@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/ecosystems/parsers-misc.js

@@ -8,7 +8,6 @@ import {
   relative,
   resolve,
 } from "node:path";
-import process from "node:process";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
@@ -18,6 +17,8 @@ import {
   DEBUG_MODE,
   readEnvironmentVariable,
 } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
 import {
   safeExistsSync,
@@ -40,6 +41,7 @@ import {
   mapConanPkgRefToPurlStringAndNameAndVersion,
   nixGenericPurl,
   purlFromUrlString,
+  tryBuildPurl,
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
 import { getDartMetadata } from "./ecosystems.js";
@@ -2652,6 +2654,15 @@ export function executePodCommand(parameters, path, options) {
       );
     }
     if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+      recordDegradation("cocoa.pods.missing", {
+        ecosystem: "cocoa",
+        tool: "pod",
+        impact: "transitive-deps",
+        command: `pod ${parameters.join(" ")}`,
+        exitCode: typeof result.status === "number" ? result.status : undefined,
+        detail:
+          "The pod command did not succeed, so the cocoapods dependency graph was not resolved.",
+      });
       console.log(
         "Consider using the cdxgen container image (`ghcr.io/cdxgen/cdxgen`), which includes cocoapods and additional build tools.",
       );
@@ -2667,7 +2678,11 @@ export function executePodCommand(parameters, path, options) {
       if (result.stderr) {
         console.log(result.stderr);
       }
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "cocoa",
+        tool: "pod",
+        detail: "the pod command failed",
+      });
     }
   }
   return result;
@@ -3189,3 +3204,174 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.externalReferences = externalRefs;
   }
 }
+
+/**
+ * Parse an xmake `xmake-requires.lock` file.
+ *
+ * The lock is a Lua table, written when the `package.requires_lock` policy is
+ * enabled. Its top level holds a `__meta__` entry plus one section per build
+ * configuration, keyed `platform|arch`; each section maps a requirement key
+ * (`"zlib#31fecfc4"`, or `"sol2 v3.2.1#72267bd5"` when the requirement
+ * carries a version) to a table with the resolved `version` and the
+ * `repo` revision the package definition came from.
+ *
+ * The same package appears once per configuration, so entries are collapsed
+ * by name and version, and the configurations a package was resolved for are
+ * kept as a property. A requirement key without a `version` field names a
+ * system package xmake did not resolve; it is inventoried without a version.
+ *
+ * No `xmake` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=xmake` property, following the
+ * convention used for nix and zig.
+ *
+ * @param {string} lockFile Path to `xmake-requires.lock`
+ * @returns {Object[]} Package records for the pinned requirements
+ */
+export function parseXmakeRequiresLock(lockFile) {
+  let text;
+  try {
+    text = readFileSync(lockFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${lockFile}: ${error.message}`);
+    return [];
+  }
+  const byKey = new Map();
+  // The outermost `{` is the file's own table, so a configuration section
+  // opens at depth 1 and a requirement inside it at depth 2. Each is dropped
+  // again once the brace depth falls back to where it opened.
+  const CONFIGURATION_DEPTH = 1;
+  const REQUIREMENT_DEPTH = 2;
+  let configuration;
+  let requirement;
+  let depth = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("--")) {
+      continue;
+    }
+    // `["macosx|arm64"] = {` opens a configuration; `["zlib#hash"] = {` opens
+    // a requirement inside one.
+    const opener = line.match(/^\[\s*"([^"]+)"\s*\]\s*=\s*\{/u);
+    if (opener && depth === CONFIGURATION_DEPTH) {
+      // `__meta__` is normally written unquoted, but a lock that quotes it
+      // must not become a configuration section either.
+      configuration = opener[1] === "__meta__" ? undefined : opener[1];
+    } else if (opener && depth === REQUIREMENT_DEPTH && configuration) {
+      requirement = xmakeRequirementName(opener[1]);
+      const key = `${configuration}|${requirement}`;
+      if (requirement && !byKey.has(key)) {
+        byKey.set(key, { name: requirement, configuration });
+      }
+    } else if (!opener && configuration && requirement) {
+      const version = line.match(/^version\s*=\s*"([^"]*)"/u);
+      if (version) {
+        const record = byKey.get(`${configuration}|${requirement}`);
+        if (record) {
+          record.version = version[1];
+        }
+      }
+    }
+    depth = Math.max(0, depth + countXmakeBraces(line));
+    if (depth <= REQUIREMENT_DEPTH) {
+      requirement = undefined;
+    }
+    if (depth <= CONFIGURATION_DEPTH) {
+      configuration = undefined;
+    }
+  }
+
+  // Collapse the per-configuration entries into one component per resolved
+  // coordinate, listing the configurations it was resolved for.
+  const merged = new Map();
+  for (const record of byKey.values()) {
+    const key = `${record.name}@${record.version || ""}`;
+    const existing = merged.get(key);
+    if (existing) {
+      existing.configurations.add(record.configuration);
+      continue;
+    }
+    merged.set(key, {
+      name: record.name,
+      version: record.version,
+      configurations: new Set([record.configuration]),
+    });
+  }
+
+  const pkgList = [];
+  for (const record of merged.values()) {
+    // A malformed coordinate in an untrusted lock costs one entry, not the
+    // whole scan.
+    const purl = tryBuildPurl({
+      type: "generic",
+      namespace: "xmake",
+      name: record.name,
+      version: record.version || null,
+    });
+    if (!purl) {
+      continue;
+    }
+    pkgList.push({
+      name: record.name,
+      ...(record.version ? { version: record.version } : {}),
+      type: "library",
+      scope: "required",
+      purl,
+      "bom-ref": decodeURIComponent(purl),
+      properties: [
+        { name: "internal:SrcFile", value: lockFile },
+        { name: "cdx:purl:proposedType", value: "xmake" },
+        {
+          name: "cdx:xmake:configurations",
+          value: [...record.configurations].sort().join(", "),
+        },
+      ],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 0.5,
+          methods: [
+            {
+              technique: "source-code-analysis",
+              confidence: 0.5,
+              value: `Filename ${lockFile}`,
+            },
+          ],
+        },
+      },
+    });
+  }
+  return pkgList;
+}
+
+/**
+ * Reduce an xmake requirement key to the package name.
+ *
+ * Keys look like `zlib#31fecfc4` or `sol2 v3.2.1#72267bd5`: the trailing
+ * `#<hash>` identifies the resolved configuration and the optional second
+ * token is the requested version range, neither of which is the name.
+ *
+ * @param {string} key Requirement key as written in the lock
+ * @returns {string|undefined} Package name
+ */
+function xmakeRequirementName(key) {
+  const name = key.split("#")[0].trim().split(/\s+/u)[0];
+  return name || undefined;
+}
+
+/**
+ * Net brace change contributed by one line of a Lua table.
+ *
+ * @param {string} line Line to scan
+ * @returns {number} Opens minus closes
+ */
+function countXmakeBraces(line) {
+  let delta = 0;
+  for (const char of line) {
+    if (char === "{") {
+      delta += 1;
+    } else if (char === "}") {
+      delta -= 1;
+    }
+  }
+  return delta;
+}

package/lib/ecosystems/parsers-nim.js

@@ -0,0 +1,221 @@
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Nim parser for `.nimble` manifests and `nimble.lock`.
+ *
+ * A `.nimble` file is a Nim script whose practical surface is a set of
+ * `key = "value"` assignments plus `requires "dep >= 1.0"` lines; it is read
+ * with a line scanner over those shapes rather than a Nim interpreter.
+ * Nimble persists the resolved dependency set to `nimble.lock` (JSON), which
+ * is the source of truth for versions.
+ *
+ * No `nim` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=nim` property, following the convention
+ * used for nix and zig.
+ */
+
+/**
+ * Parse a Nim project from a `.nimble` manifest and optional `nimble.lock`.
+ *
+ * @param {string} nimbleFile Path to the `.nimble` file
+ * @param {string} [nimbleLockFile] Path to `nimble.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export function parseNimProject(nimbleFile, nimbleLockFile) {
+  const fields = readNimbleFile(nimbleFile);
+  const parentComponent = {};
+  // Nimble files frequently omit `name`; the manifest file name is the
+  // package name in that case, which is also how nimble itself refers to it.
+  const projectName =
+    fields.name || basename(nimbleFile).replace(/\.nimble$/iu, "");
+  if (projectName) {
+    parentComponent.type = "application";
+    parentComponent.name = projectName;
+    if (fields.version) {
+      parentComponent.version = fields.version;
+    }
+    parentComponent.description =
+      fields.description || `Nim package: ${fields.name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: nimbleFile },
+    ];
+    if (fields.license) {
+      parentComponent.license = fields.license;
+    }
+  }
+
+  let lock;
+  if (nimbleLockFile) {
+    try {
+      lock = JSON.parse(readFileSync(nimbleLockFile, "utf-8"));
+    } catch (error) {
+      console.warn(`Failed to parse ${nimbleLockFile}: ${error.message}`);
+      lock = undefined;
+    }
+  }
+
+  // nimble.lock has carried `packages` both as an object keyed by name and as
+  // an array of records; both shapes are accepted so locks from either
+  // nimble generation parse.
+  const lockedEntries = [];
+  if (Array.isArray(lock?.packages)) {
+    lockedEntries.push(...lock.packages);
+  } else if (lock?.packages && typeof lock.packages === "object") {
+    for (const [name, entry] of Object.entries(lock.packages)) {
+      lockedEntries.push({ name, ...entry });
+    }
+  }
+
+  if (!lockedEntries.length) {
+    // Lockless fallback: emit declared requirements without resolved versions.
+    const pkgList = fields.requires.map((req) =>
+      nimPackage(req.name, undefined, { direct: true, srcFile: nimbleFile }),
+    );
+    return {
+      pkgList,
+      dependencies: [],
+      parentComponent,
+      rootInputs: pkgList.map((p) => p["bom-ref"]),
+    };
+  }
+
+  const directNames = new Set(fields.requires.map((req) => req.name));
+  const pkgList = [];
+  const refByName = new Map();
+  const edges = [];
+  for (const entry of lockedEntries) {
+    if (typeof entry?.name !== "string" || !entry.name) {
+      continue;
+    }
+    const version =
+      typeof entry.version === "string" && entry.version
+        ? entry.version
+        : undefined;
+    const pkg = nimPackage(entry.name, version, {
+      direct: directNames.has(entry.name),
+      vcsRevision:
+        typeof entry.vcsRevision === "string" && entry.vcsRevision
+          ? entry.vcsRevision
+          : undefined,
+      srcFile: nimbleLockFile,
+    });
+    pkgList.push(pkg);
+    refByName.set(entry.name, pkg["bom-ref"]);
+  }
+  for (const entry of lockedEntries) {
+    const ref = refByName.get(entry.name);
+    if (!ref) {
+      continue;
+    }
+    const dependsOn = (
+      Array.isArray(entry.dependencies) ? entry.dependencies : []
+    )
+      .map((depName) =>
+        typeof depName === "string" ? refByName.get(depName) : undefined,
+      )
+      .filter(Boolean);
+    edges.push({ ref, dependsOn: [...new Set(dependsOn)].sort() });
+  }
+  const rootInputs = [...directNames]
+    .map((name) => refByName.get(name))
+    .filter(Boolean);
+  return { pkgList, dependencies: edges, parentComponent, rootInputs };
+}
+
+/**
+ * Build a component-like package record for a Nim package.
+ *
+ * @param {string} name Package name
+ * @param {string|undefined} version Resolved version, if known
+ * @param {object} opts Extra context (`direct`, `vcsRevision`, `srcFile`)
+ * @returns {object} Package record
+ */
+function nimPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "generic",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    { name: "cdx:purl:proposedType", value: "nim" },
+    {
+      name: "cdx:nim:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  if (opts.vcsRevision) {
+    properties.push({ name: "cdx:nim:vcsRevision", value: opts.vcsRevision });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Read the assignments and requirements of a `.nimble` file.
+ *
+ * @param {string} filePath File to read
+ * @returns {{name?: string, version?: string, description?: string, license?: string, requires: Array<{name: string, constraint?: string}>}}
+ */
+export function readNimbleFile(filePath) {
+  const result = { requires: [] };
+  let text;
+  try {
+    text = readFileSync(filePath, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${filePath}: ${error.message}`);
+    return result;
+  }
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const assignment = line.match(
+      /^(name|version|description|license)\s*=\s*"([^"]*)"/u,
+    );
+    if (assignment) {
+      const value = assignment[2];
+      if (value) {
+        result[assignment[1]] = value;
+      }
+      continue;
+    }
+    const requires = line.match(/^requires\s+"([^"]+)"/u);
+    if (requires) {
+      const tokens = requires[1].split(/\s+/u);
+      const first = tokens[0];
+      const constraint = tokens.slice(1).join(" ");
+      if (first.startsWith("http") || first.includes("://")) {
+        // URL requirements are identified by the repository name, which is
+        // how nimble itself keys them in the lock file. A trailing .nim
+        // extension is dropped because the lock keys by the bare name.
+        const withoutExtension = first.split(/[?#]/u)[0].replace(/\.git$/u, "");
+        const segments = withoutExtension.split("/").filter(Boolean);
+        const repoName = segments[segments.length - 1] || first;
+        result.requires.push({
+          name: repoName.replace(/\.nim$/iu, ""),
+          constraint,
+        });
+        continue;
+      }
+      result.requires.push({ name: first, constraint });
+    }
+  }
+  return result;
+}

package/lib/ecosystems/parsers-opam.js

@@ -0,0 +1,180 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * OCaml opam parser for `.opam.locked` files.
+ *
+ * `opam lock` writes a `<name>.opam.locked` file that pins the full resolved
+ * dependency set of a project: a `depends:` field listing every package with
+ * an equality constraint on its version, and a `pin-depends:` field for
+ * packages pinned to a URL. The file is opam's own syntax, a small
+ * line-oriented field language, which is read here with a line scanner rather
+ * than a monolithic expression.
+ *
+ * A locked file holds the closure only: it does not record which packages are
+ * direct dependencies of the project, so every entry is reported with the
+ * same standing and the project root links to all of them.
+ *
+ * Packages are identified with the registered `opam` purl type
+ * (`pkg:opam/<name>@<version>`).
+ */
+
+/**
+ * Parse an `.opam.locked` (or plain `.opam`) file.
+ *
+ * @param {string} opamLockedFile Path to the opam file
+ * @returns {{ pkgList: object[], pins: Array<{name: string, url: string}> }}
+ */
+export function parseOpamLockedFile(opamLockedFile) {
+  let text;
+  try {
+    text = readFileSync(opamLockedFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${opamLockedFile}: ${error.message}`);
+    return { pkgList: [], pins: [] };
+  }
+
+  const depends = [];
+  const pins = [];
+  const lines = text.split("\n");
+  let section;
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    if (line.startsWith("depends:")) {
+      section = "depends";
+      continue;
+    }
+    if (line.startsWith("pin-depends:")) {
+      section = "pin-depends";
+      continue;
+    }
+    // A bare `field:` at the start of a line ends the previous list section.
+    if (/^[A-Za-z0-9_-]+:/u.test(line)) {
+      section = undefined;
+      continue;
+    }
+    if (section === "depends") {
+      collectDependsEntry(line, depends, opamLockedFile);
+    } else if (section === "pin-depends") {
+      collectPinEntry(line, pins);
+    }
+  }
+  // A pin overrides where a package is fetched from; reflect that on the
+  // resolved component so consumers can see the divergence from the registry.
+  for (const pin of pins) {
+    const target = depends.find((dep) => dep.name === pin.name);
+    if (target) {
+      target.properties.push({ name: "cdx:opam:pinned", value: "true" });
+      target.properties.push({
+        name: "cdx:opam:pinSource",
+        value: pin.url,
+      });
+    }
+  }
+  return { pkgList: depends, pins };
+}
+
+/**
+ * Turn one `depends` list line into a pinned package record.
+ *
+ * Entries look like `"dune" {= "3.16.0"}` or `"ocaml" {= "5.1.1" & build}`.
+ * Only equality pins carry a version; constraint-only entries are recorded
+ * without one so the package is still inventoried.
+ *
+ * @param {string} line Trimmed list line
+ * @param {object[]} depends Accumulator for package records
+ * @param {string} srcFile Source path for provenance
+ */
+function collectDependsEntry(line, depends, srcFile) {
+  const nameMatch = line.match(/^"([^"]+)"/u);
+  if (!nameMatch) {
+    return;
+  }
+  const name = nameMatch[1];
+  let version;
+  const constraints = line.match(/\{[^}]*\}/gu) || [];
+  for (const constraint of constraints) {
+    // A pin is a standalone `=`, not the tail of `>=`, `<=`, or `!=`.
+    const pinned = constraint.match(/(?<![<>!=])=(?!=)\s*"([^"]+)"/u);
+    if (pinned) {
+      version = pinned[1];
+      break;
+    }
+  }
+  if (depends.some((dep) => dep.name === name && dep.version === version)) {
+    return;
+  }
+  const purl = tryBuildPurl({
+    type: "opam",
+    name,
+    version: version || undefined,
+  });
+  const properties = [{ name: "internal:SrcFile", value: srcFile }];
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  depends.push(pkg);
+}
+
+/**
+ * Turn one `pin-depends` list line into a pin record.
+ *
+ * Entries look like `[ "mylib.dev" "git+https://host/path#rev" ]`. The first
+ * string is a package *version* identifier — `<name>.<version>` — whereas the
+ * matching `depends` entry carries the bare name, so the version suffix is
+ * split off before the two can be matched. Package names cannot contain a
+ * dot, which makes the first dot the separator.
+ *
+ * The URL is reduced to its origin and path so credentials embedded in a
+ * query string never reach the BOM.
+ *
+ * @param {string} line Trimmed list line
+ * @param {Array<{name: string, url: string}>} pins Accumulator for pins
+ */
+function collectPinEntry(line, pins) {
+  const strings = line.match(/"[^"]*"/gu) || [];
+  if (strings.length < 2) {
+    return;
+  }
+  const identifier = strings[0].slice(1, -1);
+  const rawUrl = strings[1].slice(1, -1);
+  pins.push({
+    name: identifier.split(".")[0],
+    url: sanitizedPinUrl(rawUrl),
+  });
+}
+
+/**
+ * Reduce a pin URL to a safe origin plus path.
+ *
+ * @param {string} rawUrl URL as written in the lock file
+ * @returns {string} Sanitised URL, or the raw value when it is not a URL
+ */
+function sanitizedPinUrl(rawUrl) {
+  const schemeSplit = rawUrl.split("://");
+  if (schemeSplit.length < 2) {
+    return rawUrl;
+  }
+  const scheme = schemeSplit[0];
+  const rest = schemeSplit[1];
+  const pathStart = rest.indexOf("/");
+  const authority = pathStart === -1 ? rest : rest.slice(0, pathStart);
+  const path = pathStart === -1 ? "" : rest.slice(pathStart).split(/[?#]/u)[0];
+  // Userinfo is dropped by taking only the authority's host portion.
+  const host = authority.split("@").pop();
+  return `${scheme}://${host}${path}`;
+}