@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/ecosystems/parsers-crystal.js

@@ -0,0 +1,179 @@
+import { readFileSync } from "node:fs";
+
+import { parse as loadYaml } from "yaml";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Crystal parser for `shard.yml` and `shard.lock`.
+ *
+ * Shards resolves dependencies declared in `shard.yml` and records the
+ * resolved set in `shard.lock`, which pins each dependency's version and
+ * source repository. Both files are YAML and are read with the standard
+ * parser.
+ *
+ * No `crystal` purl type is registered, so shards are identified as generic
+ * packages carrying a `cdx:purl:proposedType=crystal` property, following
+ * the convention used for nix and zig. This keeps the BOM valid today and
+ * allows a mechanical migration if a type is registered upstream.
+ */
+
+/**
+ * Parse a Crystal project from `shard.yml` and optional `shard.lock`.
+ *
+ * @param {string} shardYmlFile Path to `shard.yml`
+ * @param {string} [shardLockFile] Path to `shard.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export function parseShardsProject(shardYmlFile, shardLockFile) {
+  const manifest = readYamlFile(shardYmlFile);
+
+  const parentComponent = {};
+  if (typeof manifest?.name === "string" && manifest.name) {
+    parentComponent.type = "application";
+    parentComponent.name = manifest.name;
+    if (typeof manifest.version === "string" && manifest.version) {
+      parentComponent.version = manifest.version;
+    }
+    parentComponent.description =
+      typeof manifest.description === "string" && manifest.description
+        ? manifest.description
+        : `Crystal shard: ${manifest.name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: shardYmlFile },
+    ];
+    if (typeof manifest.crystal === "string" && manifest.crystal) {
+      parentComponent.properties.push({
+        name: "cdx:crystal:languageVersion",
+        value: manifest.crystal,
+      });
+    }
+  }
+
+  const declared =
+    manifest?.dependencies && typeof manifest.dependencies === "object"
+      ? Object.keys(manifest.dependencies)
+      : [];
+  const devDeclared =
+    manifest?.development_dependencies &&
+    typeof manifest.development_dependencies === "object"
+      ? Object.keys(manifest.development_dependencies)
+      : [];
+
+  let lock;
+  if (shardLockFile) {
+    lock = readYamlFile(shardLockFile);
+  }
+  const lockedShards =
+    lock?.shards && typeof lock.shards === "object" ? lock.shards : undefined;
+  if (!lockedShards) {
+    // Lockless fallback: emit declared dependencies without resolved versions.
+    const pkgList = [
+      ...declared.map((name) =>
+        crystalPackage(name, undefined, {
+          direct: true,
+          dev: false,
+          srcFile: shardYmlFile,
+        }),
+      ),
+      ...devDeclared.map((name) =>
+        crystalPackage(name, undefined, {
+          direct: true,
+          dev: true,
+          srcFile: shardYmlFile,
+        }),
+      ),
+    ];
+    return {
+      pkgList,
+      dependencies: [],
+      parentComponent,
+      rootInputs: pkgList.map((p) => p["bom-ref"]),
+    };
+  }
+
+  const directNames = new Set(declared);
+  const devNames = new Set(devDeclared);
+  const pkgList = [];
+  const refByName = new Map();
+  for (const [name, entry] of Object.entries(lockedShards)) {
+    const version =
+      typeof entry?.version === "string" && entry.version
+        ? entry.version
+        : undefined;
+    const pkg = crystalPackage(name, version, {
+      direct: directNames.has(name),
+      dev: devNames.has(name),
+      srcFile: shardLockFile,
+    });
+    pkgList.push(pkg);
+    refByName.set(name, pkg["bom-ref"]);
+  }
+
+  // shard.lock records no dependency graph between shards, so the root links
+  // to the declared set and every other shard stands on its own version pin.
+  const rootInputs = [...directNames, ...devNames]
+    .map((name) => refByName.get(name))
+    .filter(Boolean);
+  return { pkgList, dependencies: [], parentComponent, rootInputs };
+}
+
+/**
+ * Build a component-like package record for a Crystal shard.
+ *
+ * @param {string} name Shard name
+ * @param {string|undefined} version Resolved version, if known
+ * @param {object} opts Extra context (`direct`, `dev`, `srcFile`)
+ * @returns {object} Package record
+ */
+function crystalPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "generic",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    { name: "cdx:purl:proposedType", value: "crystal" },
+  ];
+  if (opts.direct) {
+    properties.push({
+      name: "cdx:crystal:dependency",
+      value: opts.dev ? "direct-dev" : "direct",
+    });
+  } else {
+    properties.push({ name: "cdx:crystal:dependency", value: "transitive" });
+  }
+  if (opts.dev) {
+    properties.push({ name: "cdx:crystal:scope", value: "development" });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: opts.dev ? "optional" : "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Read and parse a YAML file, warning instead of throwing.
+ *
+ * @param {string} filePath File to read
+ * @returns {object|undefined} Parsed value
+ */
+function readYamlFile(filePath) {
+  try {
+    return loadYaml(readFileSync(filePath, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${filePath}: ${error.message}`);
+    return undefined;
+  }
+}

package/lib/ecosystems/parsers-dotnet.js

@@ -13,6 +13,34 @@ import { findLicenseId } from "../inventory/spdx.js";
 import { xml2js } from "../parsers/xml.js";
 import { extractPackageInfoFromHintPath } from "./dotnetutils.js";
 
+/**
+ * Apply a version to a NuGet component so that the `version` field and the purl
+ * always agree.
+ *
+ * A .NET manifest can state a version that is not a version: an MSBuild property
+ * such as `$(JsonVersion)`, a range such as `[3.13.3,4.0)`, a wildcard such as
+ * `2.0.*`, or nothing at all. Such a declaration cannot go into a purl, so a
+ * component that kept it in `version` while its purl carried none described one
+ * package two ways. A scanner range matching on the versionless purl then reports
+ * every advisory published against the package name.
+ *
+ * The declaration is not lost: callers record it as `cdx:nuget:declared_version_range`.
+ *
+ * @param {Object} pkg Component to update in place. `name` must already be set.
+ * @param {String} [version] Version as stated or resolved, concrete or not
+ *
+ * @returns {Object} The same component
+ */
+export function applyNugetVersion(pkg, version) {
+  const concrete = concreteVersion(version);
+  if (concrete) {
+    pkg.version = concrete;
+  } else {
+    delete pkg.version;
+  }
+  return applyPurl(pkg, nugetPurl(pkg.name, concrete));
+}
+
 /**
  * Method to parse .nupkg files
  *
@@ -140,16 +168,22 @@ export function parseNuspecData(nupkgFile, nuspecData) {
             continue;
           }
           groupPkg.name = agroupdep.id;
+          let declaredRange;
           if (agroupdep?.version) {
             let versionStr = agroupdep.version;
             // version could have square brackets around them
             if (versionStr.startsWith("[") && versionStr.endsWith("]")) {
               versionStr = versionStr.replace(/[\[\]]/g, "");
             }
-            groupPkg.version = versionStr;
-            applyPurl(groupPkg, nugetPurl(groupPkg.name, versionStr));
+            // A nuspec dependency states the range the package accepts, not the
+            // version installed. Anything that is not a single version stays a
+            // declaration so the component and its purl agree - #4359.
+            if (!concreteVersion(versionStr)) {
+              declaredRange = agroupdep.version;
+            }
+            applyNugetVersion(groupPkg, versionStr);
           } else {
-            applyPurl(groupPkg, nugetPurl(groupPkg.name));
+            applyNugetVersion(groupPkg);
           }
           groupPkg.scope = "optional";
           groupPkg.properties = [
@@ -158,6 +192,12 @@ export function parseNuspecData(nupkgFile, nuspecData) {
               value: nupkgFile,
             },
           ];
+          if (declaredRange) {
+            groupPkg.properties.push({
+              name: "cdx:nuget:declared_version_range",
+              value: declaredRange,
+            });
+          }
           if (targetFramework) {
             groupPkg.properties.push({
               name: "cdx:dotnet:target_framework",
@@ -243,20 +283,15 @@ export function parseCsPkgData(pkgData, pkgFile, pkgNameVersions = {}) {
     // so the declaration stays visible, and the version is resolved from a
     // more precise manifest so the purl names the package that is present.
     let declaredRange;
-    if (!pkg.version || pkg.version.includes("$(")) {
+    if (!concreteVersion(pkg.version)) {
       confidence = 0.5;
+      declaredRange = pkg.version;
       // Backfill from a version already resolved by a more precise manifest.
       // Concrete versions are never overridden - a disagreement means both
       // versions must be tracked.
-      pkg.version = pkgNameVersions[pkg.name] || undefined;
-    } else if (/[[\](),*]/.test(pkg.version)) {
-      confidence = 0.5;
-      if (pkgNameVersions[pkg.name]) {
-        declaredRange = pkg.version;
-        pkg.version = pkgNameVersions[pkg.name];
-      }
+      pkg.version = pkgNameVersions[pkg.name];
     }
-    applyPurl(pkg, nugetPurl(pkg.name, pkg.version));
+    applyNugetVersion(pkg, pkg.version);
     if (pkgFile) {
       pkg.properties = [
         {
@@ -712,23 +747,17 @@ export function parseCsProjData(
           const exactPin = pkg.version.match(/^\[([^,[\]()]+)\]$/);
           if (exactPin) {
             pkg.version = exactPin[1];
-          } else if (
-            pkg.version.includes("$(") ||
-            /[*[\](),]/.test(pkg.version)
-          ) {
-            const resolved =
+          } else if (!concreteVersion(pkg.version)) {
+            declaredRange = pkg.version;
+            pkg.version =
               pkgNameVersions[pkg.name] ||
               centralVersions[pkg.name.toLowerCase()];
-            if (resolved) {
-              declaredRange = pkg.version;
-              pkg.version = resolved;
-            }
           }
         }
         // A version that could not be resolved from any source must not be
         // stringified into the purl - `@undefined` is not a version and makes the
         // component unmatchable. Mirrors parseCsPkgData.
-        applyPurl(pkg, nugetPurl(pkg.name, pkg.version));
+        applyNugetVersion(pkg, pkg.version);
         if (projFile) {
           pkg.properties = [
             {
@@ -821,26 +850,27 @@ export function parseCsProjData(
           });
         }
         const version = hintVersion ?? assemblyVersion;
-        if (version) {
-          pkg.version = version;
-          applyPurl(pkg, nugetPurl(pkg.name, version));
-        } else {
-          applyPurl(pkg, nugetPurl(pkg.name));
-          if (
-            pkg.name.startsWith("System.") ||
+        // An assembly reference that states no version anywhere - no HintPath to
+        // read one from and no `Version=` on the Include - leaves the component
+        // versionless in both fields. The registry's latest release is not a
+        // stand-in: `<Reference>` resolves an assembly from a targeting pack, a
+        // lib folder or the GAC, and the project does not say which package it
+        // came from. See #4359.
+        applyNugetVersion(pkg, version);
+        if (
+          !pkg.version &&
+          (pkg.name.startsWith("System.") ||
             pkg.name.startsWith("Mono.") ||
-            pkg.name.startsWith("Microsoft.")
-          ) {
-            // If this is a System package, then track the target frameworks
-            for (const tf of projectTargetFrameworks) {
-              pkg.properties.push({
-                name: "cdx:dotnet:target_framework",
-                value: tf,
-              });
-            }
+            pkg.name.startsWith("Microsoft."))
+        ) {
+          // If this is a System package, then track the target frameworks
+          for (const tf of projectTargetFrameworks) {
+            pkg.properties.push({
+              name: "cdx:dotnet:target_framework",
+              value: tf,
+            });
           }
         }
-        pkg["bom-ref"] = pkg.purl;
         if (assemblyName) {
           pkg.properties.push({
             name: "cdx:dotnet:assembly_name",