@cdxgen/cdxgen 13.1.0 → 13.2.0

package/lib/cli/nativeBom.js

@@ -12,11 +12,13 @@ import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import {
   CARGO_CMD,
+  CARGO_TARGET,
   CLJ_CMD,
   hasAnyProjectType,
   LEIN_CMD,
   SWIFT_CMD,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -36,6 +38,14 @@ import {
   getCratesMetadata,
   getSwiftPackageMetadata,
 } from "../ecosystems/ecosystems.js";
+import { parseShardsProject } from "../ecosystems/parsers-crystal.js";
+import {
+  createElmCacheReader,
+  getElmMetadata,
+  isElmProjectFile,
+  parseElmProject,
+  parseLegacyElmProject,
+} from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
   parseGoListDep,
@@ -46,12 +56,17 @@ import {
   parseGopkgData,
   parseGosumData,
 } from "../ecosystems/parsers-go.js";
+import { parseJuliaProject } from "../ecosystems/parsers-julia.js";
 import {
   parseCljDep,
   parseEdnData,
   parseLeinDep,
   parseLeiningenData,
 } from "../ecosystems/parsers-jvm.js";
+import {
+  parseLuaRocksLock,
+  parseRockspecFile,
+} from "../ecosystems/parsers-lua.js";
 import {
   buildObjectForCocoaPod,
   executeAlpmList,
@@ -78,12 +93,24 @@ import {
   parseSwiftResolved,
   prefetchCocoaPodspecs,
 } from "../ecosystems/parsers-misc.js";
+import { parseNimProject } from "../ecosystems/parsers-nim.js";
+import { parseOpamLockedFile } from "../ecosystems/parsers-opam.js";
+import { parseRebarLock } from "../ecosystems/parsers-rebar.js";
 import {
+  applyCargoDependencyKindMetadata,
+  buildCargoLockDependencyGraph,
+  buildCargoNativeLibraryComponents,
+  cargoComponentKey,
   parseCargoData,
   parseCargoDependencyData,
   parseCargoManifestDependencyData,
+  parseCargoManifestDependencyKinds,
+  parseCargoMetadataResolve,
   parseCargoTomlData,
+  rollupCargoDependencyKinds,
 } from "../ecosystems/parsers-rust.js";
+import { parseSpackLock } from "../ecosystems/parsers-spack.js";
+import { parseStackProject } from "../ecosystems/parsers-stack.js";
 import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
@@ -664,6 +691,223 @@ function cargoAnswersVersion(cwd) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object|undefined>} Promise resolving to a BOM object or undefined
  */
+/**
+ * Run `cargo metadata` for a manifest and return its parsed resolve graph.
+ *
+ * The lock file is the union of every dependency kind and every target triple,
+ * so it cannot answer which crates are dev-only or platform-gated. Only
+ * `cargo metadata` carries that, per dependency edge, in `resolve.nodes[].deps[].dep_kinds`.
+ *
+ * @param {string} cargoTomlFile Manifest path
+ * @param {string} [filterPlatform] Target triple to resolve the graph for
+ * @returns {object|undefined} Parsed `cargo metadata` output
+ */
+function runCargoMetadata(cargoTomlFile, filterPlatform) {
+  const basePath = dirname(cargoTomlFile);
+  const platformArgs = filterPlatform
+    ? ["--filter-platform", filterPlatform]
+    : [];
+  // `--locked` keeps the user's lock file untouched; a workspace that is out of
+  // date with its lock file needs the retry without it.
+  for (const lockArgs of [["--locked"], []]) {
+    const cargoArgs = [
+      "metadata",
+      "--format-version",
+      "1",
+      "--manifest-path",
+      cargoTomlFile,
+      ...platformArgs,
+      ...lockArgs,
+    ];
+    if (DEBUG_MODE) {
+      console.log("Executing", CARGO_CMD, cargoArgs.join(" "), "in", basePath);
+    }
+    const result = safeSpawnSync(CARGO_CMD, cargoArgs, {
+      cwd: basePath,
+      shell: isWin,
+    });
+    if (result.status === 0 && !result.error && result.stdout) {
+      try {
+        return JSON.parse(result.stdout);
+      } catch (err) {
+        if (DEBUG_MODE) {
+          console.log(`Unable to parse the cargo metadata output: ${err}`);
+        }
+        return undefined;
+      }
+    }
+    if (DEBUG_MODE) {
+      console.log(result.error, result.stderr);
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Annotate cargo components with their dependency kind, platform gate and
+ * scope.
+ *
+ * With `--deep`, the edge kinds come from `cargo metadata` and are exact at
+ * every depth. Otherwise they are recovered from the manifests, which is exact
+ * for the dependencies a workspace member declares and inherited below them.
+ *
+ * @param {object[]} pkgList Components to annotate
+ * @param {object[]} dependencyTree Lockfile dependency relationships
+ * @param {string[]} cargoFiles Manifest paths
+ * @param {Map<string, string>} manifestRootKeys Manifest path to root component key
+ * @param {object} options CLI options
+ */
+function annotateCargoDependencyKinds(
+  pkgList,
+  dependencyTree,
+  cargoFiles,
+  manifestRootKeys,
+  options,
+) {
+  if (!pkgList?.length) {
+    return;
+  }
+  const allEdges = new Map();
+  if (options?.deep) {
+    const rollups = new Map();
+    const packageInfo = new Map();
+    const visitedWorkspaceRoots = new Set();
+    // The keys that survive resolution for the requested target triple. The
+    // unfiltered graph still supplies the kinds, because a crate's kind does
+    // not change with the triple.
+    const targetIncludedKeys = CARGO_TARGET ? new Set() : undefined;
+    let targetFilterApplied = !CARGO_TARGET;
+    let anyMetadata = false;
+    let everyMetadata = true;
+    for (const cargoTomlFile of cargoFiles) {
+      const metadata = runCargoMetadata(cargoTomlFile);
+      if (!metadata) {
+        everyMetadata = false;
+        continue;
+      }
+      // Every member of a workspace answers with the same resolve graph.
+      const workspaceRoot = metadata.workspace_root || cargoTomlFile;
+      if (visitedWorkspaceRoots.has(workspaceRoot)) {
+        anyMetadata = true;
+        continue;
+      }
+      visitedWorkspaceRoots.add(workspaceRoot);
+      anyMetadata = true;
+      if (CARGO_TARGET) {
+        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        if (targetMetadata) {
+          for (const key of parseCargoMetadataResolve(targetMetadata)
+            .resolvedKeys) {
+            targetIncludedKeys.add(key);
+          }
+          targetFilterApplied = true;
+        } else {
+          console.warn(
+            `cargo metadata could not resolve the dependency graph for the target ${CARGO_TARGET}. The components are not filtered by target.`,
+          );
+        }
+      }
+      const graph = parseCargoMetadataResolve(metadata);
+      for (const [key, value] of graph.packageInfo) {
+        packageInfo.set(key, value);
+      }
+      for (const [key, value] of graph.edges) {
+        allEdges.set(key, [...(allEdges.get(key) || []), ...value]);
+      }
+      for (const [key, value] of rollupCargoDependencyKinds(graph)) {
+        const existing = rollups.get(key);
+        if (!existing) {
+          rollups.set(key, value);
+          continue;
+        }
+        // A crate that is a runtime dependency of any workspace in the scan is
+        // a runtime dependency of the BOM.
+        for (const kind of value.kinds) {
+          existing.kinds.add(kind);
+        }
+        for (const target of value.targets) {
+          existing.targets.add(target);
+        }
+        const precedence = ["root", "runtime", "build", "dev"];
+        if (
+          precedence.indexOf(value.kind) < precedence.indexOf(existing.kind)
+        ) {
+          existing.kind = value.kind;
+          existing.targetGated = value.targetGated;
+        } else if (value.kind === existing.kind && !value.targetGated) {
+          existing.targetGated = false;
+        }
+      }
+    }
+    if (anyMetadata && rollups.size) {
+      applyCargoDependencyKindMetadata(pkgList, rollups, packageInfo, {
+        resolveIsComplete: everyMetadata,
+        filterPlatform: targetFilterApplied ? CARGO_TARGET : undefined,
+        targetIncludedKeys: targetFilterApplied
+          ? targetIncludedKeys
+          : undefined,
+      });
+      // A `-sys` crate puts a C library into the artifact that the cargo
+      // dependency graph itself cannot describe.
+      const nativeLibraries = buildCargoNativeLibraryComponents(
+        packageInfo,
+        allEdges,
+        rollups,
+      );
+      if (nativeLibraries.components.length) {
+        pkgList.push(...nativeLibraries.components);
+        if (dependencyTree) {
+          dependencyTree.push(...nativeLibraries.dependencies);
+        }
+      }
+      return;
+    }
+    recordDegradation("rust.cargo-metadata-unavailable", {
+      ecosystem: "rust",
+      tool: "cargo",
+      impact: "components",
+      command: `${basename(CARGO_CMD)} metadata`,
+      detail:
+        "cargo metadata could not be executed, so dependency kinds and platform gates were recovered from the manifests alone.",
+    });
+  }
+  if (!dependencyTree?.length || !manifestRootKeys.size) {
+    return;
+  }
+  const declaredEdgesByRoot = new Map();
+  for (const [cargoTomlFile, rootKey] of manifestRootKeys) {
+    if (!rootKey) {
+      continue;
+    }
+    const declaredEdges = parseCargoManifestDependencyKinds(cargoTomlFile, {
+      includeWorkspaceMembers: !options.multiProject,
+    });
+    const existing = declaredEdgesByRoot.get(rootKey);
+    if (!existing) {
+      declaredEdgesByRoot.set(rootKey, declaredEdges);
+      continue;
+    }
+    for (const [name, value] of declaredEdges) {
+      const knownEdge = existing.get(name);
+      if (!knownEdge) {
+        existing.set(name, value);
+        continue;
+      }
+      for (const kind of value.kinds) {
+        knownEdge.kinds.add(kind);
+      }
+      for (const target of value.targets) {
+        knownEdge.targets.add(target);
+      }
+    }
+  }
+  const graph = buildCargoLockDependencyGraph(
+    dependencyTree,
+    declaredEdgesByRoot,
+  );
+  applyCargoDependencyKindMetadata(pkgList, rollupCargoDependencyKinds(graph));
+}
+
 export async function createRustBom(path, options) {
   let pkgList = [];
   let parentComponent = {};
@@ -769,6 +1013,7 @@ export async function createRustBom(path, options) {
         "No Cargo.lock was found beside the manifest, so components carry the declared dependencies without locked versions or the resolved crate graph.",
     });
   }
+  const manifestRootKeys = new Map();
   for (const f of cargoFiles) {
     if (DEBUG_MODE) {
       console.log(`Parsing ${f}`);
@@ -777,6 +1022,7 @@ export async function createRustBom(path, options) {
       includeWorkspaceMembers: !options.multiProject,
     });
     if (dlist?.length) {
+      manifestRootKeys.set(f, cargoComponentKey(dlist[0]));
       if (!cargoLockMode) {
         pkgList = pkgList.concat(dlist);
       } else {
@@ -832,6 +1078,15 @@ export async function createRustBom(path, options) {
       );
     }
   }
+  if (cargoLockMode) {
+    annotateCargoDependencyKinds(
+      pkgList,
+      dependencyTree,
+      cargoFiles,
+      manifestRootKeys,
+      options,
+    );
+  }
   return buildBomNSData(options, pkgList, "cargo", {
     src: path,
     filename: cargoLockFiles.join(", "),
@@ -1596,6 +1851,44 @@ export function createClojureBom(path, options) {
   return {};
 }
 
+/**
+ * Locate the Stack lock files under a path.
+ *
+ * Stack names the lock after the configuration file it completes, so the
+ * default `stack.yaml` produces `stack.yaml.lock` and a project with several
+ * configurations produces one lock per configuration. `stack.lock` is also
+ * accepted because tooling and documentation examples have used that name.
+ *
+ * @param {string} path Project path
+ * @param {Object} options Parse options from the cli
+ * @returns {string[]} Lock file paths, deduplicated
+ */
+export function findStackLockFiles(path, options) {
+  const prefix = options.multiProject ? "**/" : "";
+  const candidates = new Set([
+    ...getAllFiles(path, `${prefix}*.yaml.lock`, options),
+    ...getAllFiles(path, `${prefix}stack.lock`, options),
+  ]);
+  return [...candidates].filter((lockFile) => {
+    if (/(^|[\\/])stack\.(yaml\.)?lock$/u.test(lockFile)) {
+      return true;
+    }
+    // `*.yaml.lock` is not a name Stack owns, so a custom configuration is
+    // accepted only when the file it completes names a snapshot.
+    const configFile = lockFile.replace(/\.lock$/u, "");
+    if (!safeExistsSync(configFile)) {
+      return false;
+    }
+    try {
+      return /^\s*(snapshot|resolver)\s*:/mu.test(
+        readFileSync(configFile, "utf-8"),
+      );
+    } catch {
+      return false;
+    }
+  });
+}
+
 /**
  * Function to create bom string for Haskell projects
  *
@@ -1626,12 +1919,44 @@ export function createHaskellBom(path, options) {
       filename: cabalFiles.join(", "),
     });
   }
+  // Stack projects keep the resolved extra-deps in a lock file named after
+  // the configuration file, so `stack.yaml` locks to `stack.yaml.lock`.
+  const stackLockFiles = findStackLockFiles(path, options);
+  if (stackLockFiles.length) {
+    const dependencies = [];
+    let parentComponent = {};
+    for (const stackLockFile of stackLockFiles) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${stackLockFile}`);
+      }
+      const stackYamlFile = stackLockFile.replace(/\.lock$/u, "");
+      const result = parseStackProject(
+        stackLockFile,
+        safeExistsSync(stackYamlFile) ? stackYamlFile : undefined,
+      );
+      if (result.pkgList?.length) {
+        pkgList = pkgList.concat(result.pkgList);
+      }
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = result.parentComponent;
+        attachRootEdge(result, parentComponent, dependencies);
+      }
+    }
+    if (pkgList.length) {
+      return buildBomNSData(options, pkgList, "hackage", {
+        src: path,
+        filename: stackLockFiles.join(", "),
+        dependencies,
+        parentComponent,
+      });
+    }
+  }
   recordDegradation("haskell.freeze-missing", {
     ecosystem: "haskell",
     tool: "cabal",
     impact: "components",
     detail:
-      "No cabal.project.freeze was found, and the freeze file is the source the parser reads for the package set.",
+      "No cabal.project.freeze or stack.yaml.lock was found; those lock files are the sources the parsers read for the package set.",
   });
   return {};
 }
@@ -2302,3 +2627,475 @@ export async function createGleamBom(path, options) {
 
   return {};
 }
+
+/**
+ * Function to create bom string for Julia projects.
+ *
+ * The resolved `Manifest.toml` is preferred over the declared `Project.toml`
+ * so the BOM carries pinned versions and the package graph.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createJuliaBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const projectTomlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const manifestOnly = !projectTomlFiles.length;
+
+  for (const projectTomlFile of projectTomlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${projectTomlFile}`);
+    }
+    const baseDir = dirname(projectTomlFile);
+    const manifestTomlFile = join(baseDir, "Manifest.toml");
+    const result = parseJuliaProject(
+      projectTomlFile,
+      safeExistsSync(manifestTomlFile) ? manifestTomlFile : undefined,
+    );
+    collectProjectResult(result);
+  }
+  if (manifestOnly) {
+    for (const manifestTomlFile of getAllFiles(
+      path,
+      `${options.multiProject ? "**/" : ""}Manifest.toml`,
+      options,
+    )) {
+      if (DEBUG_MODE) {
+        console.log(`Parsing ${manifestTomlFile}`);
+      }
+      // Gleam also writes a `manifest.toml`; on case-insensitive filesystems
+      // the lookup above can surface it, so only accept files that parse as
+      // a Julia manifest.
+      const parsed = parseJuliaProject(undefined, manifestTomlFile);
+      if (parsed.pkgList.length) {
+        collectProjectResult(parsed);
+      }
+    }
+  }
+
+  function collectProjectResult(result) {
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (
+      !Object.keys(parentComponent).length &&
+      Object.keys(result.parentComponent).length
+    ) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "julia", {
+      src: path,
+      filename: projectTomlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Attach a root dependency edge from the parent component to its direct
+ * dependencies, following the shape used by the Gleam and Nix flows.
+ *
+ * @param {{rootInputs?: string[]}} result Parser result with root inputs
+ * @param {Object} parentComponent Parent component to give a bom-ref
+ * @param {Object[]} dependencies Dependency edge list to append to
+ */
+function attachRootEdge(result, parentComponent, dependencies) {
+  if (result.rootInputs?.length && parentComponent.name) {
+    const rootRef = `application:${parentComponent.name}:${parentComponent.version || "latest"}`;
+    parentComponent["bom-ref"] = rootRef;
+    dependencies.push({
+      ref: rootRef,
+      dependsOn: [...new Set(result.rootInputs)],
+    });
+  }
+}
+
+/**
+ * Function to create bom string for Erlang projects using rebar3.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createErlangBom(path, options) {
+  let pkgList = [];
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  for (const rebarLockFile of rebarLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rebarLockFile}`);
+    }
+    const result = parseRebarLock(rebarLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "erlang", {
+      src: path,
+      filename: rebarLockFiles.join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for OCaml projects using opam.
+ *
+ * Resolved `.opam.locked` files are preferred; a plain `.opam` file is used
+ * as a declared fallback with unpinned versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createOCamlBom(path, options) {
+  let pkgList = [];
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  const opamFiles = opamLockedFiles.length
+    ? []
+    : getAllFiles(path, `${options.multiProject ? "**/" : ""}*.opam`, options);
+  for (const opamFile of [...opamLockedFiles, ...opamFiles]) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${opamFile}`);
+    }
+    const result = parseOpamLockedFile(opamFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "ocaml", {
+      src: path,
+      filename: [...opamLockedFiles, ...opamFiles].join(", "),
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Elm projects.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createElmBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  // A single reader memoises the cache lookups shared by every manifest.
+  const cacheReader = createElmCacheReader();
+  for (const elmJsonFile of elmJsonFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${elmJsonFile}`);
+    }
+    const result = parseElmProject(elmJsonFile, cacheReader);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  const legacyFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  for (const legacyFile of legacyFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${legacyFile}`);
+    }
+    const baseDir = dirname(legacyFile);
+    const exactDepsFile = join(baseDir, "elm-stuff", "exact-dependencies.json");
+    const result = parseLegacyElmProject(
+      legacyFile,
+      safeExistsSync(exactDepsFile) ? exactDepsFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    pkgList = await getElmMetadata(pkgList, dependencies);
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "elm", {
+      src: path,
+      filename: [...elmJsonFiles, ...legacyFiles].join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Crystal projects using shards.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createCrystalBom(path, options) {
+  let pkgList = [];
+  const dependencies = [];
+  let parentComponent = {};
+
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  for (const shardYmlFile of shardYmlFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${shardYmlFile}`);
+    }
+    const baseDir = dirname(shardYmlFile);
+    const shardLockFile = join(baseDir, "shard.lock");
+    const result = parseShardsProject(
+      shardYmlFile,
+      safeExistsSync(shardLockFile) ? shardLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "crystal", {
+      src: path,
+      filename: shardYmlFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Nim projects using nimble.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createNimBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let parentComponent = {};
+
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  for (const nimbleFile of nimbleFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${nimbleFile}`);
+    }
+    const baseDir = dirname(nimbleFile);
+    const nimbleLockFile = join(baseDir, "nimble.lock");
+    const result = parseNimProject(
+      nimbleFile,
+      safeExistsSync(nimbleLockFile) ? nimbleLockFile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = result.parentComponent;
+      attachRootEdge(result, parentComponent, dependencies);
+    }
+  }
+  if (pkgList.length || Object.keys(parentComponent).length) {
+    return buildBomNSData(options, pkgList, "nim", {
+      src: path,
+      filename: nimbleFiles.join(", "),
+      dependencies,
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Lua projects using LuaRocks.
+ *
+ * When a `luarocks.lock` is present next to a rockspec it supplies the
+ * resolved versions; otherwise the rockspec's declared dependencies are
+ * inventoried without versions.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createLuaBom(path, options) {
+  let pkgList = [];
+  let parentComponent = {};
+  const seenLockFiles = new Set();
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  for (const rockspecFile of rockspecFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${rockspecFile}`);
+    }
+    const baseDir = dirname(rockspecFile);
+    const lockFile = join(baseDir, "luarocks.lock");
+    // The rockspec names the project and its declared set either way; the
+    // lock, when present, supplies the resolved versions.
+    const declared = parseRockspecFile(rockspecFile);
+    if (!Object.keys(parentComponent).length) {
+      parentComponent = declared.parentComponent;
+    }
+    let resolved;
+    if (safeExistsSync(lockFile)) {
+      seenLockFiles.add(lockFile);
+      resolved = parseLuaRocksLock(lockFile, rockspecFile);
+    }
+    const chosen = resolved?.pkgList?.length ? resolved : declared;
+    if (chosen.pkgList?.length) {
+      pkgList = pkgList.concat(chosen.pkgList);
+    }
+  }
+  // A lock can also stand alone, in a project whose rockspec is generated at
+  // release time rather than committed.
+  for (const lockFile of getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}luarocks.lock`,
+    options,
+  )) {
+    if (seenLockFiles.has(lockFile)) {
+      continue;
+    }
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseLuaRocksLock(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "lua", {
+      src: path,
+      filename: rockspecFiles.join(", "),
+      parentComponent,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Spack environments.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Promise<Object>} BOM object
+ */
+export async function createSpackBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  for (const spackLockFile of spackLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${spackLockFile}`);
+    }
+    const result = parseSpackLock(spackLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // The lock names no project component, so the environment directory is the
+  // name the environment is already known by. Its roots are the specs the
+  // lock records as requested, which is why they are linked explicitly rather
+  // than inferred from which nodes have no incoming edge: a build-only tool
+  // such as gmake also has none, and it is not a root.
+  const envName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: envName,
+    "bom-ref": `application:${envName}:latest`,
+    description: `Spack environment: ${envName}`,
+    properties: [
+      { name: "internal:SrcFile", value: spackLockFiles.join(", ") },
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "spack", {
+    src: path,
+    filename: spackLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}