@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/cppEvidence.js

@@ -24,7 +24,35 @@ import { CPP_STD_MODULES } from "../core/state.js";
 import { findAppModules } from "../inventory/atomUtils.js";
 import { getOSPackageForFile } from "../inventory/osPackageResolver.js";
 import { locateGenericPackage } from "../inventory/purl.js";
-import { parseCmakeLikeFile, parseCUsageSlice } from "./parsers-misc.js";
+import {
+  parseCmakeLikeFile,
+  parseCUsageSlice,
+  parseXmakeRequiresLock,
+} from "./parsers-misc.js";
+
+/**
+ * Add the symbols a file uses to a component's `internal:ImportedSymbols`,
+ * keeping every other property and the symbols already recorded.
+ *
+ * @param {Object} apkg Component to enrich
+ * @param {string[]} symbols Symbol names
+ */
+function mergeImportedSymbols(apkg, symbols) {
+  apkg.properties = apkg.properties || [];
+  const prop = apkg.properties.find(
+    (p) => p.name === "internal:ImportedSymbols",
+  );
+  if (prop) {
+    prop.value = Array.from(new Set([...prop.value.split("|"), ...symbols]))
+      .sort()
+      .join("|");
+  } else {
+    apkg.properties.push({
+      name: "internal:ImportedSymbols",
+      value: symbols.join("|"),
+    });
+  }
+}
 
 /**
  * Method to find c/c++ modules by collecting usages with atom
@@ -44,8 +72,11 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
   let parentComponent;
   const dependsOn = new Set();
 
+  // Components from CMake and Conan carry no group: the key spells a missing
+  // group the same way on insert and on lookup.
+  const epkgKey = (group, name) => `${group || ""}/${name}`;
   (epkgList || []).forEach((p) => {
-    epkgMap[`${p.group}/${p.name}`] = p;
+    epkgMap[epkgKey(p.group, p.name)] = p;
   });
   // Let's look for any vcpkg.json file to tell us about the directory we're scanning
   // users can use this file to give us a clue even if they do not use vcpkg library manager
@@ -72,11 +103,22 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
       if (vcPkgData.homepage) {
         parentComponent.homepage = { url: vcPkgData.homepage };
       }
+      // The builtin baseline is the vcpkg commit that pins every port version,
+      // so it identifies the version set the manifest resolves against.
+      if (typeof vcPkgData["builtin-baseline"] === "string") {
+        parentComponent.properties = [
+          {
+            name: "cdx:vcpkg:baseline",
+            value: vcPkgData["builtin-baseline"],
+          },
+        ];
+      }
       // Are there any dependencies declared in vcpkg.json
       if (vcPkgData.dependencies && Array.isArray(vcPkgData.dependencies)) {
         for (const avcdep of vcPkgData.dependencies) {
           let avcpkgName;
           let scope;
+          let vcpkgFeatures;
           if (typeof avcdep === "string" || avcdep instanceof String) {
             avcpkgName = avcdep;
           } else if (Object.keys(avcdep).length && avcdep.name) {
@@ -84,13 +126,16 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
             if (avcdep.host) {
               scope = "optional";
             }
+            vcpkgFeatures = Array.isArray(avcdep.features)
+              ? avcdep.features.join(",")
+              : undefined;
           }
           // Is this a dependency we haven't seen before including the all lower and upper case version?
           if (
             avcpkgName &&
-            !epkgMap[`/${avcpkgName}`] &&
-            !epkgMap[`/${avcpkgName.toLowerCase()}`] &&
-            !epkgMap[`/${avcpkgName.toUpperCase()}`]
+            !epkgMap[epkgKey("", avcpkgName)] &&
+            !epkgMap[epkgKey("", avcpkgName.toLowerCase())] &&
+            !epkgMap[epkgKey("", avcpkgName.toUpperCase())]
           ) {
             const pkgPurl = build({
               type: pkgType,
@@ -106,6 +151,12 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
               purl: pkgPurl,
               scope,
               "bom-ref": decodeURIComponent(pkgPurl),
+              properties: [
+                { name: "cdx:vcpkg:declared", value: "true" },
+                ...(vcpkgFeatures
+                  ? [{ name: "cdx:vcpkg:features", value: vcpkgFeatures }]
+                  : []),
+              ],
               evidence: {
                 identity: {
                   field: "purl",
@@ -129,7 +180,21 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
         }
       }
     } // if
-  } else if (safeExistsSync(join(src, "CMakeLists.txt"))) {
+  }
+  // xmake locks its resolved requirements in `xmake-requires.lock`; the
+  // entries are additions to whatever other evidence collectors found.
+  const xmakeLockFile = join(src, "xmake-requires.lock");
+  if (safeExistsSync(xmakeLockFile)) {
+    const xmakePkgs = parseXmakeRequiresLock(xmakeLockFile);
+    for (const apkg of xmakePkgs) {
+      if (!pkgAddedMap[apkg.name]) {
+        pkgList.push(apkg);
+        dependsOn.add(apkg["bom-ref"]);
+        pkgAddedMap[apkg.name] = true;
+      }
+    }
+  }
+  if (!parentComponent && safeExistsSync(join(src, "CMakeLists.txt"))) {
     const retMap = parseCmakeLikeFile(join(src, "CMakeLists.txt"), pkgType);
     if (retMap.parentComponent && Object.keys(retMap.parentComponent).length) {
       parentComponent = retMap.parentComponent;
@@ -167,6 +232,8 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
     );
   }
   const usageData = parseCUsageSlice(sliceData);
+  const osComponents = new Map();
+  const addedRefs = new Set();
   for (let afile of Object.keys(usageData)) {
     // Normalize windows separator
     afile = afile.replace("..\\", "").replace(/\\/g, "/");
@@ -197,13 +264,31 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
     if (CPP_STD_MODULES.includes(name)) {
       continue;
     }
-    let apkg = getOSPackageForFile(afile, osPkgsList) ||
-      epkgMap[`${group}/${name}`] || {
+    // The OS package list is shared by every header: a component taken from it
+    // is a copy, so the internal:PkgProvides the next header is matched against
+    // stays intact. A component the caller already listed is enriched in place
+    // and not listed again.
+    const osPkg = getOSPackageForFile(afile, osPkgsList);
+    const listedPkg = osPkg ? undefined : epkgMap[epkgKey(group, name)];
+    let apkg;
+    if (osPkg) {
+      const osRef = osPkg["bom-ref"] || osPkg.purl || osPkg.name;
+      apkg = osComponents.get(osRef);
+      if (!apkg) {
+        apkg = {
+          ...osPkg,
+          properties: (osPkg.properties || []).map((prop) => ({ ...prop })),
+        };
+        osComponents.set(osRef, apkg);
+      }
+    } else {
+      apkg = listedPkg || {
         name,
         group,
         version: "",
         type: pkgType,
       };
+    }
     // If this is a relative file, there is a good chance we can reuse the project group
     if (!afile.startsWith(_sep) && !group.length) {
       group = options.projectGroup || "";
@@ -253,36 +338,22 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
         )
         .map((v) => v.split(":")[0])
         .sort();
-      if (!apkg["properties"] && usymbols.length) {
-        apkg["properties"] = [
-          { name: "internal:ImportedSymbols", value: usymbols.join("|") },
-        ];
-      } else {
-        apkg["properties"] = [];
-      }
-      const newProps = [];
-      let symbolsPropertyFound = false;
-      for (const prop of apkg["properties"]) {
-        if (prop.name === "internal:ImportedSymbols") {
-          symbolsPropertyFound = true;
-          let existingSymbols = prop.value.split("|");
-          existingSymbols = existingSymbols.concat(usymbols);
-          prop.value = Array.from(new Set(existingSymbols)).sort().join("|");
-        }
-        newProps.push(prop);
+      if (usymbols.length) {
+        mergeImportedSymbols(apkg, usymbols);
       }
-      if (!symbolsPropertyFound && usymbols.length) {
-        apkg["properties"].push({
-          name: "internal:ImportedSymbols",
-          value: usymbols.join("|"),
-        });
-      }
-      apkg["properties"] = newProps;
     }
     // At this point, we have a package but we don't know what it's called
     // So let's try to locate this generic package using some heuristics
     apkg = locateGenericPackage(apkg);
-    if (!pkgAddedMap[name]) {
+    if (listedPkg) {
+      dependsOn.add(apkg["bom-ref"]);
+    } else if (osPkg) {
+      if (!addedRefs.has(apkg["bom-ref"])) {
+        pkgList.push(apkg);
+        dependsOn.add(apkg["bom-ref"]);
+        addedRefs.add(apkg["bom-ref"]);
+      }
+    } else if (!pkgAddedMap[name]) {
       pkgList.push(apkg);
       dependsOn.add(apkg["bom-ref"]);
       pkgAddedMap[name] = true;