@cdxgen/cdxgen 13.0.0 → 13.1.0

package/lib/cli/managedBom.js

@@ -6,6 +6,8 @@ import process from "node:process";
 import { build } from "@cdxgen/cdx-purl";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import {
   DOTNET_CMD,
   hasAnyProjectType,
@@ -94,6 +96,7 @@ import {
   trimComponents,
 } from "../inventory/depsUtils.js";
 import {
+  collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
   isDosaiDotnetLanguage,
@@ -102,6 +105,7 @@ import {
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
+import { classifyProbeResult } from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
 import { getTreeWithPlugin } from "../managers/piptree.js";
 import {
@@ -408,7 +412,11 @@ export async function createPythonBom(path, options) {
       }
       let retMap = await parsePyLockData(lockData, f);
       if (retMap?.workspaceWarningShown) {
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "python",
+          tool: "python",
+          detail: "the python lock file could not be parsed",
+        });
       }
       if (retMap?.pyLockProperties?.length) {
         parentComponent.properties = parentComponent.properties || [];
@@ -458,15 +466,6 @@ export async function createPythonBom(path, options) {
               retMap.dependenciesList,
               parentComponent,
             );
-          if (retMap.rootList) {
-            const parentDependsOn = new Set();
-            for (const p of retMap.rootList)
-              parentDependsOn.add(pypiBomRef(p.name, p.version));
-            dependencies.splice(0, 0, {
-              ref: parentComponent["bom-ref"],
-              dependsOn: [...parentDependsOn].sort(),
-            });
-          }
         } else {
           let exportedReqs = "";
           if (f.endsWith("poetry.lock")) {
@@ -493,6 +492,11 @@ export async function createPythonBom(path, options) {
               exportedReqs = expCmd.stdout.toString();
           }
           if (exportedReqs) {
+            // The export contains the resolved closure, not just the first
+            // level, so it contributes components only. The root edge comes
+            // from parsePyLockData (seeded from the manifest); for locks
+            // without a neighbouring pyproject.toml the generic postgen
+            // parent-edge repair keeps the tree reachable.
             const tmpReqFile = join(
               tempDir,
               `exported-${basename(basePath)}-reqs.txt`,
@@ -501,13 +505,6 @@ export async function createPythonBom(path, options) {
             const dlist = await parseReqFile(tmpReqFile, false);
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
-              const parentDependsOn = new Set();
-              for (const p of dlist)
-                parentDependsOn.add(pypiBomRef(p.name, p.version));
-              dependencies.splice(0, 0, {
-                ref: parentComponent["bom-ref"],
-                dependsOn: [...parentDependsOn].sort(),
-              });
             }
           }
         }
@@ -577,14 +574,30 @@ export async function createPythonBom(path, options) {
       safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
       const piplockFile = join(path, "Pipfile.lock");
       if (safeExistsSync(piplockFile)) {
-        const lockData = JSON.parse(readFileSync(piplockFile));
-        const dlist = await parsePiplockData(lockData);
+        let dlist;
+        try {
+          const lockData = JSON.parse(readFileSync(piplockFile));
+          dlist = await parsePiplockData(lockData);
+        } catch (err) {
+          recordDegradation("python.lockfile-unparseable.pipenv", {
+            ecosystem: "python",
+            impact: "transitive-deps",
+            path: piplockFile,
+            detail:
+              "The Pipfile.lock could not be parsed, so no locked versions were captured from it.",
+          });
+          console.log(`Error while parsing the lock file ${piplockFile}.`, err);
+        }
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       } else {
         console.error("Pipfile.lock not found at", path);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "python",
+          tool: "pipenv",
+          detail: "Pipfile.lock was not found",
+        });
       }
     } else if (reqDirFiles?.length) {
       for (const j in reqDirFiles) {
@@ -1087,13 +1100,33 @@ export function createPHPBom(path, options) {
       shell: isWin,
     });
     if (versionResult.status !== 0 || versionResult.error) {
+      // A composer the runtime or a policy denied is not an unavailable
+      // composer; the version probes report that as degraded evidence.
+      if (classifyProbeResult(versionResult) === "missing") {
+        recordDegradation("php.composer.missing", {
+          ecosystem: "php",
+          tool: "composer",
+          impact: "components",
+          command: "composer --version",
+          exitCode:
+            typeof versionResult.status === "number"
+              ? versionResult.status
+              : undefined,
+          detail:
+            "The composer executable could not be run, so the composer.lock generation could not be attempted.",
+        });
+      }
       console.error(
         "No composer version found. Check if composer is installed and available in PATH.",
       );
       if (DEBUG_MODE) {
         console.log(versionResult.error, versionResult.stderr);
       }
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "php",
+        tool: "composer",
+        detail: "the composer version command failed",
+      });
     }
     let composerVersion;
     if (DEBUG_MODE) {
@@ -1129,7 +1162,11 @@ export function createPHPBom(path, options) {
           console.log(result.stderr);
         }
         console.log(result.error);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "php",
+          tool: "composer",
+          detail: "the composer install command failed",
+        });
       }
     }
   }
@@ -1206,6 +1243,15 @@ export function createPHPBom(path, options) {
       parentComponent,
     });
   }
+  if (composerJsonMode && !composerLockMode) {
+    recordDegradation("php.no-lockfile", {
+      ecosystem: "php",
+      tool: "composer",
+      impact: "components",
+      detail:
+        "No composer.lock was found or generated, and the lock file is the source the Composer parser reads.",
+    });
+  }
   return {};
 }
 
@@ -1319,7 +1365,11 @@ export async function createRubyBom(path, options) {
           "Bundle install has failed. Check if bundle is installed and available in PATH.",
         );
         console.log(result.error, result.stderr);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "ruby",
+          tool: "bundler",
+          detail: "the bundler command failed",
+        });
       }
     }
   }
@@ -1361,7 +1411,11 @@ export async function createRubyBom(path, options) {
       console.log(
         "SBOM generation using only gemspec files is imprecise and results in an inaccurate dependency tree.",
       );
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "ruby",
+        tool: "bundler",
+        detail: "only gemspec files were available to parse",
+      });
     }
     for (const f of gemspecFiles) {
       const gemspecData = readFileSync(f, { encoding: "utf-8" });
@@ -1634,7 +1688,11 @@ export async function createCsharpBom(path, options) {
               "TIP: msbuild is not available for Linux. Try using a Windows build agent to generate an SBOM for this project.",
             );
           }
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "csharp",
+            tool: "dotnet",
+            detail: "the dotnet command failed",
+          });
         }
         if (result?.stderr?.includes("To install missing framework")) {
           console.log(
@@ -1683,7 +1741,11 @@ export async function createCsharpBom(path, options) {
           console.log(result.stdout);
         }
         console.log("---------");
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "csharp",
+          tool: "dotnet",
+          detail: "the dotnet restore did not produce a usable assets file",
+        });
       }
     }
     // Collect the assets, lock, and nupkg files generated from restore
@@ -1786,7 +1848,11 @@ export async function createCsharpBom(path, options) {
       console.log(
         "Alternatively, try using the custom `ghcr.io/cdxgen/cdxgen-dotnet:v13` container image, which bundles a range of dotnet SDKs.",
       );
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "csharp",
+        tool: "dotnet",
+        detail: "no dotnet dependency evidence could be collected",
+      });
     }
   }
   // packages.lock.json parsing for any project without a project.assets.json
@@ -1960,7 +2026,10 @@ export async function createCsharpBom(path, options) {
       }
       pkgList = addEvidenceForDotnet(pkgList, slicesFile);
       const methodsSlice = readDosaiJsonFile(slicesFile);
-      const servicesMap = collectDosaiServicesFromMethods(methodsSlice, {});
+      // Provider-backed Services[] first so bom-refs, trust zones, and data
+      // classifications survive; ApiEndpoints derivation fills in the rest.
+      const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
+      collectDosaiServicesFromMethods(methodsSlice, servicesMap);
       services = normalizeDosaiServiceMap(servicesMap);
     }
   }

package/lib/cli/nativeBom.js

@@ -8,6 +8,8 @@ import { build } from "@cdxgen/cdx-purl";
 import { parse as loadYaml } from "yaml";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import {
   CARGO_CMD,
   CLJ_CMD,
@@ -86,6 +88,10 @@ import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
+import {
+  classifyProbeResult,
+  classifySpawnRestriction,
+} from "../inventory/toolRequirements.js";
 import { executeOsQuery } from "../managers/binary.js";
 import {
   buildBomNSData,
@@ -357,13 +363,34 @@ export async function createGoBom(path, options) {
           // So we support a fallback to only operate with go mod graph command output in such instances
           console.log("go list -deps command has failed for", basePath);
           shouldManuallyParse = true;
+          // A spawn the runtime or a policy denied is neither a missing
+          // toolchain nor an engaged fallback; the version probes report
+          // that as degraded evidence and the policy entries name the fix.
+          if (
+            !classifySpawnRestriction("go") &&
+            result.error &&
+            classifyProbeResult(result) === "missing"
+          ) {
+            recordDegradation("go.toolchain.missing", {
+              ecosystem: "go",
+              tool: "go",
+              impact: "transitive-deps",
+              command: "go list -deps ./...",
+              detail:
+                "The go executable could not be run, so the module graph was not resolved.",
+            });
+          }
           if (DEBUG_MODE && result.stdout) {
             console.log(result.stdout);
           }
           if (DEBUG_MODE && result.stderr) {
             console.log(result.stderr);
           }
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "go",
+            tool: "go",
+            detail: "the go module graph command failed",
+          });
         }
         const stdout = result.stdout;
         if (stdout) {
@@ -411,7 +438,11 @@ export async function createGoBom(path, options) {
             if (DEBUG_MODE && result.stderr) {
               console.log(result.stderr);
             }
-            options.failOnError && process.exit(1);
+            deferFailOnError(options, {
+              ecosystem: "go",
+              tool: "go",
+              detail: "the go list command failed",
+            });
           }
           if (result.stdout) {
             cmdOutput = Buffer.from(result.stdout).toString();
@@ -492,7 +523,11 @@ export async function createGoBom(path, options) {
             console.log(
               "3. Alternatively, consider generating a post-build SBOM from the built binary using blint. Use the official container image and invoke cdxgen with the arguments `-t binary --lifecycle post-build`.",
             );
-            options.failOnError && process.exit(1);
+            deferFailOnError(options, {
+              ecosystem: "go",
+              tool: "go",
+              detail: "no go dependency evidence could be collected",
+            });
           }
         }
       }
@@ -510,6 +545,19 @@ export async function createGoBom(path, options) {
     if (
       !hasAnyProjectType(["docker", "oci", "container", "os"], options, false)
     ) {
+      // When the environment itself denies the go command, the version
+      // probes record the restriction as degraded evidence and the policy
+      // entries name the fix; the fallback is the finding only when the
+      // toolchain was free to run and could not resolve the graph.
+      if (!classifySpawnRestriction("go")) {
+        recordDegradation("go.mod-only-fallback", {
+          ecosystem: "go",
+          tool: "go",
+          impact: "transitive-deps",
+          detail:
+            "The go toolchain could not resolve the module graph, so go.mod was parsed manually and components carry only the declared requires.",
+        });
+      }
       console.log(
         "Manually parsing go.mod files. The resultant BOM would be incomplete.",
       );
@@ -584,6 +632,31 @@ export async function createGoBom(path, options) {
   return {};
 }
 
+/**
+ * Whether the cargo executable answers a version probe.
+ *
+ * A cargo command run through a shell — the Windows path — reports an absent
+ * executable as a non-zero exit with the shell's own complaint on stderr, not
+ * as a spawn error, so a failed build alone cannot tell a missing toolchain
+ * from a broken project. The probe answers that question directly.
+ *
+ * @param {string} cwd Directory to probe from.
+ * @returns {boolean} True when cargo answered.
+ */
+function cargoAnswersVersion(cwd) {
+  const probe = safeSpawnSync(CARGO_CMD, ["--version"], {
+    cdxgenActivity: {
+      kind: "probe",
+      metadata: { tool: "cargo" },
+      probeType: "build-tool-availability",
+    },
+    cwd,
+    encoding: "utf-8",
+    shell: isWin,
+  });
+  return classifyProbeResult(probe) === "found";
+}
+
 /**
  * Function to create bom string for Rust projects
  *
@@ -649,7 +722,27 @@ export async function createRustBom(path, options) {
       if (cargoInstallResult.status !== 0 || cargoInstallResult.error) {
         console.error("Error running the cargo command");
         console.log(cargoInstallResult.error, cargoInstallResult.stderr);
-        options.failOnError && process.exit(1);
+        // A spawn the runtime or a policy denied is neither a missing
+        // toolchain nor an engaged fallback; the version probes record
+        // that as degraded evidence.
+        const toolchainMissing = cargoInstallResult.error
+          ? classifyProbeResult(cargoInstallResult) === "missing"
+          : !cargoAnswersVersion(basePath);
+        if (!classifySpawnRestriction(CARGO_CMD) && toolchainMissing) {
+          recordDegradation("rust.toolchain.missing", {
+            ecosystem: "rust",
+            tool: "cargo",
+            impact: "transitive-deps",
+            command: `${basename(CARGO_CMD)} ${cargoArgs.join(" ")}`,
+            detail:
+              "The cargo executable could not be run, so the lock file could not be generated.",
+          });
+        }
+        deferFailOnError(options, {
+          ecosystem: "rust",
+          tool: "cargo",
+          detail: "the cargo command failed",
+        });
       }
     }
   }
@@ -667,6 +760,15 @@ export async function createRustBom(path, options) {
     options,
   );
   const cargoLockMode = cargoLockFiles.length;
+  if (cargoFiles.length && !cargoLockMode) {
+    recordDegradation("rust.cargo-lock-missing", {
+      ecosystem: "rust",
+      tool: "cargo",
+      impact: "transitive-deps",
+      detail:
+        "No Cargo.lock was found beside the manifest, so components carry the declared dependencies without locked versions or the resolved crate graph.",
+    });
+  }
   for (const f of cargoFiles) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${f}`);
@@ -868,6 +970,15 @@ export async function createDartBom(path, options) {
     `${options.multiProject ? "**/" : ""}pubspec.yaml`,
     options,
   );
+  if (pubSpecYamlFiles.length && !pubFiles.length) {
+    recordDegradation("dart.pub-get-needed", {
+      ecosystem: "dart",
+      tool: "dart",
+      impact: "versions",
+      detail:
+        "pubspec.yaml was parsed without pubspec.lock, so components carry version constraints instead of the locked versions.",
+    });
+  }
   let dependencies = [];
   let pkgList = [];
   let parentComponent;
@@ -1367,8 +1478,22 @@ export function createClojureBom(path, options) {
       if (result.status !== 0 || result.error) {
         if (result.stderr) {
           console.error(result.stdout, result.stderr);
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "lein",
+            detail: "the leiningen command failed",
+          });
         }
+        recordDegradation("clojure.lein.missing", {
+          ecosystem: "clojure",
+          tool: "lein",
+          impact: "transitive-deps",
+          command: `${LEIN_CMD} ${LEIN_ARGS.join(" ")}`,
+          exitCode:
+            typeof result.status === "number" ? result.status : undefined,
+          detail:
+            "lein did not produce a dependency list, so the project.clj manifest is parsed manually.",
+        });
         console.log(
           "Check if the correct version of lein is installed and available in PATH. Falling back to manual parsing.",
         );
@@ -1390,7 +1515,11 @@ export function createClojureBom(path, options) {
           }
         } else {
           console.error("lein unexpectedly didn't return any output");
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "lein",
+            detail: "the leiningen command produced no output",
+          });
         }
       }
     }
@@ -1413,8 +1542,22 @@ export function createClojureBom(path, options) {
       if (result.status !== 0 || result.error) {
         if (result.stderr) {
           console.error(result.stdout, result.stderr);
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "clj",
+            detail: "the clojure cli command failed",
+          });
         }
+        recordDegradation("clojure.cli.missing", {
+          ecosystem: "clojure",
+          tool: "clojure",
+          impact: "transitive-deps",
+          command: `${CLJ_CMD} ${CLJ_ARGS.join(" ")}`,
+          exitCode:
+            typeof result.status === "number" ? result.status : undefined,
+          detail:
+            "The clojure CLI did not produce a dependency tree, so the deps.edn manifest is parsed manually.",
+        });
         console.log(
           "Check if the correct version of clojure cli is installed and available in PATH. Falling back to manual parsing.",
         );
@@ -1436,7 +1579,11 @@ export function createClojureBom(path, options) {
           }
         } else {
           console.error("clj unexpectedly didn't return any output");
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "clj",
+            detail: "the clojure cli command produced no output",
+          });
         }
       }
     }
@@ -1479,6 +1626,13 @@ export function createHaskellBom(path, options) {
       filename: cabalFiles.join(", "),
     });
   }
+  recordDegradation("haskell.freeze-missing", {
+    ecosystem: "haskell",
+    tool: "cabal",
+    impact: "components",
+    detail:
+      "No cabal.project.freeze was found, and the freeze file is the source the parser reads for the package set.",
+  });
   return {};
 }
 
@@ -1512,6 +1666,13 @@ export function createElixirBom(path, options) {
       filename: mixFiles.join(", "),
     });
   }
+  recordDegradation("elixir.deps-not-fetched", {
+    ecosystem: "elixir",
+    tool: "mix",
+    impact: "components",
+    detail:
+      "No mix.lock was found, and the lock file written by fetching the dependencies is the source the parser reads.",
+  });
   return {};
 }
 
@@ -1634,6 +1795,16 @@ export async function createSwiftBom(path, options) {
             `It looks like the 'Sources' directory is missing, so we are missing the components and dependencies for '${basename(basePath)}'.`,
           );
         } else if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+          recordDegradation("swift.toolchain.missing", {
+            ecosystem: "swift",
+            tool: "swift",
+            impact: "transitive-deps",
+            command: `${swiftCommand} ${packageArgs.join(" ")}`,
+            exitCode:
+              typeof result.status === "number" ? result.status : undefined,
+            detail:
+              "The swift package command did not succeed, so the swift package graph was not resolved.",
+          });
           console.log(
             "Consider using the cdxgen container image (`ghcr.io/cdxgen/cdxgen`), which includes Swift and additional build tools.",
           );
@@ -1645,7 +1816,11 @@ export async function createSwiftBom(path, options) {
           }
         }
         console.error(result.stderr);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "swift",
+          tool: "swift",
+          detail: "the swift package command failed",
+        });
       }
     }
   }
@@ -1691,7 +1866,11 @@ export async function createCocoaBom(path, options) {
           "No 'Podfile.lock' found and '--no-install-deps' is set -- A Podfile.lock is needed to parse dependencies!",
         );
         missingLockWarningShown = true;
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "cocoa",
+          tool: "pod",
+          detail: "no Podfile.lock was found",
+        });
       }
     } else if (options.deep && options.installDeps) {
       executePodCommand(["install"], projectPath, options);