@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/inventory/depsUtils.js

@@ -215,6 +215,112 @@ export function propagateRequiredScopeFromDependencies(
   return components;
 }
 
+function isTypeOnlyExcludedComponent(component) {
+  if (component?.scope !== "excluded") {
+    return false;
+  }
+  return (
+    isNpmTypesOnlyComponent(component) ||
+    (component.properties || []).some(
+      (property) =>
+        property.name === "cdx:npm:package:type-only" &&
+        property.value === "true",
+    )
+  );
+}
+
+/**
+ * Scopes the dependencies of type-only npm packages as optional.
+ *
+ * A package imported only for its TypeScript types, like an `@types` package,
+ * is erased at compile time, and so is what it depends on unless a runtime
+ * package depends on it too. A component below a type-only package becomes
+ * optional when no dependency path from a root of the graph reaches it without
+ * passing through a type-only package. A component that already has a scope,
+ * from its manifest or from usage evidence, keeps it.
+ *
+ * @param {Object[]} components CycloneDX component objects
+ * @param {Object[]} dependencies CycloneDX dependency entries
+ * @returns {Object[]} The same component array with scopes updated in place
+ */
+export function markTypeOnlyDependenciesOptional(
+  components = [],
+  dependencies = [],
+) {
+  if (!components?.length || !dependencies?.length) {
+    return components;
+  }
+  const componentByRef = new Map();
+  const typeOnlyRefs = new Set();
+  for (const component of components) {
+    for (const ref of [component?.["bom-ref"], component?.purl]) {
+      if (!ref) {
+        continue;
+      }
+      const normalizedRef = normalizeBomRef(ref);
+      componentByRef.set(normalizedRef, component);
+      if (isTypeOnlyExcludedComponent(component)) {
+        typeOnlyRefs.add(normalizedRef);
+      }
+    }
+  }
+  if (!typeOnlyRefs.size) {
+    return components;
+  }
+  const childrenByRef = new Map();
+  const dependentRefs = new Set();
+  for (const dependency of dependencies) {
+    const ref = normalizeBomRef(dependency?.ref);
+    if (!ref) {
+      continue;
+    }
+    if (!childrenByRef.has(ref)) {
+      childrenByRef.set(ref, new Set());
+    }
+    for (const dependsOnRef of dependency.dependsOn || []) {
+      const childRef = normalizeBomRef(dependsOnRef);
+      if (childRef && childRef !== ref) {
+        childrenByRef.get(ref).add(childRef);
+        dependentRefs.add(childRef);
+      }
+    }
+  }
+  const walk = (startRefs) => {
+    const seen = new Set();
+    const stack = [...startRefs];
+    while (stack.length) {
+      const ref = stack.pop();
+      if (seen.has(ref)) {
+        continue;
+      }
+      seen.add(ref);
+      for (const childRef of childrenByRef.get(ref) || []) {
+        if (!typeOnlyRefs.has(childRef)) {
+          stack.push(childRef);
+        }
+      }
+    }
+    return seen;
+  };
+  // Every ref nothing depends on is a root, so a partial graph errs towards
+  // keeping a component rather than scoping it optional.
+  const runtimeRefs = walk(
+    [...childrenByRef.keys()].filter(
+      (ref) => !dependentRefs.has(ref) && !typeOnlyRefs.has(ref),
+    ),
+  );
+  for (const ref of walk(typeOnlyRefs)) {
+    if (typeOnlyRefs.has(ref) || runtimeRefs.has(ref)) {
+      continue;
+    }
+    const component = componentByRef.get(ref);
+    if (component && !component.scope) {
+      component.scope = "optional";
+    }
+  }
+  return components;
+}
+
 function serviceIdentityKey(service) {
   if (service?.["bom-ref"]) {
     return service["bom-ref"].toLowerCase();
@@ -395,6 +501,71 @@ export function mergeServices(services, newServices) {
   return Array.from(serviceMap.values());
 }
 
+// Descriptive fields, each listed with the raw spellings that collectors set
+// before component conversion. Conversion prefers the converted `licenses`
+// over a raw `license`, and a raw `author` over `authors`, so a field is only
+// filled in, under the spelling the duplicate uses, when the retained
+// component has no spelling of it.
+const DESCRIPTIVE_FIELDS = [
+  ["description"],
+  ["publisher"],
+  ["copyright"],
+  ["authors", "author"],
+  ["licenses", "license"],
+];
+
+const hasFieldValue = (value) =>
+  value !== undefined &&
+  value !== null &&
+  value !== "" &&
+  !(Array.isArray(value) && !value.length);
+
+/**
+ * Carry the descriptive metadata of a duplicate sighting over to the retained
+ * component. A lockfile is usually parsed first and knows only the identity,
+ * while a manifest seen later, such as a gemspec, knows the description,
+ * authors, licenses, and project links (discussion 4389).
+ *
+ * The retained sighting keeps its own values. Lists are not unioned because
+ * two sightings spell the same fact differently: one license as an SPDX id and
+ * as a name, or as an expression that must never share the `licenses` array
+ * with license objects. External references are unioned, since each one is a
+ * distinct link.
+ *
+ * @param {object} existingComponent Retained component, updated in place
+ * @param {object} comp Duplicate sighting of the same component
+ */
+function mergeDescriptiveFields(existingComponent, comp) {
+  for (const spellings of DESCRIPTIVE_FIELDS) {
+    if (
+      spellings.some((spelling) => hasFieldValue(existingComponent[spelling]))
+    ) {
+      continue;
+    }
+    const spelling = spellings.find((aspelling) =>
+      hasFieldValue(comp[aspelling]),
+    );
+    if (spelling) {
+      existingComponent[spelling] = comp[spelling];
+    }
+  }
+  if (!comp.externalReferences?.length) {
+    return;
+  }
+  // A copy, as the array may be shared with another sighting
+  const existingRefs = [...(existingComponent.externalReferences || [])];
+  for (const newref of comp.externalReferences) {
+    if (
+      !existingRefs.some(
+        (ref) => ref.type === newref.type && ref.url === newref.url,
+      )
+    ) {
+      existingRefs.push(newref);
+    }
+  }
+  existingComponent.externalReferences = existingRefs;
+}
+
 /**
  * Trim duplicate components by retaining all the properties
  *
@@ -403,18 +574,21 @@ export function mergeServices(services, newServices) {
  * @returns {Array} Filtered components
  */
 export function trimComponents(components) {
-  const keyCache = {};
-  const filteredComponents = [];
+  // The keys come from the scanned manifests. In a plain object, a key such as
+  // `__proto__` would resolve to Object.prototype and the merge below would
+  // write to it.
+  const keyCache = new Map();
   for (const comp of components) {
     const key = (
       comp.purl ||
       comp["bom-ref"] ||
       comp.name + comp.version
     ).toLowerCase();
-    if (!keyCache[key]) {
-      keyCache[key] = comp;
+    if (!keyCache.has(key)) {
+      keyCache.set(key, comp);
     } else {
-      const existingComponent = keyCache[key];
+      const existingComponent = keyCache.get(key);
+      mergeDescriptiveFields(existingComponent, comp);
       // We need to retain any properties that differ
       if (comp.properties) {
         if (existingComponent.properties) {
@@ -530,10 +704,7 @@ export function trimComponents(components) {
       }
     }
   }
-  for (const akey of Object.keys(keyCache)) {
-    filteredComponents.push(keyCache[akey]);
-  }
-  return filteredComponents;
+  return Array.from(keyCache.values());
 }
 
 /**
@@ -603,7 +774,8 @@ export function isPartialTree(dependencies, componentsCount = 1) {
   let isCbom = false;
   let parentsWithChildsCount = 0;
   for (const adep of dependencies) {
-    if (adep?.dependsOn.length > 0) {
+    // Producers such as protobuf omit empty dependsOn lists
+    if (adep?.dependsOn?.length > 0) {
       parentsWithChildsCount++;
     }
     if (!isCbom && adep?.provides?.length > 0) {
@@ -640,7 +812,7 @@ export function recomputeScope(pkgList, dependencies) {
   }
   for (const adep of dependencies) {
     if (requiredPkgs[adep.ref]) {
-      for (const ado of adep.dependsOn) {
+      for (const ado of adep.dependsOn || []) {
         requiredPkgs[ado] = true;
       }
     }

package/lib/inventory/display.js

@@ -1,4 +1,3 @@
-import { readFileSync } from "node:fs";
 import path from "node:path";
 import process from "node:process";
 
@@ -11,6 +10,7 @@ import {
 import { safeExistsSync } from "../core/fs.js";
 import { toCamel } from "../core/paths.js";
 import { detectAiModelVariants } from "./aiModelVariants.js";
+import { readReachablesSlices } from "./atomUtils.js";
 import { formatOccurrenceEvidence } from "./evidenceUtils.js";
 import {
   formatHbomHardwareClassSummary,
@@ -1407,12 +1407,11 @@ export function printReachables(sliceArtefacts) {
     return;
   }
   const purlCounts = {};
-  const reachablesSlices = JSON.parse(
-    readFileSync(reachablesSlicesFile, "utf-8"),
-  );
+  const reachablesSlices = readReachablesSlices(reachablesSlicesFile);
+  // undefined when the slices file was unreadable; readReachablesSlices warned.
   const rflows = Array.isArray(reachablesSlices)
     ? reachablesSlices
-    : reachablesSlices.reachables || [];
+    : reachablesSlices?.reachables || [];
   for (const areachable of rflows) {
     const purls = areachable.purls || [];
     for (const apurl of purls) {