@cdxgen/cdxgen 13.0.1 → 13.2.0

package/lib/cli/nativeBom.js

@@ -8,13 +8,17 @@ import { build } from "@cdxgen/cdx-purl";
 import { parse as loadYaml } from "yaml";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import { deferFailOnError } from "../core/deferredExit.js";
 import {
   CARGO_CMD,
+  CARGO_TARGET,
   CLJ_CMD,
   hasAnyProjectType,
   LEIN_CMD,
   SWIFT_CMD,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -34,6 +38,14 @@ import {
   getCratesMetadata,
   getSwiftPackageMetadata,
 } from "../ecosystems/ecosystems.js";
+import { parseShardsProject } from "../ecosystems/parsers-crystal.js";
+import {
+  createElmCacheReader,
+  getElmMetadata,
+  isElmProjectFile,
+  parseElmProject,
+  parseLegacyElmProject,
+} from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
   parseGoListDep,
@@ -44,12 +56,17 @@ import {
   parseGopkgData,
   parseGosumData,
 } from "../ecosystems/parsers-go.js";
+import { parseJuliaProject } from "../ecosystems/parsers-julia.js";
 import {
   parseCljDep,
   parseEdnData,
   parseLeinDep,
   parseLeiningenData,
 } from "../ecosystems/parsers-jvm.js";
+import {
+  parseLuaRocksLock,
+  parseRockspecFile,
+} from "../ecosystems/parsers-lua.js";
 import {
   buildObjectForCocoaPod,
   executeAlpmList,
@@ -76,16 +93,32 @@ import {
   parseSwiftResolved,
   prefetchCocoaPodspecs,
 } from "../ecosystems/parsers-misc.js";
+import { parseNimProject } from "../ecosystems/parsers-nim.js";
+import { parseOpamLockedFile } from "../ecosystems/parsers-opam.js";
+import { parseRebarLock } from "../ecosystems/parsers-rebar.js";
 import {
+  applyCargoDependencyKindMetadata,
+  buildCargoLockDependencyGraph,
+  buildCargoNativeLibraryComponents,
+  cargoComponentKey,
   parseCargoData,
   parseCargoDependencyData,
   parseCargoManifestDependencyData,
+  parseCargoManifestDependencyKinds,
+  parseCargoMetadataResolve,
   parseCargoTomlData,
+  rollupCargoDependencyKinds,
 } from "../ecosystems/parsers-rust.js";
+import { parseSpackLock } from "../ecosystems/parsers-spack.js";
+import { parseStackProject } from "../ecosystems/parsers-stack.js";
 import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
+import {
+  classifyProbeResult,
+  classifySpawnRestriction,
+} from "../inventory/toolRequirements.js";
 import { executeOsQuery } from "../managers/binary.js";
 import {
   buildBomNSData,
@@ -357,13 +390,34 @@ export async function createGoBom(path, options) {
           // So we support a fallback to only operate with go mod graph command output in such instances
           console.log("go list -deps command has failed for", basePath);
           shouldManuallyParse = true;
+          // A spawn the runtime or a policy denied is neither a missing
+          // toolchain nor an engaged fallback; the version probes report
+          // that as degraded evidence and the policy entries name the fix.
+          if (
+            !classifySpawnRestriction("go") &&
+            result.error &&
+            classifyProbeResult(result) === "missing"
+          ) {
+            recordDegradation("go.toolchain.missing", {
+              ecosystem: "go",
+              tool: "go",
+              impact: "transitive-deps",
+              command: "go list -deps ./...",
+              detail:
+                "The go executable could not be run, so the module graph was not resolved.",
+            });
+          }
           if (DEBUG_MODE && result.stdout) {
             console.log(result.stdout);
           }
           if (DEBUG_MODE && result.stderr) {
             console.log(result.stderr);
           }
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "go",
+            tool: "go",
+            detail: "the go module graph command failed",
+          });
         }
         const stdout = result.stdout;
         if (stdout) {
@@ -411,7 +465,11 @@ export async function createGoBom(path, options) {
             if (DEBUG_MODE && result.stderr) {
               console.log(result.stderr);
             }
-            options.failOnError && process.exit(1);
+            deferFailOnError(options, {
+              ecosystem: "go",
+              tool: "go",
+              detail: "the go list command failed",
+            });
           }
           if (result.stdout) {
             cmdOutput = Buffer.from(result.stdout).toString();
@@ -492,7 +550,11 @@ export async function createGoBom(path, options) {
             console.log(
               "3. Alternatively, consider generating a post-build SBOM from the built binary using blint. Use the official container image and invoke cdxgen with the arguments `-t binary --lifecycle post-build`.",
             );
-            options.failOnError && process.exit(1);
+            deferFailOnError(options, {
+              ecosystem: "go",
+              tool: "go",
+              detail: "no go dependency evidence could be collected",
+            });
           }
         }
       }
@@ -510,6 +572,19 @@ export async function createGoBom(path, options) {
     if (
       !hasAnyProjectType(["docker", "oci", "container", "os"], options, false)
     ) {
+      // When the environment itself denies the go command, the version
+      // probes record the restriction as degraded evidence and the policy
+      // entries name the fix; the fallback is the finding only when the
+      // toolchain was free to run and could not resolve the graph.
+      if (!classifySpawnRestriction("go")) {
+        recordDegradation("go.mod-only-fallback", {
+          ecosystem: "go",
+          tool: "go",
+          impact: "transitive-deps",
+          detail:
+            "The go toolchain could not resolve the module graph, so go.mod was parsed manually and components carry only the declared requires.",
+        });
+      }
       console.log(
         "Manually parsing go.mod files. The resultant BOM would be incomplete.",
       );
@@ -584,6 +659,31 @@ export async function createGoBom(path, options) {
   return {};
 }
 
+/**
+ * Whether the cargo executable answers a version probe.
+ *
+ * A cargo command run through a shell — the Windows path — reports an absent
+ * executable as a non-zero exit with the shell's own complaint on stderr, not
+ * as a spawn error, so a failed build alone cannot tell a missing toolchain
+ * from a broken project. The probe answers that question directly.
+ *
+ * @param {string} cwd Directory to probe from.
+ * @returns {boolean} True when cargo answered.
+ */
+function cargoAnswersVersion(cwd) {
+  const probe = safeSpawnSync(CARGO_CMD, ["--version"], {
+    cdxgenActivity: {
+      kind: "probe",
+      metadata: { tool: "cargo" },
+      probeType: "build-tool-availability",
+    },
+    cwd,
+    encoding: "utf-8",
+    shell: isWin,
+  });
+  return classifyProbeResult(probe) === "found";
+}
+
 /**
  * Function to create bom string for Rust projects
  *
@@ -591,6 +691,223 @@ export async function createGoBom(path, options) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object|undefined>} Promise resolving to a BOM object or undefined
  */
+/**
+ * Run `cargo metadata` for a manifest and return its parsed resolve graph.
+ *
+ * The lock file is the union of every dependency kind and every target triple,
+ * so it cannot answer which crates are dev-only or platform-gated. Only
+ * `cargo metadata` carries that, per dependency edge, in `resolve.nodes[].deps[].dep_kinds`.
+ *
+ * @param {string} cargoTomlFile Manifest path
+ * @param {string} [filterPlatform] Target triple to resolve the graph for
+ * @returns {object|undefined} Parsed `cargo metadata` output
+ */
+function runCargoMetadata(cargoTomlFile, filterPlatform) {
+  const basePath = dirname(cargoTomlFile);
+  const platformArgs = filterPlatform
+    ? ["--filter-platform", filterPlatform]
+    : [];
+  // `--locked` keeps the user's lock file untouched; a workspace that is out of
+  // date with its lock file needs the retry without it.
+  for (const lockArgs of [["--locked"], []]) {
+    const cargoArgs = [
+      "metadata",
+      "--format-version",
+      "1",
+      "--manifest-path",
+      cargoTomlFile,
+      ...platformArgs,
+      ...lockArgs,
+    ];
+    if (DEBUG_MODE) {
+      console.log("Executing", CARGO_CMD, cargoArgs.join(" "), "in", basePath);
+    }
+    const result = safeSpawnSync(CARGO_CMD, cargoArgs, {
+      cwd: basePath,
+      shell: isWin,
+    });
+    if (result.status === 0 && !result.error && result.stdout) {
+      try {
+        return JSON.parse(result.stdout);
+      } catch (err) {
+        if (DEBUG_MODE) {
+          console.log(`Unable to parse the cargo metadata output: ${err}`);
+        }
+        return undefined;
+      }
+    }
+    if (DEBUG_MODE) {
+      console.log(result.error, result.stderr);
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Annotate cargo components with their dependency kind, platform gate and
+ * scope.
+ *
+ * With `--deep`, the edge kinds come from `cargo metadata` and are exact at
+ * every depth. Otherwise they are recovered from the manifests, which is exact
+ * for the dependencies a workspace member declares and inherited below them.
+ *
+ * @param {object[]} pkgList Components to annotate
+ * @param {object[]} dependencyTree Lockfile dependency relationships
+ * @param {string[]} cargoFiles Manifest paths
+ * @param {Map<string, string>} manifestRootKeys Manifest path to root component key
+ * @param {object} options CLI options
+ */
+function annotateCargoDependencyKinds(
+  pkgList,
+  dependencyTree,
+  cargoFiles,
+  manifestRootKeys,
+  options,
+) {
+  if (!pkgList?.length) {
+    return;
+  }
+  const allEdges = new Map();
+  if (options?.deep) {
+    const rollups = new Map();
+    const packageInfo = new Map();
+    const visitedWorkspaceRoots = new Set();
+    // The keys that survive resolution for the requested target triple. The
+    // unfiltered graph still supplies the kinds, because a crate's kind does
+    // not change with the triple.
+    const targetIncludedKeys = CARGO_TARGET ? new Set() : undefined;
+    let targetFilterApplied = !CARGO_TARGET;
+    let anyMetadata = false;
+    let everyMetadata = true;
+    for (const cargoTomlFile of cargoFiles) {
+      const metadata = runCargoMetadata(cargoTomlFile);
+      if (!metadata) {
+        everyMetadata = false;
+        continue;
+      }
+      // Every member of a workspace answers with the same resolve graph.
+      const workspaceRoot = metadata.workspace_root || cargoTomlFile;
+      if (visitedWorkspaceRoots.has(workspaceRoot)) {
+        anyMetadata = true;
+        continue;
+      }
+      visitedWorkspaceRoots.add(workspaceRoot);
+      anyMetadata = true;
+      if (CARGO_TARGET) {
+        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        if (targetMetadata) {
+          for (const key of parseCargoMetadataResolve(targetMetadata)
+            .resolvedKeys) {
+            targetIncludedKeys.add(key);
+          }
+          targetFilterApplied = true;
+        } else {
+          console.warn(
+            `cargo metadata could not resolve the dependency graph for the target ${CARGO_TARGET}. The components are not filtered by target.`,
+          );
+        }
+      }
+      const graph = parseCargoMetadataResolve(metadata);
+      for (const [key, value] of graph.packageInfo) {
+        packageInfo.set(key, value);
+      }
+      for (const [key, value] of graph.edges) {
+        allEdges.set(key, [...(allEdges.get(key) || []), ...value]);
+      }
+      for (const [key, value] of rollupCargoDependencyKinds(graph)) {
+        const existing = rollups.get(key);
+        if (!existing) {
+          rollups.set(key, value);
+          continue;
+        }
+        // A crate that is a runtime dependency of any workspace in the scan is
+        // a runtime dependency of the BOM.
+        for (const kind of value.kinds) {
+          existing.kinds.add(kind);
+        }
+        for (const target of value.targets) {
+          existing.targets.add(target);
+        }
+        const precedence = ["root", "runtime", "build", "dev"];
+        if (
+          precedence.indexOf(value.kind) < precedence.indexOf(existing.kind)
+        ) {
+          existing.kind = value.kind;
+          existing.targetGated = value.targetGated;
+        } else if (value.kind === existing.kind && !value.targetGated) {
+          existing.targetGated = false;
+        }
+      }
+    }
+    if (anyMetadata && rollups.size) {
+      applyCargoDependencyKindMetadata(pkgList, rollups, packageInfo, {
+        resolveIsComplete: everyMetadata,
+        filterPlatform: targetFilterApplied ? CARGO_TARGET : undefined,
+        targetIncludedKeys: targetFilterApplied
+          ? targetIncludedKeys
+          : undefined,
+      });
+      // A `-sys` crate puts a C library into the artifact that the cargo
+      // dependency graph itself cannot describe.
+      const nativeLibraries = buildCargoNativeLibraryComponents(
+        packageInfo,
+        allEdges,
+        rollups,
+      );
+      if (nativeLibraries.components.length) {
+        pkgList.push(...nativeLibraries.components);
+        if (dependencyTree) {
+          dependencyTree.push(...nativeLibraries.dependencies);
+        }
+      }
+      return;
+    }
+    recordDegradation("rust.cargo-metadata-unavailable", {
+      ecosystem: "rust",
+      tool: "cargo",
+      impact: "components",
+      command: `${basename(CARGO_CMD)} metadata`,
+      detail:
+        "cargo metadata could not be executed, so dependency kinds and platform gates were recovered from the manifests alone.",
+    });
+  }
+  if (!dependencyTree?.length || !manifestRootKeys.size) {
+    return;
+  }
+  const declaredEdgesByRoot = new Map();
+  for (const [cargoTomlFile, rootKey] of manifestRootKeys) {
+    if (!rootKey) {
+      continue;
+    }
+    const declaredEdges = parseCargoManifestDependencyKinds(cargoTomlFile, {
+      includeWorkspaceMembers: !options.multiProject,
+    });
+    const existing = declaredEdgesByRoot.get(rootKey);
+    if (!existing) {
+      declaredEdgesByRoot.set(rootKey, declaredEdges);
+      continue;
+    }
+    for (const [name, value] of declaredEdges) {
+      const knownEdge = existing.get(name);
+      if (!knownEdge) {
+        existing.set(name, value);
+        continue;
+      }
+      for (const kind of value.kinds) {
+        knownEdge.kinds.add(kind);
+      }
+      for (const target of value.targets) {
+        knownEdge.targets.add(target);
+      }
+    }
+  }
+  const graph = buildCargoLockDependencyGraph(
+    dependencyTree,
+    declaredEdgesByRoot,
+  );
+  applyCargoDependencyKindMetadata(pkgList, rollupCargoDependencyKinds(graph));
+}
+
 export async function createRustBom(path, options) {
   let pkgList = [];
   let parentComponent = {};
@@ -649,7 +966,27 @@ export async function createRustBom(path, options) {
       if (cargoInstallResult.status !== 0 || cargoInstallResult.error) {
         console.error("Error running the cargo command");
         console.log(cargoInstallResult.error, cargoInstallResult.stderr);
-        options.failOnError && process.exit(1);
+        // A spawn the runtime or a policy denied is neither a missing
+        // toolchain nor an engaged fallback; the version probes record
+        // that as degraded evidence.
+        const toolchainMissing = cargoInstallResult.error
+          ? classifyProbeResult(cargoInstallResult) === "missing"
+          : !cargoAnswersVersion(basePath);
+        if (!classifySpawnRestriction(CARGO_CMD) && toolchainMissing) {
+          recordDegradation("rust.toolchain.missing", {
+            ecosystem: "rust",
+            tool: "cargo",
+            impact: "transitive-deps",
+            command: `${basename(CARGO_CMD)} ${cargoArgs.join(" ")}`,
+            detail:
+              "The cargo executable could not be run, so the lock file could not be generated.",
+          });
+        }
+        deferFailOnError(options, {
+          ecosystem: "rust",
+          tool: "cargo",
+          detail: "the cargo command failed",
+        });
       }
     }
   }
@@ -667,6 +1004,16 @@ export async function createRustBom(path, options) {
     options,
   );
   const cargoLockMode = cargoLockFiles.length;
+  if (cargoFiles.length && !cargoLockMode) {
+    recordDegradation("rust.cargo-lock-missing", {
+      ecosystem: "rust",
+      tool: "cargo",
+      impact: "transitive-deps",
+      detail:
+        "No Cargo.lock was found beside the manifest, so components carry the declared dependencies without locked versions or the resolved crate graph.",
+    });
+  }
+  const manifestRootKeys = new Map();
   for (const f of cargoFiles) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${f}`);
@@ -675,6 +1022,7 @@ export async function createRustBom(path, options) {
       includeWorkspaceMembers: !options.multiProject,
     });
     if (dlist?.length) {
+      manifestRootKeys.set(f, cargoComponentKey(dlist[0]));
       if (!cargoLockMode) {
         pkgList = pkgList.concat(dlist);
       } else {
@@ -730,6 +1078,15 @@ export async function createRustBom(path, options) {
       );
     }
   }
+  if (cargoLockMode) {
+    annotateCargoDependencyKinds(
+      pkgList,
+      dependencyTree,
+      cargoFiles,
+      manifestRootKeys,
+      options,
+    );
+  }
   return buildBomNSData(options, pkgList, "cargo", {
     src: path,
     filename: cargoLockFiles.join(", "),
@@ -868,6 +1225,15 @@ export async function createDartBom(path, options) {
     `${options.multiProject ? "**/" : ""}pubspec.yaml`,
     options,
   );
+  if (pubSpecYamlFiles.length && !pubFiles.length) {
+    recordDegradation("dart.pub-get-needed", {
+      ecosystem: "dart",
+      tool: "dart",
+      impact: "versions",
+      detail:
+        "pubspec.yaml was parsed without pubspec.lock, so components carry version constraints instead of the locked versions.",
+    });
+  }
   let dependencies = [];
   let pkgList = [];
   let parentComponent;
@@ -1367,8 +1733,22 @@ export function createClojureBom(path, options) {
       if (result.status !== 0 || result.error) {
         if (result.stderr) {
           console.error(result.stdout, result.stderr);
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "lein",
+            detail: "the leiningen command failed",
+          });
         }
+        recordDegradation("clojure.lein.missing", {
+          ecosystem: "clojure",
+          tool: "lein",
+          impact: "transitive-deps",
+          command: `${LEIN_CMD} ${LEIN_ARGS.join(" ")}`,
+          exitCode:
+            typeof result.status === "number" ? result.status : undefined,
+          detail:
+            "lein did not produce a dependency list, so the project.clj manifest is parsed manually.",
+        });
         console.log(
           "Check if the correct version of lein is installed and available in PATH. Falling back to manual parsing.",
         );
@@ -1390,7 +1770,11 @@ export function createClojureBom(path, options) {
           }
         } else {
           console.error("lein unexpectedly didn't return any output");
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "lein",
+            detail: "the leiningen command produced no output",
+          });
         }
       }
     }
@@ -1413,8 +1797,22 @@ export function createClojureBom(path, options) {
       if (result.status !== 0 || result.error) {
         if (result.stderr) {
           console.error(result.stdout, result.stderr);
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "clj",
+            detail: "the clojure cli command failed",
+          });
         }
+        recordDegradation("clojure.cli.missing", {
+          ecosystem: "clojure",
+          tool: "clojure",
+          impact: "transitive-deps",
+          command: `${CLJ_CMD} ${CLJ_ARGS.join(" ")}`,
+          exitCode:
+            typeof result.status === "number" ? result.status : undefined,
+          detail:
+            "The clojure CLI did not produce a dependency tree, so the deps.edn manifest is parsed manually.",
+        });
         console.log(
           "Check if the correct version of clojure cli is installed and available in PATH. Falling back to manual parsing.",
         );
@@ -1436,7 +1834,11 @@ export function createClojureBom(path, options) {
           }
         } else {
           console.error("clj unexpectedly didn't return any output");
-          options.failOnError && process.exit(1);
+          deferFailOnError(options, {
+            ecosystem: "clojure",
+            tool: "clj",
+            detail: "the clojure cli command produced no output",
+          });
         }
       }
     }
@@ -1449,6 +1851,44 @@ export function createClojureBom(path, options) {
   return {};
 }
 
+/**
+ * Locate the Stack lock files under a path.
+ *
+ * Stack names the lock after the configuration file it completes, so the
+ * default `stack.yaml` produces `stack.yaml.lock` and a project with several
+ * configurations produces one lock per configuration. `stack.lock` is also
+ * accepted because tooling and documentation examples have used that name.
+ *
+ * @param {string} path Project path
+ * @param {Object} options Parse options from the cli
+ * @returns {string[]} Lock file paths, deduplicated
+ */
+export function findStackLockFiles(path, options) {
+  const prefix = options.multiProject ? "**/" : "";
+  const candidates = new Set([
+    ...getAllFiles(path, `${prefix}*.yaml.lock`, options),
+    ...getAllFiles(path, `${prefix}stack.lock`, options),
+  ]);
+  return [...candidates].filter((lockFile) => {
+    if (/(^|[\\/])stack\.(yaml\.)?lock$/u.test(lockFile)) {
+      return true;
+    }
+    // `*.yaml.lock` is not a name Stack owns, so a custom configuration is
+    // accepted only when the file it completes names a snapshot.
+    const configFile = lockFile.replace(/\.lock$/u, "");
+    if (!safeExistsSync(configFile)) {
+      return false;
+    }
+    try {
+      return /^\s*(snapshot|resolver)\s*:/mu.test(
+        readFileSync(configFile, "utf-8"),
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
 /**
  * Function to create bom string for Haskell projects
  *
@@ -1479,6 +1919,45 @@ export function createHaskellBom(path, options) {
       filename: cabalFiles.join(", "),
     });
   }
+  // Stack projects keep the resolved extra-deps in a lock file named after
+  // the configuration file, so `stack.yaml` locks to `stack.yaml.lock`.
+  const stackLockFiles = findStackLockFiles(path, options);
+  if (stackLockFiles.length) {
+    const dependencies = [];
+    let parentComponent = {};
+    for (const stackLockFile of stackLockFiles) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${stackLockFile}`);
+      }
+      const stackYamlFile = stackLockFile.replace(/\.lock$/u, "");
+      const result = parseStackProject(
+        stackLockFile,
+        safeExistsSync(stackYamlFile) ? stackYamlFile : undefined,
+      );
+      if (result.pkgList?.length) {
+        pkgList = pkgList.concat(result.pkgList);
+      }
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = result.parentComponent;
+        attachRootEdge(result, parentComponent, dependencies);
+      }
+    }
+    if (pkgList.length) {
+      return buildBomNSData(options, pkgList, "hackage", {
+        src: path,
+        filename: stackLockFiles.join(", "),
+        dependencies,
+        parentComponent,
+      });
+    }
+  }
+  recordDegradation("haskell.freeze-missing", {
+    ecosystem: "haskell",
+    tool: "cabal",
+    impact: "components",
+    detail:
+      "No cabal.project.freeze or stack.yaml.lock was found; those lock files are the sources the parsers read for the package set.",
+  });
   return {};
 }
 
@@ -1512,6 +1991,13 @@ export function createElixirBom(path, options) {
       filename: mixFiles.join(", "),
     });
   }
+  recordDegradation("elixir.deps-not-fetched", {
+    ecosystem: "elixir",
+    tool: "mix",
+    impact: "components",
+    detail:
+      "No mix.lock was found, and the lock file written by fetching the dependencies is the source the parser reads.",
+  });
   return {};
 }
 
@@ -1634,6 +2120,16 @@ export async function createSwiftBom(path, options) {
             `It looks like the 'Sources' directory is missing, so we are missing the components and dependencies for '${basename(basePath)}'.`,
           );
         } else if (readEnvironmentVariable("CDXGEN_IN_CONTAINER") !== "true") {
+          recordDegradation("swift.toolchain.missing", {
+            ecosystem: "swift",
+            tool: "swift",
+            impact: "transitive-deps",
+            command: `${swiftCommand} ${packageArgs.join(" ")}`,
+            exitCode:
+              typeof result.status === "number" ? result.status : undefined,
+            detail:
+              "The swift package command did not succeed, so the swift package graph was not resolved.",
+          });
           console.log(
             "Consider using the cdxgen container image (`ghcr.io/cdxgen/cdxgen`), which includes Swift and additional build tools.",
           );
@@ -1645,7 +2141,11 @@ export async function createSwiftBom(path, options) {
           }
         }
         console.error(result.stderr);
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "swift",
+          tool: "swift",
+          detail: "the swift package command failed",
+        });
       }
     }
   }
@@ -1691,7 +2191,11 @@ export async function createCocoaBom(path, options) {
           "No 'Podfile.lock' found and '--no-install-deps' is set -- A Podfile.lock is needed to parse dependencies!",
         );
         missingLockWarningShown = true;
-        options.failOnError && process.exit(1);
+        deferFailOnError(options, {
+          ecosystem: "cocoa",
+          tool: "pod",
+          detail: "no Podfile.lock was found",
+        });
       }
     } else if (options.deep && options.installDeps) {
       executePodCommand(["install"], projectPath, options);
@@ -2123,3 +2627,475 @@ export async function createGleamBom(path, options) {
 
   return {};
 }
+
+/**
+ * Function to create bom string for Julia projects.
+ *
+ * The resolved `Manifest.toml` is preferred over the declared `Project.toml`
+ * so the BOM carries pinned versions and the package graph.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createJuliaBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const projectTomlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const manifestOnly = !projectTomlFiles.length;
+
+  for (const projectTomlFile of projectTomlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${projectTomlFile}`);
+    }
+    const baseDir = dirname(projectTomlFile);
+    const manifestTomlFile = join(baseDir, "Manifest.toml");
+    const result = parseJuliaProject(
+      projectTomlFile,
+      safeExistsSync(manifestTomlFile) ? manifestTomlFile : undefined,
+    );
+    collectProjectResult(result);
+  }
+  if (manifestOnly) {
+    for (const manifestTomlFile of getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}Manifest.toml`,
+      options,
+    )) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${manifestTomlFile}`);
+      }
+      // Gleam also writes a `manifest.toml`; on case-insensitive filesystems
+      // the lookup above can surface it, so only accept files that parse as
+      // a Julia manifest.
+      const parsed = parseJuliaProject(undefined, manifestTomlFile);
+      if (parsed.pkgList.length) {
+        collectProjectResult(parsed);
+      }
+    }
+  }
+
+  function collectProjectResult(result) {
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (
+      !Object.keys(parentComponent).length &&
+      Object.keys(result.parentComponent).length
+    ) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "julia", {
+      src: path,
+      filename: projectTomlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Attach a root dependency edge from the parent component to its direct
+ * dependencies, following the shape used by the Gleam and Nix flows.
+ *
+ * @param {{rootInputs?: string[]}} result Parser result with root inputs
+ * @param {Object} parentComponent Parent component to give a bom-ref
+ * @param {Object[]} dependencies Dependency edge list to append to
+ */
+function attachRootEdge(result, parentComponent, dependencies) {
+  if (result.rootInputs?.length && parentComponent.name) {
+    const rootRef = `application:${parentComponent.name}:${parentComponent.version || "latest"}`;
+    parentComponent["bom-ref"] = rootRef;
+    dependencies.push({
+      ref: rootRef,
+      dependsOn: [...new Set(result.rootInputs)],
+    });
+  }
+}
+
+/**
+ * Function to create bom string for Erlang projects using rebar3.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createErlangBom(path, options) {
+  let pkgList = [];
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  for (const rebarLockFile of rebarLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rebarLockFile}`);
+    }
+    const result = parseRebarLock(rebarLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "erlang", {
+      src: path,
+      filename: rebarLockFiles.join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for OCaml projects using opam.
+ *
+ * Resolved `.opam.locked` files are preferred; a plain `.opam` file is used
+ * as a declared fallback with unpinned versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createOCamlBom(path, options) {
+  let pkgList = [];
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  const opamFiles = opamLockedFiles.length
+    ? []
+    : getAllFiles(path, `${options.multiProject ? "**/" : ""}*.opam`, options);
+  for (const opamFile of [...opamLockedFiles, ...opamFiles]) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${opamFile}`);
+    }
+    const result = parseOpamLockedFile(opamFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "ocaml", {
+      src: path,
+      filename: [...opamLockedFiles, ...opamFiles].join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Elm projects.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createElmBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  // A single reader memoises the cache lookups shared by every manifest.
+  const cacheReader = createElmCacheReader();
+  for (const elmJsonFile of elmJsonFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${elmJsonFile}`);
+    }
+    const result = parseElmProject(elmJsonFile, cacheReader);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  const legacyFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  for (const legacyFile of legacyFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${legacyFile}`);
+    }
+    const baseDir = dirname(legacyFile);
+    const exactDepsFile = join(baseDir, "elm-stuff", "exact-dependencies.json");
+    const result = parseLegacyElmProject(
+      legacyFile,
+      safeExistsSync(exactDepsFile) ? exactDepsFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    pkgList = await getElmMetadata(pkgList, dependencies);
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "elm", {
+      src: path,
+      filename: [...elmJsonFiles, ...legacyFiles].join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Crystal projects using shards.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createCrystalBom(path, options) {
+  let pkgList = [];
+  const dependencies = [];
+  let parentComponent = {};
+
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  for (const shardYmlFile of shardYmlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${shardYmlFile}`);
+    }
+    const baseDir = dirname(shardYmlFile);
+    const shardLockFile = join(baseDir, "shard.lock");
+    const result = parseShardsProject(
+      shardYmlFile,
+      safeExistsSync(shardLockFile) ? shardLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "crystal", {
+      src: path,
+      filename: shardYmlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Nim projects using nimble.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createNimBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  for (const nimbleFile of nimbleFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${nimbleFile}`);
+    }
+    const baseDir = dirname(nimbleFile);
+    const nimbleLockFile = join(baseDir, "nimble.lock");
+    const result = parseNimProject(
+      nimbleFile,
+      safeExistsSync(nimbleLockFile) ? nimbleLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "nim", {
+      src: path,
+      filename: nimbleFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Lua projects using LuaRocks.
+ *
+ * When a `luarocks.lock` is present next to a rockspec it supplies the
+ * resolved versions; otherwise the rockspec's declared dependencies are
+ * inventoried without versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createLuaBom(path, options) {
+  let pkgList = [];
+  let parentComponent = {};
+  const seenLockFiles = new Set();
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  for (const rockspecFile of rockspecFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rockspecFile}`);
+    }
+    const baseDir = dirname(rockspecFile);
+    const lockFile = join(baseDir, "luarocks.lock");
+    // The rockspec names the project and its declared set either way; the
+    // lock, when present, supplies the resolved versions.
+    const declared = parseRockspecFile(rockspecFile);
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = declared.parentComponent;
+    }
+    let resolved;
+    if (safeExistsSync(lockFile)) {
+      seenLockFiles.add(lockFile);
+      resolved = parseLuaRocksLock(lockFile, rockspecFile);
+    }
+    const chosen = resolved?.pkgList?.length ? resolved : declared;
+    if (chosen.pkgList?.length) {
+      pkgList = pkgList.concat(chosen.pkgList);
+    }
+  }
+  // A lock can also stand alone, in a project whose rockspec is generated at
+  // release time rather than committed.
+  for (const lockFile of getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}luarocks.lock`,
+    options,
+  )) {
+    if (seenLockFiles.has(lockFile)) {
+      continue;
+    }
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseLuaRocksLock(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "lua", {
+      src: path,
+      filename: rockspecFiles.join(", "),
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Spack environments.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createSpackBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  for (const spackLockFile of spackLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${spackLockFile}`);
+    }
+    const result = parseSpackLock(spackLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // The lock names no project component, so the environment directory is the
+  // name the environment is already known by. Its roots are the specs the
+  // lock records as requested, which is why they are linked explicitly rather
+  // than inferred from which nodes have no incoming edge: a build-only tool
+  // such as gmake also has none, and it is not a root.
+  const envName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: envName,
+    "bom-ref": `application:${envName}:latest`,
+    description: `Spack environment: ${envName}`,
+    properties: [
+      { name: "internal:SrcFile", value: spackLockFiles.join(", ") },
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "spack", {
+    src: path,
+    filename: spackLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}