@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/evinser/evinser.js

@@ -25,16 +25,30 @@ import {
   getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
+import {
+  analyzeKosiProject,
+  collectKosiApiEndpoints,
+  collectKosiEvidence,
+  collectKosiServices,
+  isKosiKotlinLanguage,
+  kosiWorkspaceComponent,
+  mergeKosiEvidence,
+} from "../ecosystems/kosi.js";
 import {
   analyzeRusiProject,
   collectRusiEvidence,
   isRusiRustLanguage,
 } from "../ecosystems/rusi.js";
 import {
+  atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
   filterAtomSlicesByExcludePatterns,
+  readReachablesSlices,
+  readSlicesFile,
+  removeReachablesChunkFiles,
 } from "../inventory/atomUtils.js";
+import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   collectDosaiCryptoComponents,
   findCryptoAlgos,
@@ -42,6 +56,7 @@ import {
 import { collectMvnDependencies } from "../inventory/deps.js";
 import { mergeServices } from "../inventory/depsUtils.js";
 import {
+  applyDosaiReachabilityEvidence,
   collectDosaiAiComponents,
   collectDosaiDataFlowFrames,
   collectDosaiPurlEvidence,
@@ -52,9 +67,12 @@ import {
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
+  readDosaiDataFlowReport,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
 import { executeOsQuery } from "../managers/binary.js";
+import { MAX_JSON_TEXT_BYTES, readJsonFile } from "../parsers/largeJson.js";
 import { postProcess } from "../stages/postgen/postgen.js";
 import { createOrLoad } from "./db.js";
 import { findPurlLocations } from "./scalasem.js";
@@ -86,10 +104,88 @@ function appendComponentProperties(component, properties = []) {
   }
 }
 
+/**
+ * Merges one analyzer run's metadata properties into the BOM's metadata
+ * component. Analyzer metadata describes a single run, so when the input BOM
+ * already carries facts from an earlier run (cdxgen --profile research, then
+ * evinse), everything under the analyzer's own `cdx:<analyzer>:` prefix is
+ * replaced. Replacing by exact name would keep facts the new run no longer
+ * emits, such as a cdx:rusi:requestedBackend left from a fallback run.
+ *
+ * @param {Object} component Metadata component to update in place
+ * @param {Object[]} metadataProperties Properties from the analyzer run
+ */
+export function mergeAnalyzerMetadataProperties(
+  component,
+  metadataProperties = [],
+) {
+  if (!component || !metadataProperties.length) {
+    return;
+  }
+  if (component.properties?.length) {
+    const analyzerPrefixes = [
+      ...new Set(
+        metadataProperties
+          .map((p) => /^cdx:[^:]+:/.exec(p.name)?.[0])
+          .filter(Boolean),
+      ),
+    ];
+    component.properties = component.properties.filter(
+      (p) => !analyzerPrefixes.some((prefix) => p.name?.startsWith(prefix)),
+    );
+  }
+  appendComponentProperties(component, metadataProperties);
+}
+
 function filterAtomSliceData(sliceData, options = {}) {
   return filterAtomSlicesByExcludePatterns(sliceData, options.exclude);
 }
 
+/**
+ * Build the options for the evinse phase (prepareDB, analyzeProject, and
+ * createEvinseFile) from the cdxgen CLI options.
+ *
+ * This object used to be assembled inline in bin/cdxgen.js, which dropped
+ * fields the analyzers read - most notably `exclude`, so every dosai and atom
+ * run triggered by `--evidence` ignored the user's `--exclude` patterns. Keep
+ * the wiring in one place so the forwarded fields stay testable.
+ *
+ * @param {Object} options CLI options
+ * @param {Object} args Parsed CLI arguments; `args._[0]` is the source directory
+ * @param {string} input Path of the BOM file the evinse phase enriches
+ * @returns {Object} Options for prepareDB, analyzeProject, and createEvinseFile
+ */
+export function buildEvinseOptions(options, args, input) {
+  const sourceDir = args._?.[0] || ".";
+  return {
+    _: args._,
+    input,
+    output: options.evinseOutput,
+    language: options.projectType,
+    skipMavenCollector: false,
+    force: false,
+    withReachables: options.deep,
+    usagesSlicesFile: options.usagesSlicesFile,
+    dataFlowSlicesFile: options.dataFlowSlicesFile,
+    reachablesSlicesFile: options.reachablesSlicesFile,
+    semanticsSlicesFile: options.semanticsSlicesFile,
+    openapiSpecFile: options.openapiSpecFile,
+    componentType: options.componentType,
+    includeCrypto:
+      options.includeCrypto &&
+      isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
+    specVersion: options.specVersion,
+    profile: options.profile,
+    jsonPretty: options.jsonPretty,
+    exclude: options.exclude,
+    // Absolute path of the deps slice createCsharpBom writes for --deep runs,
+    // so analyzeProject can reuse it instead of rerunning dosai methods.
+    depsSlicesFile: options.depsSlicesFile
+      ? resolve(sourceDir, options.depsSlicesFile)
+      : undefined,
+  };
+}
+
 /**
  * Function to create the db for the libraries referred in the sbom.
  *
@@ -434,6 +530,11 @@ export async function createSlice(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
   const atomFile = join(sliceOutputDir, `${language}-app.atom`);
+  if (sliceType === "reachables") {
+    // atom writes reachables in numbered chunks next to the slices file; one
+    // left by an earlier run must not be read back as part of this one.
+    removeReachablesChunkFiles(slicesFile);
+  }
   let args = [sliceType];
   // Support for crypto slices aka CBOM
   if (sliceType === "reachables" && options.includeCrypto) {
@@ -478,6 +579,7 @@ export async function createSlice(
     args.push("--slice-depth");
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
+  args.push(...atomCompileCommandsArgs(filePath, language, options));
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -588,8 +690,9 @@ export function purlToLanguage(purl, filePath) {
  * Seed purl-location and import maps from SBOM component evidence.
  *
  * Walks the supplied components reading `internal:ImportedModules` (or
- * `internal:Namespaces` for php/ruby) and `evidence.occurrences` properties
- * to construct lookup maps used during slice analysis.
+ * `internal:Namespaces` for php/ruby, plus the `internal:ImportedSymbols` the
+ * C/C++ collector records) and `evidence.occurrences` properties to construct
+ * lookup maps used during slice analysis.
  *
  * @param {Object[]} components CycloneDX components from the input SBOM
  * @param {string} language Application language used to select the import property name
@@ -614,10 +717,27 @@ export function initFromSbom(components, language) {
         .forEach((v) => {
           purlImportsMap[comp.purl] = (v.value || "").split(",");
         });
+      // A C/C++ component records the symbols the project uses from it, which
+      // are what C usages are matched against. The list is pipe-separated:
+      // C++ symbols may contain commas.
+      if (["c", "cpp", "c++"].includes(language)) {
+        (comp.properties || [])
+          .filter((v) => v.name === "internal:ImportedSymbols")
+          .forEach((v) => {
+            purlImportsMap[comp.purl] = (
+              purlImportsMap[comp.purl] || []
+            ).concat((v.value || "").split("|").filter(Boolean));
+          });
+      }
     }
     if (comp.evidence.occurrences) {
+      // Keep the `location#line` shape so a re-run over a cdxgen BOM does not
+      // degrade seeded occurrences to file-only entries and duplicate the
+      // richer locations the fresh slice merge adds to the same set.
       purlLocationMap[comp.purl] = new Set(
-        comp.evidence.occurrences.map((v) => v.location),
+        comp.evidence.occurrences.map((v) =>
+          v.line ? `${v.location}#${v.line}` : v.location,
+        ),
       );
     }
   }
@@ -639,6 +759,65 @@ function usableSlicesFile(slicesFile) {
   return fileSizeInBytes > 1024;
 }
 
+/**
+ * Load a semantics slices file for reuse when it belongs to this project.
+ *
+ * `--semantics-slices-file` defaults to `semantics.slices.json` in the working
+ * directory, which is shared by every project scanned from there and also
+ * receives the reports of other analyzers (dosai, rusi, golem). A file is
+ * only reused when its shape matches the language. Swift slices must also
+ * describe the same project directory and must not predate the input SBOM:
+ * `cdxgen --evidence` writes a fresh SBOM before evinse runs, so an older
+ * slice was made from an earlier state of the sources and is regenerated.
+ * Scala slices cannot be regenerated by evinse and are reused whenever their
+ * shape matches.
+ *
+ * @param {string} language Project language
+ * @param {string} slicesFile Candidate semantics slices file
+ * @param {string} bomFile Input SBOM
+ * @param {string} dirPath Project directory
+ * @returns {undefined|Object} Parsed slice when it can be reused
+ */
+export function loadReusableSemanticsSlice(
+  language,
+  slicesFile,
+  bomFile,
+  dirPath,
+) {
+  if (!usableSlicesFile(slicesFile)) {
+    return undefined;
+  }
+  let parsed;
+  try {
+    parsed = readJsonFile(slicesFile);
+  } catch (_e) {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return undefined;
+  }
+  if (!PROJECT_TYPE_ALIASES.swift.includes(language)) {
+    // Scala semantics slices are keyed by .scala source file names
+    return Object.keys(parsed).some((key) => key.endsWith(".scala"))
+      ? parsed
+      : undefined;
+  }
+  if (!(parsed.fileIndexes || parsed.buildSymbols || parsed.moduleInfos)) {
+    return undefined;
+  }
+  if (parsed.projectPath && resolve(parsed.projectPath) !== resolve(dirPath)) {
+    return undefined;
+  }
+  try {
+    if (fs.statSync(slicesFile).mtimeMs < fs.statSync(bomFile).mtimeMs) {
+      return undefined;
+    }
+  } catch (_e) {
+    // Without timestamps the shape and project checks decide
+  }
+  return parsed;
+}
+
 /**
  * Function to analyze the project
  *
@@ -724,6 +903,84 @@ export async function analyzeProject(dbObjMap, options) {
     };
   }
 
+  if (isKosiKotlinLanguage(language)) {
+    const kosiReports = analyzeKosiProject(dirPath, options);
+    if (kosiReports?.report && Object.keys(kosiReports.report).length) {
+      // The workspace component: cdxgen's Kotlin BOM carries no project
+      // component, so every workspace-anchored slice (reachability, the
+      // app's own flows) would have nothing to attach to. createEvinseFile
+      // re-reads the BOM from disk, so the candidate rides the artefacts
+      // instead of a mutation here — applied when the BOM lacks a project
+      // component OR carries one with no purl: every kosi evidence join is
+      // keyed by purl, so a purl-less component anchors nothing and is, for
+      // this purpose, no anchor at all (found on the sample app: Gradle
+      // identity with empty group and version "latest" emits no purl, and
+      // the reachableFromRoots/cryptoFlow evidence silently attached to
+      // nothing while the dependency-joined kinds landed).
+      const metadataComponentHasPurl = Boolean(
+        bomJson.metadata?.component?.purl,
+      );
+      let workspaceComponent;
+      if (!metadataComponentHasPurl) {
+        // kosi's modules[] holds the project's OWN Gradle/Maven modules
+        // (dependencies never appear there), so the project component is
+        // its root: the shortest modulePath, ties broken by name so the
+        // choice is deterministic. `workspaceMember` is not the selector —
+        // it is a String naming the owning workspace member in kosi's
+        // schema, empty for a single-module build and then omitted from the
+        // JSON entirely, so testing it against `undefined` picked nothing
+        // on exactly the single-module projects this fallback exists for.
+        const workspaceModule = (kosiReports.report.modules || [])
+          .filter((candidate) => candidate?.purl)
+          .sort(
+            (a, b) =>
+              (a.modulePath || "").length - (b.modulePath || "").length ||
+              (a.name || "").localeCompare(b.name || ""),
+          )[0];
+        if (workspaceModule?.purl) {
+          workspaceComponent = kosiWorkspaceComponent(workspaceModule);
+        }
+      }
+      const analysisComponents = [
+        bomJson.metadata?.component,
+        workspaceComponent,
+        ...components,
+      ].filter(Boolean);
+      const kosiEvidence = collectKosiEvidence(
+        kosiReports.report,
+        analysisComponents,
+      );
+      mergeKosiEvidence(
+        kosiEvidence,
+        collectKosiEvidence(
+          kosiReports.reachableReport || {},
+          analysisComponents,
+        ),
+      );
+      servicesMap = collectKosiServices(kosiReports.report, servicesMap);
+      // The INBOUND surface: the routes the app serves, with the
+      // authentication kosi found declared on them.
+      servicesMap = collectKosiApiEndpoints(kosiReports.report, servicesMap);
+      return {
+        purlLocationMap: kosiEvidence.purlLocationMap,
+        dataFlowFrames: kosiEvidence.dataFlowFrames,
+        componentPropertiesMap: kosiEvidence.componentPropertiesMap,
+        metadataProperties: kosiEvidence.metadataProperties,
+        cryptoComponents: kosiEvidence.cryptoComponents,
+        cryptoGeneratePurls: kosiEvidence.cryptoGeneratePurls,
+        servicesMap,
+        userDefinedTypesMap,
+        workspaceComponent,
+      };
+    }
+    return {
+      purlLocationMap,
+      servicesMap,
+      dataFlowFrames,
+      userDefinedTypesMap,
+    };
+  }
+
   if (isDosaiDotnetLanguage(language)) {
     if (options.profile === "research") {
       options.withDataFlow = true;
@@ -733,19 +990,32 @@ export async function analyzeProject(dbObjMap, options) {
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
-      usageSlice = JSON.parse(
-        fs.readFileSync(options.usagesSlicesFile, "utf-8"),
-      );
+      usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+    } else if (usableSlicesFile(options.depsSlicesFile)) {
+      // createCsharpBom already ran dosai methods on this tree for --deep runs
+      // and wrote the deps slice. For dosai, that output IS the usages slice,
+      // so reuse it instead of invoking dosai a second time.
+      if (DEBUG_MODE) {
+        console.log(
+          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+        );
+      }
+      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+      usagesSlicesFile = options.depsSlicesFile;
     } else {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        usageSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
+        usageSlice = readDosaiMethodsReport(retMap.slicesFile);
         usagesSlicesFile = retMap.slicesFile;
       }
     }
     if (usageSlice && Object.keys(usageSlice).length) {
       const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components);
+      // Confidence/evidence facts ride along as properties so an unbuilt tree (Low
+      // confidence, unresolved evidence) stays distinguishable from an only-imported
+      // package in the emitted BOM.
+      applyDosaiReachabilityEvidence(usageSlice, components);
       for (const [purl, locations] of Object.entries(
         dosaiEvidence.purlLocationMap,
       )) {
@@ -770,16 +1040,12 @@ export async function analyzeProject(dbObjMap, options) {
         safeExistsSync(options.dataFlowSlicesFile)
       ) {
         dataFlowSlicesFile = options.dataFlowSlicesFile;
-        dataFlowSlice = JSON.parse(
-          fs.readFileSync(options.dataFlowSlicesFile, "utf-8"),
-        );
+        dataFlowSlice = readDosaiDataFlowReport(options.dataFlowSlicesFile);
       } else {
         retMap = await createSlice(language, dirPath, "data-flow", options);
         if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
           dataFlowSlicesFile = retMap.slicesFile;
-          dataFlowSlice = JSON.parse(
-            fs.readFileSync(retMap.slicesFile, "utf-8"),
-          );
+          dataFlowSlice = readDosaiDataFlowReport(retMap.slicesFile);
         }
       }
       if (dataFlowSlice && Object.keys(dataFlowSlice).length) {
@@ -826,7 +1092,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       reachablesSlicesFile = options.reachablesSlicesFile;
       reachablesSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.reachablesSlicesFile, "utf-8")),
+        readReachablesSlices(options.reachablesSlicesFile),
         options,
       );
     } else {
@@ -834,7 +1100,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         reachablesSlicesFile = retMap.slicesFile;
         reachablesSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readReachablesSlices(retMap.slicesFile),
           options,
         );
       }
@@ -850,7 +1116,7 @@ export async function analyzeProject(dbObjMap, options) {
   // Reuse existing usages slices
   if (options.usagesSlicesFile && usableSlicesFile(options.usagesSlicesFile)) {
     usageSlice = filterAtomSliceData(
-      JSON.parse(fs.readFileSync(options.usagesSlicesFile, "utf-8")),
+      readSlicesFile(options.usagesSlicesFile, "usages"),
       options,
     );
     usagesSlicesFile = options.usagesSlicesFile;
@@ -859,7 +1125,7 @@ export async function analyzeProject(dbObjMap, options) {
     retMap = await createSlice(language, dirPath, "usages", options);
     if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+        readSlicesFile(retMap.slicesFile, "usages"),
         options,
       );
       usagesSlicesFile = retMap.slicesFile;
@@ -885,21 +1151,20 @@ export async function analyzeProject(dbObjMap, options) {
     components.length
   ) {
     // Reuse existing semantics slices for swift and scala
-    if (
-      options.semanticsSlicesFile &&
-      safeExistsSync(options.semanticsSlicesFile)
-    ) {
-      semanticsSlice = JSON.parse(
-        fs.readFileSync(options.semanticsSlicesFile, "utf-8"),
-      );
+    const reusableSlice = loadReusableSemanticsSlice(
+      language,
+      options.semanticsSlicesFile,
+      bomFile,
+      dirPath,
+    );
+    if (reusableSlice) {
+      semanticsSlice = reusableSlice;
       semanticsSlicesFile = options.semanticsSlicesFile;
     } else if (PROJECT_TYPE_ALIASES.swift.includes(language)) {
       // Generate our own slices for swift
       retMap = await createSlice(language, dirPath, "semantics", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        semanticsSlice = JSON.parse(
-          fs.readFileSync(retMap.slicesFile, "utf-8"),
-        );
+        semanticsSlice = readSlicesFile(retMap.slicesFile, "semantics");
         semanticsSlicesFile = retMap.slicesFile;
       }
     }
@@ -936,7 +1201,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       dataFlowSlicesFile = options.dataFlowSlicesFile;
       dataFlowSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.dataFlowSlicesFile, "utf-8")),
+        readSlicesFile(options.dataFlowSlicesFile, "data-flow"),
         options,
       );
     } else if (!PROJECT_TYPE_ALIASES.scala.includes(language)) {
@@ -944,7 +1209,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         dataFlowSlicesFile = retMap.slicesFile;
         dataFlowSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readSlicesFile(retMap.slicesFile, "data-flow"),
           options,
         );
       }
@@ -1303,6 +1568,14 @@ export async function parseSliceUsages(
 /**
  * Method to parse semantic slice data. Currently supported for swift and scala languages.
  *
+ * Swift slices created by cdxgen record, for every indexed source file, the
+ * lines that reference each dependency module (`moduleReferences`); the module
+ * of a reference is the declaring module recovered from the compiler-resolved
+ * USR. Components are mapped to their package's modules through the
+ * `packages` slice, so every occurrence is backed by a resolved reference.
+ * Slices without `moduleReferences` (created by older cdxgen versions) fall
+ * back to matching symbol names.
+ *
  * @param {String} language Project language.
  * @param {Array} components Components from the input SBOM
  * @param {Object} semanticsSlice Semantic slice data
@@ -1316,86 +1589,47 @@ export function parseSemanticSlices(language, components, semanticsSlice) {
   if (!components) {
     return undefined;
   }
-  const componentNamePurlMap = {};
-  const componentSymbolsMap = {};
-  const allObfuscationsMap = {};
-  // We have two attributes in the semantics slice to expand a given module to its constituent symbols
-  // - A less precise buildSymbols, which is obtained by parsing the various output-file-map.json files
-  // - A granular and precise moduleInfos, which has the exact classes, protocols, enums etc belonging to each module
-  // The objective then is to build the purlLocationMap, which is the list of locations where a given purl is used
-  // For this, we have two attributes:
-  // - A simpler fileStructures attribute that has the mapping between a swift file and the list of referenced types
-  // - A granular fileIndexes attribute that contains information about the clang modules and line number information
-
-  // We first need to map out the component names to their purls
-  // This is because the semantics slice use the module names everywhere
+  const fileIndexes = semanticsSlice?.fileIndexes || {};
+  const hasModuleReferences = Object.values(fileIndexes).some(
+    (afileIndex) => afileIndex?.moduleReferences,
+  );
+  const purlLocationsSet = {};
   for (const comp of components) {
-    componentNamePurlMap[comp.name] = comp.purl;
-    if (!componentSymbolsMap[comp.name]) {
-      componentSymbolsMap[comp.name] = new Set();
-    }
-    if (semanticsSlice?.buildSymbols[comp.name]) {
-      for (const asym of semanticsSlice.buildSymbols[comp.name]) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    const moduleInfo = semanticsSlice?.moduleInfos[comp.name] || {};
-    if (moduleInfo.classes) {
-      for (const asym of moduleInfo.classes) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.protocols) {
-      for (const asym of moduleInfo.protocols) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.enums) {
-      for (const asym of moduleInfo.enums) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
+    // Local packages and the root application have no purl, so there is
+    // nothing the evidence could be attached to downstream
+    if (!comp?.purl) {
+      continue;
     }
-    // Now collect the method signatures from class and protocol methods
-    if (moduleInfo.classMethods) {
-      for (const aclassName of Object.keys(moduleInfo.classMethods)) {
-        for (const asym of moduleInfo.classMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
-        }
-      }
+    const moduleNames = resolveSwiftComponentModules(comp, semanticsSlice);
+    if (!moduleNames.size) {
+      continue;
     }
-    if (moduleInfo.protocolMethods) {
-      for (const aclassName of Object.keys(moduleInfo.protocolMethods)) {
-        for (const asym of moduleInfo.protocolMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
+    const locations = purlLocationsSet[comp.purl] || new Set();
+    if (hasModuleReferences) {
+      for (const [aswiftFile, afileIndex] of Object.entries(fileIndexes)) {
+        for (const [amodule, lines] of Object.entries(
+          afileIndex?.moduleReferences || {},
+        )) {
+          if (!moduleNames.has(amodule)) {
+            continue;
+          }
+          for (const aline of lines) {
+            locations.add(`${aswiftFile}#${aline}`);
+          }
         }
       }
-    }
-    // Build a large obfuscation map
-    if (moduleInfo.obfuscationMap) {
-      for (const asym of Object.keys(moduleInfo.obfuscationMap)) {
-        allObfuscationsMap[asym] = moduleInfo.obfuscationMap[asym];
-      }
-    }
-  }
-  const purlLocationsSet = {};
-  // We now have a good set of data in componentSymbolsMap and allObfuscationsMap
-  // We can iterate these symbols and check if they exist under fileIndexes.symbolLocations
-  for (const compName of Object.keys(componentSymbolsMap)) {
-    const compSymbols = Array.from(componentSymbolsMap[compName]);
-    const searchHits = searchSymbolLocations(
-      compSymbols,
-      semanticsSlice?.fileIndexes,
-    );
-    // We have an occurrence hit. Let's populate the purlLocationMap
-    if (searchHits?.length) {
-      const locations =
-        purlLocationsSet[componentNamePurlMap[compName]] || new Set();
-      for (const ahit of searchHits) {
+    } else {
+      for (const ahit of searchSymbolLocations(
+        collectLegacySwiftSymbols(moduleNames, semanticsSlice),
+        fileIndexes,
+      )) {
         for (const aline of ahit.lineNumbers) {
           locations.add(`${ahit.file}#${aline}`);
         }
       }
-      purlLocationsSet[componentNamePurlMap[compName]] = locations;
+    }
+    if (locations.size) {
+      purlLocationsSet[comp.purl] = locations;
     }
   }
   const purlLocationMap = {};
@@ -1405,22 +1639,184 @@ export function parseSemanticSlices(language, components, semanticsSlice) {
   return { purlLocationMap };
 }
 
-function searchSymbolLocations(compSymbols, fileIndexes) {
-  const searchHits = [];
-  if (!fileIndexes) {
+/**
+ * Normalise a repository location or Swift purl into `host/owner/name`.
+ *
+ * @param {String} value Repository URL, scp-style git location, or swift purl
+ * @returns {undefined|String} Lowercase `host/path` without scheme and `.git`
+ */
+function normalizeSwiftPackageLocation(value) {
+  if (!value || typeof value !== "string") {
     return undefined;
   }
-  for (const aswiftFile of Object.keys(fileIndexes)) {
-    if (!fileIndexes[aswiftFile].symbolLocations) {
+  let text = value.trim();
+  if (text.startsWith("pkg:swift/")) {
+    text = text.slice("pkg:swift/".length).split("?")[0].split("#")[0];
+    const at = text.lastIndexOf("@");
+    if (at > 0) {
+      text = text.slice(0, at);
+    }
+    try {
+      text = decodeURIComponent(text);
+    } catch (_e) {
+      // Keep the raw value
+    }
+  } else {
+    text = text.split("?")[0].split("#")[0];
+    const scheme = text.indexOf("://");
+    if (scheme >= 0) {
+      text = text.slice(scheme + 3);
+      // Drop userinfo such as git@
+      const slash = text.indexOf("/");
+      const at = text.indexOf("@");
+      if (at >= 0 && (slash < 0 || at < slash)) {
+        text = text.slice(at + 1);
+      }
+    } else if (text.includes("@") && text.includes(":")) {
+      // scp-style git@github.com:owner/name.git
+      text = text.slice(text.indexOf("@") + 1).replace(":", "/");
+    } else {
+      return undefined;
+    }
+  }
+  text = text.replace(/\/+$/, "");
+  if (text.endsWith(".git")) {
+    text = text.slice(0, -4);
+  }
+  if (text.startsWith("www.")) {
+    text = text.slice(4);
+  }
+  return text.toLowerCase() || undefined;
+}
+
+/**
+ * Resolve the Swift module names that belong to a SBOM component.
+ *
+ * A component is named after its package repository or identity while the
+ * semantic slices are keyed by module names. With the `packages` slice, a
+ * package cloned from a repository matches the component whose purl names
+ * the same repository, so a fork with the same name never inherits another
+ * package's evidence; registry and local packages, which have no repository
+ * URL, match by identity or name. Older slices only carry the
+ * `packageModules` aliases (identity, package name, repository name), which
+ * are matched against the component name and the `cdx:swift:packageName`
+ * property, so that `swift-argument-parser` resolves to its `ArgumentParser`
+ * module.
+ *
+ * @param {Object} comp SBOM component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Set<string>} Module names associated with the component
+ */
+function resolveSwiftComponentModules(comp, semanticsSlice) {
+  const moduleNames = new Set();
+  if (!comp?.name) {
+    return moduleNames;
+  }
+  const aliases = new Set(
+    [comp.name, getPropertyValue(comp, "cdx:swift:packageName")]
+      .filter(Boolean)
+      .map((alias) => String(alias).toLowerCase()),
+  );
+  if (Array.isArray(semanticsSlice?.packages)) {
+    const componentLocation = normalizeSwiftPackageLocation(comp.purl);
+    for (const apkg of semanticsSlice.packages) {
+      const packageLocation = normalizeSwiftPackageLocation(apkg?.location);
+      const matches =
+        packageLocation && componentLocation
+          ? packageLocation === componentLocation
+          : [apkg?.identity, apkg?.name].some(
+              (alias) => alias && aliases.has(String(alias).toLowerCase()),
+            );
+      if (matches) {
+        for (const amodule of apkg.modules || []) {
+          moduleNames.add(amodule);
+        }
+      }
+    }
+    return moduleNames;
+  }
+  const packageModules = semanticsSlice?.packageModules || {};
+  for (const alias of new Set([comp.name, ...aliases])) {
+    if (Array.isArray(packageModules[alias])) {
+      for (const amodule of packageModules[alias]) {
+        moduleNames.add(amodule);
+      }
+    }
+  }
+  // Modules named after the package (Yams, SWXMLHash) still match
+  if (!moduleNames.size) {
+    moduleNames.add(comp.name);
+  }
+  return moduleNames;
+}
+
+function getPropertyValue(comp, propertyName) {
+  for (const aproperty of comp?.properties || []) {
+    if (aproperty?.name === propertyName) {
+      return aproperty.value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Collect the symbol names of a component's modules from slices that predate
+ * `moduleReferences`, using the moduleInfos data and the coarser buildSymbols
+ * derived from the build's output file maps.
+ *
+ * @param {Set<String>} moduleNames Module names of the component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Object} `{ symbols, freeFunctions }` name sets
+ */
+function collectLegacySwiftSymbols(moduleNames, semanticsSlice) {
+  const symbols = new Set();
+  const freeFunctions = new Set();
+  for (const moduleName of moduleNames) {
+    for (const asym of semanticsSlice?.buildSymbols?.[moduleName] || []) {
+      symbols.add(asym);
+    }
+    const moduleInfo = semanticsSlice?.moduleInfos?.[moduleName] || {};
+    for (const asym of [
+      ...(moduleInfo.classes || []),
+      ...(moduleInfo.protocols || []),
+      ...(moduleInfo.enums || []),
+    ]) {
+      symbols.add(asym);
+    }
+    for (const methods of [
+      ...Object.values(moduleInfo.classMethods || {}),
+      ...Object.values(moduleInfo.protocolMethods || {}),
+    ]) {
+      for (const asym of methods || []) {
+        symbols.add(asym);
+      }
+    }
+    for (const asym of moduleInfo.functions || []) {
+      freeFunctions.add(asym);
+    }
+  }
+  return { symbols, freeFunctions };
+}
+
+function searchSymbolLocations(componentSymbols, fileIndexes) {
+  const searchHits = [];
+  const { symbols, freeFunctions } = componentSymbols;
+  for (const aswiftFile of Object.keys(fileIndexes || {})) {
+    const symbolLocations = fileIndexes[aswiftFile]?.symbolLocations;
+    if (!symbolLocations) {
       continue;
     }
-    for (const asym of Object.keys(fileIndexes[aswiftFile].symbolLocations)) {
-      const lineNumbers = fileIndexes[aswiftFile].symbolLocations[asym];
-      if (compSymbols.includes(asym)) {
+    for (const asym of Object.keys(symbolLocations)) {
+      // The index records free functions by their full selector
+      // (`dump(object:canonical:...)`) while module interfaces give the base
+      // name. Only top-level functions are matched by base name: members such
+      // as `encode(to:)` exist in nearly every module
+      const baseName = asym.includes("(") ? asym.split("(")[0] : undefined;
+      if (symbols.has(asym) || (baseName && freeFunctions.has(baseName))) {
         searchHits.push({
           file: aswiftFile,
           symbol: asym,
-          lineNumbers,
+          lineNumbers: symbolLocations[asym],
         });
       }
     }
@@ -1833,6 +2229,7 @@ export async function createEvinseFile(sliceArtefacts, options) {
     cryptoComponents,
     aiComponents,
     cryptoGeneratePurls,
+    workspaceComponent,
   } = sliceArtefacts;
   const bomFile = options.input;
   const evinseOutFile = options.output;
@@ -1840,7 +2237,22 @@ export async function createEvinseFile(sliceArtefacts, options) {
   const components = bomJson.components || [];
   // Clear existing annotations
   bomJson.annotations = [];
-  appendComponentProperties(bomJson.metadata?.component, metadataProperties);
+  if (workspaceComponent && !bomJson.metadata?.component?.purl) {
+    if (bomJson.metadata?.component) {
+      // A purl-less project component: keep cdxgen's own identity fields
+      // and supply the purl kosi's module discovery published, so the
+      // evidence loop below can anchor workspace evidence to it.
+      bomJson.metadata.component.purl = workspaceComponent.purl;
+      bomJson.metadata.component["bom-ref"] ??= workspaceComponent.purl;
+    } else {
+      bomJson.metadata ??= {};
+      bomJson.metadata.component = workspaceComponent;
+    }
+  }
+  mergeAnalyzerMetadataProperties(
+    bomJson.metadata?.component,
+    metadataProperties,
+  );
   let occEvidencePresent = false;
   let csEvidencePresent = false;
   let servicesPresent = false;
@@ -1899,8 +2311,15 @@ export async function createEvinseFile(sliceArtefacts, options) {
     servicesPresent = true;
   }
   // Add the crypto components to the components list
+  // Multi-type scans may have collected the same crypto assets during BOM
+  // generation, so skip any bom-ref already present to keep the BOM valid.
   if (cryptoComponents?.length) {
-    bomJson.components = bomJson.components.concat(cryptoComponents);
+    const existingRefs = new Set(
+      bomJson.components.map((comp) => comp["bom-ref"]).filter(Boolean),
+    );
+    bomJson.components = bomJson.components.concat(
+      cryptoComponents.filter((comp) => !existingRefs.has(comp["bom-ref"])),
+    );
   }
   // Add the AI components (machine-learning-model, dataset) discovered by dosai
   if (aiComponents?.length) {
@@ -1925,28 +2344,27 @@ export async function createEvinseFile(sliceArtefacts, options) {
     bomJson.dependencies = newDependencies;
   }
   if (options.annotate) {
-    if (usagesSlicesFile && safeExistsSync(usagesSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(usagesSlicesFile, "utf8"),
-      });
-    }
-    if (dataFlowSlicesFile && safeExistsSync(dataFlowSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(dataFlowSlicesFile, "utf8"),
-      });
-    }
-    if (reachablesSlicesFile && safeExistsSync(reachablesSlicesFile)) {
+    for (const slicesFile of [
+      usagesSlicesFile,
+      dataFlowSlicesFile,
+      reachablesSlicesFile,
+    ]) {
+      if (!slicesFile || !safeExistsSync(slicesFile)) {
+        continue;
+      }
+      // The annotation embeds the slice as one string, which a file this
+      // large cannot become.
+      if (fs.statSync(slicesFile).size > MAX_JSON_TEXT_BYTES) {
+        console.warn(
+          `Not annotating the BOM with the slices file "${slicesFile}", which is too large to embed as text.`,
+        );
+        continue;
+      }
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },
         timestamp: getTimestamp(),
-        text: fs.readFileSync(reachablesSlicesFile, "utf8"),
+        text: fs.readFileSync(slicesFile, "utf8"),
       });
     }
   }