@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/ecosystems/parsers-spack.js

@@ -0,0 +1,204 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * HPC Spack parser for `spack.lock`.
+ *
+ * Spack writes a JSON lock file when an environment is concretised:
+ *
+ *   - `roots` — the specs the user asked for, each as `{hash, spec}`.
+ *   - `concrete_specs` — every node of the resolved DAG, keyed by its DAG
+ *     hash. A node carries its `name`, `version`, `namespace`, the compiler
+ *     and architecture it was built for, and a `dependencies` list whose
+ *     entries reference other nodes by hash.
+ *
+ * The DAG hash is the identity Spack itself uses: two builds of the same
+ * version with different variants or compilers are different hashes, so the
+ * graph is keyed by hash throughout and the hash is carried into each
+ * component's bom-ref.
+ *
+ * No `spack` purl type is registered, so nodes are identified as generic
+ * packages carrying a `cdx:purl:proposedType=spack` property, following the
+ * convention used for nix and zig. The DAG hash is kept as a property because
+ * it identifies the concrete build, not the artifact bytes.
+ */
+
+/**
+ * Parse a `spack.lock` file.
+ *
+ * @param {string} spackLockFile Path to `spack.lock`
+ * @returns {{ pkgList: object[], dependencies: object[], rootInputs: string[] }}
+ */
+export function parseSpackLock(spackLockFile) {
+  let lock;
+  try {
+    lock = JSON.parse(readFileSync(spackLockFile, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${spackLockFile}: ${error.message}`);
+    return emptyResult();
+  }
+  const concreteSpecs =
+    lock?.concrete_specs && typeof lock.concrete_specs === "object"
+      ? lock.concrete_specs
+      : undefined;
+  if (!concreteSpecs) {
+    return emptyResult();
+  }
+
+  const pkgList = [];
+  const refByHash = new Map();
+  for (const [hash, node] of Object.entries(concreteSpecs)) {
+    if (typeof node?.name !== "string" || !node.name) {
+      continue;
+    }
+    const pkg = spackPackage(node.name, stringOrUndefined(node.version), {
+      hash,
+      namespace: stringOrUndefined(node.namespace),
+      arch: architectureLabel(node.arch),
+      compiler: compilerLabel(node.compiler),
+      srcFile: spackLockFile,
+    });
+    pkgList.push(pkg);
+    refByHash.set(hash, pkg["bom-ref"]);
+  }
+
+  const dependencies = [];
+  for (const [hash, node] of Object.entries(concreteSpecs)) {
+    const ref = refByHash.get(hash);
+    if (!ref) {
+      continue;
+    }
+    // Link and run edges are the ones that survive into the installed DAG;
+    // build-only edges are dropped to keep the graph at runtime relevance.
+    const dependsOn = new Set();
+    for (const dep of Array.isArray(node.dependencies)
+      ? node.dependencies
+      : []) {
+      const types = Array.isArray(dep?.type) ? dep.type : [];
+      if (!types.includes("link") && !types.includes("run")) {
+        continue;
+      }
+      const targetRef = refByHash.get(dep?.hash);
+      if (targetRef && targetRef !== ref) {
+        dependsOn.add(targetRef);
+      }
+    }
+    dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
+  }
+
+  // The environment names its own roots; nothing has to be inferred.
+  const rootInputs = (Array.isArray(lock.roots) ? lock.roots : [])
+    .map((root) => refByHash.get(root?.hash))
+    .filter(Boolean);
+  return { pkgList, dependencies, rootInputs: [...new Set(rootInputs)] };
+}
+
+/**
+ * Build a component-like package record for a Spack node.
+ *
+ * @param {string} name Node name
+ * @param {string|undefined} version Node version
+ * @param {object} opts Extra context (`hash`, `namespace`, `arch`, `compiler`, `srcFile`)
+ * @returns {object} Package record
+ */
+function spackPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "generic",
+    namespace: "spack",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    { name: "cdx:purl:proposedType", value: "spack" },
+  ];
+  if (opts.hash) {
+    properties.push({ name: "cdx:spack:hash", value: opts.hash });
+  }
+  if (opts.namespace) {
+    properties.push({ name: "cdx:spack:namespace", value: opts.namespace });
+  }
+  if (opts.arch) {
+    properties.push({ name: "cdx:spack:arch", value: opts.arch });
+  }
+  if (opts.compiler) {
+    properties.push({ name: "cdx:spack:compiler", value: opts.compiler });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    // An environment can hold two builds of one version that differ only in
+    // their variants or compiler, and the DAG hash is what tells them apart,
+    // so it is carried in the bom-ref as a subpath to keep the refs distinct.
+    pkg["bom-ref"] = opts.hash
+      ? `${decodeURIComponent(purl)}#${opts.hash}`
+      : decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}:${opts.hash || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Render a node's architecture as `platform-os-target`.
+ *
+ * @param {object|undefined} arch Node `arch` object
+ * @returns {string|undefined} Architecture label
+ */
+function architectureLabel(arch) {
+  if (!arch || typeof arch !== "object") {
+    return undefined;
+  }
+  // Newer lock versions nest the microarchitecture under `target.name`.
+  const target =
+    typeof arch.target === "string"
+      ? arch.target
+      : stringOrUndefined(arch.target?.name);
+  const parts = [
+    stringOrUndefined(arch.platform),
+    stringOrUndefined(arch.platform_os),
+    target,
+  ].filter(Boolean);
+  return parts.length ? parts.join("-") : undefined;
+}
+
+/**
+ * Render a node's compiler as `name@version`.
+ *
+ * @param {object|undefined} compiler Node `compiler` object
+ * @returns {string|undefined} Compiler label
+ */
+function compilerLabel(compiler) {
+  const name = stringOrUndefined(compiler?.name);
+  if (!name) {
+    return undefined;
+  }
+  const version = stringOrUndefined(compiler?.version);
+  return version ? `${name}@${version}` : name;
+}
+
+/**
+ * Narrow a value to a non-empty string.
+ *
+ * @param {*} value Value to check
+ * @returns {string|undefined} The string, or undefined
+ */
+function stringOrUndefined(value) {
+  return typeof value === "string" && value ? value : undefined;
+}
+
+/**
+ * Shared empty result for unreadable or malformed locks.
+ *
+ * @returns {{pkgList: object[], dependencies: object[], rootInputs: string[]}}
+ */
+function emptyResult() {
+  return { pkgList: [], dependencies: [], rootInputs: [] };
+}

package/lib/ecosystems/parsers-stack.js

@@ -0,0 +1,264 @@
+import { readFileSync } from "node:fs";
+
+import { parse as loadYaml } from "yaml";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Haskell Stack parser for `stack.yaml` and its lock file.
+ *
+ * Stack resolves packages from a snapshot plus the `extra-deps` a project
+ * declares, and writes the completed locations to `stack.yaml.lock` (named
+ * after the configuration file, so a custom `foo.yaml` locks to
+ * `foo.yaml.lock`). The lock is YAML with two lists:
+ *
+ *   - `packages` — one entry per extra-dep, each holding the `original`
+ *     incomplete specification and the `completed` location. A Hackage
+ *     location is the string `<name>-<version>@sha256:<hex>,<size>`; a
+ *     repository location carries `url`, `commit` and `subdir`.
+ *   - `snapshots` — the resolved snapshot chain, each with the `original`
+ *     name (`lts-22.28`) and the `completed` url, size and sha256.
+ *
+ * The lock pins only the extra-deps: packages taken from the snapshot are not
+ * listed, because the snapshot url and digest already pin them. The snapshot
+ * is therefore recorded on the parent component rather than expanded.
+ *
+ * Hackage packages are identified with the registered `hackage` purl type
+ * (`pkg:hackage/<name>@<version>`).
+ */
+
+/**
+ * Parse a Stack project from its lock file, with optional `stack.yaml`.
+ *
+ * @param {string} stackLockFile Path to `stack.yaml.lock` or `stack.lock`
+ * @param {string} [stackYamlFile] Path to `stack.yaml`, if present
+ * @returns {{ pkgList: object[], parentComponent: object, rootInputs: string[] }}
+ */
+export function parseStackProject(stackLockFile, stackYamlFile) {
+  const lock = readYamlFile(stackLockFile);
+  const stackYaml = stackYamlFile ? readYamlFile(stackYamlFile) : undefined;
+  const snapshot = snapshotName(lock, stackYaml);
+
+  const pkgList = [];
+  const seen = new Set();
+  for (const entry of Array.isArray(lock?.packages) ? lock.packages : []) {
+    const pkg = stackPackageFromEntry(entry, stackLockFile);
+    if (!pkg || seen.has(pkg["bom-ref"])) {
+      continue;
+    }
+    seen.add(pkg["bom-ref"]);
+    pkgList.push(pkg);
+  }
+
+  const parentComponent = {};
+  if (stackYamlFile || pkgList.length) {
+    const name =
+      typeof stackYaml?.name === "string" && stackYaml.name
+        ? stackYaml.name
+        : projectDirName(stackYamlFile || stackLockFile);
+    parentComponent.type = "application";
+    parentComponent.name = name;
+    parentComponent.description = `Haskell Stack project: ${name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: stackYamlFile || stackLockFile },
+    ];
+    if (snapshot) {
+      parentComponent.properties.push({
+        name: "cdx:stack:snapshot",
+        value: snapshot,
+      });
+    }
+  }
+  return {
+    pkgList,
+    parentComponent,
+    rootInputs: pkgList.map((pkg) => pkg["bom-ref"]),
+  };
+}
+
+/**
+ * Build a package record from one `packages` entry of the lock.
+ *
+ * @param {object} entry Lock entry with `original` and `completed`
+ * @param {string} srcFile Lock file path for provenance
+ * @returns {object|undefined} Package record, or undefined when unrecognised
+ */
+function stackPackageFromEntry(entry, srcFile) {
+  const completed = entry?.completed ?? {};
+  const original = entry?.original ?? {};
+  const hackage =
+    typeof completed.hackage === "string"
+      ? completed.hackage
+      : typeof original.hackage === "string"
+        ? original.hackage
+        : undefined;
+  if (hackage) {
+    return hackagePackage(hackage, srcFile);
+  }
+  // Repository extra-deps pin a commit rather than a Hackage release; the
+  // package name is the repository's last path segment unless a subdir names
+  // the package more precisely.
+  const url = typeof completed.url === "string" ? completed.url : undefined;
+  const commit =
+    typeof completed.commit === "string" ? completed.commit : undefined;
+  if (!url) {
+    return undefined;
+  }
+  const subdir =
+    typeof completed.subdir === "string" && completed.subdir
+      ? completed.subdir.split("/").filter(Boolean).pop()
+      : undefined;
+  const repoName = url
+    .split(/[?#]/u)[0]
+    .replace(/\.git$/u, "")
+    .split("/")
+    .filter(Boolean)
+    .pop();
+  const name = subdir || repoName;
+  if (!name) {
+    return undefined;
+  }
+  return finishPackage(name, commit, srcFile, [
+    { name: "cdx:stack:repository", value: url },
+    ...(commit ? [{ name: "cdx:stack:commit", value: commit }] : []),
+  ]);
+}
+
+/**
+ * Build a package record from a Hackage location string.
+ *
+ * The string is `<name>-<version>@sha256:<hex>,<size>`; the trailing
+ * `-<version>` separates the name, and the digest covers the package tarball.
+ *
+ * @param {string} location Hackage location as the lock writes it
+ * @param {string} srcFile Lock file path for provenance
+ * @returns {object|undefined} Package record
+ */
+function hackagePackage(location, srcFile) {
+  const [coordinate, rest] = splitOnce(location, "@");
+  const match = coordinate.match(/^(.+)-(\d[^-]*)$/u);
+  if (!match) {
+    return undefined;
+  }
+  const [, name, version] = match;
+  const sha256 = rest?.startsWith("sha256:")
+    ? rest.slice("sha256:".length).split(",")[0]
+    : undefined;
+  const pkg = finishPackage(name, version, srcFile, []);
+  if (sha256 && /^[0-9a-f]{64}$/iu.test(sha256)) {
+    pkg.hashes = [{ alg: "SHA-256", content: sha256.toLowerCase() }];
+  }
+  return pkg;
+}
+
+/**
+ * Assemble the common fields of a Stack package record.
+ *
+ * @param {string} name Package name
+ * @param {string|undefined} version Version or pinned commit
+ * @param {string} srcFile Lock file path for provenance
+ * @param {object[]} extraProperties Additional properties
+ * @returns {object} Package record
+ */
+function finishPackage(name, version, srcFile, extraProperties) {
+  const purl = tryBuildPurl({
+    type: "hackage",
+    name,
+    version: version || undefined,
+  });
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties: [
+      { name: "internal:SrcFile", value: srcFile },
+      // The lock records extra-deps only; snapshot packages never appear.
+      { name: "cdx:stack:dependency", value: "extra-dep" },
+      ...extraProperties,
+    ],
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Determine the snapshot the project resolves against.
+ *
+ * `stack.yaml` names it under `snapshot` (or the older `resolver`); the lock
+ * repeats it as the `original` of the first snapshot entry.
+ *
+ * @param {object|undefined} lock Parsed lock file
+ * @param {object|undefined} stackYaml Parsed `stack.yaml`
+ * @returns {string|undefined} Snapshot name or url
+ */
+function snapshotName(lock, stackYaml) {
+  for (const candidate of [stackYaml?.snapshot, stackYaml?.resolver]) {
+    if (typeof candidate === "string" && candidate) {
+      return candidate;
+    }
+  }
+  const first = Array.isArray(lock?.snapshots) ? lock.snapshots[0] : undefined;
+  const original = first?.original;
+  if (typeof original === "string" && original) {
+    return original;
+  }
+  if (typeof original?.url === "string" && original.url) {
+    return original.url;
+  }
+  if (typeof first?.completed?.url === "string") {
+    return first.completed.url;
+  }
+  return undefined;
+}
+
+/**
+ * Split a string at the first occurrence of a separator.
+ *
+ * @param {string} value Value to split
+ * @param {string} separator Separator character
+ * @returns {[string, string|undefined]} Head and remainder
+ */
+function splitOnce(value, separator) {
+  const index = value.indexOf(separator);
+  if (index === -1) {
+    return [value, undefined];
+  }
+  return [value.slice(0, index), value.slice(index + 1)];
+}
+
+/**
+ * Derive a project name from the directory holding the Stack files.
+ *
+ * Stack manifests never carry a project name, so the directory is the name
+ * developers already use for the project.
+ *
+ * @param {string} filePath File path
+ * @returns {string} Directory name
+ */
+function projectDirName(filePath) {
+  const segments = filePath.split(/[\\/]/u).filter(Boolean);
+  // Drop the file itself, keeping the directory.
+  segments.pop();
+  return segments[segments.length - 1] || "stack-project";
+}
+
+/**
+ * Read and parse a YAML file, warning instead of throwing.
+ *
+ * @param {string} filePath File to read
+ * @returns {object|undefined} Parsed value
+ */
+function readYamlFile(filePath) {
+  try {
+    return loadYaml(readFileSync(filePath, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${filePath}: ${error.message}`);
+    return undefined;
+  }
+}

package/lib/ecosystems/parsers-terraform.js

@@ -0,0 +1,194 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Terraform and OpenTofu parser for `.terraform.lock.hcl`.
+ *
+ * The lock file pins every provider the configuration resolves to, with its
+ * exact version, the version constraints that produced it, and content
+ * hashes. It is written in a small, regular subset of HCL: provider blocks,
+ * `version` and `constraints` attributes, and a `hashes` list of prefixed
+ * digests. A line scanner is sufficient and avoids a general HCL parser.
+ *
+ * Provider addresses look like `registry.terraform.io/hashicorp/aws`; the
+ * registry host and namespace identify the provider upstream, so they are
+ * kept in the component group and a generic purl
+ * (`pkg:generic/<host>/<namespace>/<type>@<version>`), with the intended type
+ * recorded as a `cdx:purl:proposedType` property because no `terraform`
+ * purl type is registered.
+ *
+ * The two hash schemes in the `hashes` list mean different things. A `zh:`
+ * digest is a SHA-256 of the official `.zip` package as the registry indexes
+ * it, so it is the one a consumer can check an artifact against and the one
+ * emitted in the CycloneDX `hashes` array. An `h1:` digest is base64 over a
+ * hash of the package's *contents* rather than the archive, which lets
+ * Terraform verify an unpacked directory but makes it useless as an artifact
+ * checksum; it is kept as a property instead of being mislabelled SHA-256.
+ */
+
+/**
+ * Parse a `.terraform.lock.hcl` file.
+ *
+ * @param {string} lockFile Path to the lock file
+ * @returns {{ pkgList: object[] }} Provider components
+ */
+export function parseTerraformLockFile(lockFile) {
+  let text;
+  try {
+    text = readFileSync(lockFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${lockFile}: ${error.message}`);
+    return { pkgList: [] };
+  }
+
+  const pkgList = [];
+  let current;
+  let inHashes = false;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    if (inHashes) {
+      if (line.startsWith("]")) {
+        inHashes = false;
+        continue;
+      }
+      const hash = line.match(/^"([^"]+)"/u);
+      if (hash && current) {
+        current.candidates.push(hash[1]);
+      }
+      continue;
+    }
+    const block = line.match(/^provider\s+"([^"]+)"\s*\{/u);
+    if (block) {
+      current = { address: block[1], candidates: [] };
+      continue;
+    }
+    if (line.startsWith("}")) {
+      if (current) {
+        const pkg = buildProviderComponent(current, lockFile);
+        if (pkg) {
+          pkgList.push(pkg);
+        }
+        current = undefined;
+      }
+      continue;
+    }
+    const version = matchAttribute(line, "version");
+    if (version && current) {
+      current.version = version;
+      continue;
+    }
+    const constraints = matchAttribute(line, "constraints");
+    if (constraints && current) {
+      current.constraints = constraints;
+      continue;
+    }
+    if (/^hashes\s*=\s*\[/u.test(line) && current) {
+      inHashes = true;
+      // Some writers put the first digest on the same line as the bracket.
+      const inline = line.replace(/^hashes\s*=\s*\[\s*/u, "");
+      const inlineHash = inline.match(/^"([^"]+)"/u);
+      if (inlineHash) {
+        current.candidates.push(inlineHash[1]);
+      }
+    }
+  }
+  return { pkgList };
+}
+
+/**
+ * Match a string attribute assignment such as `version = "5.80.0"`.
+ *
+ * @param {string} line Trimmed line
+ * @param {string} name Attribute name
+ * @returns {string|undefined} Attribute value when present
+ */
+function matchAttribute(line, name) {
+  const match = line.match(new RegExp(`^${name}\\s*=\\s*"([^"]*)"`, "u"));
+  return match ? match[1] : undefined;
+}
+
+/**
+ * Build a provider component from one parsed block.
+ *
+ * @param {{address: string, version?: string, constraints?: string, candidates: string[]}} block
+ *   Parsed provider block
+ * @param {string} srcFile Lock file path
+ * @returns {object|undefined} Component record
+ */
+function buildProviderComponent(block, srcFile) {
+  const segments = block.address.split("/").filter(Boolean);
+  if (segments.length < 2) {
+    return undefined;
+  }
+  const name = segments[segments.length - 1];
+  const namespace = segments.slice(0, -1).join("/");
+  const purl = tryBuildPurl({
+    type: "generic",
+    namespace,
+    name,
+    version: block.version,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: srcFile },
+    { name: "cdx:purl:proposedType", value: "terraform-provider" },
+    { name: "cdx:tf:address", value: block.address },
+  ];
+  if (block.constraints) {
+    properties.push({ name: "cdx:tf:constraints", value: block.constraints });
+  }
+  const contentHash = block.candidates.find((candidate) =>
+    candidate.startsWith("h1:"),
+  );
+  if (contentHash) {
+    properties.push({ name: "cdx:tf:h1", value: contentHash });
+  }
+  const pkg = {
+    group: namespace,
+    name,
+    ...(block.version ? { version: block.version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  const sha256 = zipDigestsHex(block.candidates);
+  if (sha256.length) {
+    pkg.hashes = sha256.map((content) => ({ alg: "SHA-256", content }));
+  }
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${block.address}:${block.version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Collect the `zh:` package digests of a provider block.
+ *
+ * A provider is published as one zip per platform and the lock records a
+ * digest for each, so a block yields several digests for the same version.
+ * All of them are returned: each is a genuine SHA-256 of a distributed
+ * artifact for this component, and the lock does not say which platform a
+ * given digest belongs to.
+ *
+ * @param {string[]} candidates Prefixed digests from the hashes list
+ * @returns {string[]} Lowercase hex digests, in file order and deduplicated
+ */
+function zipDigestsHex(candidates) {
+  const digests = new Set();
+  for (const candidate of candidates) {
+    if (!candidate.startsWith("zh:")) {
+      continue;
+    }
+    const digest = candidate.slice(3).toLowerCase();
+    if (/^[0-9a-f]{64}$/u.test(digest)) {
+      digests.add(digest);
+    }
+  }
+  return [...digests];
+}