@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/cli/index.js

@@ -44,6 +44,7 @@ import {
   parseOpenapiSpecData,
   parsePrivadoFile,
 } from "../ecosystems/parsers-misc.js";
+import { hasTerraformConfiguration } from "../ecosystems/parsers-terraform.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
   buildDependencyTrackBomRequest,
@@ -65,6 +66,7 @@ import {
   hasHbomProjectType,
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
+import { orderParentCandidates } from "../inventory/parentSelection.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
@@ -84,6 +86,7 @@ import {
   exportArchive,
   exportImage,
   getPkgPathList,
+  isImageReference,
   parseImageName,
 } from "../managers/docker.js";
 import {
@@ -876,6 +879,19 @@ export async function createMultiXBom(pathList, options) {
     let components = [];
     let dependencies = [];
     let parentSubComponents = [];
+    // Each builder detects the project of its own ecosystem. A builder that sets
+    // options.parentComponent to force its project into its own BOM must not
+    // make that project the next builder's too, or the next ecosystem's project
+    // is lost: every builder starts from the parent the caller gave.
+    const callerParent = options.parentComponent;
+    const withOwnParent = async (build) => {
+      options.parentComponent = callerParent;
+      try {
+        return await build();
+      } finally {
+        options.parentComponent = callerParent;
+      }
+    };
     setActivityContext({
       projectType: Array.isArray(options.projectType)
         ? options.projectType.join(",")
@@ -922,7 +938,7 @@ export async function createMultiXBom(pathList, options) {
         }
       }
       setProjectTypeActivityContext(exactAiInventoryType || "js", path);
-      bomData = await createNodejsBom(path, options);
+      bomData = await withOwnParent(() => createNodejsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (exactAiInventoryType) {
           thoughtLog(
@@ -972,7 +988,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("java", path);
-      bomData = await createJavaBom(path, options);
+      bomData = await withOwnParent(() => createJavaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} java packages.`,
@@ -1037,7 +1053,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("py", path);
-      bomData = await createPythonBom(path, options);
+      bomData = await withOwnParent(() => createPythonBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} python packages.`,
@@ -1058,6 +1074,17 @@ export async function createMultiXBom(pathList, options) {
         ) {
           parentSubComponents.push(bomData.parentComponent);
         }
+        // Retain metadata.component.components. uv workspace members are
+        // nested under the python project, so hoisting them keeps them
+        // siblings of the other sub-components instead of riding one level
+        // deeper (or being dropped by the same-name collapse) when another
+        // ecosystem's project becomes the parent.
+        if (bomData.parentComponent?.components?.length) {
+          parentSubComponents = parentSubComponents.concat(
+            bomData.parentComponent.components,
+          );
+          delete bomData.parentComponent.components;
+        }
       }
       if (bomData?.formulationList?.length) {
         formulationList = formulationList.concat(bomData.formulationList);
@@ -1070,7 +1097,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("go", path);
-      bomData = await createGoBom(path, options);
+      bomData = await withOwnParent(() => createGoBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(`I found ${bomData.bomJson.components.length} go packages.`);
         if (DEBUG_MODE) {
@@ -1098,7 +1125,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("rust", path);
-      bomData = await createRustBom(path, options);
+      bomData = await withOwnParent(() => createRustBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} rust packages.`,
@@ -1135,7 +1162,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("php", path);
-      bomData = createPHPBom(path, options);
+      bomData = await withOwnParent(() => createPHPBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} php packages.`,
@@ -1172,7 +1199,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("ruby", path);
-      bomData = await createRubyBom(path, options);
+      bomData = await withOwnParent(() => createRubyBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `We got ${bomData.bomJson.components.length} ruby packages.`,
@@ -1208,7 +1235,7 @@ export async function createMultiXBom(pathList, options) {
         thoughtLog("**CSHARP**: What about csharp and fsharp projects?");
       }
       setProjectTypeActivityContext("csharp", path);
-      bomData = await createCsharpBom(path, options);
+      bomData = await withOwnParent(() => createCsharpBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `There are ${bomData.bomJson.components.length} csharp packages.`,
@@ -1245,7 +1272,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("dart", path);
-      bomData = await createDartBom(path, options);
+      bomData = await withOwnParent(() => createDartBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} pub packages.`,
@@ -1275,7 +1302,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("haskell", path);
-      bomData = createHaskellBom(path, options);
+      bomData = await withOwnParent(() => createHaskellBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} hackage packages.`,
@@ -1305,7 +1332,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("elixir", path);
-      bomData = createElixirBom(path, options);
+      bomData = await withOwnParent(() => createElixirBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} mix packages.`,
@@ -1335,7 +1362,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("c", path);
-      bomData = createCppBom(path, options);
+      bomData = await withOwnParent(() => createCppBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cpp packages.`,
@@ -1357,6 +1384,10 @@ export async function createMultiXBom(pathList, options) {
           parentSubComponents.push(bomData.parentComponent);
         }
       }
+      // presets and compilers describe the build, whatever it depends on
+      if (bomData?.formulationList?.length) {
+        formulationList = formulationList.concat(bomData.formulationList);
+      }
     }
     if (hasAnyProjectType(["oci", "clojure"], options)) {
       if (!hasAnyProjectType(["oci"], options, false)) {
@@ -1365,7 +1396,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("clojure", path);
-      bomData = createClojureBom(path, options);
+      bomData = await withOwnParent(() => createClojureBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} clojure packages.`,
@@ -1395,7 +1426,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("github", path);
-      bomData = createGitHubBom(path, options);
+      bomData = await withOwnParent(() => createGitHubBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} github action packages as well. Should I convert these to formulation instead 🤔`,
@@ -1425,7 +1456,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cloudbuild", path);
-      bomData = createCloudBuildBom(path, options);
+      bomData = await withOwnParent(() => createCloudBuildBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cloudbuild packages.`,
@@ -1455,7 +1486,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("swift", path);
-      bomData = await createSwiftBom(path, options);
+      bomData = await withOwnParent(() => createSwiftBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} swift packages here.`,
@@ -1493,7 +1524,7 @@ export async function createMultiXBom(pathList, options) {
         detail:
           "Components are being inferred by scanning jar/war/ear files from disk.",
       });
-      bomData = await createJarBom(path, options);
+      bomData = await withOwnParent(() => createJarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} jar packages as well.`,
@@ -1518,7 +1549,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "cocoa"], options)) {
       setProjectTypeActivityContext("cocoa", path);
-      bomData = await createCocoaBom(path, options);
+      bomData = await withOwnParent(() => createCocoaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1537,7 +1568,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "nix"], options)) {
       setProjectTypeActivityContext("nix", path);
-      bomData = await createNixBom(path, options);
+      bomData = await withOwnParent(() => createNixBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1559,7 +1590,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["caxa"], options, false)) {
       setProjectTypeActivityContext("caxa", path);
-      bomData = await createCaxaBom(path, options);
+      bomData = await withOwnParent(() => createCaxaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1581,7 +1612,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["asar"], options, false)) {
       setProjectTypeActivityContext("asar", path);
-      bomData = await createAsarBom(path, options);
+      bomData = await withOwnParent(() => createAsarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1603,7 +1634,9 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["vscode-extension"], options, false)) {
       setProjectTypeActivityContext("vscode-extension", path);
-      bomData = await createVscodeExtensionBom(path, options);
+      bomData = await withOwnParent(() =>
+        createVscodeExtensionBom(path, options),
+      );
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1646,7 +1679,9 @@ export async function createMultiXBom(pathList, options) {
           sharedOptions.__didScanChromeExtensions = true;
         }
         setProjectTypeActivityContext("chrome-extension", path);
-        bomData = await createChromeExtensionBom(path, options);
+        bomData = await withOwnParent(() =>
+          createChromeExtensionBom(path, options),
+        );
         if (bomData?.bomJson?.components?.length) {
           if (DEBUG_MODE) {
             console.log(
@@ -1667,6 +1702,34 @@ export async function createMultiXBom(pathList, options) {
         }
       }
     }
+    if (hasAnyProjectType(["terraform"], options)) {
+      thoughtLog(
+        "**TERRAFORM**: Looking for Terraform and OpenTofu modules and providers. The registry metadata fetch is opt-in, so I will rely on the lock file, the module manifest and the configuration files.",
+      );
+      setProjectTypeActivityContext("terraform", path);
+      bomData = await withOwnParent(() => createTerraformBom(path, options));
+      if (bomData?.bomJson?.components?.length) {
+        thoughtLog(
+          `I found ${bomData.bomJson.components.length} terraform components. Should I also resolve their licenses from the registry when FETCH_LICENSE is enabled?`,
+        );
+        if (DEBUG_MODE) {
+          console.log(
+            `Found ${bomData.bomJson.components.length} terraform components at ${path}`,
+          );
+        }
+        components = components.concat(bomData.bomJson.components);
+        dependencies = mergeDependencies(
+          dependencies,
+          bomData.bomJson.dependencies,
+        );
+        if (
+          bomData.parentComponent &&
+          Object.keys(bomData.parentComponent).length
+        ) {
+          parentSubComponents.push(bomData.parentComponent);
+        }
+      }
+    }
     // Collect any crypto keys
     if (
       options.specVersion >= 1.6 &&
@@ -1679,7 +1742,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cbom", path);
-      bomData = await createCryptoCertsBom(path, options);
+      bomData = await withOwnParent(() => createCryptoCertsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} crypto assets.`,
@@ -1770,7 +1833,7 @@ export async function createMultiXBom(pathList, options) {
     !options.lastWorkingDir.includes("/home/")
   ) {
     setProjectTypeActivityContext("jar", options.lastWorkingDir);
-    bomData = createJarBom(options.lastWorkingDir, options);
+    bomData = await createJarBom(options.lastWorkingDir, options);
     if (bomData?.bomJson?.components?.length) {
       if (DEBUG_MODE) {
         console.log(
@@ -1796,14 +1859,24 @@ export async function createMultiXBom(pathList, options) {
       thoughtLog("**METADATA**: Tweaking the parent component hierarchy.");
     }
     if (!parentComponent || !Object.keys(parentComponent).length) {
-      parentComponent = parentSubComponents[0];
+      // the project whose manifest sits at the scan root describes the
+      // repository; ties keep the order the ecosystems were scanned in
+      parentComponent = orderParentCandidates(
+        parentSubComponents,
+        pathList,
+        options,
+      )[0];
     }
     // Our naive approach to appending to sub-components could result in same parent being included as a child
     // This is filtered out here
     parentSubComponents = parentSubComponents.filter(
       (c) => c["bom-ref"] !== parentComponent["bom-ref"],
     );
-    parentComponent.components = trimComponents(parentSubComponents);
+    // keep the parent's own sub-components (a CMake project's sub-projects)
+    parentComponent.components = trimComponents([
+      ...(parentComponent.components || []),
+      ...parentSubComponents,
+    ]);
     if (
       parentComponent.components.length === 1 &&
       parentComponent.components[0].name === parentComponent.name &&
@@ -1813,24 +1886,15 @@ export async function createMultiXBom(pathList, options) {
       delete parentComponent.components;
     }
     // Add references between the multiple sub-boms
-    let parentDependencies = dependencies.find(
-      (d) => d["ref"] === parentComponent["bom-ref"],
-    );
-    if (!parentDependencies) {
-      parentDependencies = {
-        ref: parentComponent["bom-ref"],
-      };
-      dependencies = mergeDependencies(dependencies, parentDependencies);
-    }
-    if (!parentDependencies["dependsOn"]) {
-      parentDependencies["dependsOn"] = [];
-    }
-    for (const parentSub of parentSubComponents) {
-      // Issue: 1622. We might have already captured this parent component dependency
-      if (!parentDependencies["dependsOn"].includes(parentSub["bom-ref"])) {
-        parentDependencies["dependsOn"].push(parentSub["bom-ref"]);
-      }
-    }
+    // mergeDependencies returns fresh objects and unions dependsOn per ref,
+    // so the parent edges are folded in through a single merge
+    const parentRef = parentComponent["bom-ref"];
+    const parentSubRefs = parentSubComponents
+      .map((c) => c["bom-ref"])
+      .filter((ref) => ref && ref !== parentRef);
+    dependencies = mergeDependencies(dependencies, [
+      { ref: parentRef, dependsOn: parentSubRefs },
+    ]);
   }
   // some cleanup, but not complete
   for (const path of pathList) {
@@ -1900,17 +1964,49 @@ export async function createDynamicBom(path, options) {
     blockExec: options.traceBlockExec,
     traceCrypto: options.traceCrypto,
     cbom: options.cbom,
+    proxyEgress: options.traceProxyEgress,
+    allowLoopback: options.traceAllowLoopback,
+    dryRun: options.traceDryRun,
+    policy: options.tracePolicy,
+    policyFile: options.tracePolicyFile,
+    blockInterpreters: options.traceBlockInterpreters,
+    denyPersistenceWrites: options.traceDenyPersistenceWrites,
+    privateTmp: options.tracePrivateTmp,
+    protectHome: options.traceProtectHome,
   };
 
-  const { components: pkgList, services: traceServices } =
-    await buildDynamicComponents(commandStr, workingDir, traceOptions);
+  const {
+    components: pkgList,
+    services: traceServices,
+    dryRunSummary,
+  } = await buildDynamicComponents(commandStr, workingDir, traceOptions);
 
-  return buildBomNSData(options, pkgList, "generic", {
+  const bomNSData = buildBomNSData(options, pkgList, "generic", {
     src: workingDir,
     projectType: "dynamic",
     filename: commandStr,
     services: traceServices,
   });
+  // A dry run denies every side effect, so the attempted-operation counts are
+  // the result. Only counts are recorded, never the paths or targets.
+  if (dryRunSummary && bomNSData?.bomJson?.metadata) {
+    const metadata = bomNSData.bomJson.metadata;
+    metadata.properties = metadata.properties || [];
+    metadata.properties.push({ name: "cdx:dynamic:dryRun", value: "true" });
+    metadata.properties.push({
+      name: "cdx:dynamic:dryRun:captured",
+      value: dryRunSummary.captured === false ? "false" : "true",
+    });
+    for (const [key, value] of Object.entries(dryRunSummary)) {
+      if (Number.isInteger(value)) {
+        metadata.properties.push({
+          name: `cdx:dynamic:dryRun:${key}`,
+          value: String(value),
+        });
+      }
+    }
+  }
+  return bomNSData;
 }
 
 /**
@@ -2431,14 +2527,10 @@ export async function createXBom(path, options) {
     return createPerlBom(path, options);
   }
 
-  // Terraform and OpenTofu providers
-  const tfLockFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
-    options,
-  );
-  if (tfLockFiles.length) {
-    return createTerraformBom(path, options);
+  // Terraform and OpenTofu providers and modules, discovered with the same
+  // patterns and exclusions the workspace assembly uses.
+  if (hasTerraformConfiguration(path, options)) {
+    return await createTerraformBom(path, options);
   }
 }
 
@@ -2561,7 +2653,13 @@ async function createBomForPath(path, options) {
   } else if (
     (options.projectType &&
       !options.projectType?.includes("universal") &&
-      hasAnyProjectType(["oci"], options, false)) ||
+      hasAnyProjectType(["oci"], options, false) &&
+      // Explicit container types accept every documented image reference
+      // style (postgres:15-alpine, shiftleft/scan-slim, registry:5000/ns/img),
+      // but only for inputs that cannot be a local path: existing files and
+      // directories keep flowing to the tar, oci-dir and source scanners.
+      !safeExistsSync(path) &&
+      isImageReference(path)) ||
     path.startsWith("docker.io") ||
     path.startsWith("quay.io") ||
     path.startsWith("ghcr.io") ||
@@ -2822,7 +2920,7 @@ async function createBomForPath(path, options) {
     return createPerlBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
-    return createTerraformBom(path, options);
+    return await createTerraformBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);