@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/evinser/evinser.js

@@ -25,6 +25,15 @@ import {
   getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
+import {
+  analyzeKosiProject,
+  collectKosiApiEndpoints,
+  collectKosiEvidence,
+  collectKosiServices,
+  isKosiKotlinLanguage,
+  kosiWorkspaceComponent,
+  mergeKosiEvidence,
+} from "../ecosystems/kosi.js";
 import {
   analyzeRusiProject,
   collectRusiEvidence,
@@ -42,12 +51,16 @@ import {
 import { collectMvnDependencies } from "../inventory/deps.js";
 import { mergeServices } from "../inventory/depsUtils.js";
 import {
+  applyDosaiReachabilityEvidence,
+  collectDosaiAiComponents,
   collectDosaiDataFlowFrames,
   collectDosaiPurlEvidence,
+  collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiDataFlowSlice,
   createDosaiMethodsSlice,
   isDosaiDotnetLanguage,
+  normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
@@ -613,8 +626,13 @@ export function initFromSbom(components, language) {
         });
     }
     if (comp.evidence.occurrences) {
+      // Keep the `location#line` shape so a re-run over a cdxgen BOM does not
+      // degrade seeded occurrences to file-only entries and duplicate the
+      // richer locations the fresh slice merge adds to the same set.
       purlLocationMap[comp.purl] = new Set(
-        comp.evidence.occurrences.map((v) => v.location),
+        comp.evidence.occurrences.map((v) =>
+          v.line ? `${v.location}#${v.line}` : v.location,
+        ),
       );
     }
   }
@@ -662,6 +680,7 @@ export async function analyzeProject(dbObjMap, options) {
   const bomJson = JSON.parse(fs.readFileSync(bomFile, "utf8"));
   const components = bomJson.components || [];
   let cryptoComponents = [];
+  let aiComponents = [];
   let cryptoGeneratePurls = {};
   let openapiSpecFile;
   // Load any existing purl-location information from the sbom.
@@ -720,6 +739,84 @@ export async function analyzeProject(dbObjMap, options) {
     };
   }
 
+  if (isKosiKotlinLanguage(language)) {
+    const kosiReports = analyzeKosiProject(dirPath, options);
+    if (kosiReports?.report && Object.keys(kosiReports.report).length) {
+      // The workspace component: cdxgen's Kotlin BOM carries no project
+      // component, so every workspace-anchored slice (reachability, the
+      // app's own flows) would have nothing to attach to. createEvinseFile
+      // re-reads the BOM from disk, so the candidate rides the artefacts
+      // instead of a mutation here — applied when the BOM lacks a project
+      // component OR carries one with no purl: every kosi evidence join is
+      // keyed by purl, so a purl-less component anchors nothing and is, for
+      // this purpose, no anchor at all (found on the sample app: Gradle
+      // identity with empty group and version "latest" emits no purl, and
+      // the reachableFromRoots/cryptoFlow evidence silently attached to
+      // nothing while the dependency-joined kinds landed).
+      const metadataComponentHasPurl = Boolean(
+        bomJson.metadata?.component?.purl,
+      );
+      let workspaceComponent;
+      if (!metadataComponentHasPurl) {
+        // kosi's modules[] holds the project's OWN Gradle/Maven modules
+        // (dependencies never appear there), so the project component is
+        // its root: the shortest modulePath, ties broken by name so the
+        // choice is deterministic. `workspaceMember` is not the selector —
+        // it is a String naming the owning workspace member in kosi's
+        // schema, empty for a single-module build and then omitted from the
+        // JSON entirely, so testing it against `undefined` picked nothing
+        // on exactly the single-module projects this fallback exists for.
+        const workspaceModule = (kosiReports.report.modules || [])
+          .filter((candidate) => candidate?.purl)
+          .sort(
+            (a, b) =>
+              (a.modulePath || "").length - (b.modulePath || "").length ||
+              (a.name || "").localeCompare(b.name || ""),
+          )[0];
+        if (workspaceModule?.purl) {
+          workspaceComponent = kosiWorkspaceComponent(workspaceModule);
+        }
+      }
+      const analysisComponents = [
+        bomJson.metadata?.component,
+        workspaceComponent,
+        ...components,
+      ].filter(Boolean);
+      const kosiEvidence = collectKosiEvidence(
+        kosiReports.report,
+        analysisComponents,
+      );
+      mergeKosiEvidence(
+        kosiEvidence,
+        collectKosiEvidence(
+          kosiReports.reachableReport || {},
+          analysisComponents,
+        ),
+      );
+      servicesMap = collectKosiServices(kosiReports.report, servicesMap);
+      // The INBOUND surface: the routes the app serves, with the
+      // authentication kosi found declared on them.
+      servicesMap = collectKosiApiEndpoints(kosiReports.report, servicesMap);
+      return {
+        purlLocationMap: kosiEvidence.purlLocationMap,
+        dataFlowFrames: kosiEvidence.dataFlowFrames,
+        componentPropertiesMap: kosiEvidence.componentPropertiesMap,
+        metadataProperties: kosiEvidence.metadataProperties,
+        cryptoComponents: kosiEvidence.cryptoComponents,
+        cryptoGeneratePurls: kosiEvidence.cryptoGeneratePurls,
+        servicesMap,
+        userDefinedTypesMap,
+        workspaceComponent,
+      };
+    }
+    return {
+      purlLocationMap,
+      servicesMap,
+      dataFlowFrames,
+      userDefinedTypesMap,
+    };
+  }
+
   if (isDosaiDotnetLanguage(language)) {
     if (options.profile === "research") {
       options.withDataFlow = true;
@@ -742,6 +839,10 @@ export async function analyzeProject(dbObjMap, options) {
     }
     if (usageSlice && Object.keys(usageSlice).length) {
       const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components);
+      // Confidence/evidence facts ride along as properties so an unbuilt tree (Low
+      // confidence, unresolved evidence) stays distinguishable from an only-imported
+      // package in the emitted BOM.
+      applyDosaiReachabilityEvidence(usageSlice, components);
       for (const [purl, locations] of Object.entries(
         dosaiEvidence.purlLocationMap,
       )) {
@@ -750,6 +851,13 @@ export async function analyzeProject(dbObjMap, options) {
           purlLocationMap[purl].add(location);
         }
       }
+      // Rich Services[] inventory first (bom-refs, trust zones, data); endpoint
+      // derivation fills any services the providers did not emit.
+      // AI components must be carried out of analyzeProject explicitly. Mutating the local
+      // `components` array here had no effect: the return below omits it and createEvinseFile
+      // re-reads the BOM from disk, so the whole AI-BOM contribution was silently discarded.
+      collectDosaiAiComponents(usageSlice, aiComponents);
+      servicesMap = collectDosaiServiceComponents(usageSlice, servicesMap);
       servicesMap = collectDosaiServicesFromMethods(usageSlice, servicesMap);
       userDefinedTypesMap = {};
     }
@@ -802,6 +910,7 @@ export async function analyzeProject(dbObjMap, options) {
       tempDirOwned: retMap?.tempDirOwned,
       userDefinedTypesMap,
       cryptoComponents,
+      aiComponents,
       cryptoGeneratePurls,
     };
   }
@@ -832,6 +941,7 @@ export async function analyzeProject(dbObjMap, options) {
     const retMap = collectReachableFrames(language, reachablesSlice);
     dataFlowFrames = retMap.dataFlowFrames;
     cryptoComponents = retMap.cryptoComponents;
+    aiComponents = retMap.aiComponents || [];
     cryptoGeneratePurls = retMap.cryptoGeneratePurls;
   }
   // Reuse existing usages slices
@@ -960,6 +1070,7 @@ export async function analyzeProject(dbObjMap, options) {
     tempDirOwned: retMap?.tempDirOwned,
     userDefinedTypesMap,
     cryptoComponents,
+    aiComponents,
     cryptoGeneratePurls,
     openapiSpecFile,
   };
@@ -1804,7 +1915,7 @@ export function extractEndpoints(language, code) {
  * @param {Object} options Command line options
  * @returns
  */
-export function createEvinseFile(sliceArtefacts, options) {
+export async function createEvinseFile(sliceArtefacts, options) {
   const {
     tempDir,
     tempDirOwned,
@@ -1817,7 +1928,9 @@ export function createEvinseFile(sliceArtefacts, options) {
     componentPropertiesMap = {},
     metadataProperties = [],
     cryptoComponents,
+    aiComponents,
     cryptoGeneratePurls,
+    workspaceComponent,
   } = sliceArtefacts;
   const bomFile = options.input;
   const evinseOutFile = options.output;
@@ -1825,6 +1938,18 @@ export function createEvinseFile(sliceArtefacts, options) {
   const components = bomJson.components || [];
   // Clear existing annotations
   bomJson.annotations = [];
+  if (workspaceComponent && !bomJson.metadata?.component?.purl) {
+    if (bomJson.metadata?.component) {
+      // A purl-less project component: keep cdxgen's own identity fields
+      // and supply the purl kosi's module discovery published, so the
+      // evidence loop below can anchor workspace evidence to it.
+      bomJson.metadata.component.purl = workspaceComponent.purl;
+      bomJson.metadata.component["bom-ref"] ??= workspaceComponent.purl;
+    } else {
+      bomJson.metadata ??= {};
+      bomJson.metadata.component = workspaceComponent;
+    }
+  }
   appendComponentProperties(bomJson.metadata?.component, metadataProperties);
   let occEvidencePresent = false;
   let csEvidencePresent = false;
@@ -1873,16 +1998,12 @@ export function createEvinseFile(sliceArtefacts, options) {
     }
   } // for
   if (servicesMap && Object.keys(servicesMap).length) {
-    const services = [];
-    for (const serviceName of Object.keys(servicesMap)) {
-      services.push({
-        name: serviceName,
-        endpoints: Array.from(servicesMap[serviceName].endpoints),
-        authenticated: servicesMap[serviceName].authenticated,
-        "x-trust-boundary": servicesMap[serviceName].xTrustBoundary,
-        properties: servicesMap[serviceName].properties,
-      });
-    }
+    // normalizeDosaiServiceMap is the single mapping from the internal service
+    // definitions to CycloneDX services[]. The OpenAPI/Java/Python detectors set
+    // the camelCase `xTrustBoundary` while dosai's provider inventory (schema
+    // 4.0.0) carries stable bom-refs, trust zones, data classifications, and
+    // evidence occurrences; both shapes flow through the same normalizer.
+    const services = normalizeDosaiServiceMap(servicesMap);
     // Add to existing services while preserving CycloneDX uniqueItems validity
     bomJson.services = mergeServices(bomJson.services || [], services);
     servicesPresent = true;
@@ -1891,6 +2012,10 @@ export function createEvinseFile(sliceArtefacts, options) {
   if (cryptoComponents?.length) {
     bomJson.components = bomJson.components.concat(cryptoComponents);
   }
+  // Add the AI components (machine-learning-model, dataset) discovered by dosai
+  if (aiComponents?.length) {
+    bomJson.components = bomJson.components.concat(aiComponents);
+  }
   // Fix the dependencies section with provides information
   if (
     cryptoGeneratePurls &&
@@ -1943,7 +2068,10 @@ export function createEvinseFile(sliceArtefacts, options) {
   // Redo post-processing with evinse data. `executeOsQuery` has to be injected
   // because postgen no longer imports it directly (stages is below managers);
   // without it the crypto formulation path receives `undefined` and throws.
-  const bomNSData = postProcess({ bomJson }, { ...options, executeOsQuery });
+  const bomNSData = await postProcess(
+    { bomJson },
+    { ...options, executeOsQuery },
+  );
   safeWriteSync(
     evinseOutFile,
     JSON.stringify(bomNSData.bomJson, null, options.jsonPretty ? 2 : null),