@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/ecosystems/parsers-misc.js

@@ -41,11 +41,24 @@ import {
   mapConanPkgRefToPurlStringAndNameAndVersion,
   nixGenericPurl,
   purlFromUrlString,
+  tryBuildPurl,
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
+import { cmakeFetchDependencies } from "../parsers/cmakeLists.js";
+import { submodulePurlCoordinates } from "../parsers/gitmodules.js";
 import { getDartMetadata } from "./ecosystems.js";
 import { parsePkgJson } from "./parsers-js.js";
 
+/**
+ * Upper bound for a flake.nix `inputs = { ... }` block before the input-name
+ * patterns are applied. The patterns backtrack quadratically, so an unbounded
+ * attacker-crafted block is a CPU denial of service; genuine inputs blocks are
+ * a few kilobytes at most.
+ *
+ * @type {number}
+ */
+const MAX_FLAKE_INPUTS_BLOCK_LENGTH = 16 * 1024;
+
 /**
  * Method to parse pubspec.lock files.
  *
@@ -1205,19 +1218,41 @@ export function parseFlakeNix(flakeNixFile) {
     let match;
     while ((match = inputsRegex.exec(flakeContent)) !== null) {
       const inputBlock = match[0];
+      // The name-run patterns below backtrack quadratically over unbounded
+      // blocks, so a crafted flake.nix could burn minutes of CPU. Real flake
+      // inputs blocks are a few KB; anything larger is skipped.
+      if (inputBlock.length > MAX_FLAKE_INPUTS_BLOCK_LENGTH) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Skipping a suspiciously large inputs block (${inputBlock.length} chars) in ${flakeNixFile}.`,
+          );
+        }
+        continue;
+      }
 
-      // Match different input patterns including nested inputs
+      // Match different input patterns including nested inputs. The cheap
+      // substring pre-checks keep URL-less blocks linear.
       const inputPatterns = [
-        /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\.url\s*=\s*"([^"]+)"/g,
-        /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\s*=\s*\{\s*url\s*=\s*"([^"]+)"[^}]*}/gs,
+        {
+          regex: /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\.url\s*=\s*"([^"]+)"/g,
+          probe: ".url",
+        },
+        {
+          regex:
+            /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\s*=\s*\{\s*url\s*=\s*"([^"]+)"[^}]*}/gs,
+          probe: "url",
+        },
       ];
 
       const addedPackages = new Set();
 
       for (const pattern of inputPatterns) {
+        if (!inputBlock.includes(pattern.probe)) {
+          continue;
+        }
         let subMatch;
-        pattern.lastIndex = 0;
-        while ((subMatch = pattern.exec(inputBlock)) !== null) {
+        pattern.regex.lastIndex = 0;
+        while ((subMatch = pattern.regex.exec(inputBlock)) !== null) {
           const name = subMatch[1];
           const url = subMatch[2] || subMatch[3];
 
@@ -1779,7 +1814,7 @@ export function parseSwiftJsonTreeObject(
       group: purl ? purl.namespace : "",
       version: purl ? purl.version : jsonObject.version,
     },
-    purl ? decodeURIComponent(purl.toString()) : null,
+    purl ? purl.toString() : null,
     jsonObject.name,
   );
   const properties = [];
@@ -1885,15 +1920,23 @@ export function parseSwiftResolved(resolvedFile) {
       }
       for (const adep of resolvedList) {
         const locationOrUrl = adep.location || adep.repositoryURL;
-        const version = adep.state.version || adep.state.revision;
+        const version = adep.state?.version || adep.state?.revision;
+        // A pin with no remote URL (a local checkout) has no valid swift
+        // namespace, so it becomes a component without a purl instead of
+        // aborting the rest of the file.
         const purl = purlFromUrlString("swift", locationOrUrl, version);
-        const purlString = decodeURIComponent(purl.toString());
+        const name =
+          purl?.name ||
+          adep.identity ||
+          adep.package ||
+          (locationOrUrl ? basename(locationOrUrl).replace(/\.git$/, "") : "");
+        if (!name) {
+          continue;
+        }
         const rootPkg = {
-          name: purl.name,
-          group: purl.namespace,
-          version: purl.version,
-          purl: purlString,
-          "bom-ref": purlString,
+          name,
+          group: purl?.namespace || "",
+          version: purl ? purl.version : version,
           properties: [
             {
               name: "internal:SrcFile",
@@ -1902,7 +1945,7 @@ export function parseSwiftResolved(resolvedFile) {
           ],
           evidence: {
             identity: {
-              field: "purl",
+              field: purl ? "purl" : "name",
               confidence: 1,
               methods: [
                 {
@@ -1914,6 +1957,7 @@ export function parseSwiftResolved(resolvedFile) {
             },
           },
         };
+        applyPurl(rootPkg, purl ? purl.toString() : null);
         if (locationOrUrl) {
           rootPkg.repository = { url: locationOrUrl };
         }
@@ -1926,6 +1970,281 @@ export function parseSwiftResolved(resolvedFile) {
   return pkgList;
 }
 
+/**
+ * Compute the bom-ref of a `swift package show-dependencies` node the same
+ * way parseSwiftJsonTreeObject does.
+ *
+ * @param {Object} node show-dependencies node
+ * @returns {undefined|string} bom-ref
+ */
+function swiftTreeNodeRef(node) {
+  if (node?.url?.startsWith("http")) {
+    const purl = purlFromUrlString("swift", node.url, node.version);
+    if (purl) {
+      return decodeURIComponent(purl.toString());
+    }
+  }
+  return node?.name;
+}
+
+function swiftTreeNodeKeys(node) {
+  const repoName = (node?.url || "")
+    .split("?")[0]
+    .replace(/\/+$/, "")
+    .split("/")
+    .pop()
+    ?.replace(/\.git$/, "");
+  return [node?.identity, node?.name, repoName]
+    .filter(Boolean)
+    .map((k) => String(k).toLowerCase());
+}
+
+// Target types that are part of what the package builds and ships
+const SWIFT_PRODUCTION_TARGET_TYPES = new Set([
+  "executable",
+  "macro",
+  "plugin",
+]);
+
+/**
+ * Identify the targets of a Swift package that are part of what it ships.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests,
+ * such as snapshot or fixture helper libraries.
+ *
+ * @param {Object} dumpJson `swift package dump-package` document
+ * @returns {Set<string>} Lowercase names of the production targets
+ */
+export function collectSwiftProductionTargets(dumpJson) {
+  const targets = dumpJson?.targets || [];
+  const targetsByName = new Map(
+    targets.map((t) => [String(t?.name || "").toLowerCase(), t]),
+  );
+  const localTargetRefs = (target) => {
+    const refs = [];
+    for (const adep of target?.dependencies || []) {
+      const name = adep?.target?.[0] ?? adep?.byName?.[0];
+      if (name && targetsByName.has(String(name).toLowerCase())) {
+        refs.push(String(name).toLowerCase());
+      }
+    }
+    return refs;
+  };
+  const productTargets = new Set(
+    (dumpJson?.products || []).flatMap((p) =>
+      (p?.targets || []).map((t) => String(t).toLowerCase()),
+    ),
+  );
+  const referencedTargets = new Set(targets.flatMap((t) => localTargetRefs(t)));
+  const productionTargets = new Set();
+  const stack = targets
+    .filter(
+      (t) =>
+        !isSwiftTestTarget(t) &&
+        (productTargets.has(String(t.name).toLowerCase()) ||
+          SWIFT_PRODUCTION_TARGET_TYPES.has(t.type) ||
+          !referencedTargets.has(String(t.name).toLowerCase())),
+    )
+    .map((t) => String(t.name).toLowerCase());
+  while (stack.length) {
+    const name = stack.pop();
+    if (productionTargets.has(name)) {
+      continue;
+    }
+    productionTargets.add(name);
+    stack.push(...localTargetRefs(targetsByName.get(name)));
+  }
+  return productionTargets;
+}
+
+/**
+ * Classify the dependencies of a Swift package into the packages its shipped
+ * code needs and the packages only its tests need.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests
+ * (test-support libraries). A package is test-only when only test and
+ * test-support targets reference its products or use its plugins. With the dependency graph from
+ * `swift package show-dependencies`, the packages reachable only through
+ * test-only packages are test-only as well; a package reachable from a
+ * production dependency, or from a declared dependency no target references,
+ * stays required.
+ *
+ * Target dependencies reference products either as
+ * `{"product": [name, package]}` or `{"byName": [name]}`; SwiftPM resolves a
+ * `byName` product through the package of the same name. When a production
+ * `byName` reference names neither a local target nor a package, the
+ * classification is abandoned rather than risking a required package being
+ * scoped optional.
+ *
+ * @param {Object|String} dumpJson `swift package dump-package` document, parsed or as text
+ * @param {Object|String} [treeJson] `swift package show-dependencies --format json` document, parsed or as text
+ * @returns {Object} `{ optionalRefs, requiredRefs, optionalNames, requiredNames }`:
+ *   bom-refs from the dependency graph, and lowercase package identities,
+ *   names, and repository names (the only result without a graph)
+ */
+export function classifySwiftDependencyScopes(dumpJson, treeJson) {
+  // Command output may be handed over unparsed
+  const parseJson = (value) => {
+    if (typeof value !== "string") {
+      return value;
+    }
+    try {
+      return JSON.parse(value);
+    } catch (_e) {
+      return undefined;
+    }
+  };
+  dumpJson = parseJson(dumpJson);
+  treeJson = parseJson(treeJson);
+  const empty = {
+    optionalRefs: new Set(),
+    requiredRefs: new Set(),
+    optionalNames: new Set(),
+    requiredNames: new Set(),
+  };
+  const targets = dumpJson?.targets || [];
+  if (!targets.length) {
+    return empty;
+  }
+  const targetsByName = new Map(
+    targets.map((t) => [String(t?.name || "").toLowerCase(), t]),
+  );
+  const productionTargets = collectSwiftProductionTargets(dumpJson);
+  const packageKeys = (target) => {
+    const keys = [];
+    const unresolved = [];
+    for (const adep of target?.dependencies || []) {
+      if (adep?.product) {
+        keys.push(String(adep.product[1] ?? adep.product[0]).toLowerCase());
+      } else if (adep?.byName?.[0]) {
+        const name = String(adep.byName[0]).toLowerCase();
+        if (!targetsByName.has(name)) {
+          unresolved.push(name);
+        }
+      }
+    }
+    // Build tool plugins count for the target that uses them, so a plugin
+    // used only by test targets is test-only
+    for (const ausage of target?.pluginUsages || []) {
+      if (ausage?.plugin?.[1]) {
+        keys.push(String(ausage.plugin[1]).toLowerCase());
+      }
+    }
+    return { keys, unresolved };
+  };
+  const directNodes = treeJson?.dependencies || [];
+  const nodesByKey = new Map();
+  for (const node of directNodes) {
+    for (const key of swiftTreeNodeKeys(node)) {
+      if (!nodesByKey.has(key)) {
+        nodesByKey.set(key, node);
+      }
+    }
+  }
+  const prodKeys = new Set();
+  const testKeys = new Set();
+  for (const target of targets) {
+    const isProduction =
+      !isSwiftTestTarget(target) &&
+      productionTargets.has(String(target.name).toLowerCase());
+    const { keys, unresolved } = packageKeys(target);
+    const bucket = isProduction ? prodKeys : testKeys;
+    for (const key of keys) {
+      bucket.add(key);
+    }
+    for (const name of unresolved) {
+      // byName products resolve through the package of the same name
+      if (!treeJson || nodesByKey.has(name)) {
+        bucket.add(name);
+      } else if (isProduction) {
+        return empty;
+      }
+    }
+  }
+  if (!treeJson) {
+    return {
+      ...empty,
+      optionalNames: new Set([...testKeys].filter((k) => !prodKeys.has(k))),
+      requiredNames: prodKeys,
+    };
+  }
+  // Package graph keyed by bom-ref
+  const childrenByRef = new Map();
+  const keysByRef = new Map();
+  const collectGraph = (node) => {
+    const ref = swiftTreeNodeRef(node);
+    if (!ref || childrenByRef.has(ref)) {
+      return ref;
+    }
+    childrenByRef.set(ref, new Set());
+    keysByRef.set(ref, swiftTreeNodeKeys(node));
+    for (const child of node?.dependencies || []) {
+      const childRef = collectGraph(child);
+      if (childRef) {
+        childrenByRef.get(ref).add(childRef);
+      }
+    }
+    return ref;
+  };
+  const prodRoots = [];
+  const testRoots = [];
+  for (const node of directNodes) {
+    const ref = collectGraph(node);
+    const keys = swiftTreeNodeKeys(node);
+    const usedByProduction = keys.some((k) => prodKeys.has(k));
+    const usedByTests = keys.some((k) => testKeys.has(k));
+    if (usedByTests && !usedByProduction) {
+      testRoots.push(ref);
+    } else {
+      // Production dependencies, and declared dependencies no target uses
+      prodRoots.push(ref);
+    }
+  }
+  const reach = (roots) => {
+    const seen = new Set();
+    const pending = [...roots];
+    while (pending.length) {
+      const ref = pending.pop();
+      if (!ref || seen.has(ref)) {
+        continue;
+      }
+      seen.add(ref);
+      pending.push(...(childrenByRef.get(ref) || []));
+    }
+    return seen;
+  };
+  const requiredRefs = reach(prodRoots);
+  const optionalRefs = new Set(
+    [...reach(testRoots)].filter((ref) => !requiredRefs.has(ref)),
+  );
+  // Components from Package.resolved can carry a different version or URL
+  // spelling than the graph, so the package names are reported as well
+  const namesOf = (refs) =>
+    new Set([...refs].flatMap((ref) => keysByRef.get(ref) || []));
+  return {
+    optionalRefs,
+    requiredRefs,
+    optionalNames: namesOf(optionalRefs),
+    requiredNames: namesOf(requiredRefs),
+  };
+}
+
+/**
+ * Decide whether a dump-package target is a test target. The `type` field is
+ * usually the string `"test"`, but manifest APIs have also been observed
+ * representing it as an object.
+ *
+ * @param {Object} atarget dump-package target
+ * @returns {boolean} `true` for test targets
+ */
+export function isSwiftTestTarget(atarget) {
+  return atarget?.type === "test" || atarget?.type?.test === true;
+}
+
 /**
  * Parse a CMake-generated dot/graphviz file and extract components and their dependency
  * relationships.
@@ -2046,12 +2365,256 @@ export function parseCmakeDotFile(dotFile, pkgType, options = {}) {
   };
 }
 
+/** CMake `URL_HASH` algorithm names, their CycloneDX spelling and hex length. */
+const CMAKE_HASH_ALGORITHMS = {
+  MD5: ["MD5", 32],
+  SHA1: ["SHA-1", 40],
+  SHA256: ["SHA-256", 64],
+  SHA384: ["SHA-384", 96],
+  SHA512: ["SHA-512", 128],
+  SHA3_256: ["SHA3-256", 64],
+  SHA3_384: ["SHA3-384", 96],
+  SHA3_512: ["SHA3-512", 128],
+};
+
+/** Keywords of the CMake `find_*` commands; they are never package names. */
+const CMAKE_FIND_KEYWORDS = new Set([
+  "BYPASS_PROVIDER",
+  "CMAKE_FIND_ROOT_PATH_BOTH",
+  "COMPONENTS",
+  "CONFIG",
+  "CONFIGS",
+  "DOC",
+  "ENV",
+  "EXACT",
+  "GLOBAL",
+  "HINTS",
+  "MODULE",
+  "NAMES",
+  "NAMES_PER_DIR",
+  "NO_CACHE",
+  "NO_CMAKE_BUILDS_PATH",
+  "NO_CMAKE_ENVIRONMENT_PATH",
+  "NO_CMAKE_FIND_ROOT_PATH",
+  "NO_CMAKE_INSTALL_PREFIX",
+  "NO_CMAKE_PACKAGE_REGISTRY",
+  "NO_CMAKE_PATH",
+  "NO_CMAKE_SYSTEM_PACKAGE_REGISTRY",
+  "NO_CMAKE_SYSTEM_PATH",
+  "NO_DEFAULT_PATH",
+  "NO_MODULE",
+  "NO_PACKAGE_ROOT_PATH",
+  "NO_POLICY_SCOPE",
+  "NO_SYSTEM_ENVIRONMENT_PATH",
+  "ONLY_CMAKE_FIND_ROOT_PATH",
+  "OPTIONAL",
+  "OPTIONAL_COMPONENTS",
+  "PATHS",
+  "PATH_SUFFIXES",
+  "QUIET",
+  "REGISTRY_VIEW",
+  "REQUIRED",
+  "VALIDATOR",
+]);
+
+const CMAKE_FIND_COMMANDS = new Set([
+  "find_package",
+  "find_library",
+  "find_dependency",
+  "find_file",
+]);
+
+/**
+ * A download URL that is safe to publish: http(s) or ftp only, with any user
+ * information, query string and fragment removed.
+ *
+ * @param {string} url URL as written in the build file
+ * @returns {string|undefined} The cleaned URL, or undefined when it is not one
+ */
+function publishableDownloadUrl(url) {
+  if (!url || url.includes("${")) {
+    return undefined;
+  }
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:", "ftp:"].includes(parsed.protocol)) {
+      return undefined;
+    }
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The repository and version of a GitHub source archive URL:
+ * `https://github.com/<owner>/<repo>/archive/<ref>.zip` (also `refs/tags/...`
+ * and `.tar.gz`) and
+ * `https://github.com/<owner>/<repo>/releases/download/<tag>/<file>`.
+ *
+ * @param {string} url Download URL
+ * @returns {{owner: string, repo: string, version: string}|undefined}
+ */
+function githubArchiveCoordinates(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  if (parsed.hostname !== "github.com") {
+    return undefined;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 4) {
+    return undefined;
+  }
+  const [owner, repo, section, ...rest] = segments;
+  let version;
+  if (section === "archive") {
+    let ref = rest.join("/");
+    for (const prefix of ["refs/tags/", "refs/heads/"]) {
+      if (ref.startsWith(prefix)) {
+        ref = ref.slice(prefix.length);
+      }
+    }
+    for (const ext of [".tar.gz", ".tar.bz2", ".tar.xz", ".tgz", ".zip"]) {
+      if (ref.endsWith(ext)) {
+        ref = ref.slice(0, -ext.length);
+        break;
+      }
+    }
+    version = ref;
+  } else if (section === "releases" && rest[0] === "download" && rest[1]) {
+    version = rest[1];
+  }
+  if (!version) {
+    return undefined;
+  }
+  return { owner, repo: repo.replace(/\.git$/, ""), version };
+}
+
+/**
+ * The source archive of the WrapDB release a Meson dependency name resolved to,
+ * as a distribution reference carrying the archive's hash. The hash describes
+ * that release's archive, which is not known to be the version the project
+ * builds, so it belongs to the reference rather than to the component.
+ *
+ * @param {Object} awrap WrapDB entry
+ * @returns {Object|undefined} External reference, or undefined without a URL
+ */
+function wrapDbReference(awrap) {
+  const url = publishableDownloadUrl(awrap?.analyzed_source_url);
+  if (!url) {
+    return undefined;
+  }
+  const reference = {
+    type: "distribution",
+    url,
+    comment:
+      `WrapDB release ${awrap.name_with_version || awrap.analyzed_version || ""}`.trim(),
+  };
+  if (/^[0-9a-fA-F]{64}$/.test(awrap.analyzed_source_hash || "")) {
+    reference.hashes = [
+      { alg: "SHA-256", content: awrap.analyzed_source_hash.toLowerCase() },
+    ];
+  }
+  return reference;
+}
+
+/**
+ * The component for a dependency a CMake file downloads at configure time
+ * (`FetchContent_Declare`, `ExternalProject_Add`, `CPMAddPackage`).
+ *
+ * A git repository becomes a `github` purl, or a `generic` one with a
+ * `vcs_url`, at its tag or commit. A GitHub archive URL becomes a `github` purl
+ * at the ref it names. Any other URL becomes a `generic` purl with a
+ * `download_url`, and a `URL_HASH` becomes a hash. A version that still holds an
+ * unresolved `${VAR}` is left out rather than published.
+ *
+ * @param {Object} dep Dependency facts from `cmakeFetchDependencies`
+ * @param {string} srcFile The CMake file the dependency was read from
+ * @returns {Object} The component
+ */
+export function cmakeFetchDependencyComponent(dep, srcFile) {
+  const resolved = (value) =>
+    value && !value.includes("${") ? value : undefined;
+  let version = resolved(dep.gitTag) || resolved(dep.version);
+  let coords;
+  const gitUrl = publishableDownloadUrl(dep.gitRepository);
+  const downloadUrl = publishableDownloadUrl(dep.url);
+  if (gitUrl) {
+    coords = submodulePurlCoordinates(gitUrl, version);
+  } else if (downloadUrl) {
+    const archive = githubArchiveCoordinates(downloadUrl);
+    if (archive) {
+      version = version || archive.version;
+      coords = {
+        type: "github",
+        namespace: archive.owner,
+        name: archive.repo,
+        version,
+      };
+    } else {
+      coords = {
+        type: "generic",
+        name: dep.name,
+        version: version || null,
+        qualifiers: { download_url: downloadUrl },
+      };
+    }
+  }
+  const purl =
+    (coords && tryBuildPurl(coords)) ||
+    tryBuildPurl({ type: "generic", name: dep.name, version: version || null });
+  const confidence = version ? 0.6 : 0.3;
+  const component = {
+    name: dep.name,
+    version: version || "",
+    type: "library",
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence,
+            value: `Filename ${srcFile}`,
+          },
+        ],
+      },
+    },
+    properties: [
+      { name: "cdx:cmake:depKind", value: dep.kind },
+      { name: "cdx:cmake:resolvedVia", value: "cmake-lists" },
+    ],
+  };
+  applyPurl(component, purl, `library:${dep.name}:${version || ""}`);
+  const [alg, content] = (dep.urlHash || "").split("=");
+  const [cdxAlg, hexLength] = CMAKE_HASH_ALGORITHMS[alg?.toUpperCase()] || [];
+  if (
+    cdxAlg &&
+    content?.length === hexLength &&
+    /^[0-9a-fA-F]+$/.test(content)
+  ) {
+    component.hashes = [{ alg: cdxAlg, content: content.toLowerCase() }];
+  }
+  return component;
+}
+
 /**
  * Parse a CMake-like build file (CMakeLists.txt, meson.build, etc.) and extract the
  * parent component and list of dependency packages.
  *
  * Handles `set`, `project`, `find_package`, `find_library`, `find_dependency`,
- * `find_file`, `FetchContent_MakeAvailable`, and `dependency()` directives.
+ * `find_file` and `dependency()` directives (CMake command names in any case),
+ * and, for CMake files, the dependencies downloaded at configure time by
+ * `FetchContent_Declare`, `ExternalProject_Add` and `CPMAddPackage`.
  * Uses the MesonWrapDB to improve name resolution confidence.
  *
  * @param {string} cmakeListFile Path to the CMake-like build file
@@ -2060,13 +2623,30 @@ export function parseCmakeDotFile(dotFile, pkgType, options = {}) {
  * @returns {{ parentComponent: Object, pkgList: Object[] }}
  */
 export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
-  let cmakeListData = readFileSync(cmakeListFile, { encoding: "utf-8" });
+  const rawData = readFileSync(cmakeListFile, { encoding: "utf-8" });
+  let cmakeListData = rawData;
   const pkgList = [];
   const pkgAddedMap = {};
   const versionSpecifiersMap = {};
   const versionsMap = {};
   let parentComponent = {};
   const templateValues = {};
+  // A dependency fetched at configure time is the same package a find_package()
+  // of the same name asks for: the fetched component, with its source and pin,
+  // stands for both.
+  const fetchedNames = new Set();
+  if (!basename(cmakeListFile).startsWith("meson")) {
+    const fetchedRefs = new Set();
+    for (const dep of cmakeFetchDependencies(rawData)) {
+      const component = cmakeFetchDependencyComponent(dep, cmakeListFile);
+      if (fetchedRefs.has(component["bom-ref"])) {
+        continue;
+      }
+      fetchedRefs.add(component["bom-ref"]);
+      fetchedNames.add(dep.name.toLowerCase());
+      pkgList.push(component);
+    }
+  }
   cmakeListData = cmakeListData
     .replace(/^ {2}/g, "")
     .replace(/\(\r\n/g, "(")
@@ -2081,138 +2661,129 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
     const group = "";
     const path = undefined;
     const name_list = [];
-    if (l.startsWith("set")) {
-      const tmpA = l.replace("set(", "").replace(")", "").trim().split(" ");
+    // CMake command names are case-insensitive: `PROJECT(...)` and
+    // `Find_Package(...)` are the same commands as their lower-case spellings.
+    const openParen = l.indexOf("(");
+    const command =
+      openParen > 0 ? l.slice(0, openParen).trim().toLowerCase() : "";
+    let commandArgs = openParen > 0 ? l.slice(openParen + 1) : "";
+    if (command === "set") {
+      const tmpA = commandArgs.replace(")", "").trim().split(" ");
       if (tmpA && tmpA.length === 2) {
         templateValues[tmpA[0]] = tmpA[1];
       }
-    } else if (
-      l.startsWith("project") &&
-      !Object.keys(parentComponent).length
-    ) {
-      if (l.includes("${")) {
+    } else if (command === "project" && !Object.keys(parentComponent).length) {
+      if (commandArgs.includes("${")) {
         for (const tmplKey of Object.keys(templateValues)) {
-          l = l.replace(`\${${tmplKey}}`, templateValues[tmplKey] || "");
+          commandArgs = commandArgs.replace(
+            `\${${tmplKey}}`,
+            templateValues[tmplKey] || "",
+          );
         }
       }
-      const tmpA = l.replace("project (", "project(").split("project(");
-      if (tmpA && tmpA.length > 1) {
-        const tmpB = (tmpA[1] || "")
-          .trim()
-          .replace(/["']/g, "")
-          .replace(/ /g, ",")
-          .split(")")[0]
-          .split(",")
-          .filter((v) => v.length > 1);
-        const parentName =
-          tmpB.length > 0 ? tmpB[0].replace(":", "").trim() : "";
-        let parentVersion;
-        // In case of meson.build we can find the version number after the word version
-        // thanks to our replaces and splits
-        const versionIndex = tmpB.findIndex(
-          (v) => v?.toLowerCase() === "version",
+      const tmpB = commandArgs
+        .trim()
+        .replace(/["']/g, "")
+        .replace(/ /g, ",")
+        .split(")")[0]
+        .split(",")
+        .filter((v) => v.length > 1);
+      const parentName = tmpB.length > 0 ? tmpB[0].replace(":", "").trim() : "";
+      let parentVersion;
+      // In case of meson.build we can find the version number after the word version
+      // thanks to our replaces and splits
+      const versionIndex = tmpB.findIndex(
+        (v) => v?.toLowerCase() === "version",
+      );
+      if (versionIndex > -1 && tmpB.length > versionIndex) {
+        parentVersion = tmpB[versionIndex + 1];
+      }
+      // A `${VAR}` that no `set()` in this file defines stays literal. It is
+      // not a version, and percent-encoding it into a purl publishes the
+      // variable name as the version, so the field is left empty instead.
+      // CMakeCache.txt carries the evaluated value when a build tree exists.
+      if (parentVersion?.includes("$")) {
+        parentVersion = undefined;
+      }
+      if (parentName?.length && !parentName.includes("$")) {
+        parentComponent = {
+          group: options.projectGroup || "",
+          name: parentName,
+          version: parentVersion || options.projectVersion || "",
+          type: "application",
+        };
+        const safePath = path ? path.replace(/^\/+/, "") : null;
+        parentComponent["purl"] = build({
+          type: pkgType,
+          namespace: parentComponent.group || null,
+          name: parentComponent.name,
+          version: parentComponent.version || null,
+          subpath: safePath,
+        });
+        parentComponent["bom-ref"] = decodeURIComponent(
+          parentComponent["purl"],
         );
-        if (versionIndex > -1 && tmpB.length > versionIndex) {
-          parentVersion = tmpB[versionIndex + 1];
-        }
-        // A `${VAR}` that no `set()` in this file defines stays literal. It is
-        // not a version, and percent-encoding it into a purl publishes the
-        // variable name as the version, so the field is left empty instead.
-        // CMakeCache.txt carries the evaluated value when a build tree exists.
-        if (parentVersion?.includes("$")) {
-          parentVersion = undefined;
-        }
-        if (parentName?.length && !parentName.includes("$")) {
-          parentComponent = {
-            group: options.projectGroup || "",
-            name: parentName,
-            version: parentVersion || options.projectVersion || "",
-            type: "application",
-          };
-          const safePath = path ? path.replace(/^\/+/, "") : null;
-          parentComponent["purl"] = build({
-            type: pkgType,
-            namespace: parentComponent.group || null,
-            name: parentComponent.name,
-            version: parentComponent.version || null,
-            subpath: safePath,
-          });
-          parentComponent["bom-ref"] = decodeURIComponent(
-            parentComponent["purl"],
-          );
-        }
       }
-    } else if (l.startsWith("find_")) {
-      let tmpA = [];
-      for (const fm of [
-        "find_package(",
-        "find_library(",
-        "find_dependency(",
-        "find_file(",
-        "FetchContent_MakeAvailable(",
-      ]) {
-        if (l.startsWith(fm)) {
-          tmpA = l.split(fm);
-          break;
+    } else if (CMAKE_FIND_COMMANDS.has(command)) {
+      let tmpB = commandArgs.split(")")[0].split(" ");
+      tmpB = tmpB.filter(
+        (v) =>
+          !CMAKE_FIND_KEYWORDS.has(v) &&
+          !v.includes("$") &&
+          !v.startsWith("CMAKE_") &&
+          v.length,
+      );
+      // find_package(Catch2)
+      // find_package(GTest REQUIRED)
+      // find_package(Boost 1.79 COMPONENTS date_time)
+      // find_library(PTHREADPOOL_LIB pthreadpool REQUIRED)
+      // find_library and find_file name the cache variable that receives the
+      // result in their first argument, so that argument is a destination
+      // rather than a package. Every other command in this list opens with a
+      // package name, including names such as `ZLIB` that read like a
+      // variable.
+      // Their names are the values after NAMES, or else the one argument after
+      // the variable; the remaining arguments are search paths and options.
+      if (command === "find_library" || command === "find_file") {
+        const tokens = commandArgs
+          .split(")")[0]
+          .split(" ")
+          .filter((v) => v.length);
+        const namesAt = tokens.indexOf("NAMES");
+        let names = tokens.slice(1, 2);
+        if (namesAt > -1) {
+          names = [];
+          for (const token of tokens.slice(namesAt + 1)) {
+            if (CMAKE_FIND_KEYWORDS.has(token)) {
+              break;
+            }
+            names.push(token);
+          }
         }
+        tmpB = names.filter((v) => !v.includes("$") && !v.startsWith("CMAKE_"));
       }
-      if (tmpA && tmpA.length > 1) {
-        let tmpB = tmpA[1].split(")")[0].split(" ");
-        tmpB = tmpB.filter(
-          (v) =>
-            ![
-              "REQUIRED",
-              "COMPONENTS",
-              "QUIET",
-              "NAMES",
-              "PATHS",
-              "ENV",
-              "NO_MODULE",
-              "NO_DEFAULT_PATH",
-            ].includes(v) &&
-            !v.includes("$") &&
-            !v.startsWith("CMAKE_") &&
-            v.length,
-        );
-        // find_package(Catch2)
-        // find_package(GTest REQUIRED)
-        // find_package(Boost 1.79 COMPONENTS date_time)
-        // find_library(PTHREADPOOL_LIB pthreadpool REQUIRED)
-        // find_library and find_file name the cache variable that receives the
-        // result in their first argument, so that argument is a destination
-        // rather than a package. Every other command in this list opens with a
-        // package name, including names such as `ZLIB` that read like a
-        // variable.
-        if (l.startsWith("find_library") || l.startsWith("find_file")) {
-          tmpB = tmpB.slice(1);
-        }
-        if (tmpB.length) {
-          const working_name = tmpB[0];
-          name_list.push(working_name);
-          if (l.startsWith("find_package") && tmpB.length > 1) {
-            if (
-              /^\d+/.test(tmpB[1]) &&
-              !tmpB[1].includes("${") &&
-              !tmpB[1].startsWith("@")
-            ) {
-              versionsMap[working_name] = tmpB[1];
+      if (tmpB.length) {
+        const working_name = tmpB[0];
+        name_list.push(working_name);
+        if (command === "find_package" && tmpB.length > 1) {
+          if (
+            /^\d+/.test(tmpB[1]) &&
+            !tmpB[1].includes("${") &&
+            !tmpB[1].startsWith("@")
+          ) {
+            versionsMap[working_name] = tmpB[1];
+          }
+        } else {
+          for (const n of tmpB) {
+            if (n.match(/^\d/)) {
+              continue;
             }
-          } else {
-            for (const n of tmpB) {
-              if (n.match(/^\d/)) {
-                continue;
-              }
-              if (n.includes(_sep)) {
-                if (
-                  n.includes(".so") ||
-                  n.includes(".a") ||
-                  n.includes(".dll")
-                ) {
-                  name_list.push(basename(n));
-                }
-              } else {
-                name_list.push(n);
+            if (n.includes(_sep)) {
+              if (n.includes(".so") || n.includes(".a") || n.includes(".dll")) {
+                name_list.push(basename(n));
               }
+            } else {
+              name_list.push(n);
             }
           }
         }
@@ -2244,10 +2815,12 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
     for (let n of name_list) {
       const props = [];
       let confidence = 0;
+      let wrapReference;
       if (
         n &&
         n.length > 1 &&
         !pkgAddedMap[n] &&
+        !fetchedNames.has(n.toLowerCase()) &&
         !n.startsWith(_sep) &&
         !n.startsWith("@")
       ) {
@@ -2262,14 +2835,18 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
           ) {
             // Use the new name
             n = wrapkey;
-            for (const eprop of Object.keys(awrap)) {
+            wrapReference = wrapDbReference(awrap);
+            props.push({ name: "cdx:meson:wrapdb:wrap", value: wrapkey });
+            if (awrap.analyzed_version) {
               props.push({
-                name: eprop,
-                value: Array.isArray(awrap[eprop])
-                  ? awrap[eprop].join("|")
-                  : awrap[eprop],
+                name: "cdx:meson:wrapdb:latestVersion",
+                value: awrap.analyzed_version,
               });
             }
+            props.push({
+              name: "internal:PkgProvides",
+              value: awrap.PkgProvides.join("|"),
+            });
             // Our confidence has improved from 0 since there is a matching wrap so we know the correct name
             // and url. We lack the version details.
             confidence = 0.5;
@@ -2320,6 +2897,9 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
           },
           properties: props,
         };
+        if (wrapReference) {
+          apkg.externalReferences = [wrapReference];
+        }
         apkg["bom-ref"] = decodeURIComponent(apkg["purl"]);
         pkgList.push(apkg);
         pkgAddedMap[n] = true;
@@ -2349,41 +2929,48 @@ export function parseCUsageSlice(sliceData) {
     return undefined;
   }
   const usageData = {};
-  try {
-    const objectSlices = sliceData.objectSlices || [];
-    for (const slice of objectSlices) {
+  const objectSlices = sliceData.objectSlices || [];
+  for (const slice of objectSlices) {
+    // One malformed slice must not cost the slices after it.
+    try {
+      const fileName = slice?.fileName || "";
+      const isInclude = (slice?.code || "").startsWith("#include");
       if (
-        (!slice.fileName && !slice.code.startsWith("#include")) ||
-        slice.fileName.startsWith("<includes") ||
-        slice.fileName.startsWith("<global") ||
-        slice.fileName.includes("__")
+        (!fileName && !isInclude) ||
+        fileName.startsWith("<includes") ||
+        fileName.startsWith("<global") ||
+        fileName.includes("__")
       ) {
         continue;
       }
-      const slFileName = slice.fileName;
-      const allLines = usageData[slFileName] || new Set();
+      const allLines = (fileName && usageData[fileName]) || new Set();
       if (slice.fullName && slice.fullName.length > 3) {
-        if (slice.code?.startsWith("#include")) {
-          usageData[slice.fullName] = new Set();
+        if (isInclude) {
+          // an included file keeps the symbols already recorded for it
+          usageData[slice.fullName] = usageData[slice.fullName] || new Set();
         } else {
           allLines.add(slice.fullName);
         }
       }
-      for (const ausage of slice.usages) {
-        let calls = ausage?.invokedCalls || [];
-        calls = calls.concat(ausage?.argToCalls || []);
+      for (const ausage of slice.usages || []) {
+        const calls = (ausage?.invokedCalls || []).concat(
+          ausage?.argToCalls || [],
+        );
         for (const acall of calls) {
-          if (!acall.resolvedMethod.includes("->")) {
-            allLines.add(acall.resolvedMethod);
+          const resolvedMethod = acall?.resolvedMethod;
+          if (resolvedMethod && !resolvedMethod.includes("->")) {
+            allLines.add(resolvedMethod);
           }
         }
       }
-      if (Array.from(allLines).length) {
-        usageData[slFileName] = allLines;
+      if (fileName && allLines.size) {
+        usageData[fileName] = allLines;
       }
+    } catch (err) {
+      thoughtLog("Skipping a C usage slice that could not be read.", {
+        error: err?.message,
+      });
     }
-  } catch (_err) {
-    // ignore
   }
   return usageData;
 }
@@ -3203,3 +3790,174 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.externalReferences = externalRefs;
   }
 }
+
+/**
+ * Parse an xmake `xmake-requires.lock` file.
+ *
+ * The lock is a Lua table, written when the `package.requires_lock` policy is
+ * enabled. Its top level holds a `__meta__` entry plus one section per build
+ * configuration, keyed `platform|arch`; each section maps a requirement key
+ * (`"zlib#31fecfc4"`, or `"sol2 v3.2.1#72267bd5"` when the requirement
+ * carries a version) to a table with the resolved `version` and the
+ * `repo` revision the package definition came from.
+ *
+ * The same package appears once per configuration, so entries are collapsed
+ * by name and version, and the configurations a package was resolved for are
+ * kept as a property. A requirement key without a `version` field names a
+ * system package xmake did not resolve; it is inventoried without a version.
+ *
+ * No `xmake` purl type is registered, so packages are identified as generic
+ * carrying a `cdx:purl:proposedType=xmake` property, following the
+ * convention used for nix and zig.
+ *
+ * @param {string} lockFile Path to `xmake-requires.lock`
+ * @returns {Object[]} Package records for the pinned requirements
+ */
+export function parseXmakeRequiresLock(lockFile) {
+  let text;
+  try {
+    text = readFileSync(lockFile, "utf-8");
+  } catch (error) {
+    console.warn(`Failed to read ${lockFile}: ${error.message}`);
+    return [];
+  }
+  const byKey = new Map();
+  // The outermost `{` is the file's own table, so a configuration section
+  // opens at depth 1 and a requirement inside it at depth 2. Each is dropped
+  // again once the brace depth falls back to where it opened.
+  const CONFIGURATION_DEPTH = 1;
+  const REQUIREMENT_DEPTH = 2;
+  let configuration;
+  let requirement;
+  let depth = 0;
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith("--")) {
+      continue;
+    }
+    // `["macosx|arm64"] = {` opens a configuration; `["zlib#hash"] = {` opens
+    // a requirement inside one.
+    const opener = line.match(/^\[\s*"([^"]+)"\s*\]\s*=\s*\{/u);
+    if (opener && depth === CONFIGURATION_DEPTH) {
+      // `__meta__` is normally written unquoted, but a lock that quotes it
+      // must not become a configuration section either.
+      configuration = opener[1] === "__meta__" ? undefined : opener[1];
+    } else if (opener && depth === REQUIREMENT_DEPTH && configuration) {
+      requirement = xmakeRequirementName(opener[1]);
+      const key = `${configuration}|${requirement}`;
+      if (requirement && !byKey.has(key)) {
+        byKey.set(key, { name: requirement, configuration });
+      }
+    } else if (!opener && configuration && requirement) {
+      const version = line.match(/^version\s*=\s*"([^"]*)"/u);
+      if (version) {
+        const record = byKey.get(`${configuration}|${requirement}`);
+        if (record) {
+          record.version = version[1];
+        }
+      }
+    }
+    depth = Math.max(0, depth + countXmakeBraces(line));
+    if (depth <= REQUIREMENT_DEPTH) {
+      requirement = undefined;
+    }
+    if (depth <= CONFIGURATION_DEPTH) {
+      configuration = undefined;
+    }
+  }
+
+  // Collapse the per-configuration entries into one component per resolved
+  // coordinate, listing the configurations it was resolved for.
+  const merged = new Map();
+  for (const record of byKey.values()) {
+    const key = `${record.name}@${record.version || ""}`;
+    const existing = merged.get(key);
+    if (existing) {
+      existing.configurations.add(record.configuration);
+      continue;
+    }
+    merged.set(key, {
+      name: record.name,
+      version: record.version,
+      configurations: new Set([record.configuration]),
+    });
+  }
+
+  const pkgList = [];
+  for (const record of merged.values()) {
+    // A malformed coordinate in an untrusted lock costs one entry, not the
+    // whole scan.
+    const purl = tryBuildPurl({
+      type: "generic",
+      namespace: "xmake",
+      name: record.name,
+      version: record.version || null,
+    });
+    if (!purl) {
+      continue;
+    }
+    pkgList.push({
+      name: record.name,
+      ...(record.version ? { version: record.version } : {}),
+      type: "library",
+      scope: "required",
+      purl,
+      "bom-ref": decodeURIComponent(purl),
+      properties: [
+        { name: "internal:SrcFile", value: lockFile },
+        { name: "cdx:purl:proposedType", value: "xmake" },
+        {
+          name: "cdx:xmake:configurations",
+          value: [...record.configurations].sort().join(", "),
+        },
+      ],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 0.5,
+          methods: [
+            {
+              technique: "source-code-analysis",
+              confidence: 0.5,
+              value: `Filename ${lockFile}`,
+            },
+          ],
+        },
+      },
+    });
+  }
+  return pkgList;
+}
+
+/**
+ * Reduce an xmake requirement key to the package name.
+ *
+ * Keys look like `zlib#31fecfc4` or `sol2 v3.2.1#72267bd5`: the trailing
+ * `#<hash>` identifies the resolved configuration and the optional second
+ * token is the requested version range, neither of which is the name.
+ *
+ * @param {string} key Requirement key as written in the lock
+ * @returns {string|undefined} Package name
+ */
+function xmakeRequirementName(key) {
+  const name = key.split("#")[0].trim().split(/\s+/u)[0];
+  return name || undefined;
+}
+
+/**
+ * Net brace change contributed by one line of a Lua table.
+ *
+ * @param {string} line Line to scan
+ * @returns {number} Opens minus closes
+ */
+function countXmakeBraces(line) {
+  let delta = 0;
+  for (const char of line) {
+    if (char === "{") {
+      delta += 1;
+    } else if (char === "}") {
+      delta -= 1;
+    }
+  }
+  return delta;
+}