@cdxgen/cdxgen 13.1.0 → 13.3.0

package/lib/cli/managedBom.js

@@ -50,6 +50,7 @@ import {
   parseGitHubWorkflowData,
   parseHelmYamlData,
 } from "../ecosystems/parsers-misc.js";
+import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
   generatePixiLockFile,
   parseMojoProject,
@@ -61,6 +62,8 @@ import {
   parseReqFile,
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
+import { parseRenvLock } from "../ecosystems/parsers-r.js";
+import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -70,7 +73,10 @@ import {
   getPyModules,
 } from "../ecosystems/pythonutils.js";
 import {
+  addRubyGemsDistributionUrls,
+  addRubyRuntimeComponent,
   collectGemModuleNames,
+  describeProjectGem,
   enrichGemsFromLocalCache,
   parseBundleConfig,
   parseGemfileLockData,
@@ -101,7 +107,7 @@ import {
   createDosaiMethodsSlice,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
-  readDosaiJsonFile,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
@@ -570,8 +576,17 @@ export async function createPythonBom(path, options) {
   }
   if (requirementsMode || pipenvMode) {
     if (pipenvMode) {
-      // TODO: Support for nested directories
-      safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      // `pipenv install` builds and installs the project's own dependencies
+      // (including `-e .` self-references that execute setup.py), so unlike
+      // the lockfile parsing below it must honor --no-install-deps and the
+      // pre-build lifecycle.
+      if (options.installDeps !== false) {
+        safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      } else {
+        console.log(
+          "Skipping 'pipenv install' since dependency installation is disabled.",
+        );
+      }
       const piplockFile = join(path, "Pipfile.lock");
       if (safeExistsSync(piplockFile)) {
         let dlist;
@@ -1349,6 +1364,7 @@ export async function createRubyBom(path, options) {
   let pkgList = [];
   let dependencies = [];
   let rootList = [];
+  const projectGemRefs = [];
   const parentComponent = createDefaultParentComponent(path, "gem", options);
   const gemFileMode = gemFiles.length;
   const gemLockMode = gemLockFiles.length;
@@ -1402,10 +1418,18 @@ export async function createRubyBom(path, options) {
       if (retMap.rootList?.length) {
         rootList = rootList.concat(retMap.rootList);
       }
+      // `PATH remote: .` is relative to the lockfile, so only the lockfiles
+      // of the scanned directory can serve the gem the root gemspec builds
+      if (
+        retMap.projectGemRefs?.length &&
+        dirname(resolve(f)) === resolve(path)
+      ) {
+        projectGemRefs.push(...retMap.projectGemRefs);
+      }
     }
   }
   // Parsing .gemspec files would help us get more metadata such as description, authors, licenses etc
-  let rootGemspecComponent;
+  let projectGem;
   if (gemspecFiles.length) {
     if (!gemLockFiles.length && !hasAnyProjectType(["oci"], options, false)) {
       console.log(
@@ -1417,38 +1441,51 @@ export async function createRubyBom(path, options) {
         detail: "only gemspec files were available to parse",
       });
     }
+    // Bundler evaluated the root gemspec to lock it under `PATH remote: .`,
+    // so the locked release stands in for a version computed at runtime. It
+    // is resolved before the merge, so that the gemspec and lockfile
+    // sightings of the gem reconcile into one component.
+    const lockedVersions = Object.create(null);
+    for (const p of pkgList) {
+      if (p.version && projectGemRefs.includes(p["bom-ref"])) {
+        lockedVersions[p.name] = p.version;
+      }
+    }
     for (const f of gemspecFiles) {
       const gemspecData = readFileSync(f, { encoding: "utf-8" });
-      const gpkgList = await parseGemspecData(gemspecData, f);
-      if (gpkgList.length) {
-        pkgList = pkgList.concat(gpkgList);
-        pkgList = trimComponents(pkgList);
-        if (
-          !rootGemspecComponent &&
-          dirname(resolve(f)) === resolve(path) &&
-          gpkgList[0]?.name
-        ) {
-          rootGemspecComponent = gpkgList[0];
-        }
+      const isRootGemspec = dirname(resolve(f)) === resolve(path);
+      const gpkgList = await parseGemspecData(
+        gemspecData,
+        f,
+        isRootGemspec ? { lockedVersions } : {},
+      );
+      if (!gpkgList.length) {
+        continue;
       }
-    }
-    if (
-      rootGemspecComponent &&
-      !("project-name" in options) &&
-      options.projectName === undefined
-    ) {
-      parentComponent.name = rootGemspecComponent.name;
-      parentComponent.version = rootGemspecComponent.version || "latest";
-      const parentPurl = build({
-        type: "gem",
-        namespace: parentComponent.group || null,
-        name: parentComponent.name,
-        version: parentComponent.version || null,
-      });
-      parentComponent["bom-ref"] = decodeURIComponent(parentPurl);
-      parentComponent["purl"] = parentPurl;
+      // The gemspec in the scanned directory is the gem the project builds
+      if (!projectGem && isRootGemspec && gpkgList[0]?.name) {
+        projectGem = gpkgList[0];
+      }
+      pkgList = trimComponents(pkgList.concat(gpkgList));
     }
   }
+  // Describe that gem in metadata.component, unless `--project-name` names a
+  // different project or an image is being scanned
+  if (
+    projectGem &&
+    !hasAnyProjectType(["oci"], options, false) &&
+    (!("project-name" in options) || options.projectName === projectGem.name)
+  ) {
+    ({ pkgList, dependencies, rootList } = describeProjectGem(
+      parentComponent,
+      projectGem,
+      pkgList,
+      dependencies,
+      rootList,
+      projectGemRefs,
+      options,
+    ));
+  }
   if (rootList.length) {
     dependencies = mergeDependencies(
       dependencies,
@@ -1544,6 +1581,21 @@ export async function createRubyBom(path, options) {
   // lookup, gives us the sha256 of the exact native build, and unlike the
   // registry lookups it also works in dry-run mode.
   pkgList = await enrichGemsFromLocalCache(pkgList, { gemHome });
+  // The download URL of a gem from the public registry needs no network call
+  pkgList = addRubyGemsDistributionUrls(pkgList);
+  // Gems declare the Ruby they run on; surface it as the runtime they depend
+  // on. The component says the runtime is external, which only CycloneDX 1.7
+  // can express, and a container image ships its own Ruby.
+  if (
+    options.specVersion >= 1.7 &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    ({ pkgList, dependencies } = addRubyRuntimeComponent(
+      pkgList,
+      parentComponent,
+      dependencies,
+    ));
+  }
   return buildBomNSData(options, pkgList, "gem", {
     src: path,
     dependencies,
@@ -2003,9 +2055,13 @@ export async function createCsharpBom(path, options) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
     if (options.deep) {
+      // resolve (not join) so a fully-qualified --deps-slices-file is used
+      // as-is: join would append it to the scan path, which is never a valid
+      // path on Windows and silently loses the .NET evidence elsewhere
+      // (issue 4394). A relative value still resolves against the scan path.
       const slicesFile = resolve(
         options.depsSlicesFile
-          ? join(path, options.depsSlicesFile)
+          ? resolve(path, options.depsSlicesFile)
           : join(getTmpDir(), "dosai.json"),
       );
       // Create the slices file if it doesn't exist
@@ -2018,14 +2074,24 @@ export async function createCsharpBom(path, options) {
           resolve(slicesFile),
           options,
         );
-        if (!sliceResult && DEBUG_MODE) {
-          console.log(
-            "Slicing with dosai was unsuccessful. Check the errors reported in the logs above.",
+        if (!sliceResult) {
+          // Visible without --debug: otherwise the components silently lose
+          // the dependency-slice evidence while the scan still exits 0.
+          // --evidence (which implies --deep) runs dosai again during evinse
+          // and can still add occurrences, so this names only what is lost.
+          console.warn(
+            "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with --debug for the dosai errors.",
           );
         }
+      } else if (DEBUG_MODE) {
+        console.log(
+          `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
+        );
       }
       pkgList = addEvidenceForDotnet(pkgList, slicesFile);
-      const methodsSlice = readDosaiJsonFile(slicesFile);
+      const methodsSlice = readDosaiMethodsReport(slicesFile, {
+        sections: ["Metadata", "Services", "ApiEndpoints"],
+      });
       // Provider-backed Services[] first so bom-refs, trust zones, and data
       // classifications survive; ApiEndpoints derivation fills in the rest.
       const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
@@ -2033,12 +2099,20 @@ export async function createCsharpBom(path, options) {
       services = normalizeDosaiServiceMap(servicesMap);
     }
   }
-  // Parent dependency tree
+  // Parent dependency tree. A single project file already contributed an
+  // entry for the same parent, so the lock file roots are merged into it
+  // rather than added as a second entry for the same ref.
   if (parentDependsOn.size && parentComponent?.["bom-ref"]) {
-    dependencies.splice(0, 0, {
-      ref: parentComponent["bom-ref"],
-      dependsOn: Array.from(parentDependsOn).sort(),
-    });
+    dependencies = mergeDependencies(
+      [
+        {
+          ref: parentComponent["bom-ref"],
+          dependsOn: Array.from(parentDependsOn).sort(),
+        },
+      ],
+      dependencies,
+      parentComponent,
+    );
   }
   if (shouldFetchLicense()) {
     const retMap = await getNugetMetadata(pkgList, dependencies);
@@ -2150,3 +2224,152 @@ export async function createCryptoCertsBom(path, options) {
     },
   };
 }
+
+/**
+ * Function to create bom string for R projects using renv.
+ *
+ * The `renv.lock` file carries the resolved package set for the project
+ * library, including the R version it was produced under.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createRBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  let rootInputs = [];
+  let rVersion;
+  const renvLockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}renv.lock`,
+    options,
+  );
+  for (const renvLockFile of renvLockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${renvLockFile}`);
+    }
+    const result = parseRenvLock(renvLockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+    if (result.rootInputs?.length) {
+      rootInputs = rootInputs.concat(result.rootInputs);
+    }
+    if (!rVersion) {
+      rVersion = result.rVersion;
+    }
+  }
+  if (!pkgList.length) {
+    return {};
+  }
+  // renv locks the library, not the project: they carry no project name, so
+  // the directory is the name the project is already known by. The R version
+  // the library was resolved under is a property of that project.
+  const projectName = basename(resolve(path));
+  const parentComponent = {
+    type: "application",
+    name: projectName,
+    "bom-ref": `application:${projectName}:latest`,
+    description: `R project: ${projectName}`,
+    properties: [
+      { name: "internal:SrcFile", value: renvLockFiles.join(", ") },
+      ...(rVersion ? [{ name: "cdx:renv:rVersion", value: rVersion }] : []),
+    ],
+  };
+  if (rootInputs.length) {
+    dependencies.push({
+      ref: parentComponent["bom-ref"],
+      dependsOn: [...new Set(rootInputs)].sort(),
+    });
+  }
+  return buildBomNSData(options, pkgList, "cran", {
+    src: path,
+    filename: renvLockFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
+}
+
+/**
+ * Function to create bom string for Perl projects using Carton.
+ *
+ * The `cpanfile.snapshot` carries the resolved install set; the declared
+ * `cpanfile` is consulted to distinguish direct dependencies.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createPerlBom(path, options) {
+  let pkgList = [];
+  let dependencies = [];
+  const snapshotFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}cpanfile.snapshot`,
+    options,
+  );
+  for (const snapshotFile of snapshotFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${snapshotFile}`);
+    }
+    const baseDir = dirname(snapshotFile);
+    const cpanfile = join(baseDir, "cpanfile");
+    const result = parseCpanSnapshot(
+      snapshotFile,
+      safeExistsSync(cpanfile) ? cpanfile : undefined,
+    );
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+    if (result.dependencies?.length) {
+      dependencies = dependencies.concat(result.dependencies);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "cpan", {
+      src: path,
+      filename: snapshotFiles.join(", "),
+      dependencies,
+    });
+  }
+  return {};
+}
+
+/**
+ * Function to create bom string for Terraform and OpenTofu projects.
+ *
+ * The `.terraform.lock.hcl` file pins the providers the configuration
+ * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ *
+ * @param {string} path to the project
+ * @param {Object} options Parse options from the cli
+ * @returns {Object} BOM object
+ */
+export function createTerraformBom(path, options) {
+  let pkgList = [];
+  const lockFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    options,
+  );
+  for (const lockFile of lockFiles) {
+    if (DEBUG_MODE) {
+      console.log(`Parsing ${lockFile}`);
+    }
+    const result = parseTerraformLockFile(lockFile);
+    if (result.pkgList?.length) {
+      pkgList = pkgList.concat(result.pkgList);
+    }
+  }
+  if (pkgList.length) {
+    return buildBomNSData(options, pkgList, "terraform", {
+      src: path,
+      filename: lockFiles.join(", "),
+    });
+  }
+  return {};
+}