + "-" + VERSION_ID  (e.g. "ubuntu-22.04")
+ *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
+ *                           "azure-linux" for both Azure Linux and CBL-Mariner)
+ *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
  *   - distroName  {string}  codename/alias          (e.g. "jammy")
  *
  * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
@@ -180,6 +288,7 @@ export function getDistroInfo(root = "/") {
       purlType = "deb";
       break;
     case "alpine":
+    case "alpaquita":
     case "openwrt":
       purlType = "apk";
       break;
@@ -193,6 +302,9 @@ export function getDistroInfo(root = "/") {
     case "centos":
     case "rocky":
     case "almalinux":
+    case "azurelinux":
+    case "cbl-mariner":
+    case "mariner":
     case "oracle":
     case "ol":
     case "amzn":
@@ -216,19 +328,10 @@ export function getDistroInfo(root = "/") {
       break;
   }
 
-  // Determine the purl namespace (vendor)
-  let namespace = rawId;
-  if (rawId === "rhel") {
-    namespace = "redhat";
-  } else if (rawId === "ol") {
-    namespace = "oracle";
-  } else if (rawId === "amzn") {
-    namespace = "amazonlinux";
-  } else if (rawId === "opensuse-leap" || rawId === "opensuse-tumbleweed") {
-    namespace = "opensuse";
-  } else if (rawId === "almalinux") {
-    namespace = "almalinux";
-  } else if (!rawId) {
+  // Determine the purl namespace (vendor), canonicalising vendors that are
+  // published under several spellings (e.g. mariner -> azure-linux)
+  let namespace = OS_NAMESPACE_ALIAS[rawId] || rawId;
+  if (!rawId) {
     // Fallback via ID_LIKE
     if (idLike.includes("rhel") || idLike.includes("centos")) {
       namespace = "redhat";
@@ -245,8 +348,12 @@ export function getDistroInfo(root = "/") {
     }
   }
 
-  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17")
+  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17"),
+  // canonicalising the vendor prefix so one release has a single qualifier
+  // value (e.g. "mariner-2.0" and "azurelinux-3.0" -> "azure-linux-2.0"/
+  // "azure-linux-3.0")
   let distroId = versionId ? `${rawId}-${versionId}` : rawId;
+  distroId = canonicalDistroQualifier(distroId);
 
   // Special-case Alpine: truncate to major.minor
   if (purlType === "apk" && versionId) {

package/lib/inventory/table.js

@@ -2,6 +2,7 @@ import process from "node:process";
 
 import { readEnvironmentVariable } from "../core/activity.js";
 import { TABLE_BORDER_STYLE } from "../core/env.js";
+import { diagnosticStream } from "../core/logger.js";
 import {
   alignText,
   stringWidth,
@@ -218,7 +219,10 @@ export function table(rows, config = {}) {
 }
 
 /**
- * Create a streaming table writer that renders rows to stdout incrementally.
+ * Create a streaming table writer that renders rows incrementally.
+ *
+ * Rows go to the diagnostic stream: a rendered table is human-readable output,
+ * and writing it to stdout corrupted the BOM document under `-o -`.
  *
  * @param {Object} [config={}] Table configuration (header, columns, border style)
  * @returns {{write(row: *): void, end(): void}} Writer whose `end()` emits the bottom border
@@ -242,21 +246,21 @@ export function createStream(config = {}) {
         const topBorder = drawBorder(columns, borderChars, "top");
         middleBorder = drawBorder(columns, borderChars, "mid");
         bottomBorder = drawBorder(columns, borderChars, "bottom");
-        process.stdout.write(`${topBorder}\n`);
+        diagnosticStream.write(`${topBorder}\n`);
       }
       if (hasRows) {
-        process.stdout.write(`${middleBorder}\n`);
+        diagnosticStream.write(`${middleBorder}\n`);
       }
       const safeRow = Array.isArray(row) ? row : [row];
       const rendered = renderRow(safeRow, columns, borderChars);
-      process.stdout.write(`${rendered.join("\n")}\n`);
+      diagnosticStream.write(`${rendered.join("\n")}\n`);
       hasRows = true;
     },
     end() {
       if (!columns || closed) {
         return;
       }
-      process.stdout.write(`${bottomBorder}\n`);
+      diagnosticStream.write(`${bottomBorder}\n`);
       closed = true;
     },
   };