@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/cli/cliOptions.js

@@ -15,6 +15,10 @@ import { join, resolve } from "node:path";
 
 import { isSecureMode, readEnvironmentVariable } from "../core/activity.js";
 import { PROJECT_TYPE_ALIASES } from "../core/env.js";
+import {
+  METADATA_PROPERTY_CONFIG_KEYS,
+  parseMetadataProperties,
+} from "../core/metadataProperties.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
   normalizeCycloneDxComponentTypeFilter,
@@ -120,6 +124,80 @@ export function isUserProvided(value, yaDefault) {
   return value !== undefined && value !== yaDefault;
 }
 
+/**
+ * Combine the custom metadata properties of every source (discussion 4391):
+ * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
+ * CDXGEN_METADATA_PROPERTIES environment variables, and a config file's
+ * `metadata-property` or `metadataProperties` entry.
+ *
+ * yargs would let the highest-precedence source replace the others outright,
+ * so each is read on its own and they are merged instead. A name set by more
+ * than one source takes its values from the one that wins in the usual order
+ * — the command line, then the environment, then the config file — while a
+ * source may repeat a name for a multi-valued property.
+ *
+ * @param {object} args Parsed yargs argv
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments, which tell a
+ *   flag on the command line from one yargs filled in from elsewhere
+ * @param {object} [context.projectConfig] The sanitized config file contents.
+ *   Without it, a programmatic caller's `args` are taken as the config.
+ * @returns {{name: string, value: string}[]} The merged properties
+ */
+export function resolveMetadataProperties(
+  args,
+  { argv = process.argv, projectConfig } = {},
+) {
+  const flagGiven = argv.some((argument) =>
+    ["--metadata-property", "--metadataProperty"].includes(
+      `${argument}`.split("=")[0],
+    ),
+  );
+  const fromConfig = projectConfig
+    ? METADATA_PROPERTY_CONFIG_KEYS.flatMap((key) =>
+        parseMetadataProperties(projectConfig[key]),
+      )
+    : flagGiven
+      ? []
+      : [
+          ...parseMetadataProperties(args?.metadataProperty),
+          ...parseMetadataProperties(args?.metadataProperties),
+        ];
+  const sources = [
+    flagGiven ? parseMetadataProperties(args?.metadataProperty) : [],
+    [
+      ...parseMetadataProperties(
+        readEnvironmentVariable("CDXGEN_METADATA_PROPERTY"),
+      ),
+      ...parseMetadataProperties(
+        readEnvironmentVariable("CDXGEN_METADATA_PROPERTIES"),
+      ),
+    ],
+    fromConfig,
+  ];
+  const properties = [];
+  const claimedNames = new Set();
+  for (const source of sources) {
+    const sourceNames = new Set();
+    for (const aprop of source) {
+      if (
+        claimedNames.has(aprop.name) ||
+        properties.some(
+          (prop) => prop.name === aprop.name && prop.value === aprop.value,
+        )
+      ) {
+        continue;
+      }
+      properties.push(aprop);
+      sourceNames.add(aprop.name);
+    }
+    for (const name of sourceNames) {
+      claimedNames.add(name);
+    }
+  }
+  return properties;
+}
+
 /**
  * Apply command-name-based defaults to the raw parsed args. When cdxgen is
  * invoked via a symlink or alias (e.g. `obom`, `cbom`, `spdxgen`, `aibom`),
@@ -162,6 +240,8 @@ export function applyCommandNameDefaults(args, invokedCommandName) {
  * @param {object} context
  * @param {string} context.filePath          Resolved source path
  * @param {boolean} context.isRemoteOrPurl   True when source is a URL or purl
+ * @param {string[]} [context.argv]          Raw command-line arguments
+ * @param {object} [context.projectConfig]   Sanitized config file contents
  * @returns {object} The initial options object
  */
 /**
@@ -221,8 +301,12 @@ function resolveIntrospectOption(args, argv) {
 
 export function buildInitialOptions(
   args,
-  { filePath, isRemoteOrPurl, argv = process.argv },
+  { filePath, isRemoteOrPurl, argv = process.argv, projectConfig },
 ) {
+  const metadataProperties = resolveMetadataProperties(args, {
+    argv,
+    projectConfig,
+  });
   const res = Object.assign({}, args, {
     projectType: args.type,
     multiProject: args.recurse,
@@ -235,6 +319,9 @@ export function buildInitialOptions(
     include: args.include || args.includeRegex,
     noIgnore: args.noIgnore,
     gitAiNotesRef: args.gitAiNotesRef || "refs/notes/ai",
+    metadataProperties: metadataProperties.length
+      ? metadataProperties
+      : undefined,
     // Introspection: the flag or the documented environment opt-in. An
     // explicit --no-introspect stays `false` and beats both, while an
     // unmentioned flag stays undefined so a profile can still enable it.
@@ -598,6 +685,9 @@ export function applyAdvancedOptions(options, context = {}) {
  *                                             passed `--spec-version`
  * @param {boolean} [context.isDryRun=false]   Dry-run mode
  * @param {boolean} [context.isSecureMode]     Secure mode
+ * @param {object} [context.projectConfig]     Sanitized config file contents,
+ *                                             whose metadata properties merge
+ *                                             with the other sources'
  * @returns {{ options: object, warnings: OptionsWarning[] }}
  */
 export function buildOptionsFromArgs(args, context) {
@@ -607,12 +697,14 @@ export function buildOptionsFromArgs(args, context) {
     isRemoteOrPurl,
     userSetSpecVersion,
     isDryRun = false,
+    projectConfig,
   } = context;
 
   const expandedArgs = applyCommandNameDefaults(args, invokedCommandName);
   const options = buildInitialOptions(expandedArgs, {
     filePath,
     isRemoteOrPurl,
+    projectConfig,
   });
   const phase3Warnings = applyPostConstructionOverrides(options, {
     invokedCommandName,

package/lib/cli/index.js

@@ -32,6 +32,11 @@ import { thoughtLog } from "../core/logger.js";
 import { mapWithConcurrency } from "../core/parallel.js";
 import { dirNameStr } from "../core/paths.js";
 import { ui } from "../core/ui.js";
+import { isElmProjectFile } from "../ecosystems/parsers-elm.js";
+import {
+  isJuliaManifestFile,
+  isJuliaProjectFile,
+} from "../ecosystems/parsers-julia.js";
 import {
   parseBitbucketPipelinesFile,
   parseContainerFile,
@@ -79,6 +84,7 @@ import {
   exportArchive,
   exportImage,
   getPkgPathList,
+  isImageReference,
   parseImageName,
 } from "../managers/docker.js";
 import {
@@ -90,6 +96,7 @@ import {
   determineParentComponent,
 } from "./bomAssembly.js";
 import {
+  createAgenticBom,
   createAsarBom,
   createCaxaBom,
   createChromeExtensionBom,
@@ -126,24 +133,36 @@ import {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 import {
   createCargoCacheBom,
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
+  findStackLockFiles,
   getCargoCacheDir,
 } from "./nativeBom.js";
 
@@ -154,22 +173,33 @@ export {
   createGitHubBom,
   createHelmBom,
   createJenkinsBom,
+  createPerlBom,
   createPHPBom,
   createPixiBom,
   createPythonBom,
+  createRBom,
   createRubyBom,
+  createTerraformBom,
 } from "./managedBom.js";
 export {
   createClojureBom,
   createCocoaBom,
   createCppBom,
+  createCrystalBom,
   createDartBom,
   createElixirBom,
+  createElmBom,
+  createErlangBom,
   createGleamBom,
   createGoBom,
   createHaskellBom,
+  createJuliaBom,
+  createLuaBom,
+  createNimBom,
   createNixBom,
+  createOCamlBom,
   createRustBom,
+  createSpackBom,
   createSwiftBom,
   createZigBom,
 } from "./nativeBom.js";
@@ -1871,17 +1901,49 @@ export async function createDynamicBom(path, options) {
     blockExec: options.traceBlockExec,
     traceCrypto: options.traceCrypto,
     cbom: options.cbom,
+    proxyEgress: options.traceProxyEgress,
+    allowLoopback: options.traceAllowLoopback,
+    dryRun: options.traceDryRun,
+    policy: options.tracePolicy,
+    policyFile: options.tracePolicyFile,
+    blockInterpreters: options.traceBlockInterpreters,
+    denyPersistenceWrites: options.traceDenyPersistenceWrites,
+    privateTmp: options.tracePrivateTmp,
+    protectHome: options.traceProtectHome,
   };
 
-  const { components: pkgList, services: traceServices } =
-    await buildDynamicComponents(commandStr, workingDir, traceOptions);
+  const {
+    components: pkgList,
+    services: traceServices,
+    dryRunSummary,
+  } = await buildDynamicComponents(commandStr, workingDir, traceOptions);
 
-  return buildBomNSData(options, pkgList, "generic", {
+  const bomNSData = buildBomNSData(options, pkgList, "generic", {
     src: workingDir,
     projectType: "dynamic",
     filename: commandStr,
     services: traceServices,
   });
+  // A dry run denies every side effect, so the attempted-operation counts are
+  // the result. Only counts are recorded, never the paths or targets.
+  if (dryRunSummary && bomNSData?.bomJson?.metadata) {
+    const metadata = bomNSData.bomJson.metadata;
+    metadata.properties = metadata.properties || [];
+    metadata.properties.push({ name: "cdx:dynamic:dryRun", value: "true" });
+    metadata.properties.push({
+      name: "cdx:dynamic:dryRun:captured",
+      value: dryRunSummary.captured === false ? "false" : "true",
+    });
+    for (const [key, value] of Object.entries(dryRunSummary)) {
+      if (Number.isInteger(value)) {
+        metadata.properties.push({
+          name: `cdx:dynamic:dryRun:${key}`,
+          value: String(value),
+        });
+      }
+    }
+  }
+  return bomNSData;
 }
 
 /**
@@ -2060,7 +2122,8 @@ export async function createXBom(path, options) {
     `${options.multiProject ? "**/" : ""}cabal.project.freeze`,
     options,
   );
-  if (hackageFiles.length) {
+  const stackLockDetectFiles = findStackLockFiles(path, options);
+  if (hackageFiles.length || stackLockDetectFiles.length) {
     return createHaskellBom(path, options);
   }
 
@@ -2285,6 +2348,131 @@ export async function createXBom(path, options) {
   if (gleamTomlFiles.length) {
     return await createGleamBom(path, options);
   }
+
+  // Julia
+  const juliaProjectFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Project.toml`,
+    options,
+  );
+  const juliaManifestFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}Manifest.toml`,
+    options,
+  );
+  // `Project.toml` is not a name Julia owns — Cloud Native Buildpacks use it
+  // too — so dispatch only when a file actually declares a Julia environment.
+  if (
+    juliaManifestFiles.some(isJuliaManifestFile) ||
+    juliaProjectFiles.some(isJuliaProjectFile)
+  ) {
+    return await createJuliaBom(path, options);
+  }
+
+  // Erlang with rebar3
+  const rebarLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}rebar.lock`,
+    options,
+  );
+  if (rebarLockFiles.length) {
+    return await createErlangBom(path, options);
+  }
+
+  // OCaml with opam
+  const opamLockedFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.opam.locked`,
+    options,
+  );
+  if (opamLockedFiles.length) {
+    return await createOCamlBom(path, options);
+  }
+
+  // Elm with elm.json (0.19) or elm-package.json (0.18)
+  const elmJsonFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm.json`,
+    options,
+  ).filter(isElmProjectFile);
+  const legacyElmFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}elm-package.json`,
+    options,
+  );
+  if (elmJsonFiles.length || legacyElmFiles.length) {
+    return await createElmBom(path, options);
+  }
+
+  // Crystal with shards
+  const shardYmlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}shard.yml`,
+    options,
+  );
+  if (shardYmlFiles.length) {
+    return await createCrystalBom(path, options);
+  }
+
+  // Nim with nimble
+  const nimbleFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.nimble`,
+    options,
+  );
+  if (nimbleFiles.length) {
+    return await createNimBom(path, options);
+  }
+
+  // Lua with LuaRocks
+  const rockspecFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.rockspec`,
+    options,
+  );
+  if (rockspecFiles.length) {
+    return await createLuaBom(path, options);
+  }
+
+  // Spack environments
+  const spackLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}spack.lock`,
+    options,
+  );
+  if (spackLockFiles.length) {
+    return await createSpackBom(path, options);
+  }
+
+  // R with renv
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  if (renvLockFiles.length) {
+    return createRBom(path, options);
+  }
+
+  // Perl with Carton
+  const cpanSnapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  if (cpanSnapshotFiles.length) {
+    return createPerlBom(path, options);
+  }
+
+  // Terraform and OpenTofu providers
+  const tfLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  if (tfLockFiles.length) {
+    return createTerraformBom(path, options);
+  }
 }
 
 /**
@@ -2406,7 +2594,13 @@ async function createBomForPath(path, options) {
   } else if (
     (options.projectType &&
       !options.projectType?.includes("universal") &&
-      hasAnyProjectType(["oci"], options, false)) ||
+      hasAnyProjectType(["oci"], options, false) &&
+      // Explicit container types accept every documented image reference
+      // style (postgres:15-alpine, shiftleft/scan-slim, registry:5000/ns/img),
+      // but only for inputs that cannot be a local path: existing files and
+      // directories keep flowing to the tar, oci-dir and source scanners.
+      !safeExistsSync(path) &&
+      isImageReference(path)) ||
     path.startsWith("docker.io") ||
     path.startsWith("quay.io") ||
     path.startsWith("ghcr.io") ||
@@ -2636,6 +2830,39 @@ async function createBomForPath(path, options) {
   if (PROJECT_TYPE_ALIASES["gleam"].includes(projectType[0])) {
     return await createGleamBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["julia"].includes(projectType[0])) {
+    return await createJuliaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["erlang"].includes(projectType[0])) {
+    return await createErlangBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["ocaml"].includes(projectType[0])) {
+    return await createOCamlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["elm"].includes(projectType[0])) {
+    return await createElmBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["crystal"].includes(projectType[0])) {
+    return await createCrystalBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["nim"].includes(projectType[0])) {
+    return await createNimBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["lua"].includes(projectType[0])) {
+    return await createLuaBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["spack"].includes(projectType[0])) {
+    return await createSpackBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["r"].includes(projectType[0])) {
+    return createRBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["perl"].includes(projectType[0])) {
+    return createPerlBom(path, options);
+  }
+  if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
+    return createTerraformBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);
   }
@@ -2645,6 +2872,9 @@ async function createBomForPath(path, options) {
   if (PROJECT_TYPE_ALIASES["vscode-extension"].includes(projectType[0])) {
     return await createVscodeExtensionBom(path, options);
   }
+  if (PROJECT_TYPE_ALIASES["agentic"].includes(projectType[0])) {
+    return await createAgenticBom(path, options);
+  }
   if (PROJECT_TYPE_ALIASES["chrome-extension"].includes(projectType[0])) {
     return await createChromeExtensionBom(path, options);
   }