@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/ecosystems/parsers-gleam.js

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import toml from "@iarna/toml";
+import * as toml from "smol-toml";
 
 import { tryBuildPurl } from "../inventory/purl.js";
 

package/lib/ecosystems/parsers-julia.js

@@ -0,0 +1,268 @@
+import { readFileSync } from "node:fs";
+
+import * as toml from "smol-toml";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Julia project parser.
+ *
+ * Two files are consulted:
+ *   - `Project.toml` — the manifest holding the project name, UUID, version,
+ *     the names (and UUIDs) of its direct dependencies, and version
+ *     compatibility constraints.
+ *   - `Manifest.toml` — the lock file written by Pkg on resolve, pinning every
+ *     package in the environment with its UUID, version, content hash, and the
+ *     names of the packages it depends on.
+ *
+ * Packages are identified with the registered `julia` purl type, which carries
+ * the package UUID as a required qualifier (`pkg:julia/JSON@0.21.4?uuid=…`).
+ * The UUID is what Julia itself uses to identify packages, so keeping it in
+ * the purl lets consumers match components across differently named mirrors.
+ *
+ * Julia standard libraries ship with the language itself and carry no version
+ * in the manifest; they are emitted without a version and marked as standard
+ * libraries so they can be told apart from registry packages.
+ */
+
+/**
+ * Parse a Julia environment from its `Project.toml` and optional
+ * `Manifest.toml`.
+ *
+ * @param {string} [projectTomlFile] Path to `Project.toml`, if present
+ * @param {string} [manifestTomlFile] Path to `Manifest.toml`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export function parseJuliaProject(projectTomlFile, manifestTomlFile) {
+  const project = projectTomlFile ? readTomlFile(projectTomlFile) : undefined;
+
+  const parentComponent = {};
+  const directNames = new Set(
+    project?.deps && typeof project.deps === "object"
+      ? Object.keys(project.deps)
+      : [],
+  );
+  if (project?.name) {
+    const properties = [{ name: "internal:SrcFile", value: projectTomlFile }];
+    if (typeof project.uuid === "string" && project.uuid) {
+      properties.push({ name: "cdx:julia:uuid", value: project.uuid });
+    }
+    parentComponent.type = "application";
+    parentComponent.name = project.name;
+    if (typeof project.version === "string" && project.version) {
+      parentComponent.version = project.version;
+    }
+    parentComponent.description = `Julia project: ${project.name}`;
+    parentComponent.properties = properties;
+  }
+
+  let manifest;
+  if (manifestTomlFile) {
+    manifest = readTomlFile(manifestTomlFile);
+  }
+
+  // Manifest packages live under `[[deps.<Name>]]` array-of-table entries,
+  // which smol-toml surfaces as a plain object keyed by package name.
+  const manifestDeps = manifest?.deps;
+  if (!manifestDeps || typeof manifestDeps !== "object") {
+    // Lockless fallback: emit the declared direct dependencies without
+    // resolved versions, using the UUIDs from Project.toml.
+    const pkgList = [...directNames].map((name) =>
+      juliaPackage(name, undefined, project?.deps?.[name], {
+        direct: true,
+        stdlib: JULIA_STDLIBS.has(name),
+        srcFile: projectTomlFile,
+      }),
+    );
+    return {
+      pkgList,
+      dependencies: [],
+      parentComponent,
+      rootInputs: pkgList.map((p) => p["bom-ref"]),
+    };
+  }
+
+  const pkgList = [];
+  const edges = [];
+  const refByName = new Map();
+  for (const [name, raw] of Object.entries(manifestDeps)) {
+    // `[[deps.<Name>]]` is an array of tables; a name repeats only when two
+    // sources of the same package are pinned, and the first entry is the one
+    // the environment resolves first.
+    const entry = Array.isArray(raw) ? raw[0] : raw;
+    const uuid =
+      typeof entry?.uuid === "string" && entry.uuid ? entry.uuid : undefined;
+    const registryVersion =
+      typeof entry?.version === "string" && entry.version
+        ? entry.version
+        : undefined;
+    // Entries without a registry version are pinned by content hash (git or
+    // local path sources); the hash is the most precise version available.
+    const gitTreeSha1 =
+      typeof entry?.["git-tree-sha1"] === "string" && entry["git-tree-sha1"]
+        ? entry["git-tree-sha1"]
+        : undefined;
+    const version = registryVersion || gitTreeSha1;
+    const pkg = juliaPackage(name, version, uuid, {
+      direct: directNames.has(name),
+      stdlib: !registryVersion && JULIA_STDLIBS.has(name),
+      srcFile: manifestTomlFile,
+    });
+    pkgList.push(pkg);
+    refByName.set(name, pkg["bom-ref"]);
+  }
+  for (const [name, raw] of Object.entries(manifestDeps)) {
+    const ref = refByName.get(name);
+    if (!ref) {
+      continue;
+    }
+    const entry = Array.isArray(raw) ? raw[0] : raw;
+    const dependsOn = (Array.isArray(entry?.deps) ? entry.deps : [])
+      .map((depName) => refByName.get(depName))
+      .filter(Boolean);
+    edges.push({ ref, dependsOn: [...new Set(dependsOn)].sort() });
+  }
+  const rootInputs = [...directNames]
+    .map((name) => refByName.get(name))
+    .filter(Boolean);
+  return { pkgList, dependencies: edges, parentComponent, rootInputs };
+}
+
+/**
+ * Tell whether a `Project.toml` declares a Julia environment.
+ *
+ * Cloud Native Buildpacks and Gleam use the same file names, so the caller
+ * needs a content check before dispatching. A Julia project always carries a
+ * package `uuid`, a `[deps]` table, or a `[compat]` table.
+ *
+ * @param {string} filePath Path to the candidate `Project.toml`
+ * @returns {boolean} true when the file is a Julia project
+ */
+export function isJuliaProjectFile(filePath) {
+  const project = readTomlFile(filePath);
+  return Boolean(
+    project &&
+      (typeof project.uuid === "string" ||
+        (project.deps && typeof project.deps === "object") ||
+        (project.compat && typeof project.compat === "object")),
+  );
+}
+
+/**
+ * Tell whether a `Manifest.toml` is a Julia lock file.
+ *
+ * Gleam writes a lowercase `manifest.toml` that case-insensitive filesystems
+ * surface under the same glob; a Julia manifest is recognised by its
+ * `manifest_format` marker or its `[[deps.<Name>]]` tables.
+ *
+ * @param {string} filePath Path to the candidate `Manifest.toml`
+ * @returns {boolean} true when the file is a Julia manifest
+ */
+export function isJuliaManifestFile(filePath) {
+  const manifest = readTomlFile(filePath);
+  return Boolean(
+    manifest &&
+      (typeof manifest.manifest_format === "string" ||
+        (manifest.deps && typeof manifest.deps === "object")),
+  );
+}
+
+/**
+ * Build a component-like package record for a Julia dependency.
+ *
+ * @param {string} name Package name as Julia writes it
+ * @param {string|undefined} version Resolved version, if known
+ * @param {string|undefined} uuid Package UUID, if known
+ * @param {object} opts Extra context (`direct`, `stdlib`, `srcFile`)
+ * @returns {object} Package record
+ */
+function juliaPackage(name, version, uuid, opts) {
+  // The julia purl type requires the uuid qualifier; when it is unknown the
+  // purl is dropped entirely rather than emitted without its identity anchor.
+  const purl =
+    name && uuid
+      ? tryBuildPurl({
+          type: "julia",
+          name,
+          version: version || undefined,
+          qualifiers: { uuid },
+        })
+      : null;
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    {
+      name: "cdx:julia:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  if (uuid) {
+    properties.push({ name: "cdx:julia:uuid", value: uuid });
+  }
+  if (opts.stdlib) {
+    properties.push({ name: "cdx:julia:stdlib", value: "true" });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Julia standard libraries ship with the language itself. They carry no
+ * version in the manifest, so they are recognised by name against this list.
+ *
+ * @type {Set<string>}
+ */
+const JULIA_STDLIBS = new Set([
+  "Base",
+  "CRC32c",
+  "Dates",
+  "DelimitedFiles",
+  "Distributed",
+  "FileWatching",
+  "Future",
+  "LibGit2",
+  "Libdl",
+  "LinearAlgebra",
+  "Logging",
+  "Markdown",
+  "Mmap",
+  "Printf",
+  "Profile",
+  "Random",
+  "REPL",
+  "Serialization",
+  "SharedArrays",
+  "Sockets",
+  "SparseArrays",
+  "Statistics",
+  "TOML",
+  "Test",
+  "UUIDs",
+  "Unicode",
+]);
+
+/**
+ * Read and parse a TOML file, warning instead of throwing on invalid input.
+ *
+ * @param {string} filePath File to read
+ * @returns {object|undefined} Parsed value
+ */
+function readTomlFile(filePath) {
+  try {
+    return toml.parse(readFileSync(filePath, "utf-8"));
+  } catch (error) {
+    console.warn(`Failed to parse ${filePath}: ${error.message}`);
+    return undefined;
+  }
+}

package/lib/ecosystems/parsers-lua.js

@@ -0,0 +1,218 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Lua parser for rockspecs and `luarocks.lock`.
+ *
+ * A rockspec is a Lua source file whose top level is a sequence of
+ * assignments describing one package: its name, version, source, and a
+ * `dependencies` table of constraint strings (`"lua >= 5.1"`). LuaRocks 3
+ * can also persist the resolved set to `luarocks.lock`. Both are read with a
+ * small line scanner over the shapes these files actually use, rather than a
+ * Lua interpreter.
+ *
+ * Rocks are identified with the registered `luarocks` purl type
+ * (`pkg:luarocks/<name>@<version>`). Lua versions carry a rock revision
+ * suffix (`5.4.6-1`); the full rock version is kept verbatim because the
+ * revision distinguishes distinct builds.
+ */
+
+/**
+ * Parse a rockspec manifest.
+ *
+ * @param {string} rockspecFile Path to the `.rockspec` file
+ * @returns {{ pkgList: object[], parentComponent: object }}
+ */
+export function parseRockspecFile(rockspecFile) {
+  const fields = readLuaAssignments(rockspecFile);
+  const name = fields.get("package");
+  const version = fields.get("version");
+  const declaredDeps = fields.get("dependencies");
+
+  const parentComponent = {};
+  if (name) {
+    parentComponent.type = "application";
+    parentComponent.name = name;
+    if (version) {
+      parentComponent.version = version;
+    }
+    parentComponent.description = `Lua rockspec: ${name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: rockspecFile },
+    ];
+  }
+
+  const directNames = new Set(
+    Array.isArray(declaredDeps) ? declaredDeps.map((dep) => dep.name) : [],
+  );
+  const pkgList = [...directNames].map((depName) =>
+    luaPackage(depName, undefined, { direct: true, srcFile: rockspecFile }),
+  );
+  return { pkgList, parentComponent };
+}
+
+/**
+ * Parse a `luarocks.lock` file.
+ *
+ * @param {string} lockFile Path to `luarocks.lock`
+ * @param {string} [rockspecFile] Path to the rockspec, to mark direct deps
+ * @returns {{ pkgList: object[], parentComponent: object }}
+ */
+export function parseLuaRocksLock(lockFile, rockspecFile) {
+  const fields = readLuaAssignments(lockFile);
+  const locked = fields.get("dependencies");
+  if (!Array.isArray(locked)) {
+    return { pkgList: [], parentComponent: {} };
+  }
+  const directNames = new Set();
+  if (rockspecFile) {
+    const declared = readLuaAssignments(rockspecFile).get("dependencies");
+    if (Array.isArray(declared)) {
+      for (const dep of declared) {
+        if (typeof dep?.name === "string") {
+          directNames.add(dep.name);
+        }
+      }
+    }
+  }
+  const pkgList = locked
+    .filter((dep) => typeof dep?.name === "string" && dep.name)
+    .map((dep) =>
+      luaPackage(dep.name, dep.version, {
+        // Without a rockspec there is no declared set to compare against, so
+        // the whole closure is reported direct rather than guessing.
+        direct: rockspecFile ? directNames.has(dep.name) : true,
+        srcFile: lockFile,
+      }),
+    );
+  return { pkgList, parentComponent: {} };
+}
+
+/**
+ * Build a component-like package record for a Lua rock.
+ *
+ * @param {string} name Rock name
+ * @param {string|undefined} version Rock version including revision suffix
+ * @param {object} opts Extra context (`direct`, `srcFile`)
+ * @returns {object} Package record
+ */
+function luaPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "luarocks",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    {
+      name: "cdx:luarocks:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Read the top-level assignments of a Lua configuration file.
+ *
+ * The files cdxgen consumes use a constrained surface: `key = value` lines
+ * where the value is a quoted string, a table of strings or
+ * `["key"] = "value"` entries, or a short list expression. Values are
+ * normalised to strings, arrays of `{name, constraint}` records, or arrays
+ * of `{key, value}` records for mixed tables.
+ *
+ * @param {string} filePath File to read
+ * @returns {Map<string, *>} Parsed top-level fields
+ */
+export function readLuaAssignments(filePath) {
+  const fields = new Map();
+  let text;
+  try {
+    text = readFileSync(filePath, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${filePath}: ${error.message}`);
+    return fields;
+  }
+  let currentTable;
+  let depth = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("--") || line.startsWith("#")) {
+      continue;
+    }
+    if (depth === 0) {
+      const assignment = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/u);
+      if (!assignment) {
+        continue;
+      }
+      const [, key, rest] = assignment;
+      const stringValue = rest.match(/^"([^"]*)"/u);
+      if (stringValue) {
+        fields.set(key, stringValue[1]);
+        continue;
+      }
+      if (rest.startsWith("{")) {
+        currentTable = [];
+        fields.set(key, currentTable);
+        depth = countBraces(rest, 0);
+      }
+      continue;
+    }
+    // Inside a table: collect string items, `key = "value"` pairs, and the
+    // bracketed `["key"] = "value"` form LuaRocks uses for names that are not
+    // valid Lua identifiers.
+    depth = countBraces(line, depth);
+    const keyed = line.match(
+      /^(?:\[\s*"([^"]+)"\s*\]|([A-Za-z_][A-Za-z0-9_]*))\s*=\s*"([^"]*)"/u,
+    );
+    if (keyed && currentTable) {
+      currentTable.push({ name: keyed[1] ?? keyed[2], version: keyed[3] });
+      continue;
+    }
+    const item = line.match(/^"([^"]+)"/u);
+    if (item && currentTable) {
+      const tokens = item[1].split(/\s+/u);
+      currentTable.push({
+        name: tokens[0],
+        constraint: tokens.slice(1).join(" "),
+      });
+    }
+    if (depth <= 0) {
+      depth = 0;
+    }
+  }
+  return fields;
+}
+
+/**
+ * Track table nesting depth for one line.
+ *
+ * @param {string} line Line to scan
+ * @param {number} depth Depth before the line
+ * @returns {number} Depth after the line
+ */
+function countBraces(line, depth) {
+  let next = depth;
+  for (const char of line) {
+    if (char === "{") {
+      next += 1;
+    } else if (char === "}") {
+      next -= 1;
+    }
+  }
+  return next;
+}

package/lib/ecosystems/parsers-misc.js

@@ -41,6 +41,7 @@ import {
   mapConanPkgRefToPurlStringAndNameAndVersion,
   nixGenericPurl,
   purlFromUrlString,
+  tryBuildPurl,
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
 import { getDartMetadata } from "./ecosystems.js";
@@ -3203,3 +3204,174 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.externalReferences = externalRefs;
   }
 }
+
+/**
+ * Parse an xmake `xmake-requires.lock` file.
+ *
+ * The lock is a Lua table, written when the `package.requires_lock` policy is
+ * enabled. Its top level holds a `__meta__` entry plus one section per build
+ * configuration, keyed `platform|arch`; each section maps a requirement key
+ * (`"zlib#31fecfc4"`, or `"sol2 v3.2.1#72267bd5"` when the requirement
+ * carries a version) to a table with the resolved `version` and the
+ * `repo` revision the package definition came from.
+ *
+ * The same package appears once per configuration, so entries are collapsed
+ * by name and version, and the configurations a package was resolved for are
+ * kept as a property. A requirement key without a `version` field names a
+ * system package xmake did not resolve; it is inventoried without a version.
+ *
+ * No `xmake` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=xmake` property, following the
+ * convention used for nix and zig.
+ *
+ * @param {string} lockFile Path to `xmake-requires.lock`
+ * @returns {Object[]} Package records for the pinned requirements
+ */
+export function parseXmakeRequiresLock(lockFile) {
+  let text;
+  try {
+    text = readFileSync(lockFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${lockFile}: ${error.message}`);
+    return [];
+  }
+  const byKey = new Map();
+  // The outermost `{` is the file's own table, so a configuration section
+  // opens at depth 1 and a requirement inside it at depth 2. Each is dropped
+  // again once the brace depth falls back to where it opened.
+  const CONFIGURATION_DEPTH = 1;
+  const REQUIREMENT_DEPTH = 2;
+  let configuration;
+  let requirement;
+  let depth = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("--")) {
+      continue;
+    }
+    // `["macosx|arm64"] = {` opens a configuration; `["zlib#hash"] = {` opens
+    // a requirement inside one.
+    const opener = line.match(/^\[\s*"([^"]+)"\s*\]\s*=\s*\{/u);
+    if (opener && depth === CONFIGURATION_DEPTH) {
+      // `__meta__` is normally written unquoted, but a lock that quotes it
+      // must not become a configuration section either.
+      configuration = opener[1] === "__meta__" ? undefined : opener[1];
+    } else if (opener && depth === REQUIREMENT_DEPTH && configuration) {
+      requirement = xmakeRequirementName(opener[1]);
+      const key = `${configuration}|${requirement}`;
+      if (requirement && !byKey.has(key)) {
+        byKey.set(key, { name: requirement, configuration });
+      }
+    } else if (!opener && configuration && requirement) {
+      const version = line.match(/^version\s*=\s*"([^"]*)"/u);
+      if (version) {
+        const record = byKey.get(`${configuration}|${requirement}`);
+        if (record) {
+          record.version = version[1];
+        }
+      }
+    }
+    depth = Math.max(0, depth + countXmakeBraces(line));
+    if (depth <= REQUIREMENT_DEPTH) {
+      requirement = undefined;
+    }
+    if (depth <= CONFIGURATION_DEPTH) {
+      configuration = undefined;
+    }
+  }
+
+  // Collapse the per-configuration entries into one component per resolved
+  // coordinate, listing the configurations it was resolved for.
+  const merged = new Map();
+  for (const record of byKey.values()) {
+    const key = `${record.name}@${record.version || ""}`;
+    const existing = merged.get(key);
+    if (existing) {
+      existing.configurations.add(record.configuration);
+      continue;
+    }
+    merged.set(key, {
+      name: record.name,
+      version: record.version,
+      configurations: new Set([record.configuration]),
+    });
+  }
+
+  const pkgList = [];
+  for (const record of merged.values()) {
+    // A malformed coordinate in an untrusted lock costs one entry, not the
+    // whole scan.
+    const purl = tryBuildPurl({
+      type: "generic",
+      namespace: "xmake",
+      name: record.name,
+      version: record.version || null,
+    });
+    if (!purl) {
+      continue;
+    }
+    pkgList.push({
+      name: record.name,
+      ...(record.version ? { version: record.version } : {}),
+      type: "library",
+      scope: "required",
+      purl,
+      "bom-ref": decodeURIComponent(purl),
+      properties: [
+        { name: "internal:SrcFile", value: lockFile },
+        { name: "cdx:purl:proposedType", value: "xmake" },
+        {
+          name: "cdx:xmake:configurations",
+          value: [...record.configurations].sort().join(", "),
+        },
+      ],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 0.5,
+          methods: [
+            {
+              technique: "source-code-analysis",
+              confidence: 0.5,
+              value: `Filename ${lockFile}`,
+            },
+          ],
+        },
+      },
+    });
+  }
+  return pkgList;
+}
+
+/**
+ * Reduce an xmake requirement key to the package name.
+ *
+ * Keys look like `zlib#31fecfc4` or `sol2 v3.2.1#72267bd5`: the trailing
+ * `#<hash>` identifies the resolved configuration and the optional second
+ * token is the requested version range, neither of which is the name.
+ *
+ * @param {string} key Requirement key as written in the lock
+ * @returns {string|undefined} Package name
+ */
+function xmakeRequirementName(key) {
+  const name = key.split("#")[0].trim().split(/\s+/u)[0];
+  return name || undefined;
+}
+
+/**
+ * Net brace change contributed by one line of a Lua table.
+ *
+ * @param {string} line Line to scan
+ * @returns {number} Opens minus closes
+ */
+function countXmakeBraces(line) {
+  let delta = 0;
+  for (const char of line) {
+    if (char === "{") {
+      delta += 1;
+    } else if (char === "}") {
+      delta -= 1;
+    }
+  }
+  return delta;
+}