@cdxgen/cdxgen 13.2.0 → 13.3.0

package/lib/evinser/evinser.js

@@ -40,10 +40,15 @@ import {
   isRusiRustLanguage,
 } from "../ecosystems/rusi.js";
 import {
+  atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
   filterAtomSlicesByExcludePatterns,
+  readReachablesSlices,
+  readSlicesFile,
+  removeReachablesChunkFiles,
 } from "../inventory/atomUtils.js";
+import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   collectDosaiCryptoComponents,
   findCryptoAlgos,
@@ -62,9 +67,12 @@ import {
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
+  readDosaiDataFlowReport,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { parseOccurrenceEvidenceLocation } from "../inventory/evidenceUtils.js";
 import { executeOsQuery } from "../managers/binary.js";
+import { MAX_JSON_TEXT_BYTES, readJsonFile } from "../parsers/largeJson.js";
 import { postProcess } from "../stages/postgen/postgen.js";
 import { createOrLoad } from "./db.js";
 import { findPurlLocations } from "./scalasem.js";
@@ -96,10 +104,88 @@ function appendComponentProperties(component, properties = []) {
   }
 }
 
+/**
+ * Merges one analyzer run's metadata properties into the BOM's metadata
+ * component. Analyzer metadata describes a single run, so when the input BOM
+ * already carries facts from an earlier run (cdxgen --profile research, then
+ * evinse), everything under the analyzer's own `cdx:<analyzer>:` prefix is
+ * replaced. Replacing by exact name would keep facts the new run no longer
+ * emits, such as a cdx:rusi:requestedBackend left from a fallback run.
+ *
+ * @param {Object} component Metadata component to update in place
+ * @param {Object[]} metadataProperties Properties from the analyzer run
+ */
+export function mergeAnalyzerMetadataProperties(
+  component,
+  metadataProperties = [],
+) {
+  if (!component || !metadataProperties.length) {
+    return;
+  }
+  if (component.properties?.length) {
+    const analyzerPrefixes = [
+      ...new Set(
+        metadataProperties
+          .map((p) => /^cdx:[^:]+:/.exec(p.name)?.[0])
+          .filter(Boolean),
+      ),
+    ];
+    component.properties = component.properties.filter(
+      (p) => !analyzerPrefixes.some((prefix) => p.name?.startsWith(prefix)),
+    );
+  }
+  appendComponentProperties(component, metadataProperties);
+}
+
 function filterAtomSliceData(sliceData, options = {}) {
   return filterAtomSlicesByExcludePatterns(sliceData, options.exclude);
 }
 
+/**
+ * Build the options for the evinse phase (prepareDB, analyzeProject, and
+ * createEvinseFile) from the cdxgen CLI options.
+ *
+ * This object used to be assembled inline in bin/cdxgen.js, which dropped
+ * fields the analyzers read - most notably `exclude`, so every dosai and atom
+ * run triggered by `--evidence` ignored the user's `--exclude` patterns. Keep
+ * the wiring in one place so the forwarded fields stay testable.
+ *
+ * @param {Object} options CLI options
+ * @param {Object} args Parsed CLI arguments; `args._[0]` is the source directory
+ * @param {string} input Path of the BOM file the evinse phase enriches
+ * @returns {Object} Options for prepareDB, analyzeProject, and createEvinseFile
+ */
+export function buildEvinseOptions(options, args, input) {
+  const sourceDir = args._?.[0] || ".";
+  return {
+    _: args._,
+    input,
+    output: options.evinseOutput,
+    language: options.projectType,
+    skipMavenCollector: false,
+    force: false,
+    withReachables: options.deep,
+    usagesSlicesFile: options.usagesSlicesFile,
+    dataFlowSlicesFile: options.dataFlowSlicesFile,
+    reachablesSlicesFile: options.reachablesSlicesFile,
+    semanticsSlicesFile: options.semanticsSlicesFile,
+    openapiSpecFile: options.openapiSpecFile,
+    componentType: options.componentType,
+    includeCrypto:
+      options.includeCrypto &&
+      isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
+    specVersion: options.specVersion,
+    profile: options.profile,
+    jsonPretty: options.jsonPretty,
+    exclude: options.exclude,
+    // Absolute path of the deps slice createCsharpBom writes for --deep runs,
+    // so analyzeProject can reuse it instead of rerunning dosai methods.
+    depsSlicesFile: options.depsSlicesFile
+      ? resolve(sourceDir, options.depsSlicesFile)
+      : undefined,
+  };
+}
+
 /**
  * Function to create the db for the libraries referred in the sbom.
  *
@@ -444,6 +530,11 @@ export async function createSlice(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
   const atomFile = join(sliceOutputDir, `${language}-app.atom`);
+  if (sliceType === "reachables") {
+    // atom writes reachables in numbered chunks next to the slices file; one
+    // left by an earlier run must not be read back as part of this one.
+    removeReachablesChunkFiles(slicesFile);
+  }
   let args = [sliceType];
   // Support for crypto slices aka CBOM
   if (sliceType === "reachables" && options.includeCrypto) {
@@ -488,6 +579,7 @@ export async function createSlice(
     args.push("--slice-depth");
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
+  args.push(...atomCompileCommandsArgs(filePath, language, options));
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -598,8 +690,9 @@ export function purlToLanguage(purl, filePath) {
  * Seed purl-location and import maps from SBOM component evidence.
  *
  * Walks the supplied components reading `internal:ImportedModules` (or
- * `internal:Namespaces` for php/ruby) and `evidence.occurrences` properties
- * to construct lookup maps used during slice analysis.
+ * `internal:Namespaces` for php/ruby, plus the `internal:ImportedSymbols` the
+ * C/C++ collector records) and `evidence.occurrences` properties to construct
+ * lookup maps used during slice analysis.
  *
  * @param {Object[]} components CycloneDX components from the input SBOM
  * @param {string} language Application language used to select the import property name
@@ -624,6 +717,18 @@ export function initFromSbom(components, language) {
         .forEach((v) => {
           purlImportsMap[comp.purl] = (v.value || "").split(",");
         });
+      // A C/C++ component records the symbols the project uses from it, which
+      // are what C usages are matched against. The list is pipe-separated:
+      // C++ symbols may contain commas.
+      if (["c", "cpp", "c++"].includes(language)) {
+        (comp.properties || [])
+          .filter((v) => v.name === "internal:ImportedSymbols")
+          .forEach((v) => {
+            purlImportsMap[comp.purl] = (
+              purlImportsMap[comp.purl] || []
+            ).concat((v.value || "").split("|").filter(Boolean));
+          });
+      }
     }
     if (comp.evidence.occurrences) {
       // Keep the `location#line` shape so a re-run over a cdxgen BOM does not
@@ -654,6 +759,65 @@ function usableSlicesFile(slicesFile) {
   return fileSizeInBytes > 1024;
 }
 
+/**
+ * Load a semantics slices file for reuse when it belongs to this project.
+ *
+ * `--semantics-slices-file` defaults to `semantics.slices.json` in the working
+ * directory, which is shared by every project scanned from there and also
+ * receives the reports of other analyzers (dosai, rusi, golem). A file is
+ * only reused when its shape matches the language. Swift slices must also
+ * describe the same project directory and must not predate the input SBOM:
+ * `cdxgen --evidence` writes a fresh SBOM before evinse runs, so an older
+ * slice was made from an earlier state of the sources and is regenerated.
+ * Scala slices cannot be regenerated by evinse and are reused whenever their
+ * shape matches.
+ *
+ * @param {string} language Project language
+ * @param {string} slicesFile Candidate semantics slices file
+ * @param {string} bomFile Input SBOM
+ * @param {string} dirPath Project directory
+ * @returns {undefined|Object} Parsed slice when it can be reused
+ */
+export function loadReusableSemanticsSlice(
+  language,
+  slicesFile,
+  bomFile,
+  dirPath,
+) {
+  if (!usableSlicesFile(slicesFile)) {
+    return undefined;
+  }
+  let parsed;
+  try {
+    parsed = readJsonFile(slicesFile);
+  } catch (_e) {
+    return undefined;
+  }
+  if (!parsed || typeof parsed !== "object") {
+    return undefined;
+  }
+  if (!PROJECT_TYPE_ALIASES.swift.includes(language)) {
+    // Scala semantics slices are keyed by .scala source file names
+    return Object.keys(parsed).some((key) => key.endsWith(".scala"))
+      ? parsed
+      : undefined;
+  }
+  if (!(parsed.fileIndexes || parsed.buildSymbols || parsed.moduleInfos)) {
+    return undefined;
+  }
+  if (parsed.projectPath && resolve(parsed.projectPath) !== resolve(dirPath)) {
+    return undefined;
+  }
+  try {
+    if (fs.statSync(slicesFile).mtimeMs < fs.statSync(bomFile).mtimeMs) {
+      return undefined;
+    }
+  } catch (_e) {
+    // Without timestamps the shape and project checks decide
+  }
+  return parsed;
+}
+
 /**
  * Function to analyze the project
  *
@@ -826,14 +990,23 @@ export async function analyzeProject(dbObjMap, options) {
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
-      usageSlice = JSON.parse(
-        fs.readFileSync(options.usagesSlicesFile, "utf-8"),
-      );
+      usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+    } else if (usableSlicesFile(options.depsSlicesFile)) {
+      // createCsharpBom already ran dosai methods on this tree for --deep runs
+      // and wrote the deps slice. For dosai, that output IS the usages slice,
+      // so reuse it instead of invoking dosai a second time.
+      if (DEBUG_MODE) {
+        console.log(
+          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+        );
+      }
+      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+      usagesSlicesFile = options.depsSlicesFile;
     } else {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        usageSlice = JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8"));
+        usageSlice = readDosaiMethodsReport(retMap.slicesFile);
         usagesSlicesFile = retMap.slicesFile;
       }
     }
@@ -867,16 +1040,12 @@ export async function analyzeProject(dbObjMap, options) {
         safeExistsSync(options.dataFlowSlicesFile)
       ) {
         dataFlowSlicesFile = options.dataFlowSlicesFile;
-        dataFlowSlice = JSON.parse(
-          fs.readFileSync(options.dataFlowSlicesFile, "utf-8"),
-        );
+        dataFlowSlice = readDosaiDataFlowReport(options.dataFlowSlicesFile);
       } else {
         retMap = await createSlice(language, dirPath, "data-flow", options);
         if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
           dataFlowSlicesFile = retMap.slicesFile;
-          dataFlowSlice = JSON.parse(
-            fs.readFileSync(retMap.slicesFile, "utf-8"),
-          );
+          dataFlowSlice = readDosaiDataFlowReport(retMap.slicesFile);
         }
       }
       if (dataFlowSlice && Object.keys(dataFlowSlice).length) {
@@ -923,7 +1092,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       reachablesSlicesFile = options.reachablesSlicesFile;
       reachablesSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.reachablesSlicesFile, "utf-8")),
+        readReachablesSlices(options.reachablesSlicesFile),
         options,
       );
     } else {
@@ -931,7 +1100,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         reachablesSlicesFile = retMap.slicesFile;
         reachablesSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readReachablesSlices(retMap.slicesFile),
           options,
         );
       }
@@ -947,7 +1116,7 @@ export async function analyzeProject(dbObjMap, options) {
   // Reuse existing usages slices
   if (options.usagesSlicesFile && usableSlicesFile(options.usagesSlicesFile)) {
     usageSlice = filterAtomSliceData(
-      JSON.parse(fs.readFileSync(options.usagesSlicesFile, "utf-8")),
+      readSlicesFile(options.usagesSlicesFile, "usages"),
       options,
     );
     usagesSlicesFile = options.usagesSlicesFile;
@@ -956,7 +1125,7 @@ export async function analyzeProject(dbObjMap, options) {
     retMap = await createSlice(language, dirPath, "usages", options);
     if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
       usageSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+        readSlicesFile(retMap.slicesFile, "usages"),
         options,
       );
       usagesSlicesFile = retMap.slicesFile;
@@ -982,21 +1151,20 @@ export async function analyzeProject(dbObjMap, options) {
     components.length
   ) {
     // Reuse existing semantics slices for swift and scala
-    if (
-      options.semanticsSlicesFile &&
-      safeExistsSync(options.semanticsSlicesFile)
-    ) {
-      semanticsSlice = JSON.parse(
-        fs.readFileSync(options.semanticsSlicesFile, "utf-8"),
-      );
+    const reusableSlice = loadReusableSemanticsSlice(
+      language,
+      options.semanticsSlicesFile,
+      bomFile,
+      dirPath,
+    );
+    if (reusableSlice) {
+      semanticsSlice = reusableSlice;
       semanticsSlicesFile = options.semanticsSlicesFile;
     } else if (PROJECT_TYPE_ALIASES.swift.includes(language)) {
       // Generate our own slices for swift
       retMap = await createSlice(language, dirPath, "semantics", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
-        semanticsSlice = JSON.parse(
-          fs.readFileSync(retMap.slicesFile, "utf-8"),
-        );
+        semanticsSlice = readSlicesFile(retMap.slicesFile, "semantics");
         semanticsSlicesFile = retMap.slicesFile;
       }
     }
@@ -1033,7 +1201,7 @@ export async function analyzeProject(dbObjMap, options) {
     ) {
       dataFlowSlicesFile = options.dataFlowSlicesFile;
       dataFlowSlice = filterAtomSliceData(
-        JSON.parse(fs.readFileSync(options.dataFlowSlicesFile, "utf-8")),
+        readSlicesFile(options.dataFlowSlicesFile, "data-flow"),
         options,
       );
     } else if (!PROJECT_TYPE_ALIASES.scala.includes(language)) {
@@ -1041,7 +1209,7 @@ export async function analyzeProject(dbObjMap, options) {
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         dataFlowSlicesFile = retMap.slicesFile;
         dataFlowSlice = filterAtomSliceData(
-          JSON.parse(fs.readFileSync(retMap.slicesFile, "utf-8")),
+          readSlicesFile(retMap.slicesFile, "data-flow"),
           options,
         );
       }
@@ -1400,6 +1568,14 @@ export async function parseSliceUsages(
 /**
  * Method to parse semantic slice data. Currently supported for swift and scala languages.
  *
+ * Swift slices created by cdxgen record, for every indexed source file, the
+ * lines that reference each dependency module (`moduleReferences`); the module
+ * of a reference is the declaring module recovered from the compiler-resolved
+ * USR. Components are mapped to their package's modules through the
+ * `packages` slice, so every occurrence is backed by a resolved reference.
+ * Slices without `moduleReferences` (created by older cdxgen versions) fall
+ * back to matching symbol names.
+ *
  * @param {String} language Project language.
  * @param {Array} components Components from the input SBOM
  * @param {Object} semanticsSlice Semantic slice data
@@ -1413,86 +1589,47 @@ export function parseSemanticSlices(language, components, semanticsSlice) {
   if (!components) {
     return undefined;
   }
-  const componentNamePurlMap = {};
-  const componentSymbolsMap = {};
-  const allObfuscationsMap = {};
-  // We have two attributes in the semantics slice to expand a given module to its constituent symbols
-  // - A less precise buildSymbols, which is obtained by parsing the various output-file-map.json files
-  // - A granular and precise moduleInfos, which has the exact classes, protocols, enums etc belonging to each module
-  // The objective then is to build the purlLocationMap, which is the list of locations where a given purl is used
-  // For this, we have two attributes:
-  // - A simpler fileStructures attribute that has the mapping between a swift file and the list of referenced types
-  // - A granular fileIndexes attribute that contains information about the clang modules and line number information
-
-  // We first need to map out the component names to their purls
-  // This is because the semantics slice use the module names everywhere
+  const fileIndexes = semanticsSlice?.fileIndexes || {};
+  const hasModuleReferences = Object.values(fileIndexes).some(
+    (afileIndex) => afileIndex?.moduleReferences,
+  );
+  const purlLocationsSet = {};
   for (const comp of components) {
-    componentNamePurlMap[comp.name] = comp.purl;
-    if (!componentSymbolsMap[comp.name]) {
-      componentSymbolsMap[comp.name] = new Set();
-    }
-    if (semanticsSlice?.buildSymbols[comp.name]) {
-      for (const asym of semanticsSlice.buildSymbols[comp.name]) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    const moduleInfo = semanticsSlice?.moduleInfos[comp.name] || {};
-    if (moduleInfo.classes) {
-      for (const asym of moduleInfo.classes) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.protocols) {
-      for (const asym of moduleInfo.protocols) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
-    }
-    if (moduleInfo.enums) {
-      for (const asym of moduleInfo.enums) {
-        componentSymbolsMap[comp.name].add(asym);
-      }
+    // Local packages and the root application have no purl, so there is
+    // nothing the evidence could be attached to downstream
+    if (!comp?.purl) {
+      continue;
     }
-    // Now collect the method signatures from class and protocol methods
-    if (moduleInfo.classMethods) {
-      for (const aclassName of Object.keys(moduleInfo.classMethods)) {
-        for (const asym of moduleInfo.classMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
-        }
-      }
+    const moduleNames = resolveSwiftComponentModules(comp, semanticsSlice);
+    if (!moduleNames.size) {
+      continue;
     }
-    if (moduleInfo.protocolMethods) {
-      for (const aclassName of Object.keys(moduleInfo.protocolMethods)) {
-        for (const asym of moduleInfo.protocolMethods[aclassName]) {
-          componentSymbolsMap[comp.name].add(asym);
+    const locations = purlLocationsSet[comp.purl] || new Set();
+    if (hasModuleReferences) {
+      for (const [aswiftFile, afileIndex] of Object.entries(fileIndexes)) {
+        for (const [amodule, lines] of Object.entries(
+          afileIndex?.moduleReferences || {},
+        )) {
+          if (!moduleNames.has(amodule)) {
+            continue;
+          }
+          for (const aline of lines) {
+            locations.add(`${aswiftFile}#${aline}`);
+          }
         }
       }
-    }
-    // Build a large obfuscation map
-    if (moduleInfo.obfuscationMap) {
-      for (const asym of Object.keys(moduleInfo.obfuscationMap)) {
-        allObfuscationsMap[asym] = moduleInfo.obfuscationMap[asym];
-      }
-    }
-  }
-  const purlLocationsSet = {};
-  // We now have a good set of data in componentSymbolsMap and allObfuscationsMap
-  // We can iterate these symbols and check if they exist under fileIndexes.symbolLocations
-  for (const compName of Object.keys(componentSymbolsMap)) {
-    const compSymbols = Array.from(componentSymbolsMap[compName]);
-    const searchHits = searchSymbolLocations(
-      compSymbols,
-      semanticsSlice?.fileIndexes,
-    );
-    // We have an occurrence hit. Let's populate the purlLocationMap
-    if (searchHits?.length) {
-      const locations =
-        purlLocationsSet[componentNamePurlMap[compName]] || new Set();
-      for (const ahit of searchHits) {
+    } else {
+      for (const ahit of searchSymbolLocations(
+        collectLegacySwiftSymbols(moduleNames, semanticsSlice),
+        fileIndexes,
+      )) {
         for (const aline of ahit.lineNumbers) {
           locations.add(`${ahit.file}#${aline}`);
         }
       }
-      purlLocationsSet[componentNamePurlMap[compName]] = locations;
+    }
+    if (locations.size) {
+      purlLocationsSet[comp.purl] = locations;
     }
   }
   const purlLocationMap = {};
@@ -1502,22 +1639,184 @@ export function parseSemanticSlices(language, components, semanticsSlice) {
   return { purlLocationMap };
 }
 
-function searchSymbolLocations(compSymbols, fileIndexes) {
-  const searchHits = [];
-  if (!fileIndexes) {
+/**
+ * Normalise a repository location or Swift purl into `host/owner/name`.
+ *
+ * @param {String} value Repository URL, scp-style git location, or swift purl
+ * @returns {undefined|String} Lowercase `host/path` without scheme and `.git`
+ */
+function normalizeSwiftPackageLocation(value) {
+  if (!value || typeof value !== "string") {
     return undefined;
   }
-  for (const aswiftFile of Object.keys(fileIndexes)) {
-    if (!fileIndexes[aswiftFile].symbolLocations) {
+  let text = value.trim();
+  if (text.startsWith("pkg:swift/")) {
+    text = text.slice("pkg:swift/".length).split("?")[0].split("#")[0];
+    const at = text.lastIndexOf("@");
+    if (at > 0) {
+      text = text.slice(0, at);
+    }
+    try {
+      text = decodeURIComponent(text);
+    } catch (_e) {
+      // Keep the raw value
+    }
+  } else {
+    text = text.split("?")[0].split("#")[0];
+    const scheme = text.indexOf("://");
+    if (scheme >= 0) {
+      text = text.slice(scheme + 3);
+      // Drop userinfo such as git@
+      const slash = text.indexOf("/");
+      const at = text.indexOf("@");
+      if (at >= 0 && (slash < 0 || at < slash)) {
+        text = text.slice(at + 1);
+      }
+    } else if (text.includes("@") && text.includes(":")) {
+      // scp-style git@github.com:owner/name.git
+      text = text.slice(text.indexOf("@") + 1).replace(":", "/");
+    } else {
+      return undefined;
+    }
+  }
+  text = text.replace(/\/+$/, "");
+  if (text.endsWith(".git")) {
+    text = text.slice(0, -4);
+  }
+  if (text.startsWith("www.")) {
+    text = text.slice(4);
+  }
+  return text.toLowerCase() || undefined;
+}
+
+/**
+ * Resolve the Swift module names that belong to a SBOM component.
+ *
+ * A component is named after its package repository or identity while the
+ * semantic slices are keyed by module names. With the `packages` slice, a
+ * package cloned from a repository matches the component whose purl names
+ * the same repository, so a fork with the same name never inherits another
+ * package's evidence; registry and local packages, which have no repository
+ * URL, match by identity or name. Older slices only carry the
+ * `packageModules` aliases (identity, package name, repository name), which
+ * are matched against the component name and the `cdx:swift:packageName`
+ * property, so that `swift-argument-parser` resolves to its `ArgumentParser`
+ * module.
+ *
+ * @param {Object} comp SBOM component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Set<string>} Module names associated with the component
+ */
+function resolveSwiftComponentModules(comp, semanticsSlice) {
+  const moduleNames = new Set();
+  if (!comp?.name) {
+    return moduleNames;
+  }
+  const aliases = new Set(
+    [comp.name, getPropertyValue(comp, "cdx:swift:packageName")]
+      .filter(Boolean)
+      .map((alias) => String(alias).toLowerCase()),
+  );
+  if (Array.isArray(semanticsSlice?.packages)) {
+    const componentLocation = normalizeSwiftPackageLocation(comp.purl);
+    for (const apkg of semanticsSlice.packages) {
+      const packageLocation = normalizeSwiftPackageLocation(apkg?.location);
+      const matches =
+        packageLocation && componentLocation
+          ? packageLocation === componentLocation
+          : [apkg?.identity, apkg?.name].some(
+              (alias) => alias && aliases.has(String(alias).toLowerCase()),
+            );
+      if (matches) {
+        for (const amodule of apkg.modules || []) {
+          moduleNames.add(amodule);
+        }
+      }
+    }
+    return moduleNames;
+  }
+  const packageModules = semanticsSlice?.packageModules || {};
+  for (const alias of new Set([comp.name, ...aliases])) {
+    if (Array.isArray(packageModules[alias])) {
+      for (const amodule of packageModules[alias]) {
+        moduleNames.add(amodule);
+      }
+    }
+  }
+  // Modules named after the package (Yams, SWXMLHash) still match
+  if (!moduleNames.size) {
+    moduleNames.add(comp.name);
+  }
+  return moduleNames;
+}
+
+function getPropertyValue(comp, propertyName) {
+  for (const aproperty of comp?.properties || []) {
+    if (aproperty?.name === propertyName) {
+      return aproperty.value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Collect the symbol names of a component's modules from slices that predate
+ * `moduleReferences`, using the moduleInfos data and the coarser buildSymbols
+ * derived from the build's output file maps.
+ *
+ * @param {Set<String>} moduleNames Module names of the component
+ * @param {Object} semanticsSlice Semantic slice data
+ * @returns {Object} `{ symbols, freeFunctions }` name sets
+ */
+function collectLegacySwiftSymbols(moduleNames, semanticsSlice) {
+  const symbols = new Set();
+  const freeFunctions = new Set();
+  for (const moduleName of moduleNames) {
+    for (const asym of semanticsSlice?.buildSymbols?.[moduleName] || []) {
+      symbols.add(asym);
+    }
+    const moduleInfo = semanticsSlice?.moduleInfos?.[moduleName] || {};
+    for (const asym of [
+      ...(moduleInfo.classes || []),
+      ...(moduleInfo.protocols || []),
+      ...(moduleInfo.enums || []),
+    ]) {
+      symbols.add(asym);
+    }
+    for (const methods of [
+      ...Object.values(moduleInfo.classMethods || {}),
+      ...Object.values(moduleInfo.protocolMethods || {}),
+    ]) {
+      for (const asym of methods || []) {
+        symbols.add(asym);
+      }
+    }
+    for (const asym of moduleInfo.functions || []) {
+      freeFunctions.add(asym);
+    }
+  }
+  return { symbols, freeFunctions };
+}
+
+function searchSymbolLocations(componentSymbols, fileIndexes) {
+  const searchHits = [];
+  const { symbols, freeFunctions } = componentSymbols;
+  for (const aswiftFile of Object.keys(fileIndexes || {})) {
+    const symbolLocations = fileIndexes[aswiftFile]?.symbolLocations;
+    if (!symbolLocations) {
       continue;
     }
-    for (const asym of Object.keys(fileIndexes[aswiftFile].symbolLocations)) {
-      const lineNumbers = fileIndexes[aswiftFile].symbolLocations[asym];
-      if (compSymbols.includes(asym)) {
+    for (const asym of Object.keys(symbolLocations)) {
+      // The index records free functions by their full selector
+      // (`dump(object:canonical:...)`) while module interfaces give the base
+      // name. Only top-level functions are matched by base name: members such
+      // as `encode(to:)` exist in nearly every module
+      const baseName = asym.includes("(") ? asym.split("(")[0] : undefined;
+      if (symbols.has(asym) || (baseName && freeFunctions.has(baseName))) {
         searchHits.push({
           file: aswiftFile,
           symbol: asym,
-          lineNumbers,
+          lineNumbers: symbolLocations[asym],
         });
       }
     }
@@ -1950,7 +2249,10 @@ export async function createEvinseFile(sliceArtefacts, options) {
       bomJson.metadata.component = workspaceComponent;
     }
   }
-  appendComponentProperties(bomJson.metadata?.component, metadataProperties);
+  mergeAnalyzerMetadataProperties(
+    bomJson.metadata?.component,
+    metadataProperties,
+  );
   let occEvidencePresent = false;
   let csEvidencePresent = false;
   let servicesPresent = false;
@@ -2009,8 +2311,15 @@ export async function createEvinseFile(sliceArtefacts, options) {
     servicesPresent = true;
   }
   // Add the crypto components to the components list
+  // Multi-type scans may have collected the same crypto assets during BOM
+  // generation, so skip any bom-ref already present to keep the BOM valid.
   if (cryptoComponents?.length) {
-    bomJson.components = bomJson.components.concat(cryptoComponents);
+    const existingRefs = new Set(
+      bomJson.components.map((comp) => comp["bom-ref"]).filter(Boolean),
+    );
+    bomJson.components = bomJson.components.concat(
+      cryptoComponents.filter((comp) => !existingRefs.has(comp["bom-ref"])),
+    );
   }
   // Add the AI components (machine-learning-model, dataset) discovered by dosai
   if (aiComponents?.length) {
@@ -2035,28 +2344,27 @@ export async function createEvinseFile(sliceArtefacts, options) {
     bomJson.dependencies = newDependencies;
   }
   if (options.annotate) {
-    if (usagesSlicesFile && safeExistsSync(usagesSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(usagesSlicesFile, "utf8"),
-      });
-    }
-    if (dataFlowSlicesFile && safeExistsSync(dataFlowSlicesFile)) {
-      bomJson.annotations.push({
-        subjects: [bomJson.serialNumber],
-        annotator: { component: bomJson.metadata.tools.components[0] },
-        timestamp: getTimestamp(),
-        text: fs.readFileSync(dataFlowSlicesFile, "utf8"),
-      });
-    }
-    if (reachablesSlicesFile && safeExistsSync(reachablesSlicesFile)) {
+    for (const slicesFile of [
+      usagesSlicesFile,
+      dataFlowSlicesFile,
+      reachablesSlicesFile,
+    ]) {
+      if (!slicesFile || !safeExistsSync(slicesFile)) {
+        continue;
+      }
+      // The annotation embeds the slice as one string, which a file this
+      // large cannot become.
+      if (fs.statSync(slicesFile).size > MAX_JSON_TEXT_BYTES) {
+        console.warn(
+          `Not annotating the BOM with the slices file "${slicesFile}", which is too large to embed as text.`,
+        );
+        continue;
+      }
       bomJson.annotations.push({
         subjects: [bomJson.serialNumber],
         annotator: { component: bomJson.metadata.tools.components[0] },
         timestamp: getTimestamp(),
-        text: fs.readFileSync(reachablesSlicesFile, "utf8"),
+        text: fs.readFileSync(slicesFile, "utf8"),
       });
     }
   }