@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/ecosystems/parsers-nim.js

@@ -0,0 +1,221 @@
+import { readFileSync } from "node:fs";
+import { basename } from "node:path";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Nim parser for `.nimble` manifests and `nimble.lock`.
+ *
+ * A `.nimble` file is a Nim script whose practical surface is a set of
+ * `key = "value"` assignments plus `requires "dep >= 1.0"` lines; it is read
+ * with a line scanner over those shapes rather than a Nim interpreter.
+ * Nimble persists the resolved dependency set to `nimble.lock` (JSON), which
+ * is the source of truth for versions.
+ *
+ * No `nim` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=nim` property, following the convention
+ * used for nix and zig.
+ */
+
+/**
+ * Parse a Nim project from a `.nimble` manifest and optional `nimble.lock`.
+ *
+ * @param {string} nimbleFile Path to the `.nimble` file
+ * @param {string} [nimbleLockFile] Path to `nimble.lock`, if present
+ * @returns {{ pkgList: object[], dependencies: object[], parentComponent: object, rootInputs?: string[] }}
+ */
+export function parseNimProject(nimbleFile, nimbleLockFile) {
+  const fields = readNimbleFile(nimbleFile);
+  const parentComponent = {};
+  // Nimble files frequently omit `name`; the manifest file name is the
+  // package name in that case, which is also how nimble itself refers to it.
+  const projectName =
+    fields.name || basename(nimbleFile).replace(/\.nimble$/iu, "");
+  if (projectName) {
+    parentComponent.type = "application";
+    parentComponent.name = projectName;
+    if (fields.version) {
+      parentComponent.version = fields.version;
+    }
+    parentComponent.description =
+      fields.description || `Nim package: ${fields.name}`;
+    parentComponent.properties = [
+      { name: "internal:SrcFile", value: nimbleFile },
+    ];
+    if (fields.license) {
+      parentComponent.license = fields.license;
+    }
+  }
+
+  let lock;
+  if (nimbleLockFile) {
+    try {
+      lock = JSON.parse(readFileSync(nimbleLockFile, "utf-8"));
+    } catch (error) {
+      console.warn(`Failed to parse ${nimbleLockFile}: ${error.message}`);
+      lock = undefined;
+    }
+  }
+
+  // nimble.lock has carried `packages` both as an object keyed by name and as
+  // an array of records; both shapes are accepted so locks from either
+  // nimble generation parse.
+  const lockedEntries = [];
+  if (Array.isArray(lock?.packages)) {
+    lockedEntries.push(...lock.packages);
+  } else if (lock?.packages && typeof lock.packages === "object") {
+    for (const [name, entry] of Object.entries(lock.packages)) {
+      lockedEntries.push({ name, ...entry });
+    }
+  }
+
+  if (!lockedEntries.length) {
+    // Lockless fallback: emit declared requirements without resolved versions.
+    const pkgList = fields.requires.map((req) =>
+      nimPackage(req.name, undefined, { direct: true, srcFile: nimbleFile }),
+    );
+    return {
+      pkgList,
+      dependencies: [],
+      parentComponent,
+      rootInputs: pkgList.map((p) => p["bom-ref"]),
+    };
+  }
+
+  const directNames = new Set(fields.requires.map((req) => req.name));
+  const pkgList = [];
+  const refByName = new Map();
+  const edges = [];
+  for (const entry of lockedEntries) {
+    if (typeof entry?.name !== "string" || !entry.name) {
+      continue;
+    }
+    const version =
+      typeof entry.version === "string" && entry.version
+        ? entry.version
+        : undefined;
+    const pkg = nimPackage(entry.name, version, {
+      direct: directNames.has(entry.name),
+      vcsRevision:
+        typeof entry.vcsRevision === "string" && entry.vcsRevision
+          ? entry.vcsRevision
+          : undefined,
+      srcFile: nimbleLockFile,
+    });
+    pkgList.push(pkg);
+    refByName.set(entry.name, pkg["bom-ref"]);
+  }
+  for (const entry of lockedEntries) {
+    const ref = refByName.get(entry.name);
+    if (!ref) {
+      continue;
+    }
+    const dependsOn = (
+      Array.isArray(entry.dependencies) ? entry.dependencies : []
+    )
+      .map((depName) =>
+        typeof depName === "string" ? refByName.get(depName) : undefined,
+      )
+      .filter(Boolean);
+    edges.push({ ref, dependsOn: [...new Set(dependsOn)].sort() });
+  }
+  const rootInputs = [...directNames]
+    .map((name) => refByName.get(name))
+    .filter(Boolean);
+  return { pkgList, dependencies: edges, parentComponent, rootInputs };
+}
+
+/**
+ * Build a component-like package record for a Nim package.
+ *
+ * @param {string} name Package name
+ * @param {string|undefined} version Resolved version, if known
+ * @param {object} opts Extra context (`direct`, `vcsRevision`, `srcFile`)
+ * @returns {object} Package record
+ */
+function nimPackage(name, version, opts) {
+  const purl = tryBuildPurl({
+    type: "generic",
+    name,
+    version: version || undefined,
+  });
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    { name: "cdx:purl:proposedType", value: "nim" },
+    {
+      name: "cdx:nim:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  if (opts.vcsRevision) {
+    properties.push({ name: "cdx:nim:vcsRevision", value: opts.vcsRevision });
+  }
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Read the assignments and requirements of a `.nimble` file.
+ *
+ * @param {string} filePath File to read
+ * @returns {{name?: string, version?: string, description?: string, license?: string, requires: Array<{name: string, constraint?: string}>}}
+ */
+export function readNimbleFile(filePath) {
+  const result = { requires: [] };
+  let text;
+  try {
+    text = readFileSync(filePath, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${filePath}: ${error.message}`);
+    return result;
+  }
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    const assignment = line.match(
+      /^(name|version|description|license)\s*=\s*"([^"]*)"/u,
+    );
+    if (assignment) {
+      const value = assignment[2];
+      if (value) {
+        result[assignment[1]] = value;
+      }
+      continue;
+    }
+    const requires = line.match(/^requires\s+"([^"]+)"/u);
+    if (requires) {
+      const tokens = requires[1].split(/\s+/u);
+      const first = tokens[0];
+      const constraint = tokens.slice(1).join(" ");
+      if (first.startsWith("http") || first.includes("://")) {
+        // URL requirements are identified by the repository name, which is
+        // how nimble itself keys them in the lock file. A trailing .nim
+        // extension is dropped because the lock keys by the bare name.
+        const withoutExtension = first.split(/[?#]/u)[0].replace(/\.git$/u, "");
+        const segments = withoutExtension.split("/").filter(Boolean);
+        const repoName = segments[segments.length - 1] || first;
+        result.requires.push({
+          name: repoName.replace(/\.nim$/iu, ""),
+          constraint,
+        });
+        continue;
+      }
+      result.requires.push({ name: first, constraint });
+    }
+  }
+  return result;
+}

package/lib/ecosystems/parsers-opam.js

@@ -0,0 +1,180 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * OCaml opam parser for `.opam.locked` files.
+ *
+ * `opam lock` writes a `<name>.opam.locked` file that pins the full resolved
+ * dependency set of a project: a `depends:` field listing every package with
+ * an equality constraint on its version, and a `pin-depends:` field for
+ * packages pinned to a URL. The file is opam's own syntax, a small
+ * line-oriented field language, which is read here with a line scanner rather
+ * than a monolithic expression.
+ *
+ * A locked file holds the closure only: it does not record which packages are
+ * direct dependencies of the project, so every entry is reported with the
+ * same standing and the project root links to all of them.
+ *
+ * Packages are identified with the registered `opam` purl type
+ * (`pkg:opam/<name>@<version>`).
+ */
+
+/**
+ * Parse an `.opam.locked` (or plain `.opam`) file.
+ *
+ * @param {string} opamLockedFile Path to the opam file
+ * @returns {{ pkgList: object[], pins: Array<{name: string, url: string}> }}
+ */
+export function parseOpamLockedFile(opamLockedFile) {
+  let text;
+  try {
+    text = readFileSync(opamLockedFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${opamLockedFile}: ${error.message}`);
+    return { pkgList: [], pins: [] };
+  }
+
+  const depends = [];
+  const pins = [];
+  const lines = text.split("\n");
+  let section;
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    if (line.startsWith("depends:")) {
+      section = "depends";
+      continue;
+    }
+    if (line.startsWith("pin-depends:")) {
+      section = "pin-depends";
+      continue;
+    }
+    // A bare `field:` at the start of a line ends the previous list section.
+    if (/^[A-Za-z0-9_-]+:/u.test(line)) {
+      section = undefined;
+      continue;
+    }
+    if (section === "depends") {
+      collectDependsEntry(line, depends, opamLockedFile);
+    } else if (section === "pin-depends") {
+      collectPinEntry(line, pins);
+    }
+  }
+  // A pin overrides where a package is fetched from; reflect that on the
+  // resolved component so consumers can see the divergence from the registry.
+  for (const pin of pins) {
+    const target = depends.find((dep) => dep.name === pin.name);
+    if (target) {
+      target.properties.push({ name: "cdx:opam:pinned", value: "true" });
+      target.properties.push({
+        name: "cdx:opam:pinSource",
+        value: pin.url,
+      });
+    }
+  }
+  return { pkgList: depends, pins };
+}
+
+/**
+ * Turn one `depends` list line into a pinned package record.
+ *
+ * Entries look like `"dune" {= "3.16.0"}` or `"ocaml" {= "5.1.1" & build}`.
+ * Only equality pins carry a version; constraint-only entries are recorded
+ * without one so the package is still inventoried.
+ *
+ * @param {string} line Trimmed list line
+ * @param {object[]} depends Accumulator for package records
+ * @param {string} srcFile Source path for provenance
+ */
+function collectDependsEntry(line, depends, srcFile) {
+  const nameMatch = line.match(/^"([^"]+)"/u);
+  if (!nameMatch) {
+    return;
+  }
+  const name = nameMatch[1];
+  let version;
+  const constraints = line.match(/\{[^}]*\}/gu) || [];
+  for (const constraint of constraints) {
+    // A pin is a standalone `=`, not the tail of `>=`, `<=`, or `!=`.
+    const pinned = constraint.match(/(?<![<>!=])=(?!=)\s*"([^"]+)"/u);
+    if (pinned) {
+      version = pinned[1];
+      break;
+    }
+  }
+  if (depends.some((dep) => dep.name === name && dep.version === version)) {
+    return;
+  }
+  const purl = tryBuildPurl({
+    type: "opam",
+    name,
+    version: version || undefined,
+  });
+  const properties = [{ name: "internal:SrcFile", value: srcFile }];
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  depends.push(pkg);
+}
+
+/**
+ * Turn one `pin-depends` list line into a pin record.
+ *
+ * Entries look like `[ "mylib.dev" "git+https://host/path#rev" ]`. The first
+ * string is a package *version* identifier — `<name>.<version>` — whereas the
+ * matching `depends` entry carries the bare name, so the version suffix is
+ * split off before the two can be matched. Package names cannot contain a
+ * dot, which makes the first dot the separator.
+ *
+ * The URL is reduced to its origin and path so credentials embedded in a
+ * query string never reach the BOM.
+ *
+ * @param {string} line Trimmed list line
+ * @param {Array<{name: string, url: string}>} pins Accumulator for pins
+ */
+function collectPinEntry(line, pins) {
+  const strings = line.match(/"[^"]*"/gu) || [];
+  if (strings.length < 2) {
+    return;
+  }
+  const identifier = strings[0].slice(1, -1);
+  const rawUrl = strings[1].slice(1, -1);
+  pins.push({
+    name: identifier.split(".")[0],
+    url: sanitizedPinUrl(rawUrl),
+  });
+}
+
+/**
+ * Reduce a pin URL to a safe origin plus path.
+ *
+ * @param {string} rawUrl URL as written in the lock file
+ * @returns {string} Sanitised URL, or the raw value when it is not a URL
+ */
+function sanitizedPinUrl(rawUrl) {
+  const schemeSplit = rawUrl.split("://");
+  if (schemeSplit.length < 2) {
+    return rawUrl;
+  }
+  const scheme = schemeSplit[0];
+  const rest = schemeSplit[1];
+  const pathStart = rest.indexOf("/");
+  const authority = pathStart === -1 ? rest : rest.slice(0, pathStart);
+  const path = pathStart === -1 ? "" : rest.slice(pathStart).split(/[?#]/u)[0];
+  // Userinfo is dropped by taking only the authority's host portion.
+  const host = authority.split("@").pop();
+  return `${scheme}://${host}${path}`;
+}

package/lib/ecosystems/parsers-perl.js

@@ -0,0 +1,277 @@
+import { readFileSync } from "node:fs";
+
+import { tryBuildPurl } from "../inventory/purl.js";
+
+/**
+ * Perl parser for `cpanfile` and `cpanfile.snapshot`.
+ *
+ * Carton snapshots the resolved install set as a text document: one entry per
+ * distribution, each carrying the `pathname` it was fetched from (which
+ * encodes the PAUSE author id), the packages it provides, and the
+ * requirements it was resolved against. The declared `cpanfile` lists the
+ * project's own requirements.
+ *
+ * Distributions are identified with the registered `cpan` purl type, whose
+ * rules require the author id as the namespace
+ * (`pkg:cpan/<AUTHOR>/<Distribution>@<version>`).
+ */
+
+/**
+ * Parse a `cpanfile.snapshot` into distributions with a dependency graph.
+ *
+ * @param {string} snapshotFile Path to `cpanfile.snapshot`
+ * @param {string} [cpanfileFile] Path to `cpanfile`, if present
+ * @returns {{ pkgList: object[], dependencies: object[] }}
+ */
+export function parseCpanSnapshot(snapshotFile, cpanfileFile) {
+  let text;
+  try {
+    text = readFileSync(snapshotFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${snapshotFile}: ${error.message}`);
+    return { pkgList: [], dependencies: [] };
+  }
+
+  const distributions = [];
+  let current;
+  let section;
+  for (const rawLine of text.split("\n")) {
+    if (!rawLine.trim() || rawLine.trim().startsWith("#")) {
+      continue;
+    }
+    const indent = rawLine.length - rawLine.trimStart().length;
+    const line = rawLine.trim();
+    if (indent === 0) {
+      // Top-level headers separate the snapshot sections.
+      current = undefined;
+      section = line === "DISTRIBUTIONS" ? "distributions" : undefined;
+      continue;
+    }
+    if (line.startsWith("DISTRIBUTIONS")) {
+      section = "distributions";
+      continue;
+    }
+    if (section !== "distributions") {
+      continue;
+    }
+    // A distribution line is indented by two spaces and carries
+    // `<Name>-<version>`; its details follow indented deeper.
+    if (indent === 2) {
+      const dist = parseDistributionLine(line);
+      if (dist) {
+        distributions.push(dist);
+        current = dist;
+      }
+      continue;
+    }
+    if (!current) {
+      continue;
+    }
+    if (line.startsWith("pathname:")) {
+      current.author = authorFromPathname(
+        line.slice("pathname:".length).trim(),
+      );
+      continue;
+    }
+    if (line.startsWith("provides:")) {
+      current.inProvides = true;
+      current.inRequirements = false;
+      continue;
+    }
+    if (line.startsWith("requirements:")) {
+      current.inRequirements = true;
+      current.inProvides = false;
+      continue;
+    }
+    // Deeper indented `key value` lines under provides/requirements.
+    const pair = line.match(/^([A-Za-z0-9_:.-]+)\s+(\S+)$/u);
+    if (pair) {
+      if (current.inProvides) {
+        current.provides.set(pair[1], pair[2]);
+      } else if (current.inRequirements) {
+        current.requirements.push(pair[1]);
+      }
+    }
+  }
+
+  const directNames = cpanfileFile
+    ? directRequirementsFromCpanfile(cpanfileFile)
+    : new Set();
+
+  // Map every provided package name to its distribution so requirements can
+  // be resolved to edges between distributions.
+  const distByPackage = new Map();
+  for (const dist of distributions) {
+    for (const provided of dist.provides.keys()) {
+      if (!distByPackage.has(provided)) {
+        distByPackage.set(provided, dist);
+      }
+    }
+  }
+
+  const pkgList = [];
+  const refByDist = new Map();
+  for (const dist of distributions) {
+    const name = dist.name;
+    const version = dist.version;
+    const direct =
+      directNames.size === 0
+        ? true
+        : [...dist.provides.keys()].some((pkg) => directNames.has(pkg));
+    const pkg = cpanPackage(name, version, dist.author, {
+      direct,
+      srcFile: snapshotFile,
+    });
+    pkgList.push(pkg);
+    refByDist.set(dist, pkg["bom-ref"]);
+  }
+
+  const dependencies = [];
+  for (const dist of distributions) {
+    const ref = refByDist.get(dist);
+    const dependsOn = new Set();
+    for (const requirement of dist.requirements) {
+      const target = distByPackage.get(requirement);
+      if (target && target !== dist) {
+        const targetRef = refByDist.get(target);
+        if (targetRef) {
+          dependsOn.add(targetRef);
+        }
+      }
+    }
+    dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
+  }
+  return { pkgList, dependencies };
+}
+
+/**
+ * Parse a `Name-Version` distribution line.
+ *
+ * @param {string} line Trimmed distribution line
+ * @param {string} srcFile Source path for provenance
+ * @returns {object|undefined} Distribution accumulator
+ */
+function parseDistributionLine(line) {
+  const match = line.match(/^([A-Za-z0-9_.-]+?)-(\d[^ ]*)$/u);
+  if (!match) {
+    return undefined;
+  }
+  return {
+    name: match[1],
+    version: match[2],
+    author: undefined,
+    provides: new Map(),
+    requirements: [],
+    inProvides: false,
+    inRequirements: false,
+  };
+}
+
+/**
+ * Extract the PAUSE author id from a CPAN pathname.
+ *
+ * Pathnames look like `M/MI/MIYAGAWA/Plack-1.0051.tar.gz`; the author id is
+ * the third segment.
+ *
+ * @param {string} pathname CPAN pathname
+ * @returns {string|undefined} Author id
+ */
+function authorFromPathname(pathname) {
+  const segments = pathname.split("/").filter(Boolean);
+  return segments.length >= 3 ? segments[2] : undefined;
+}
+
+/**
+ * Build a component-like package record for a CPAN distribution.
+ *
+ * @param {string} name Distribution name
+ * @param {string|undefined} version Distribution version
+ * @param {string|undefined} author PAUSE author id
+ * @param {object} opts Extra context (`direct`, `srcFile`)
+ * @returns {object} Package record
+ */
+function cpanPackage(name, version, author, opts) {
+  // The cpan purl type requires the author namespace; without it the purl is
+  // dropped rather than emitted without its identity anchor.
+  const purl = author
+    ? tryBuildPurl({
+        type: "cpan",
+        namespace: author,
+        name,
+        version: version || undefined,
+      })
+    : null;
+  const properties = [
+    { name: "internal:SrcFile", value: opts.srcFile },
+    {
+      name: "cdx:cpan:dependency",
+      value: opts.direct ? "direct" : "transitive",
+    },
+  ];
+  const pkg = {
+    name,
+    ...(version ? { version } : {}),
+    type: "library",
+    scope: "required",
+    properties,
+  };
+  if (purl) {
+    pkg.purl = purl;
+    pkg["bom-ref"] = decodeURIComponent(purl);
+  } else {
+    pkg["bom-ref"] = `library:${name}:${version || ""}`;
+  }
+  return pkg;
+}
+
+/**
+ * Collect the requirement names declared in a `cpanfile`.
+ *
+ * Only the `requires` keyword outside phase blocks is read; phases such as
+ * `on 'test'` are ignored so test-only modules do not become direct
+ * dependencies.
+ *
+ * @param {string} cpanfileFile Path to `cpanfile`
+ * @returns {Set<string>} Declared requirement names
+ */
+export function directRequirementsFromCpanfile(cpanfileFile) {
+  const names = new Set();
+  let text;
+  try {
+    text = readFileSync(cpanfileFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${cpanfileFile}: ${error.message}`);
+    return names;
+  }
+  let inPhaseBlock = false;
+  let blockDepth = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    if (inPhaseBlock) {
+      for (const char of line) {
+        if (char === "{") {
+          blockDepth += 1;
+        } else if (char === "}") {
+          blockDepth -= 1;
+          if (blockDepth === 0) {
+            inPhaseBlock = false;
+          }
+        }
+      }
+      continue;
+    }
+    if (/^on\s+['"]/.test(line) && line.includes("sub")) {
+      inPhaseBlock = true;
+      blockDepth = line.includes("{") ? 1 : 0;
+      continue;
+    }
+    const requires = line.match(/^requires\s+['"]([^'"]+)['"]/u);
+    if (requires) {
+      names.add(requires[1]);
+    }
+  }
+  return names;
+}

package/lib/ecosystems/parsers-python.js

@@ -4,7 +4,7 @@ import process from "node:process";
 import { URL } from "node:url";
 
 import { build } from "@cdxgen/cdx-purl";
-import toml from "@iarna/toml";
+import * as toml from "smol-toml";
 import { parse as _load } from "yaml";
 
 import { DEBUG_MODE } from "../core/activity.js";