@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/ecosystems/parsers-misc.js

@@ -4,6 +4,7 @@ import {
   sep as _sep,
   basename,
   dirname,
+  isAbsolute,
   join,
   relative,
   resolve,
@@ -12,11 +13,7 @@ import {
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
 
-import {
-  cdxgenAgent,
-  DEBUG_MODE,
-  readEnvironmentVariable,
-} from "../core/activity.js";
+import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
@@ -28,10 +25,12 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import { registerRunReset } from "../core/runState.js";
 import { mesonWrapDB } from "../core/state.js";
 import { isGitHubUrl } from "../core/urls.js";
 import { parseWorkflowFile } from "../inventory/ciParsers/githubActions.js";
 import {
+  gatedGet,
   prefetchEnabled,
   prefetchedResponse,
   prefetchJson,
@@ -44,9 +43,37 @@ import {
   tryBuildPurl,
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
+import { cmakeFetchDependencies } from "../parsers/cmakeLists.js";
+import { submodulePurlCoordinates } from "../parsers/gitmodules.js";
 import { getDartMetadata } from "./ecosystems.js";
 import { parsePkgJson } from "./parsers-js.js";
 
+/**
+ * Upper bound for a flake.nix `inputs = { ... }` block before the input-name
+ * patterns are applied. The patterns backtrack quadratically, so an unbounded
+ * attacker-crafted block is a CPU denial of service; genuine inputs blocks are
+ * a few kilobytes at most.
+ *
+ * @type {number}
+ */
+const MAX_FLAKE_INPUTS_BLOCK_LENGTH = 16 * 1024;
+
+/**
+ * Whether a package registry can hold a pubspec.lock entry.
+ *
+ * The entry's `source` names where the package comes from. `sdk` packages ship
+ * with the Dart or Flutter SDK, `path` packages live in the working tree, and
+ * `git` packages come from a repository. None is published on a registry, and
+ * asking about them leaks their names and imports a look-alike's metadata.
+ *
+ * @param {Object} packageData One pubspec.lock `packages` entry.
+ * @returns {boolean}
+ */
+function canPubRegistryServe(packageData) {
+  const source = packageData?.source;
+  return source === undefined || source === "hosted";
+}
+
 /**
  * Method to parse pubspec.lock files.
  *
@@ -59,10 +86,11 @@ export async function parsePubLockData(pubLockData, lockFile) {
   if (!pubLockData) {
     return [];
   }
-  let pkgList = [];
+  const pkgList = [];
   const rootList = [];
   const data = _load(pubLockData);
   const packages = data.packages;
+  const lookupList = [];
   for (const [packageName, packageData] of Object.entries(packages)) {
     const pkg = {
       name: packageName,
@@ -119,9 +147,15 @@ export async function parsePubLockData(pubLockData, lockFile) {
       };
     }
     pkgList.push(pkg);
+    if (canPubRegistryServe(packageData)) {
+      lookupList.push(pkg);
+    }
   }
   if (shouldFetchLicense()) {
-    pkgList = await getDartMetadata(pkgList);
+    // getDartMetadata enriches in place, so the sdk, path and git packages
+    // stay in pkgList with the lockfile's answers and are simply not handed
+    // to it.
+    await getDartMetadata(lookupList);
   }
   return { rootList, pkgList };
 }
@@ -1206,19 +1240,41 @@ export function parseFlakeNix(flakeNixFile) {
     let match;
     while ((match = inputsRegex.exec(flakeContent)) !== null) {
       const inputBlock = match[0];
+      // The name-run patterns below backtrack quadratically over unbounded
+      // blocks, so a crafted flake.nix could burn minutes of CPU. Real flake
+      // inputs blocks are a few KB; anything larger is skipped.
+      if (inputBlock.length > MAX_FLAKE_INPUTS_BLOCK_LENGTH) {
+        if (DEBUG_MODE) {
+          console.log(
+            `Skipping a suspiciously large inputs block (${inputBlock.length} chars) in ${flakeNixFile}.`,
+          );
+        }
+        continue;
+      }
 
-      // Match different input patterns including nested inputs
+      // Match different input patterns including nested inputs. The cheap
+      // substring pre-checks keep URL-less blocks linear.
       const inputPatterns = [
-        /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\.url\s*=\s*"([^"]+)"/g,
-        /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\s*=\s*\{\s*url\s*=\s*"([^"]+)"[^}]*}/gs,
+        {
+          regex: /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\.url\s*=\s*"([^"]+)"/g,
+          probe: ".url",
+        },
+        {
+          regex:
+            /([a-zA-Z0-9_-]+(?:\.[a-zA-Z0-9_-]+)*)\s*=\s*\{\s*url\s*=\s*"([^"]+)"[^}]*}/gs,
+          probe: "url",
+        },
       ];
 
       const addedPackages = new Set();
 
       for (const pattern of inputPatterns) {
+        if (!inputBlock.includes(pattern.probe)) {
+          continue;
+        }
         let subMatch;
-        pattern.lastIndex = 0;
-        while ((subMatch = pattern.exec(inputBlock)) !== null) {
+        pattern.regex.lastIndex = 0;
+        while ((subMatch = pattern.regex.exec(inputBlock)) !== null) {
           const name = subMatch[1];
           const url = subMatch[2] || subMatch[3];
 
@@ -1780,7 +1836,7 @@ export function parseSwiftJsonTreeObject(
       group: purl ? purl.namespace : "",
       version: purl ? purl.version : jsonObject.version,
     },
-    purl ? decodeURIComponent(purl.toString()) : null,
+    purl ? purl.toString() : null,
     jsonObject.name,
   );
   const properties = [];
@@ -1886,15 +1942,23 @@ export function parseSwiftResolved(resolvedFile) {
       }
       for (const adep of resolvedList) {
         const locationOrUrl = adep.location || adep.repositoryURL;
-        const version = adep.state.version || adep.state.revision;
+        const version = adep.state?.version || adep.state?.revision;
+        // A pin with no remote URL (a local checkout) has no valid swift
+        // namespace, so it becomes a component without a purl instead of
+        // aborting the rest of the file.
         const purl = purlFromUrlString("swift", locationOrUrl, version);
-        const purlString = decodeURIComponent(purl.toString());
+        const name =
+          purl?.name ||
+          adep.identity ||
+          adep.package ||
+          (locationOrUrl ? basename(locationOrUrl).replace(/\.git$/, "") : "");
+        if (!name) {
+          continue;
+        }
         const rootPkg = {
-          name: purl.name,
-          group: purl.namespace,
-          version: purl.version,
-          purl: purlString,
-          "bom-ref": purlString,
+          name,
+          group: purl?.namespace || "",
+          version: purl ? purl.version : version,
           properties: [
             {
               name: "internal:SrcFile",
@@ -1903,7 +1967,7 @@ export function parseSwiftResolved(resolvedFile) {
           ],
           evidence: {
             identity: {
-              field: "purl",
+              field: purl ? "purl" : "name",
               confidence: 1,
               methods: [
                 {
@@ -1915,6 +1979,7 @@ export function parseSwiftResolved(resolvedFile) {
             },
           },
         };
+        applyPurl(rootPkg, purl ? purl.toString() : null);
         if (locationOrUrl) {
           rootPkg.repository = { url: locationOrUrl };
         }
@@ -1927,6 +1992,281 @@ export function parseSwiftResolved(resolvedFile) {
   return pkgList;
 }
 
+/**
+ * Compute the bom-ref of a `swift package show-dependencies` node the same
+ * way parseSwiftJsonTreeObject does.
+ *
+ * @param {Object} node show-dependencies node
+ * @returns {undefined|string} bom-ref
+ */
+function swiftTreeNodeRef(node) {
+  if (node?.url?.startsWith("http")) {
+    const purl = purlFromUrlString("swift", node.url, node.version);
+    if (purl) {
+      return decodeURIComponent(purl.toString());
+    }
+  }
+  return node?.name;
+}
+
+function swiftTreeNodeKeys(node) {
+  const repoName = (node?.url || "")
+    .split("?")[0]
+    .replace(/\/+$/, "")
+    .split("/")
+    .pop()
+    ?.replace(/\.git$/, "");
+  return [node?.identity, node?.name, repoName]
+    .filter(Boolean)
+    .map((k) => String(k).toLowerCase());
+}
+
+// Target types that are part of what the package builds and ships
+const SWIFT_PRODUCTION_TARGET_TYPES = new Set([
+  "executable",
+  "macro",
+  "plugin",
+]);
+
+/**
+ * Identify the targets of a Swift package that are part of what it ships.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests,
+ * such as snapshot or fixture helper libraries.
+ *
+ * @param {Object} dumpJson `swift package dump-package` document
+ * @returns {Set<string>} Lowercase names of the production targets
+ */
+export function collectSwiftProductionTargets(dumpJson) {
+  const targets = dumpJson?.targets || [];
+  const targetsByName = new Map(
+    targets.map((t) => [String(t?.name || "").toLowerCase(), t]),
+  );
+  const localTargetRefs = (target) => {
+    const refs = [];
+    for (const adep of target?.dependencies || []) {
+      const name = adep?.target?.[0] ?? adep?.byName?.[0];
+      if (name && targetsByName.has(String(name).toLowerCase())) {
+        refs.push(String(name).toLowerCase());
+      }
+    }
+    return refs;
+  };
+  const productTargets = new Set(
+    (dumpJson?.products || []).flatMap((p) =>
+      (p?.targets || []).map((t) => String(t).toLowerCase()),
+    ),
+  );
+  const referencedTargets = new Set(targets.flatMap((t) => localTargetRefs(t)));
+  const productionTargets = new Set();
+  const stack = targets
+    .filter(
+      (t) =>
+        !isSwiftTestTarget(t) &&
+        (productTargets.has(String(t.name).toLowerCase()) ||
+          SWIFT_PRODUCTION_TARGET_TYPES.has(t.type) ||
+          !referencedTargets.has(String(t.name).toLowerCase())),
+    )
+    .map((t) => String(t.name).toLowerCase());
+  while (stack.length) {
+    const name = stack.pop();
+    if (productionTargets.has(name)) {
+      continue;
+    }
+    productionTargets.add(name);
+    stack.push(...localTargetRefs(targetsByName.get(name)));
+  }
+  return productionTargets;
+}
+
+/**
+ * Classify the dependencies of a Swift package into the packages its shipped
+ * code needs and the packages only its tests need.
+ *
+ * Production targets are the non-test targets that are part of a product,
+ * executables, macros, plugins, targets nothing else depends on, and every
+ * target they depend on. The remaining non-test targets only serve tests
+ * (test-support libraries). A package is test-only when only test and
+ * test-support targets reference its products or use its plugins. With the dependency graph from
+ * `swift package show-dependencies`, the packages reachable only through
+ * test-only packages are test-only as well; a package reachable from a
+ * production dependency, or from a declared dependency no target references,
+ * stays required.
+ *
+ * Target dependencies reference products either as
+ * `{"product": [name, package]}` or `{"byName": [name]}`; SwiftPM resolves a
+ * `byName` product through the package of the same name. When a production
+ * `byName` reference names neither a local target nor a package, the
+ * classification is abandoned rather than risking a required package being
+ * scoped optional.
+ *
+ * @param {Object|String} dumpJson `swift package dump-package` document, parsed or as text
+ * @param {Object|String} [treeJson] `swift package show-dependencies --format json` document, parsed or as text
+ * @returns {Object} `{ optionalRefs, requiredRefs, optionalNames, requiredNames }`:
+ *   bom-refs from the dependency graph, and lowercase package identities,
+ *   names, and repository names (the only result without a graph)
+ */
+export function classifySwiftDependencyScopes(dumpJson, treeJson) {
+  // Command output may be handed over unparsed
+  const parseJson = (value) => {
+    if (typeof value !== "string") {
+      return value;
+    }
+    try {
+      return JSON.parse(value);
+    } catch (_e) {
+      return undefined;
+    }
+  };
+  dumpJson = parseJson(dumpJson);
+  treeJson = parseJson(treeJson);
+  const empty = {
+    optionalRefs: new Set(),
+    requiredRefs: new Set(),
+    optionalNames: new Set(),
+    requiredNames: new Set(),
+  };
+  const targets = dumpJson?.targets || [];
+  if (!targets.length) {
+    return empty;
+  }
+  const targetsByName = new Map(
+    targets.map((t) => [String(t?.name || "").toLowerCase(), t]),
+  );
+  const productionTargets = collectSwiftProductionTargets(dumpJson);
+  const packageKeys = (target) => {
+    const keys = [];
+    const unresolved = [];
+    for (const adep of target?.dependencies || []) {
+      if (adep?.product) {
+        keys.push(String(adep.product[1] ?? adep.product[0]).toLowerCase());
+      } else if (adep?.byName?.[0]) {
+        const name = String(adep.byName[0]).toLowerCase();
+        if (!targetsByName.has(name)) {
+          unresolved.push(name);
+        }
+      }
+    }
+    // Build tool plugins count for the target that uses them, so a plugin
+    // used only by test targets is test-only
+    for (const ausage of target?.pluginUsages || []) {
+      if (ausage?.plugin?.[1]) {
+        keys.push(String(ausage.plugin[1]).toLowerCase());
+      }
+    }
+    return { keys, unresolved };
+  };
+  const directNodes = treeJson?.dependencies || [];
+  const nodesByKey = new Map();
+  for (const node of directNodes) {
+    for (const key of swiftTreeNodeKeys(node)) {
+      if (!nodesByKey.has(key)) {
+        nodesByKey.set(key, node);
+      }
+    }
+  }
+  const prodKeys = new Set();
+  const testKeys = new Set();
+  for (const target of targets) {
+    const isProduction =
+      !isSwiftTestTarget(target) &&
+      productionTargets.has(String(target.name).toLowerCase());
+    const { keys, unresolved } = packageKeys(target);
+    const bucket = isProduction ? prodKeys : testKeys;
+    for (const key of keys) {
+      bucket.add(key);
+    }
+    for (const name of unresolved) {
+      // byName products resolve through the package of the same name
+      if (!treeJson || nodesByKey.has(name)) {
+        bucket.add(name);
+      } else if (isProduction) {
+        return empty;
+      }
+    }
+  }
+  if (!treeJson) {
+    return {
+      ...empty,
+      optionalNames: new Set([...testKeys].filter((k) => !prodKeys.has(k))),
+      requiredNames: prodKeys,
+    };
+  }
+  // Package graph keyed by bom-ref
+  const childrenByRef = new Map();
+  const keysByRef = new Map();
+  const collectGraph = (node) => {
+    const ref = swiftTreeNodeRef(node);
+    if (!ref || childrenByRef.has(ref)) {
+      return ref;
+    }
+    childrenByRef.set(ref, new Set());
+    keysByRef.set(ref, swiftTreeNodeKeys(node));
+    for (const child of node?.dependencies || []) {
+      const childRef = collectGraph(child);
+      if (childRef) {
+        childrenByRef.get(ref).add(childRef);
+      }
+    }
+    return ref;
+  };
+  const prodRoots = [];
+  const testRoots = [];
+  for (const node of directNodes) {
+    const ref = collectGraph(node);
+    const keys = swiftTreeNodeKeys(node);
+    const usedByProduction = keys.some((k) => prodKeys.has(k));
+    const usedByTests = keys.some((k) => testKeys.has(k));
+    if (usedByTests && !usedByProduction) {
+      testRoots.push(ref);
+    } else {
+      // Production dependencies, and declared dependencies no target uses
+      prodRoots.push(ref);
+    }
+  }
+  const reach = (roots) => {
+    const seen = new Set();
+    const pending = [...roots];
+    while (pending.length) {
+      const ref = pending.pop();
+      if (!ref || seen.has(ref)) {
+        continue;
+      }
+      seen.add(ref);
+      pending.push(...(childrenByRef.get(ref) || []));
+    }
+    return seen;
+  };
+  const requiredRefs = reach(prodRoots);
+  const optionalRefs = new Set(
+    [...reach(testRoots)].filter((ref) => !requiredRefs.has(ref)),
+  );
+  // Components from Package.resolved can carry a different version or URL
+  // spelling than the graph, so the package names are reported as well
+  const namesOf = (refs) =>
+    new Set([...refs].flatMap((ref) => keysByRef.get(ref) || []));
+  return {
+    optionalRefs,
+    requiredRefs,
+    optionalNames: namesOf(optionalRefs),
+    requiredNames: namesOf(requiredRefs),
+  };
+}
+
+/**
+ * Decide whether a dump-package target is a test target. The `type` field is
+ * usually the string `"test"`, but manifest APIs have also been observed
+ * representing it as an object.
+ *
+ * @param {Object} atarget dump-package target
+ * @returns {boolean} `true` for test targets
+ */
+export function isSwiftTestTarget(atarget) {
+  return atarget?.type === "test" || atarget?.type?.test === true;
+}
+
 /**
  * Parse a CMake-generated dot/graphviz file and extract components and their dependency
  * relationships.
@@ -2047,12 +2387,256 @@ export function parseCmakeDotFile(dotFile, pkgType, options = {}) {
   };
 }
 
+/** CMake `URL_HASH` algorithm names, their CycloneDX spelling and hex length. */
+const CMAKE_HASH_ALGORITHMS = {
+  MD5: ["MD5", 32],
+  SHA1: ["SHA-1", 40],
+  SHA256: ["SHA-256", 64],
+  SHA384: ["SHA-384", 96],
+  SHA512: ["SHA-512", 128],
+  SHA3_256: ["SHA3-256", 64],
+  SHA3_384: ["SHA3-384", 96],
+  SHA3_512: ["SHA3-512", 128],
+};
+
+/** Keywords of the CMake `find_*` commands; they are never package names. */
+const CMAKE_FIND_KEYWORDS = new Set([
+  "BYPASS_PROVIDER",
+  "CMAKE_FIND_ROOT_PATH_BOTH",
+  "COMPONENTS",
+  "CONFIG",
+  "CONFIGS",
+  "DOC",
+  "ENV",
+  "EXACT",
+  "GLOBAL",
+  "HINTS",
+  "MODULE",
+  "NAMES",
+  "NAMES_PER_DIR",
+  "NO_CACHE",
+  "NO_CMAKE_BUILDS_PATH",
+  "NO_CMAKE_ENVIRONMENT_PATH",
+  "NO_CMAKE_FIND_ROOT_PATH",
+  "NO_CMAKE_INSTALL_PREFIX",
+  "NO_CMAKE_PACKAGE_REGISTRY",
+  "NO_CMAKE_PATH",
+  "NO_CMAKE_SYSTEM_PACKAGE_REGISTRY",
+  "NO_CMAKE_SYSTEM_PATH",
+  "NO_DEFAULT_PATH",
+  "NO_MODULE",
+  "NO_PACKAGE_ROOT_PATH",
+  "NO_POLICY_SCOPE",
+  "NO_SYSTEM_ENVIRONMENT_PATH",
+  "ONLY_CMAKE_FIND_ROOT_PATH",
+  "OPTIONAL",
+  "OPTIONAL_COMPONENTS",
+  "PATHS",
+  "PATH_SUFFIXES",
+  "QUIET",
+  "REGISTRY_VIEW",
+  "REQUIRED",
+  "VALIDATOR",
+]);
+
+const CMAKE_FIND_COMMANDS = new Set([
+  "find_package",
+  "find_library",
+  "find_dependency",
+  "find_file",
+]);
+
+/**
+ * A download URL that is safe to publish: http(s) or ftp only, with any user
+ * information, query string and fragment removed.
+ *
+ * @param {string} url URL as written in the build file
+ * @returns {string|undefined} The cleaned URL, or undefined when it is not one
+ */
+function publishableDownloadUrl(url) {
+  if (!url || url.includes("${")) {
+    return undefined;
+  }
+  try {
+    const parsed = new URL(url);
+    if (!["http:", "https:", "ftp:"].includes(parsed.protocol)) {
+      return undefined;
+    }
+    parsed.username = "";
+    parsed.password = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return parsed.toString();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The repository and version of a GitHub source archive URL:
+ * `https://github.com/<owner>/<repo>/archive/<ref>.zip` (also `refs/tags/...`
+ * and `.tar.gz`) and
+ * `https://github.com/<owner>/<repo>/releases/download/<tag>/<file>`.
+ *
+ * @param {string} url Download URL
+ * @returns {{owner: string, repo: string, version: string}|undefined}
+ */
+function githubArchiveCoordinates(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return undefined;
+  }
+  if (parsed.hostname !== "github.com") {
+    return undefined;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length < 4) {
+    return undefined;
+  }
+  const [owner, repo, section, ...rest] = segments;
+  let version;
+  if (section === "archive") {
+    let ref = rest.join("/");
+    for (const prefix of ["refs/tags/", "refs/heads/"]) {
+      if (ref.startsWith(prefix)) {
+        ref = ref.slice(prefix.length);
+      }
+    }
+    for (const ext of [".tar.gz", ".tar.bz2", ".tar.xz", ".tgz", ".zip"]) {
+      if (ref.endsWith(ext)) {
+        ref = ref.slice(0, -ext.length);
+        break;
+      }
+    }
+    version = ref;
+  } else if (section === "releases" && rest[0] === "download" && rest[1]) {
+    version = rest[1];
+  }
+  if (!version) {
+    return undefined;
+  }
+  return { owner, repo: repo.replace(/\.git$/, ""), version };
+}
+
+/**
+ * The source archive of the WrapDB release a Meson dependency name resolved to,
+ * as a distribution reference carrying the archive's hash. The hash describes
+ * that release's archive, which is not known to be the version the project
+ * builds, so it belongs to the reference rather than to the component.
+ *
+ * @param {Object} awrap WrapDB entry
+ * @returns {Object|undefined} External reference, or undefined without a URL
+ */
+function wrapDbReference(awrap) {
+  const url = publishableDownloadUrl(awrap?.analyzed_source_url);
+  if (!url) {
+    return undefined;
+  }
+  const reference = {
+    type: "distribution",
+    url,
+    comment:
+      `WrapDB release ${awrap.name_with_version || awrap.analyzed_version || ""}`.trim(),
+  };
+  if (/^[0-9a-fA-F]{64}$/.test(awrap.analyzed_source_hash || "")) {
+    reference.hashes = [
+      { alg: "SHA-256", content: awrap.analyzed_source_hash.toLowerCase() },
+    ];
+  }
+  return reference;
+}
+
+/**
+ * The component for a dependency a CMake file downloads at configure time
+ * (`FetchContent_Declare`, `ExternalProject_Add`, `CPMAddPackage`).
+ *
+ * A git repository becomes a `github` purl, or a `generic` one with a
+ * `vcs_url`, at its tag or commit. A GitHub archive URL becomes a `github` purl
+ * at the ref it names. Any other URL becomes a `generic` purl with a
+ * `download_url`, and a `URL_HASH` becomes a hash. A version that still holds an
+ * unresolved `${VAR}` is left out rather than published.
+ *
+ * @param {Object} dep Dependency facts from `cmakeFetchDependencies`
+ * @param {string} srcFile The CMake file the dependency was read from
+ * @returns {Object} The component
+ */
+export function cmakeFetchDependencyComponent(dep, srcFile) {
+  const resolved = (value) =>
+    value && !value.includes("${") ? value : undefined;
+  let version = resolved(dep.gitTag) || resolved(dep.version);
+  let coords;
+  const gitUrl = publishableDownloadUrl(dep.gitRepository);
+  const downloadUrl = publishableDownloadUrl(dep.url);
+  if (gitUrl) {
+    coords = submodulePurlCoordinates(gitUrl, version);
+  } else if (downloadUrl) {
+    const archive = githubArchiveCoordinates(downloadUrl);
+    if (archive) {
+      version = version || archive.version;
+      coords = {
+        type: "github",
+        namespace: archive.owner,
+        name: archive.repo,
+        version,
+      };
+    } else {
+      coords = {
+        type: "generic",
+        name: dep.name,
+        version: version || null,
+        qualifiers: { download_url: downloadUrl },
+      };
+    }
+  }
+  const purl =
+    (coords && tryBuildPurl(coords)) ||
+    tryBuildPurl({ type: "generic", name: dep.name, version: version || null });
+  const confidence = version ? 0.6 : 0.3;
+  const component = {
+    name: dep.name,
+    version: version || "",
+    type: "library",
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence,
+            value: `Filename ${srcFile}`,
+          },
+        ],
+      },
+    },
+    properties: [
+      { name: "cdx:cmake:depKind", value: dep.kind },
+      { name: "cdx:cmake:resolvedVia", value: "cmake-lists" },
+    ],
+  };
+  applyPurl(component, purl, `library:${dep.name}:${version || ""}`);
+  const [alg, content] = (dep.urlHash || "").split("=");
+  const [cdxAlg, hexLength] = CMAKE_HASH_ALGORITHMS[alg?.toUpperCase()] || [];
+  if (
+    cdxAlg &&
+    content?.length === hexLength &&
+    /^[0-9a-fA-F]+$/.test(content)
+  ) {
+    component.hashes = [{ alg: cdxAlg, content: content.toLowerCase() }];
+  }
+  return component;
+}
+
 /**
  * Parse a CMake-like build file (CMakeLists.txt, meson.build, etc.) and extract the
  * parent component and list of dependency packages.
  *
  * Handles `set`, `project`, `find_package`, `find_library`, `find_dependency`,
- * `find_file`, `FetchContent_MakeAvailable`, and `dependency()` directives.
+ * `find_file` and `dependency()` directives (CMake command names in any case),
+ * and, for CMake files, the dependencies downloaded at configure time by
+ * `FetchContent_Declare`, `ExternalProject_Add` and `CPMAddPackage`.
  * Uses the MesonWrapDB to improve name resolution confidence.
  *
  * @param {string} cmakeListFile Path to the CMake-like build file
@@ -2061,13 +2645,30 @@ export function parseCmakeDotFile(dotFile, pkgType, options = {}) {
  * @returns {{ parentComponent: Object, pkgList: Object[] }}
  */
 export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
-  let cmakeListData = readFileSync(cmakeListFile, { encoding: "utf-8" });
+  const rawData = readFileSync(cmakeListFile, { encoding: "utf-8" });
+  let cmakeListData = rawData;
   const pkgList = [];
   const pkgAddedMap = {};
   const versionSpecifiersMap = {};
   const versionsMap = {};
   let parentComponent = {};
   const templateValues = {};
+  // A dependency fetched at configure time is the same package a find_package()
+  // of the same name asks for: the fetched component, with its source and pin,
+  // stands for both.
+  const fetchedNames = new Set();
+  if (!basename(cmakeListFile).startsWith("meson")) {
+    const fetchedRefs = new Set();
+    for (const dep of cmakeFetchDependencies(rawData)) {
+      const component = cmakeFetchDependencyComponent(dep, cmakeListFile);
+      if (fetchedRefs.has(component["bom-ref"])) {
+        continue;
+      }
+      fetchedRefs.add(component["bom-ref"]);
+      fetchedNames.add(dep.name.toLowerCase());
+      pkgList.push(component);
+    }
+  }
   cmakeListData = cmakeListData
     .replace(/^ {2}/g, "")
     .replace(/\(\r\n/g, "(")
@@ -2082,138 +2683,129 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
     const group = "";
     const path = undefined;
     const name_list = [];
-    if (l.startsWith("set")) {
-      const tmpA = l.replace("set(", "").replace(")", "").trim().split(" ");
+    // CMake command names are case-insensitive: `PROJECT(...)` and
+    // `Find_Package(...)` are the same commands as their lower-case spellings.
+    const openParen = l.indexOf("(");
+    const command =
+      openParen > 0 ? l.slice(0, openParen).trim().toLowerCase() : "";
+    let commandArgs = openParen > 0 ? l.slice(openParen + 1) : "";
+    if (command === "set") {
+      const tmpA = commandArgs.replace(")", "").trim().split(" ");
       if (tmpA && tmpA.length === 2) {
         templateValues[tmpA[0]] = tmpA[1];
       }
-    } else if (
-      l.startsWith("project") &&
-      !Object.keys(parentComponent).length
-    ) {
-      if (l.includes("${")) {
+    } else if (command === "project" && !Object.keys(parentComponent).length) {
+      if (commandArgs.includes("${")) {
         for (const tmplKey of Object.keys(templateValues)) {
-          l = l.replace(`\${${tmplKey}}`, templateValues[tmplKey] || "");
+          commandArgs = commandArgs.replace(
+            `\${${tmplKey}}`,
+            templateValues[tmplKey] || "",
+          );
         }
       }
-      const tmpA = l.replace("project (", "project(").split("project(");
-      if (tmpA && tmpA.length > 1) {
-        const tmpB = (tmpA[1] || "")
-          .trim()
-          .replace(/["']/g, "")
-          .replace(/ /g, ",")
-          .split(")")[0]
-          .split(",")
-          .filter((v) => v.length > 1);
-        const parentName =
-          tmpB.length > 0 ? tmpB[0].replace(":", "").trim() : "";
-        let parentVersion;
-        // In case of meson.build we can find the version number after the word version
-        // thanks to our replaces and splits
-        const versionIndex = tmpB.findIndex(
-          (v) => v?.toLowerCase() === "version",
+      const tmpB = commandArgs
+        .trim()
+        .replace(/["']/g, "")
+        .replace(/ /g, ",")
+        .split(")")[0]
+        .split(",")
+        .filter((v) => v.length > 1);
+      const parentName = tmpB.length > 0 ? tmpB[0].replace(":", "").trim() : "";
+      let parentVersion;
+      // In case of meson.build we can find the version number after the word version
+      // thanks to our replaces and splits
+      const versionIndex = tmpB.findIndex(
+        (v) => v?.toLowerCase() === "version",
+      );
+      if (versionIndex > -1 && tmpB.length > versionIndex) {
+        parentVersion = tmpB[versionIndex + 1];
+      }
+      // A `${VAR}` that no `set()` in this file defines stays literal. It is
+      // not a version, and percent-encoding it into a purl publishes the
+      // variable name as the version, so the field is left empty instead.
+      // CMakeCache.txt carries the evaluated value when a build tree exists.
+      if (parentVersion?.includes("$")) {
+        parentVersion = undefined;
+      }
+      if (parentName?.length && !parentName.includes("$")) {
+        parentComponent = {
+          group: options.projectGroup || "",
+          name: parentName,
+          version: parentVersion || options.projectVersion || "",
+          type: "application",
+        };
+        const safePath = path ? path.replace(/^\/+/, "") : null;
+        parentComponent["purl"] = build({
+          type: pkgType,
+          namespace: parentComponent.group || null,
+          name: parentComponent.name,
+          version: parentComponent.version || null,
+          subpath: safePath,
+        });
+        parentComponent["bom-ref"] = decodeURIComponent(
+          parentComponent["purl"],
         );
-        if (versionIndex > -1 && tmpB.length > versionIndex) {
-          parentVersion = tmpB[versionIndex + 1];
-        }
-        // A `${VAR}` that no `set()` in this file defines stays literal. It is
-        // not a version, and percent-encoding it into a purl publishes the
-        // variable name as the version, so the field is left empty instead.
-        // CMakeCache.txt carries the evaluated value when a build tree exists.
-        if (parentVersion?.includes("$")) {
-          parentVersion = undefined;
-        }
-        if (parentName?.length && !parentName.includes("$")) {
-          parentComponent = {
-            group: options.projectGroup || "",
-            name: parentName,
-            version: parentVersion || options.projectVersion || "",
-            type: "application",
-          };
-          const safePath = path ? path.replace(/^\/+/, "") : null;
-          parentComponent["purl"] = build({
-            type: pkgType,
-            namespace: parentComponent.group || null,
-            name: parentComponent.name,
-            version: parentComponent.version || null,
-            subpath: safePath,
-          });
-          parentComponent["bom-ref"] = decodeURIComponent(
-            parentComponent["purl"],
-          );
-        }
       }
-    } else if (l.startsWith("find_")) {
-      let tmpA = [];
-      for (const fm of [
-        "find_package(",
-        "find_library(",
-        "find_dependency(",
-        "find_file(",
-        "FetchContent_MakeAvailable(",
-      ]) {
-        if (l.startsWith(fm)) {
-          tmpA = l.split(fm);
-          break;
+    } else if (CMAKE_FIND_COMMANDS.has(command)) {
+      let tmpB = commandArgs.split(")")[0].split(" ");
+      tmpB = tmpB.filter(
+        (v) =>
+          !CMAKE_FIND_KEYWORDS.has(v) &&
+          !v.includes("$") &&
+          !v.startsWith("CMAKE_") &&
+          v.length,
+      );
+      // find_package(Catch2)
+      // find_package(GTest REQUIRED)
+      // find_package(Boost 1.79 COMPONENTS date_time)
+      // find_library(PTHREADPOOL_LIB pthreadpool REQUIRED)
+      // find_library and find_file name the cache variable that receives the
+      // result in their first argument, so that argument is a destination
+      // rather than a package. Every other command in this list opens with a
+      // package name, including names such as `ZLIB` that read like a
+      // variable.
+      // Their names are the values after NAMES, or else the one argument after
+      // the variable; the remaining arguments are search paths and options.
+      if (command === "find_library" || command === "find_file") {
+        const tokens = commandArgs
+          .split(")")[0]
+          .split(" ")
+          .filter((v) => v.length);
+        const namesAt = tokens.indexOf("NAMES");
+        let names = tokens.slice(1, 2);
+        if (namesAt > -1) {
+          names = [];
+          for (const token of tokens.slice(namesAt + 1)) {
+            if (CMAKE_FIND_KEYWORDS.has(token)) {
+              break;
+            }
+            names.push(token);
+          }
         }
+        tmpB = names.filter((v) => !v.includes("$") && !v.startsWith("CMAKE_"));
       }
-      if (tmpA && tmpA.length > 1) {
-        let tmpB = tmpA[1].split(")")[0].split(" ");
-        tmpB = tmpB.filter(
-          (v) =>
-            ![
-              "REQUIRED",
-              "COMPONENTS",
-              "QUIET",
-              "NAMES",
-              "PATHS",
-              "ENV",
-              "NO_MODULE",
-              "NO_DEFAULT_PATH",
-            ].includes(v) &&
-            !v.includes("$") &&
-            !v.startsWith("CMAKE_") &&
-            v.length,
-        );
-        // find_package(Catch2)
-        // find_package(GTest REQUIRED)
-        // find_package(Boost 1.79 COMPONENTS date_time)
-        // find_library(PTHREADPOOL_LIB pthreadpool REQUIRED)
-        // find_library and find_file name the cache variable that receives the
-        // result in their first argument, so that argument is a destination
-        // rather than a package. Every other command in this list opens with a
-        // package name, including names such as `ZLIB` that read like a
-        // variable.
-        if (l.startsWith("find_library") || l.startsWith("find_file")) {
-          tmpB = tmpB.slice(1);
-        }
-        if (tmpB.length) {
-          const working_name = tmpB[0];
-          name_list.push(working_name);
-          if (l.startsWith("find_package") && tmpB.length > 1) {
-            if (
-              /^\d+/.test(tmpB[1]) &&
-              !tmpB[1].includes("${") &&
-              !tmpB[1].startsWith("@")
-            ) {
-              versionsMap[working_name] = tmpB[1];
+      if (tmpB.length) {
+        const working_name = tmpB[0];
+        name_list.push(working_name);
+        if (command === "find_package" && tmpB.length > 1) {
+          if (
+            /^\d+/.test(tmpB[1]) &&
+            !tmpB[1].includes("${") &&
+            !tmpB[1].startsWith("@")
+          ) {
+            versionsMap[working_name] = tmpB[1];
+          }
+        } else {
+          for (const n of tmpB) {
+            if (n.match(/^\d/)) {
+              continue;
             }
-          } else {
-            for (const n of tmpB) {
-              if (n.match(/^\d/)) {
-                continue;
-              }
-              if (n.includes(_sep)) {
-                if (
-                  n.includes(".so") ||
-                  n.includes(".a") ||
-                  n.includes(".dll")
-                ) {
-                  name_list.push(basename(n));
-                }
-              } else {
-                name_list.push(n);
+            if (n.includes(_sep)) {
+              if (n.includes(".so") || n.includes(".a") || n.includes(".dll")) {
+                name_list.push(basename(n));
               }
+            } else {
+              name_list.push(n);
             }
           }
         }
@@ -2245,10 +2837,12 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
     for (let n of name_list) {
       const props = [];
       let confidence = 0;
+      let wrapReference;
       if (
         n &&
         n.length > 1 &&
         !pkgAddedMap[n] &&
+        !fetchedNames.has(n.toLowerCase()) &&
         !n.startsWith(_sep) &&
         !n.startsWith("@")
       ) {
@@ -2263,14 +2857,18 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
           ) {
             // Use the new name
             n = wrapkey;
-            for (const eprop of Object.keys(awrap)) {
+            wrapReference = wrapDbReference(awrap);
+            props.push({ name: "cdx:meson:wrapdb:wrap", value: wrapkey });
+            if (awrap.analyzed_version) {
               props.push({
-                name: eprop,
-                value: Array.isArray(awrap[eprop])
-                  ? awrap[eprop].join("|")
-                  : awrap[eprop],
+                name: "cdx:meson:wrapdb:latestVersion",
+                value: awrap.analyzed_version,
               });
             }
+            props.push({
+              name: "internal:PkgProvides",
+              value: awrap.PkgProvides.join("|"),
+            });
             // Our confidence has improved from 0 since there is a matching wrap so we know the correct name
             // and url. We lack the version details.
             confidence = 0.5;
@@ -2321,6 +2919,9 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
           },
           properties: props,
         };
+        if (wrapReference) {
+          apkg.externalReferences = [wrapReference];
+        }
         apkg["bom-ref"] = decodeURIComponent(apkg["purl"]);
         pkgList.push(apkg);
         pkgAddedMap[n] = true;
@@ -2350,41 +2951,48 @@ export function parseCUsageSlice(sliceData) {
     return undefined;
   }
   const usageData = {};
-  try {
-    const objectSlices = sliceData.objectSlices || [];
-    for (const slice of objectSlices) {
+  const objectSlices = sliceData.objectSlices || [];
+  for (const slice of objectSlices) {
+    // One malformed slice must not cost the slices after it.
+    try {
+      const fileName = slice?.fileName || "";
+      const isInclude = (slice?.code || "").startsWith("#include");
       if (
-        (!slice.fileName && !slice.code.startsWith("#include")) ||
-        slice.fileName.startsWith("<includes") ||
-        slice.fileName.startsWith("<global") ||
-        slice.fileName.includes("__")
+        (!fileName && !isInclude) ||
+        fileName.startsWith("<includes") ||
+        fileName.startsWith("<global") ||
+        fileName.includes("__")
       ) {
         continue;
       }
-      const slFileName = slice.fileName;
-      const allLines = usageData[slFileName] || new Set();
+      const allLines = (fileName && usageData[fileName]) || new Set();
       if (slice.fullName && slice.fullName.length > 3) {
-        if (slice.code?.startsWith("#include")) {
-          usageData[slice.fullName] = new Set();
+        if (isInclude) {
+          // an included file keeps the symbols already recorded for it
+          usageData[slice.fullName] = usageData[slice.fullName] || new Set();
         } else {
           allLines.add(slice.fullName);
         }
       }
-      for (const ausage of slice.usages) {
-        let calls = ausage?.invokedCalls || [];
-        calls = calls.concat(ausage?.argToCalls || []);
+      for (const ausage of slice.usages || []) {
+        const calls = (ausage?.invokedCalls || []).concat(
+          ausage?.argToCalls || [],
+        );
         for (const acall of calls) {
-          if (!acall.resolvedMethod.includes("->")) {
-            allLines.add(acall.resolvedMethod);
+          const resolvedMethod = acall?.resolvedMethod;
+          if (resolvedMethod && !resolvedMethod.includes("->")) {
+            allLines.add(resolvedMethod);
           }
         }
       }
-      if (Array.from(allLines).length) {
-        usageData[slFileName] = allLines;
+      if (fileName && allLines.size) {
+        usageData[fileName] = allLines;
       }
+    } catch (err) {
+      thoughtLog("Skipping a C usage slice that could not be read.", {
+        error: err?.message,
+      });
     }
-  } catch (_err) {
-    // ignore
   }
   return usageData;
 }
@@ -2416,14 +3024,67 @@ export function parseMakeDFile(dfile) {
   return pkgFilesMap;
 }
 
+/**
+ * Resolve a path a lockfile names against the lockfile's directory, refusing
+ * absolute paths and any that leave the scanned directory. The value comes
+ * from the scanned project, so it must not steer the scan at files outside
+ * it. The bound is the scan root, not the lockfile's directory: a React
+ * Native `ios/Podfile` names its pods as `../node_modules/...`.
+ *
+ * @param {String} projectPath Directory of the Podfile.lock
+ * @param {String} value Path as the lockfile writes it
+ * @param {String} [scanRoot] Directory the scan was asked for; the lockfile's
+ *   directory when not given
+ * @returns {String|undefined} The resolved path, or undefined when refused
+ */
+function resolveInsideScan(projectPath, value, scanRoot = projectPath) {
+  if (typeof value !== "string" || !value.length) {
+    return undefined;
+  }
+  if (
+    isAbsolute(value) ||
+    /^[a-zA-Z]:[\\/]/.test(value) ||
+    value.startsWith("\\\\")
+  ) {
+    return undefined;
+  }
+  const resolved = resolve(projectPath, value);
+  const back = relative(resolve(scanRoot), resolved);
+  if (back.startsWith("..") || isAbsolute(back)) {
+    return undefined;
+  }
+  return resolved;
+}
+
+/**
+ * Whether a pod name can be used as a file name. Pod names come from the
+ * lockfile and are joined onto directories.
+ *
+ * @param {String} podName Root pod name
+ * @returns {Boolean}
+ */
+function isSafePodFileName(podName) {
+  return (
+    typeof podName === "string" &&
+    podName.length > 0 &&
+    !podName.includes("/") &&
+    !podName.includes("\\") &&
+    !podName.includes("\0") &&
+    podName !== "." &&
+    podName !== ".."
+  );
+}
+
 /**
  * Parse the contents of a 'Podfile.lock'
  *
  * @param {Object} podfileLock The content of the podfile.lock as an Object
  * @param {String} projectPath The path to the project root
+ * @param {String} [scanRoot] Directory the scan was asked for. Local `:path`
+ *   and `:podspec` sources outside it are not read. Defaults to projectPath.
  * @returns {Map} Map of all dependencies with their direct dependencies
  */
-export async function parsePodfileLock(podfileLock, projectPath) {
+export async function parsePodfileLock(podfileLock, projectPath, scanRoot) {
   const dependencies = new Map();
   for (const pod of podfileLock["PODS"]) {
     const dependency = {};
@@ -2445,58 +3106,103 @@ export async function parsePodfileLock(podfileLock, projectPath) {
           dependency.metadata.name.indexOf("/"),
         )
       : dependency.metadata.name;
-    if (podfileLock["EXTERNAL SOURCES"]?.[podName]) {
+    if (
+      podfileLock["EXTERNAL SOURCES"]?.[podName] &&
+      isSafePodFileName(podName)
+    ) {
       const externalPod = podfileLock["EXTERNAL SOURCES"][podName];
       if (externalPod[":git"]) {
-        let projectRepo = externalPod[":git"];
-        if (isGitHubUrl(projectRepo)) {
-          projectRepo = projectRepo.replace(
-            "github.com",
-            "raw.githubusercontent.com",
-          );
-        }
-        if (projectRepo.endsWith(".git")) {
-          projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+        // The podspec of a checked out pod, which `pod install` writes
+        // alongside the sources it downloaded. Reading it needs no request,
+        // so it answers before any raw repository URL.
+        const localPodspec = join(
+          projectPath,
+          "Pods",
+          "Local Podspecs",
+          `${podName}.podspec.json`,
+        );
+        if (safeExistsSync(localPodspec)) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: localPodspec,
+            },
+          ];
+        } else {
+          let projectRepo = externalPod[":git"];
+          if (isGitHubUrl(projectRepo)) {
+            projectRepo = projectRepo.replace(
+              "github.com",
+              "raw.githubusercontent.com",
+            );
+          }
+          if (projectRepo.endsWith(".git")) {
+            projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+          }
+          // The commit the lockfile recorded in CHECKOUT OPTIONS names the
+          // exact revision CocoaPods checked out, so its podspec is asked
+          // for directly instead of probing the default branch names. It
+          // wins over a branch, whose head may have moved since.
+          const checkoutCommit =
+            podfileLock["CHECKOUT OPTIONS"]?.[podName]?.[":commit"];
+          const projectRepoBranchOrTag =
+            typeof checkoutCommit === "string" &&
+            /^[0-9a-f]{7,64}$/i.test(checkoutCommit)
+              ? checkoutCommit
+              : externalPod[":tag"]
+                ? `refs/tags/${externalPod[":tag"]}`
+                : externalPod[":branch"]
+                  ? `refs/heads/${externalPod[":branch"]}`
+                  : "refs/heads/<DEFAULT>";
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:podspecLocation",
+              value: `${projectRepo}/${projectRepoBranchOrTag}/${podName}.podspec`,
+            },
+          ];
         }
-        const projectRepoBranchOrTag = externalPod[":tag"]
-          ? `tags/${externalPod[":tag"]}`
-          : `heads/${externalPod[":branch"] ? externalPod[":branch"] : "<DEFAULT>"}`;
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:podspecLocation",
-            value: `${projectRepo}/refs/${projectRepoBranchOrTag}/${podName}.podspec`,
-          },
-        ];
       } else if (externalPod[":path"]) {
-        const projectLocation = resolve(projectPath, externalPod[":path"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: projectLocation,
-          },
-        ];
-        let podspec = join(projectLocation, `${podName}.podspec`);
-        if (!safeExistsSync(podspec)) {
-          podspec = `${podspec}.json`;
-        }
-        if (safeExistsSync(podspec)) {
-          dependency.metadata.properties.push({
-            name: "cdx:pods:podspecLocation",
-            value: podspec,
-          });
+        const projectLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":path"],
+          scanRoot,
+        );
+        if (projectLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: projectLocation,
+            },
+          ];
+          let podspec = join(projectLocation, `${podName}.podspec`);
+          if (!safeExistsSync(podspec)) {
+            podspec = `${podspec}.json`;
+          }
+          if (safeExistsSync(podspec)) {
+            dependency.metadata.properties.push({
+              name: "cdx:pods:podspecLocation",
+              value: podspec,
+            });
+          }
         }
       } else if (externalPod[":podspec"]) {
-        const podspecLocation = resolve(projectPath, externalPod[":podspec"]);
-        dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: dirname(podspecLocation),
-          },
-          {
-            name: "cdx:pods:podspecLocation",
-            value: podspecLocation,
-          },
-        ];
+        const podspecLocation = resolveInsideScan(
+          projectPath,
+          externalPod[":podspec"],
+          scanRoot,
+        );
+        if (podspecLocation) {
+          dependency.metadata.properties = [
+            {
+              name: "cdx:pods:projectDir",
+              value: dirname(podspecLocation),
+            },
+            {
+              name: "cdx:pods:podspecLocation",
+              value: podspecLocation,
+            },
+          ];
+        }
       }
     }
     dependencies.set(dependency.metadata.name, dependency);
@@ -2822,6 +3528,8 @@ export function resetCocoaPodspecPrefetch() {
   cocoaPodspecPrefetch = new Map();
 }
 
+registerRunReset("cocoapods:podspecs", resetCocoaPodspecPrefetch);
+
 /**
  * Prefetch the remote podspecs a full CocoaPods scan is about to read.
  *
@@ -2924,7 +3632,7 @@ async function fullScanCocoaPod(dependency, component, options) {
           try {
             httpResult =
               prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
-              (await cdxgenAgent.get(candidate));
+              (await gatedGet(candidate, { responseType: "text" }));
             podspecLocation = candidate;
           } catch (_err) {
             continue;
@@ -2939,6 +3647,11 @@ async function fullScanCocoaPod(dependency, component, options) {
       } else {
         podspecContent = readFileSync(podspecLocation, "utf-8");
       }
+      // A location none of the candidates served contributes nothing: the
+      // component keeps what the lockfile already said about the pod.
+      if (podspecContent === undefined) {
+        return;
+      }
       for (const replacement of replacements) {
         const replacementPair = replacement.split("=");
         let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");