@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/cli/managedBom.js

@@ -6,6 +6,8 @@ import process from "node:process";
 import { build } from "@cdxgen/cdx-purl";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import {
   DOTNET_CMD,
   hasAnyProjectType,
@@ -48,6 +50,7 @@ import {
   parseGitHubWorkflowData,
   parseHelmYamlData,
 } from "../ecosystems/parsers-misc.js";
+import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
   generatePixiLockFile,
   parseMojoProject,
@@ -59,6 +62,8 @@ import {
   parseReqFile,
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
+import { parseRenvLock } from "../ecosystems/parsers-r.js";
+import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -94,6 +99,7 @@ import {
   trimComponents,
 } from "../inventory/depsUtils.js";
 import {
+  collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
   isDosaiDotnetLanguage,
@@ -102,6 +108,7 @@ import {
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
+import { classifyProbeResult } from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
 import { getTreeWithPlugin } from "../managers/piptree.js";
 import {
@@ -408,7 +415,11 @@ export async function createPythonBom(path, options) {
       }
       let retMap = await parsePyLockData(lockData, f);
       if (retMap?.workspaceWarningShown) {
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "python",
+          tool: "python",
+          detail: "the python lock file could not be parsed",
+        });
       }
       if (retMap?.pyLockProperties?.length) {
         parentComponent.properties = parentComponent.properties || [];
@@ -458,15 +469,6 @@ export async function createPythonBom(path, options) {
               retMap.dependenciesList,
               parentComponent,
             );
-          if (retMap.rootList) {
-            const parentDependsOn = new Set();
-            for (const p of retMap.rootList)
-              parentDependsOn.add(pypiBomRef(p.name, p.version));
-            dependencies.splice(0, 0, {
-              ref: parentComponent["bom-ref"],
-              dependsOn: [...parentDependsOn].sort(),
-            });
-          }
         } else {
           let exportedReqs = "";
           if (f.endsWith("poetry.lock")) {
@@ -493,6 +495,11 @@ export async function createPythonBom(path, options) {
               exportedReqs = expCmd.stdout.toString();
           }
           if (exportedReqs) {
+            // The export contains the resolved closure, not just the first
+            // level, so it contributes components only. The root edge comes
+            // from parsePyLockData (seeded from the manifest); for locks
+            // without a neighbouring pyproject.toml the generic postgen
+            // parent-edge repair keeps the tree reachable.
             const tmpReqFile = join(
               tempDir,
               `exported-${basename(basePath)}-reqs.txt`,
@@ -501,13 +508,6 @@ export async function createPythonBom(path, options) {
             const dlist = await parseReqFile(tmpReqFile, false);
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
-              const parentDependsOn = new Set();
-              for (const p of dlist)
-                parentDependsOn.add(pypiBomRef(p.name, p.version));
-              dependencies.splice(0, 0, {
-                ref: parentComponent["bom-ref"],
-                dependsOn: [...parentDependsOn].sort(),
-              });
             }
           }
         }
@@ -577,14 +577,30 @@ export async function createPythonBom(path, options) {
       safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
       const piplockFile = join(path, "Pipfile.lock");
       if (safeExistsSync(piplockFile)) {
-        const lockData = JSON.parse(readFileSync(piplockFile));
-        const dlist = await parsePiplockData(lockData);
+        let dlist;
+        try {
+          const lockData = JSON.parse(readFileSync(piplockFile));
+          dlist = await parsePiplockData(lockData);
+        } catch (err) {
+          recordDegradation("python.lockfile-unparseable.pipenv", {
+            ecosystem: "python",
+            impact: "transitive-deps",
+            path: piplockFile,
+            detail:
+              "The Pipfile.lock could not be parsed, so no locked versions were captured from it.",
+          });
+          console.log(`Error while parsing the lock file ${piplockFile}.`, err);
+        }
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       } else {
         console.error("Pipfile.lock not found at", path);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "python",
+          tool: "pipenv",
+          detail: "Pipfile.lock was not found",
+        });
       }
     } else if (reqDirFiles?.length) {
       for (const j in reqDirFiles) {
@@ -1087,13 +1103,33 @@ export function createPHPBom(path, options) {
       shell: isWin,
     });
     if (versionResult.status !== 0 || versionResult.error) {
+      // A composer the runtime or a policy denied is not an unavailable
+      // composer; the version probes report that as degraded evidence.
+      if (classifyProbeResult(versionResult) === "missing") {
+        recordDegradation("php.composer.missing", {
+          ecosystem: "php",
+          tool: "composer",
+          impact: "components",
+          command: "composer --version",
+          exitCode:
+            typeof versionResult.status === "number"
+              ? versionResult.status
+              : undefined,
+          detail:
+            "The composer executable could not be run, so the composer.lock generation could not be attempted.",
+        });
+      }
       console.error(
         "No composer version found. Check if composer is installed and available in PATH.",
       );
       if (DEBUG_MODE) {
         console.log(versionResult.error, versionResult.stderr);
       }
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "php",
+        tool: "composer",
+        detail: "the composer version command failed",
+      });
     }
     let composerVersion;
     if (DEBUG_MODE) {
@@ -1129,7 +1165,11 @@ export function createPHPBom(path, options) {
           console.log(result.stderr);
         }
         console.log(result.error);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "php",
+          tool: "composer",
+          detail: "the composer install command failed",
+        });
       }
     }
   }
@@ -1206,6 +1246,15 @@ export function createPHPBom(path, options) {
       parentComponent,
     });
   }
+  if (composerJsonMode && !composerLockMode) {
+    recordDegradation("php.no-lockfile", {
+      ecosystem: "php",
+      tool: "composer",
+      impact: "components",
+      detail:
+        "No composer.lock was found or generated, and the lock file is the source the Composer parser reads.",
+    });
+  }
   return {};
 }
 
@@ -1319,7 +1368,11 @@ export async function createRubyBom(path, options) {
           "Bundle install has failed. Check if bundle is installed and available in PATH.",
         );
         console.log(result.error, result.stderr);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "ruby",
+          tool: "bundler",
+          detail: "the bundler command failed",
+        });
       }
     }
   }
@@ -1361,7 +1414,11 @@ export async function createRubyBom(path, options) {
       console.log(
         "SBOM generation using only gemspec files is imprecise and results in an inaccurate dependency tree.",
       );
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "ruby",
+        tool: "bundler",
+        detail: "only gemspec files were available to parse",
+      });
     }
     for (const f of gemspecFiles) {
       const gemspecData = readFileSync(f, { encoding: "utf-8" });
@@ -1634,7 +1691,11 @@ export async function createCsharpBom(path, options) {
               "TIP: msbuild is not available for Linux. Try using a Windows build agent to generate an SBOM for this project.",
             );
           }
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "csharp",
+            tool: "dotnet",
+            detail: "the dotnet command failed",
+          });
         }
         if (result?.stderr?.includes("To install missing framework")) {
           console.log(
@@ -1683,7 +1744,11 @@ export async function createCsharpBom(path, options) {
           console.log(result.stdout);
         }
         console.log("---------");
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "csharp",
+          tool: "dotnet",
+          detail: "the dotnet restore did not produce a usable assets file",
+        });
       }
     }
     // Collect the assets, lock, and nupkg files generated from restore
@@ -1786,7 +1851,11 @@ export async function createCsharpBom(path, options) {
       console.log(
         "Alternatively, try using the custom `ghcr.io/cdxgen/cdxgen-dotnet:v13` container image, which bundles a range of dotnet SDKs.",
       );
-      options.failOnError && process.exit(1);
+      deferFailOnError(options, {
+        ecosystem: "csharp",
+        tool: "dotnet",
+        detail: "no dotnet dependency evidence could be collected",
+      });
     }
   }
   // packages.lock.json parsing for any project without a project.assets.json
@@ -1960,7 +2029,10 @@ export async function createCsharpBom(path, options) {
       }
       pkgList = addEvidenceForDotnet(pkgList, slicesFile);
       const methodsSlice = readDosaiJsonFile(slicesFile);
-      const servicesMap = collectDosaiServicesFromMethods(methodsSlice, {});
+      // Provider-backed Services[] first so bom-refs, trust zones, and data
+      // classifications survive; ApiEndpoints derivation fills in the rest.
+      const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
+      collectDosaiServicesFromMethods(methodsSlice, servicesMap);
       services = normalizeDosaiServiceMap(servicesMap);
     }
   }
@@ -2081,3 +2153,152 @@ export async function createCryptoCertsBom(path, options) {
     },
   };
 }
+
+/**
+ * Function to create bom string for R projects using renv.
+ *
+ * The `renv.lock` file carries the resolved package set for the project
+ * library, including the R version it was produced under.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createRBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  let rVersion;
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  for (const renvLockFile of renvLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${renvLockFile}`);
+    }
+    const result = parseRenvLock(renvLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+    if (!rVersion) {
+      rVersion = result.rVersion;
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // renv locks the library, not the project: they carry no project name, so
+  // the directory is the name the project is already known by. The R version
+  // the library was resolved under is a property of that project.
+  const projectName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: projectName,
+    "bom-ref": `application:${projectName}:latest`,
+    description: `R project: ${projectName}`,
+    properties: [
+      { name: "internal:SrcFile", value: renvLockFiles.join(", ") },
+      ...(rVersion ? [{ name: "cdx:renv:rVersion", value: rVersion }] : []),
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "cran", {
+    src: path,
+    filename: renvLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}
+
+/**
+ * Function to create bom string for Perl projects using Carton.
+ *
+ * The `cpanfile.snapshot` carries the resolved install set; the declared
+ * `cpanfile` is consulted to distinguish direct dependencies.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createPerlBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  const snapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  for (const snapshotFile of snapshotFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${snapshotFile}`);
+    }
+    const baseDir = dirname(snapshotFile);
+    const cpanfile = join(baseDir, "cpanfile");
+    const result = parseCpanSnapshot(
+      snapshotFile,
+      safeExistsSync(cpanfile) ? cpanfile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "cpan", {
+      src: path,
+      filename: snapshotFiles.join(", "),
+      dependencies,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Terraform and OpenTofu projects.
+ *
+ * The `.terraform.lock.hcl` file pins the providers the configuration
+ * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createTerraformBom(path, options) {
+  let pkgList = [];
+  const lockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  for (const lockFile of lockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseTerraformLockFile(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "terraform", {
+      src: path,
+      filename: lockFiles.join(", "),
+    });
+  }
+  return {};
+}