@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/third-party/arborist/snapshots/calc-dep-flags.test.cjs

@@ -0,0 +1,462 @@
+/* IMPORTANT
+ * This snapshot file is auto-generated, but designed for humans.
+ * It should be checked into source control and tracked carefully.
+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
+ * Make sure to inspect the output below.  Do not ignore changes!
+ */
+'use strict'
+exports[`test/calc-dep-flags.js TAP flag stuff > after 1`] = `
+ArboristNode {
+  "children": Map {
+    "dev" => ArboristNode {
+      "dev": true,
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "dev",
+          "spec": "*",
+          "type": "dev",
+        },
+      },
+      "edgesOut": Map {
+        "devdep" => EdgeOut {
+          "name": "devdep",
+          "spec": "*",
+          "to": "node_modules/devdep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/dev",
+      "name": "dev",
+      "path": "/x/node_modules/dev",
+      "version": "1.2.3",
+    },
+    "devandoptional" => ArboristNode {
+      "dev": true,
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/devdep",
+          "name": "devandoptional",
+          "spec": "*",
+          "type": "optional",
+        },
+      },
+      "location": "node_modules/devandoptional",
+      "name": "devandoptional",
+      "optional": true,
+      "path": "/x/node_modules/devandoptional",
+      "version": "1.2.3",
+    },
+    "devdep" => ArboristNode {
+      "children": Map {
+        "linky" => ArboristLink {
+          "dev": true,
+          "edgesIn": Set {
+            EdgeIn {
+              "from": "node_modules/devdep",
+              "name": "linky",
+              "spec": "*",
+              "type": "prod",
+            },
+          },
+          "location": "node_modules/devdep/node_modules/linky",
+          "name": "linky",
+          "path": "/x/node_modules/devdep/node_modules/linky",
+          "realpath": "/x/y/z",
+          "resolved": "file:../../../y/z",
+          "target": ArboristNode {
+            "location": "y/z",
+          },
+          "version": "1.2.3",
+        },
+      },
+      "dev": true,
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/dev",
+          "name": "devdep",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "edgesOut": Map {
+        "devandoptional" => EdgeOut {
+          "name": "devandoptional",
+          "spec": "*",
+          "to": "node_modules/devandoptional",
+          "type": "optional",
+        },
+        "devoptional" => EdgeOut {
+          "name": "devoptional",
+          "spec": "*",
+          "to": "node_modules/devoptional",
+          "type": "prod",
+        },
+        "linky" => EdgeOut {
+          "name": "linky",
+          "spec": "*",
+          "to": "node_modules/devdep/node_modules/linky",
+          "type": "prod",
+        },
+        "proddep" => EdgeOut {
+          "name": "proddep",
+          "spec": "*",
+          "to": "node_modules/proddep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/devdep",
+      "name": "devdep",
+      "path": "/x/node_modules/devdep",
+      "version": "1.2.3",
+    },
+    "devoptional" => ArboristNode {
+      "devOptional": true,
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/devdep",
+          "name": "devoptional",
+          "spec": "*",
+          "type": "prod",
+        },
+        EdgeIn {
+          "from": "node_modules/optional",
+          "name": "devoptional",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/devoptional",
+      "name": "devoptional",
+      "path": "/x/node_modules/devoptional",
+      "version": "1.2.3",
+    },
+    "extraneous" => ArboristNode {
+      "dev": true,
+      "extraneous": true,
+      "location": "node_modules/extraneous",
+      "name": "extraneous",
+      "optional": true,
+      "path": "/x/node_modules/extraneous",
+      "peer": true,
+    },
+    "metapeer" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/prod",
+          "name": "metapeer",
+          "spec": "*",
+          "type": "peer",
+        },
+      },
+      "edgesOut": Map {
+        "metapeerdep" => EdgeOut {
+          "name": "metapeerdep",
+          "spec": "*",
+          "to": "node_modules/metapeerdep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/metapeer",
+      "name": "metapeer",
+      "path": "/x/node_modules/metapeer",
+      "peer": true,
+      "version": "1.2.3",
+    },
+    "metapeerdep" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/metapeer",
+          "name": "metapeerdep",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/metapeerdep",
+      "name": "metapeerdep",
+      "path": "/x/node_modules/metapeerdep",
+      "peer": true,
+      "version": "1.2.3",
+    },
+    "optional" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "optional",
+          "spec": "*",
+          "type": "optional",
+        },
+        EdgeIn {
+          "from": "node_modules/peeroptional",
+          "name": "optional",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "edgesOut": Map {
+        "devoptional" => EdgeOut {
+          "name": "devoptional",
+          "spec": "*",
+          "to": "node_modules/devoptional",
+          "type": "prod",
+        },
+        "missing" => EdgeOut {
+          "error": "MISSING",
+          "name": "missing",
+          "spec": "*",
+          "to": null,
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/optional",
+      "name": "optional",
+      "optional": true,
+      "path": "/x/node_modules/optional",
+      "version": "1.2.3",
+    },
+    "peer" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "peer",
+          "spec": "*",
+          "type": "peer",
+        },
+      },
+      "edgesOut": Map {
+        "peerdep" => EdgeOut {
+          "name": "peerdep",
+          "spec": "*",
+          "to": "node_modules/peerdep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/peer",
+      "name": "peer",
+      "path": "/x/node_modules/peer",
+      "peer": true,
+      "version": "1.2.3",
+    },
+    "peerdep" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/peer",
+          "name": "peerdep",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/peerdep",
+      "name": "peerdep",
+      "path": "/x/node_modules/peerdep",
+      "peer": true,
+      "version": "1.2.3",
+    },
+    "peeroptional" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "peeroptional",
+          "spec": "*",
+          "type": "peerOptional",
+        },
+      },
+      "edgesOut": Map {
+        "optional" => EdgeOut {
+          "name": "optional",
+          "spec": "*",
+          "to": "node_modules/optional",
+          "type": "prod",
+        },
+      },
+      "extraneous": true,
+      "location": "node_modules/peeroptional",
+      "name": "peeroptional",
+      "optional": true,
+      "path": "/x/node_modules/peeroptional",
+      "peer": true,
+      "version": "1.2.3",
+    },
+    "prod" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "prod",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "edgesOut": Map {
+        "metapeer" => EdgeOut {
+          "name": "metapeer",
+          "spec": "*",
+          "to": "node_modules/metapeer",
+          "type": "peer",
+        },
+        "proddep" => EdgeOut {
+          "name": "proddep",
+          "spec": "*",
+          "to": "node_modules/proddep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/prod",
+      "name": "prod",
+      "path": "/x/node_modules/prod",
+      "version": "1.2.3",
+    },
+    "proddep" => ArboristNode {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "node_modules/devdep",
+          "name": "proddep",
+          "spec": "*",
+          "type": "prod",
+        },
+        EdgeIn {
+          "from": "node_modules/prod",
+          "name": "proddep",
+          "spec": "*",
+          "type": "prod",
+        },
+        EdgeIn {
+          "from": "node_modules/proddep",
+          "name": "proddep",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "edgesOut": Map {
+        "proddep" => EdgeOut {
+          "name": "proddep",
+          "spec": "*",
+          "to": "node_modules/proddep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/proddep",
+      "name": "proddep",
+      "path": "/x/node_modules/proddep",
+      "version": "1.2.3",
+    },
+  },
+  "edgesOut": Map {
+    "dev" => EdgeOut {
+      "name": "dev",
+      "spec": "*",
+      "to": "node_modules/dev",
+      "type": "dev",
+    },
+    "optional" => EdgeOut {
+      "name": "optional",
+      "spec": "*",
+      "to": "node_modules/optional",
+      "type": "optional",
+    },
+    "peer" => EdgeOut {
+      "name": "peer",
+      "spec": "*",
+      "to": "node_modules/peer",
+      "type": "peer",
+    },
+    "peeroptional" => EdgeOut {
+      "name": "peeroptional",
+      "spec": "*",
+      "to": "node_modules/peeroptional",
+      "type": "peerOptional",
+    },
+    "prod" => EdgeOut {
+      "name": "prod",
+      "spec": "*",
+      "to": "node_modules/prod",
+      "type": "prod",
+    },
+  },
+  "fsChildren": Set {
+    ArboristNode {
+      "children": Map {
+        "linklink" => ArboristLink {
+          "dev": true,
+          "edgesIn": Set {
+            EdgeIn {
+              "from": "y/z",
+              "name": "linklink",
+              "spec": "*",
+              "type": "prod",
+            },
+          },
+          "location": "y/z/node_modules/linklink",
+          "name": "linklink",
+          "path": "/x/y/z/node_modules/linklink",
+          "realpath": "/l/i/n/k/link",
+          "resolved": "file:../../../../l/i/n/k/link",
+          "target": ArboristNode {
+            "dev": true,
+            "location": "../l/i/n/k/link",
+            "name": "link",
+            "packageName": "linklink",
+            "path": "/l/i/n/k/link",
+            "version": "1.2.3",
+          },
+          "version": "1.2.3",
+        },
+      },
+      "dev": true,
+      "edgesOut": Map {
+        "linklink" => EdgeOut {
+          "name": "linklink",
+          "spec": "*",
+          "to": "y/z/node_modules/linklink",
+          "type": "prod",
+        },
+      },
+      "location": "y/z",
+      "name": "z",
+      "packageName": "linky",
+      "path": "/x/y/z",
+      "version": "1.2.3",
+    },
+  },
+  "isProjectRoot": true,
+  "location": "",
+  "name": "x",
+  "path": "/x",
+}
+`
+
+exports[`test/calc-dep-flags.js TAP no reset > after 1`] = `
+ArboristNode {
+  "children": Map {
+    "foo" => ArboristNode {
+      "dev": true,
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "foo",
+          "spec": "*",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/foo",
+      "name": "foo",
+      "path": "/some/path/node_modules/foo",
+      "peer": true,
+      "version": "1.2.3",
+    },
+  },
+  "dev": true,
+  "edgesOut": Map {
+    "foo" => EdgeOut {
+      "name": "foo",
+      "spec": "*",
+      "to": "node_modules/foo",
+      "type": "prod",
+    },
+  },
+  "isProjectRoot": true,
+  "location": "",
+  "name": "path",
+  "path": "/some/path",
+  "peer": true,
+}
+`

package/lib/validator/bomValidator.js

@@ -15,7 +15,7 @@ import {
   toCycloneDxSpecVersionString,
 } from "../inventory/bomUtils.js";
 import { isPartialTree } from "../inventory/depsUtils.js";
-import { isValidPurl } from "../inventory/purl.js";
+import { isValidPurl, parsePurlLoose } from "../inventory/purl.js";
 
 const dirName = dirNameStr;
 // The v13 floor is spec 1.6. 1.4 and 1.5 were dropped here so that the JS and
@@ -790,17 +790,13 @@ export const validateRefs = (bomJson) => {
       if (!refMap[dep.ref]) {
         warningsList.push(`Invalid ref in dependencies ${dep.ref}`);
       }
-      let parentPurlType;
-      try {
-        const purlObj = Purl.parse(dep.ref);
-        parentPurlType = purlObj.type;
-      } catch (_e) {
-        // pass
-      }
+      // A ref is the decoded form of a purl, so a version with `+` does not
+      // parse strictly; the type is all that is needed here.
+      const parentPurlType = parsePurlLoose(dep.ref)?.type;
       if (
         parentComponentRef &&
         dep.ref === parentComponentRef &&
-        dep.dependsOn.length === 0 &&
+        !dep.dependsOn?.length &&
         bomJson.dependencies.length > 1
       ) {
         warningsList.push(
@@ -814,13 +810,7 @@ export const validateRefs = (bomJson) => {
               `Invalid ref in dependencies.dependsOn ${don}. Parent: ${dep.ref}`,
             );
           }
-          let childPurlType;
-          try {
-            const purlObj = Purl.parse(don);
-            childPurlType = purlObj.type;
-          } catch (_e) {
-            // pass
-          }
+          const childPurlType = parsePurlLoose(don)?.type;
           if (
             parentPurlType &&
             childPurlType &&

package/lib/validator/index.js

@@ -11,7 +11,11 @@
  * wrapper (`bin/validate.js`) is responsible for reading the input BOM.
  */
 
-import { verifyNode } from "../helpers/bomSigner.js";
+import {
+  loadSharedSecret,
+  verifyBom,
+  verifyNode,
+} from "../helpers/bomSigner.js";
 import {
   validateBom,
   validateMetadata,
@@ -109,18 +113,26 @@ export async function validateGeneratedBom(bomJson) {
  * Run schema + deep validation checks from the existing validator helpers and
  * capture their boolean results without letting them blow up the process.
  *
+ * An exception is not a verdict on the BOM, so it is recorded in
+ * `validationErrors` instead of silently counting as a plain failure.
+ *
  * @param {object} bomJson
  * @param {object} opts
- * @returns {Promise<{ schemaValid: boolean, deepValid: boolean }>}
+ * @returns {Promise<{ schemaValid: boolean, deepValid: boolean, validationErrors: Array<{ stage: string, message: string }> }>}
  */
 async function runSchemaAndDeep(bomJson, opts) {
   let schemaValid = true;
   let deepValid = true;
+  const validationErrors = [];
   if (opts.schema !== false) {
     try {
       schemaValid = (await validateBom(bomJson)) !== false;
     } catch (err) {
       schemaValid = false;
+      validationErrors.push({
+        stage: "schema",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("schema", err);
     }
   }
@@ -133,10 +145,14 @@ async function runSchemaAndDeep(bomJson, opts) {
         validateProps(bomJson) !== false;
     } catch (err) {
       deepValid = false;
+      validationErrors.push({
+        stage: "deep",
+        message: err?.message || String(err),
+      });
       if (opts.onError) opts.onError("deep", err);
     }
   }
-  return { schemaValid, deepValid };
+  return { schemaValid, deepValid, validationErrors };
 }
 
 /**
@@ -151,10 +167,13 @@ async function runSchemaAndDeep(bomJson, opts) {
  * @param {string} [options.minSeverity]        Minimum severity for returned findings.
  * @param {boolean} [options.includeManual]     Include manual-review findings (default true).
  * @param {boolean} [options.includePass]       Include passing findings (default false).
- * @param {string} [options.publicKey]          If set, verify the BOM signature.
+ * @param {string} [options.publicKey]          If set, verify the BOM signature with this public key.
+ * @param {string|Buffer} [options.secretKey]   If set, verify an HMAC (HS*) BOM signature with this shared secret.
+ * @param {boolean} [options.nestedSignatures]  Also verify component, service, and annotation signatures (default true), as cdx-verify does.
  * @returns {{
  *   schemaValid: boolean,
  *   deepValid: boolean,
+ *   validationErrors: Array<{ stage: string, message: string }>,
  *   signatureVerified: boolean | null,
  *   signatureDetails: object | null,
  *   findings: Array<object>,
@@ -164,7 +183,10 @@ async function runSchemaAndDeep(bomJson, opts) {
  * }}
  */
 export async function validateBomAdvanced(bomJson, options = {}) {
-  const { schemaValid, deepValid } = await runSchemaAndDeep(bomJson, options);
+  const { schemaValid, deepValid, validationErrors } = await runSchemaAndDeep(
+    bomJson,
+    options,
+  );
   const allFindings = evaluateAll(bomJson, {
     categories: options.categories,
     benchmarks: options.benchmarks,
@@ -177,17 +199,32 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   });
   let signatureVerified = null;
   let signatureDetails = null;
-  if (options.publicKey && bomJson?.signature) {
+  const verificationRequested = Boolean(options.publicKey || options.secretKey);
+  if (verificationRequested && bomJson?.signature) {
     try {
-      const match = verifyNode(bomJson, options.publicKey);
+      const key = options.secretKey
+        ? loadSharedSecret(options.secretKey)
+        : options.publicKey;
+      const reasons = [];
+      const verify =
+        options.nestedSignatures === false ? verifyNode : verifyBom;
+      const match = verify(bomJson, key, { reasons });
       signatureVerified = Boolean(match);
-      signatureDetails = match || null;
+      if (match) {
+        signatureDetails = match;
+      } else {
+        signatureDetails = {
+          error: reasons.length
+            ? [...new Set(reasons)].join(" ")
+            : "No signature matched the key.",
+        };
+      }
     } catch (err) {
       signatureVerified = false;
       signatureDetails = { error: err?.message || String(err) };
     }
-  } else if (options.publicKey) {
-    // Public key provided but BOM has no signature.
+  } else if (verificationRequested) {
+    // Verification key provided but BOM has no signature.
     signatureVerified = false;
     signatureDetails = { error: "BOM has no signature block." };
   }
@@ -197,6 +234,7 @@ export async function validateBomAdvanced(bomJson, options = {}) {
   return {
     schemaValid,
     deepValid,
+    validationErrors,
     signatureVerified,
     signatureDetails,
     findings: filtered,

package/lib/validator/reporters/console.js

@@ -128,6 +128,9 @@ export function formatSummary(summary) {
 export function render(report) {
   const pieces = [];
   pieces.push(formatSummary(report.summary));
+  for (const e of report.validationErrors || []) {
+    pieces.push(`Validator error during ${e.stage} validation: ${e.message}`);
+  }
   if (report.benchmarks?.length) {
     pieces.push(formatBenchmarks(report.benchmarks));
   }

package/lib/validator/reporters/json.js

@@ -12,6 +12,7 @@ export function render(report, _options = {}) {
   const payload = {
     schemaValid: report.schemaValid,
     deepValid: report.deepValid,
+    validationErrors: report.validationErrors || [],
     signatureVerified: report.signatureVerified ?? null,
     summary: report.summary,
     benchmarks: report.benchmarks || [],

package/lib/validator/reporters/sarif.js

@@ -167,12 +167,19 @@ export function render(report, options = {}) {
           {
             executionSuccessful:
               report.summary?.fail === 0 && report.schemaValid !== false,
+            toolExecutionNotifications: (report.validationErrors || []).map(
+              (e) => ({
+                level: "error",
+                message: { text: `${e.stage} validation error: ${e.message}` },
+              }),
+            ),
           },
         ],
         results: findings.map(toSarifResult),
         properties: {
           schemaValid: report.schemaValid,
           deepValid: report.deepValid,
+          validationErrors: report.validationErrors || [],
           signatureVerified: report.signatureVerified ?? null,
           summary: report.summary,
           benchmarks: report.benchmarks || [],