@cdxgen/cdxgen 13.2.0 → 13.4.0

package/lib/cli/managedBom.js

@@ -13,6 +13,7 @@ import {
   hasAnyProjectType,
   isFeatureEnabled,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -33,14 +34,18 @@ import {
   parseBdistMetadata,
 } from "../ecosystems/ecosystems.js";
 import {
+  agreedNugetVersions,
+  dotnetManifestProjectDir,
   getCentralPackageVersions,
-  getPropertyGroupTextNodes,
+  indexPropsProperties,
   parseCsPkgData,
   parseCsPkgLockData,
   parseCsProjAssetsData,
   parseCsProjData,
   parseNupkg,
   parsePaketLockData,
+  projectPropertyCandidates,
+  resolveInstalledNugetVersion,
 } from "../ecosystems/parsers-dotnet.js";
 import { parseMinJs } from "../ecosystems/parsers-js.js";
 import {
@@ -52,7 +57,9 @@ import {
 } from "../ecosystems/parsers-misc.js";
 import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
+  enrichFromInstalledMetadata,
   generatePixiLockFile,
+  installedMetadataKey,
   parseMojoProject,
   parsePiplockData,
   parsePixiLockFile,
@@ -63,7 +70,7 @@ import {
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
 import { parseRenvLock } from "../ecosystems/parsers-r.js";
-import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
+import { parseTerraformWorkspace } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -73,12 +80,16 @@ import {
   getPyModules,
 } from "../ecosystems/pythonutils.js";
 import {
+  addRubyGemsDistributionUrls,
+  addRubyRuntimeComponent,
   collectGemModuleNames,
+  describeProjectGem,
   enrichGemsFromLocalCache,
   parseBundleConfig,
   parseGemfileLockData,
   parseGemspecData,
 } from "../ecosystems/rubyutils.js";
+import { getTerraformRegistryMetadata } from "../ecosystems/terraformRegistry.js";
 import {
   collectAiInventory,
   summarizeAiInventory,
@@ -102,9 +113,10 @@ import {
   collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
+  dosaiRunWasStopped,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
-  readDosaiJsonFile,
+  readDosaiMethodsReport,
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
@@ -401,6 +413,17 @@ export async function createPythonBom(path, options) {
     !pyLockFiles?.length;
   const poetryMode = poetryFiles?.length;
 
+  // The installed dist-info METADATA files describe the distributions this
+  // machine holds. They are read once, before any lockfile is parsed, so the
+  // lockfile entries they match are enriched before PyPI is asked and the
+  // registry is left only what the installations do not answer.
+  const installedLists = (metadataFiles || []).map((mf) =>
+    parseBdistMetadata(mf),
+  );
+  const installedMetadata = installedLists
+    .map((dlist) => dlist?.[0])
+    .filter((md) => md?.name);
+
   // TODO: Support for nested directories
   const setupPy = join(path, "setup.py");
   const setupPyMode = safeExistsSync(setupPy);
@@ -413,7 +436,9 @@ export async function createPythonBom(path, options) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let retMap = await parsePyLockData(lockData, f);
+      let retMap = await parsePyLockData(lockData, f, undefined, {
+        installedMetadata,
+      });
       if (retMap?.workspaceWarningShown) {
         deferFailOnError(options, {
           ecosystem: "python",
@@ -505,7 +530,11 @@ export async function createPythonBom(path, options) {
               `exported-${basename(basePath)}-reqs.txt`,
             );
             safeWriteSync(tmpReqFile, exportedReqs);
-            const dlist = await parseReqFile(tmpReqFile, false);
+            const dlist = await parseReqFile(
+              tmpReqFile,
+              false,
+              installedMetadata,
+            );
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
             }
@@ -515,15 +544,6 @@ export async function createPythonBom(path, options) {
     }
     options.parentComponent = parentComponent;
   } // poetryMode
-  if (metadataFiles?.length) {
-    // dist-info directories
-    for (const mf of metadataFiles) {
-      const dlist = parseBdistMetadata(mf);
-      if (dlist?.length) {
-        pkgList = pkgList.concat(dlist);
-      }
-    }
-  }
   // .whl files. Zip file containing dist-info directory
   if (whlFiles?.length) {
     for (const wf of whlFiles) {
@@ -573,14 +593,23 @@ export async function createPythonBom(path, options) {
   }
   if (requirementsMode || pipenvMode) {
     if (pipenvMode) {
-      // TODO: Support for nested directories
-      safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      // `pipenv install` builds and installs the project's own dependencies
+      // (including `-e .` self-references that execute setup.py), so unlike
+      // the lockfile parsing below it must honor --no-install-deps and the
+      // pre-build lifecycle.
+      if (options.installDeps !== false) {
+        safeSpawnSync("pipenv", ["install"], { cwd: path, shell: isWin });
+      } else {
+        console.log(
+          "Skipping 'pipenv install' since dependency installation is disabled.",
+        );
+      }
       const piplockFile = join(path, "Pipfile.lock");
       if (safeExistsSync(piplockFile)) {
         let dlist;
         try {
           const lockData = JSON.parse(readFileSync(piplockFile));
-          dlist = await parsePiplockData(lockData);
+          dlist = await parsePiplockData(lockData, installedMetadata);
         } catch (err) {
           recordDegradation("python.lockfile-unparseable.pipenv", {
             ecosystem: "python",
@@ -605,7 +634,7 @@ export async function createPythonBom(path, options) {
     } else if (reqDirFiles?.length) {
       for (const j in reqDirFiles) {
         const f = reqDirFiles[j];
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
@@ -613,13 +642,30 @@ export async function createPythonBom(path, options) {
       metadataFilename = reqDirFiles.join(", ");
     } else if (reqFiles?.length) {
       for (const f of reqFiles) {
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       }
     }
   }
+  if (metadataFiles?.length) {
+    // dist-info directories, after every manifest block has added its
+    // entries. An installation whose package a lockfile, Pipfile.lock or
+    // requirements entry already lists enriched that entry, so it is not
+    // also emitted as a component of its own; an installation nothing else
+    // covers still is one. This pass is the emission decision only: each
+    // parser enriched its own entries before it asked PyPI.
+    const enriched = enrichFromInstalledMetadata(pkgList, installedMetadata);
+    for (const dlist of installedLists) {
+      if (dlist?.length) {
+        if (enriched.has(installedMetadataKey(dlist[0]))) {
+          continue;
+        }
+        pkgList = pkgList.concat(dlist);
+      }
+    }
+  }
 
   const parentDependsOn = new Set();
 
@@ -730,79 +776,81 @@ export async function createPythonBom(path, options) {
           );
         }
       }
-      // ATOM parsedeps block
-      // Atom parsedeps slices can be used to identify packages that are not declared in manifests
-      // Since it is a slow operation, we only use it as a fallback or in deep mode
-      // This change was made in 10.9.2 release onwards
-      if (options.deep || !pkgList.length) {
-        if (!pkgList.length) {
-          thoughtLog(
-            "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
-          );
-        }
-        const retMap = await getPyModules(path, pkgList, options);
-        // We need to patch the existing package list to add ImportedModules for evinse to work
-        if (retMap.modList?.length) {
-          const iSymbolsMap = {};
-          retMap.modList.forEach((v) => {
-            iSymbolsMap[v.name] = v.importedSymbols;
-            iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
-          });
-          for (const apkg of pkgList) {
-            if (iSymbolsMap[apkg.name]) {
-              apkg.scope = "required";
-              apkg.properties = apkg.properties || [];
-              apkg.properties.push({
-                name: "internal:ImportedModules",
-                value: iSymbolsMap[apkg.name],
-              });
-            }
+    }
+    // ATOM parsedeps block
+    // Atom parsedeps slices can be used to identify packages that are not declared in manifests
+    // Since it is a slow operation, we only use it as a fallback or in deep mode
+    // This change was made in 10.9.2 release onwards. It reads the sources and
+    // installs nothing, so it runs whether or not dependencies are installed.
+    if (options.deep || !pkgList.length) {
+      if (!pkgList.length) {
+        thoughtLog(
+          "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
+        );
+      }
+      const retMap = await getPyModules(path, pkgList, options);
+      // We need to patch the existing package list to add ImportedModules for evinse to work
+      if (retMap.modList?.length) {
+        const iSymbolsMap = {};
+        retMap.modList.forEach((v) => {
+          iSymbolsMap[v.name] = v.importedSymbols;
+          iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
+        });
+        for (const apkg of pkgList) {
+          if (iSymbolsMap[apkg.name]) {
+            apkg.scope = "required";
+            apkg.properties = apkg.properties || [];
+            apkg.properties.push({
+              name: "internal:ImportedModules",
+              value: iSymbolsMap[apkg.name],
+            });
           }
         }
-        if (retMap.pkgList?.length) {
-          pkgList = pkgList.concat(retMap.pkgList);
-          for (const p of retMap.pkgList) {
-            if (
-              !p.version ||
-              (parentComponent &&
-                p.name === parentComponent.name &&
-                (p.version === parentComponent.version ||
-                  p.version === "latest"))
-            ) {
-              continue;
-            }
-            parentDependsOn.add(pypiBomRef(p.name, p.version));
+      }
+      if (retMap.pkgList?.length) {
+        pkgList = pkgList.concat(retMap.pkgList);
+        for (const p of retMap.pkgList) {
+          if (
+            !p.version ||
+            (parentComponent &&
+              p.name === parentComponent.name &&
+              (p.version === parentComponent.version || p.version === "latest"))
+          ) {
+            continue;
           }
-        }
-        if (retMap.dependenciesList) {
-          dependencies = mergeDependencies(
-            dependencies,
-            retMap.dependenciesList,
-            parentComponent,
-          );
-        }
-        if (retMap.allImports) {
-          allImports = { ...allImports, ...retMap.allImports };
+          parentDependsOn.add(pypiBomRef(p.name, p.version));
         }
       }
-      // ATOM parsedeps block
-      let parentPresent = false;
-      for (const d of dependencies) {
-        if (d.ref === parentComponent["bom-ref"]) {
-          parentPresent = true;
-          break;
-        }
+      if (retMap.dependenciesList) {
+        dependencies = mergeDependencies(
+          dependencies,
+          retMap.dependenciesList,
+          parentComponent,
+        );
       }
-      if (!parentPresent) {
-        const pdependencies = {
-          ref: parentComponent["bom-ref"],
-          dependsOn: Array.from(parentDependsOn).filter(
-            (r) => parentComponent && r !== parentComponent["bom-ref"],
-          ),
-        };
-        dependencies.splice(0, 0, pdependencies);
+      if (retMap.allImports) {
+        allImports = { ...allImports, ...retMap.allImports };
+      }
+    }
+    // ATOM parsedeps block
+    let parentPresent = false;
+    for (const d of dependencies) {
+      if (d.ref === parentComponent["bom-ref"]) {
+        parentPresent = true;
+        break;
       }
     }
+    // Without an install, the parent's dependencies are known only when the
+    // import scan found some: an empty list would claim it has none.
+    if (!parentPresent && (options.installDeps || parentDependsOn.size)) {
+      const pdependencies = {
+        ref: parentComponent["bom-ref"],
+        dependsOn: Array.from(parentDependsOn).filter(
+          (r) => parentComponent && r !== parentComponent["bom-ref"],
+        ),
+      };
+      dependencies.splice(0, 0, pdependencies);
+    }
   }
   // Final fallback is to manually parse setup.py if we still
   // have an empty list
@@ -1352,6 +1400,7 @@ export async function createRubyBom(path, options) {
   let pkgList = [];
   let dependencies = [];
   let rootList = [];
+  const projectGemRefs = [];
   const parentComponent = createDefaultParentComponent(path, "gem", options);
   const gemFileMode = gemFiles.length;
   const gemLockMode = gemLockFiles.length;
@@ -1390,7 +1439,7 @@ export async function createRubyBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const gemLockData = readFileSync(f, { encoding: "utf-8" });
-      const retMap = await parseGemfileLockData(gemLockData, f);
+      const retMap = await parseGemfileLockData(gemLockData, f, { gemHome });
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1405,10 +1454,18 @@ export async function createRubyBom(path, options) {
       if (retMap.rootList?.length) {
         rootList = rootList.concat(retMap.rootList);
       }
+      // `PATH remote: .` is relative to the lockfile, so only the lockfiles
+      // of the scanned directory can serve the gem the root gemspec builds
+      if (
+        retMap.projectGemRefs?.length &&
+        dirname(resolve(f)) === resolve(path)
+      ) {
+        projectGemRefs.push(...retMap.projectGemRefs);
+      }
     }
   }
   // Parsing .gemspec files would help us get more metadata such as description, authors, licenses etc
-  let rootGemspecComponent;
+  let projectGem;
   if (gemspecFiles.length) {
     if (!gemLockFiles.length && !hasAnyProjectType(["oci"], options, false)) {
       console.log(
@@ -1420,37 +1477,50 @@ export async function createRubyBom(path, options) {
         detail: "only gemspec files were available to parse",
       });
     }
+    // Bundler evaluated the root gemspec to lock it under `PATH remote: .`,
+    // so the locked release stands in for a version computed at runtime. It
+    // is resolved before the merge, so that the gemspec and lockfile
+    // sightings of the gem reconcile into one component.
+    const lockedVersions = Object.create(null);
+    for (const p of pkgList) {
+      if (p.version && projectGemRefs.includes(p["bom-ref"])) {
+        lockedVersions[p.name] = p.version;
+      }
+    }
     for (const f of gemspecFiles) {
       const gemspecData = readFileSync(f, { encoding: "utf-8" });
-      const gpkgList = await parseGemspecData(gemspecData, f);
-      if (gpkgList.length) {
-        pkgList = pkgList.concat(gpkgList);
-        pkgList = trimComponents(pkgList);
-        if (
-          !rootGemspecComponent &&
-          dirname(resolve(f)) === resolve(path) &&
-          gpkgList[0]?.name
-        ) {
-          rootGemspecComponent = gpkgList[0];
-        }
+      const isRootGemspec = dirname(resolve(f)) === resolve(path);
+      const gpkgList = await parseGemspecData(
+        gemspecData,
+        f,
+        isRootGemspec ? { lockedVersions, projectGemspec: true } : {},
+      );
+      if (!gpkgList.length) {
+        continue;
       }
+      // The gemspec in the scanned directory is the gem the project builds
+      if (!projectGem && isRootGemspec && gpkgList[0]?.name) {
+        projectGem = gpkgList[0];
+      }
+      pkgList = trimComponents(pkgList.concat(gpkgList));
     }
-    if (
-      rootGemspecComponent &&
-      !("project-name" in options) &&
-      options.projectName === undefined
-    ) {
-      parentComponent.name = rootGemspecComponent.name;
-      parentComponent.version = rootGemspecComponent.version || "latest";
-      const parentPurl = build({
-        type: "gem",
-        namespace: parentComponent.group || null,
-        name: parentComponent.name,
-        version: parentComponent.version || null,
-      });
-      parentComponent["bom-ref"] = decodeURIComponent(parentPurl);
-      parentComponent["purl"] = parentPurl;
-    }
+  }
+  // Describe that gem in metadata.component, unless `--project-name` names a
+  // different project or an image is being scanned
+  if (
+    projectGem &&
+    !hasAnyProjectType(["oci"], options, false) &&
+    (!("project-name" in options) || options.projectName === projectGem.name)
+  ) {
+    ({ pkgList, dependencies, rootList } = describeProjectGem(
+      parentComponent,
+      projectGem,
+      pkgList,
+      dependencies,
+      rootList,
+      projectGemRefs,
+      options,
+    ));
   }
   if (rootList.length) {
     dependencies = mergeDependencies(
@@ -1547,6 +1617,21 @@ export async function createRubyBom(path, options) {
   // lookup, gives us the sha256 of the exact native build, and unlike the
   // registry lookups it also works in dry-run mode.
   pkgList = await enrichGemsFromLocalCache(pkgList, { gemHome });
+  // The download URL of a gem from the public registry needs no network call
+  pkgList = addRubyGemsDistributionUrls(pkgList);
+  // Gems declare the Ruby they run on; surface it as the runtime they depend
+  // on. The component says the runtime is external, which only CycloneDX 1.7
+  // can express, and a container image ships its own Ruby.
+  if (
+    options.specVersion >= 1.7 &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    ({ pkgList, dependencies } = addRubyRuntimeComponent(
+      pkgList,
+      parentComponent,
+      dependencies,
+    ));
+  }
   return buildBomNSData(options, pkgList, "gem", {
     src: path,
     dependencies,
@@ -1772,49 +1857,88 @@ export async function createCsharpBom(path, options) {
   const parentDependsOn = new Set();
   if (nupkgFiles.length && projAssetsFiles.length === 0) {
     manifestFiles = manifestFiles.concat(nupkgFiles);
-    // When parsing nupkg files, only version ranges will be specified under dependencies
-    // To resolve the version, we need to track the mapping between name and resolved versions here
-    let dependenciesMap = {};
-    const pkgNameVersions = {};
+    // A nuspec states the range each dependency accepts, not the version
+    // installed. The installed packages are the components, and a dependency
+    // edge points at the installed version its range resolves to; a minimum
+    // version nobody installed is not a component.
+    const installedVersions = {};
+    const installedNames = {};
+    let dependencyRanges = {};
     for (const nf of nupkgFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${nf}`);
       }
       const retMap = await parseNupkg(nf);
-      if (retMap?.pkgList?.length) {
-        pkgList = pkgList.concat(retMap.pkgList);
-        for (const d of retMap.pkgList) {
-          parentDependsOn.add(d["bom-ref"]);
-          pkgNameVersions[d.name] = d.version;
+      const installed = retMap?.pkgList?.[0];
+      if (installed) {
+        pkgList.push(installed);
+        parentDependsOn.add(installed["bom-ref"]);
+        const key = installed.name.toLowerCase();
+        installedNames[key] ??= installed.name;
+        installedVersions[key] ??= [];
+        if (installed.version) {
+          installedVersions[key].push(installed.version);
         }
       }
-      if (retMap?.dependenciesMap) {
-        dependenciesMap = { ...dependenciesMap, ...retMap.dependenciesMap };
+      if (retMap?.dependencyRanges) {
+        dependencyRanges = { ...dependencyRanges, ...retMap.dependencyRanges };
       }
     } // end for
-    for (const k of Object.keys(dependenciesMap)) {
-      const dependsOn = dependenciesMap[k].map((p) => {
-        const ver = pkgNameVersions[p] || "latest";
-        const purl = nugetPurl(p, ver);
-        return purl ? decodeURIComponent(purl) : `library:${p}:${ver}`;
-      });
-      dependencies.push({ ref: k, dependsOn: [...new Set(dependsOn)].sort() });
+    for (const [ref, ranges] of Object.entries(dependencyRanges)) {
+      const dependsOn = new Set();
+      for (const [name, range] of Object.entries(ranges)) {
+        const key = name.toLowerCase();
+        const version = resolveInstalledNugetVersion(
+          range,
+          installedVersions[key],
+        );
+        const purl = version ? nugetPurl(installedNames[key], version) : null;
+        if (purl) {
+          dependsOn.add(decodeURIComponent(purl));
+        }
+      }
+      dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
     }
   }
+  // Versions each project restored, by project directory and lowercased
+  // package id. Two projects of one tree routinely restore different versions
+  // of a package, so a version missing from one project's manifest is taken
+  // from that project's restore output, never from another project's.
+  // The restore output also spells each package id the way its nuspec does.
+  const projectVersions = {};
+  const projectNames = {};
+  const recordProjectVersions = (projectDir, pkgs) => {
+    projectVersions[projectDir] ??= {};
+    projectNames[projectDir] ??= {};
+    for (const p of pkgs || []) {
+      if (
+        p?.name &&
+        p.version &&
+        !["application", "project"].includes(p.type)
+      ) {
+        projectVersions[projectDir][p.name.toLowerCase()] ??= p.version;
+        projectNames[projectDir][p.name.toLowerCase()] ??= p.name;
+      }
+    }
+  };
+  // Direct dependencies of each project directory from its lock file or
+  // packages.config, attached to that project once the project files are read.
+  const rootsByProjectDir = {};
+  const recordRoots = (projectDir, pkgs) => {
+    rootsByProjectDir[projectDir] ??= new Set();
+    for (const p of pkgs || []) {
+      if (p?.["bom-ref"]) {
+        rootsByProjectDir[projectDir].add(p["bom-ref"]);
+      }
+    }
+  };
   // In a multi-project scan, different projects may use different manifest
   // formats: modern SDK-style (project.assets.json / packages.lock.json) or
   // legacy (packages.config). Apply the assets > lock > config precedence per
   // project directory instead of across the whole scan, so dependencies from
   // one project's manifest are not dropped just because another format exists
   // elsewhere in the scan.
-  const assetsProjectDirs = new Set(
-    projAssetsFiles.map((af) => {
-      // project.assets.json is generated under <project>/obj/
-      const d = dirname(af);
-      return basename(d) === "obj" ? dirname(d) : d;
-    }),
-  );
-  const lockProjectDirs = new Set(pkgLockFiles.map((af) => dirname(af)));
+  const assetsProjectDirs = new Set();
   // project.assets.json parsing
   if (projAssetsFiles.length) {
     manifestFiles = manifestFiles.concat(projAssetsFiles);
@@ -1826,6 +1950,11 @@ export async function createCsharpBom(path, options) {
       const results = parseCsProjAssetsData(pkgData, af);
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
+      // Restore output names its project; an artifacts layout keeps it outside
+      // the project directory.
+      const projectDir = dotnetManifestProjectDir(af, results.projectPath);
+      assetsProjectDirs.add(projectDir);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -1858,9 +1987,12 @@ export async function createCsharpBom(path, options) {
       });
     }
   }
+  const lockProjectDirs = new Set(
+    pkgLockFiles.map((af) => dotnetManifestProjectDir(af)),
+  );
   // packages.lock.json parsing for any project without a project.assets.json
   const pkgLockToParse = pkgLockFiles.filter(
-    (af) => !assetsProjectDirs.has(dirname(af)),
+    (af) => !assetsProjectDirs.has(dotnetManifestProjectDir(af)),
   );
   if (pkgLockToParse.length) {
     manifestFiles = manifestFiles.concat(pkgLockToParse);
@@ -1874,37 +2006,29 @@ export async function createCsharpBom(path, options) {
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
       const rootList = results["rootList"];
+      const projectDir = dotnetManifestProjectDir(af);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
       if (deps?.length) {
         dependencies = mergeDependencies(dependencies, deps, parentComponent);
       }
-      // Keep track of the direct dependencies so that we can construct one complete
-      // list after processing all lock files
-      if (rootList?.length) {
-        for (const p of rootList) {
-          parentDependsOn.add(p["bom-ref"]);
-        }
-      }
+      recordRoots(projectDir, rootList);
     }
   }
   // packages.config parsing for any project without a modern manifest
   // (project.assets.json / packages.lock.json) covering the same directory
   const pkgConfigToParse = pkgConfigFiles.filter((f) => {
-    const projDir = dirname(f);
+    const projDir = dotnetManifestProjectDir(f);
     return !assetsProjectDirs.has(projDir) && !lockProjectDirs.has(projDir);
   });
   if (pkgConfigToParse.length) {
     manifestFiles = manifestFiles.concat(pkgConfigToParse);
-    // Versions already resolved from project.assets.json / packages.lock.json
-    // can backfill templated or missing versions in packages.config
-    const resolvedVersions = {};
-    for (const p of pkgList) {
-      if (p.name && p.version) {
-        resolvedVersions[p.name] = p.version;
-      }
-    }
+    // A templated or missing version is backfilled only from a version every
+    // other manifest of the scan agrees on: these projects restored nothing of
+    // their own, and another project's version may not be theirs.
+    const resolvedVersions = agreedNugetVersions(pkgList);
     // packages.config parsing
     for (const f of pkgConfigToParse) {
       if (DEBUG_MODE) {
@@ -1912,11 +2036,11 @@ export async function createCsharpBom(path, options) {
       }
       pkgData = readFileSync(f, { encoding: "utf-8" });
       const dlist = parseCsPkgData(pkgData, f, resolvedVersions);
+      const projectDir = dotnetManifestProjectDir(f);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
-        for (const d of dlist) {
-          parentDependsOn.add(d["bom-ref"]);
-        }
+        recordRoots(projectDir, dlist);
       }
     }
   }
@@ -1939,27 +2063,26 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
-  const pkgNameVersions = {};
+  const projectRefByDir = {};
   let services = [];
   if (csProjFiles.length) {
     manifestFiles = manifestFiles.concat(csProjFiles);
-    // Parsing csproj is quite error-prone. Some project files may not have versions specified
-    // To work around this, we make use of the version from the existing list
-    for (const p of pkgList) {
-      if (p.version) {
-        pkgNameVersions[p.name] = p.version;
-      }
-    }
+    // Parsing csproj is quite error-prone. Some project files may not have
+    // versions specified. Such a version comes from what this project restored,
+    // then from central package management, and only then from a version the
+    // whole scan agrees on.
+    const agreedVersions = agreedNugetVersions(pkgList);
     let msbuildInstalled = false;
-    let pkgVersionLabelCandidates = {};
-    const result = safeSpawnSync(DOTNET_CMD, ["msbuild --version"], {
+    const result = safeSpawnSync(DOTNET_CMD, ["msbuild", "--version"], {
       shell: isWin,
     });
-    if (result.status === 0 && !result.error && result.stdout.trim()) {
+    if (result.status === 0 && !result.error && result.stdout?.trim()) {
       msbuildInstalled = true;
-    } else {
-      pkgVersionLabelCandidates = getPropertyGroupTextNodes(propsFiles);
     }
+    // `$(Name)` version labels resolve from the props files that can apply to
+    // each project (beside and above it), read once for the whole scan.
+    // msbuild evaluates only what they leave unresolved.
+    const propsIndex = indexPropsProperties(propsFiles);
     // Directory.Packages.props can sit above the directory being scanned, so it is
     // resolved per project file by walking up rather than from the props glob below.
     // The cache keeps a repository with many projects from re-parsing the same file.
@@ -1970,15 +2093,19 @@ export async function createCsharpBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const csProjData = readFileSync(f, { encoding: "utf-8" });
+      const projectDir = dotnetManifestProjectDir(f);
       const retMap = parseCsProjData(
         csProjData,
         f,
-        pkgNameVersions,
+        projectVersions[projectDir] || {},
         msbuildInstalled,
-        pkgVersionLabelCandidates,
+        projectPropertyCandidates(f, propsIndex),
         getCentralPackageVersions(f, centralVersionsCache),
+        agreedVersions,
+        projectNames[projectDir] || {},
       );
       if (retMap?.parentComponent?.purl) {
+        projectRefByDir[projectDir] ??= retMap.parentComponent["bom-ref"];
         // If there are multiple project files, track the parent components using nested components
         if (csProjFiles.length > 1) {
           if (!parentComponent.components) {
@@ -2002,46 +2129,103 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
+  // A lock file's or packages.config's direct dependencies belong to the
+  // project in that directory; without a project file there, to the parent.
+  for (const [projectDir, roots] of Object.entries(rootsByProjectDir)) {
+    if (!roots.size) {
+      continue;
+    }
+    const projectRef = projectRefByDir[projectDir];
+    if (projectRef && projectRef !== parentComponent?.["bom-ref"]) {
+      dependencies = mergeDependencies(
+        dependencies,
+        [{ ref: projectRef, dependsOn: [...roots].sort() }],
+        parentComponent,
+      );
+    } else {
+      for (const ref of roots) {
+        parentDependsOn.add(ref);
+      }
+    }
+  }
   if (pkgList.length) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
     if (options.deep) {
-      const slicesFile = resolve(
-        options.depsSlicesFile
-          ? join(path, options.depsSlicesFile)
-          : join(getTmpDir(), "dosai.json"),
-      );
-      // Create the slices file if it doesn't exist
-      if (!safeExistsSync(slicesFile)) {
-        thoughtLog(
-          "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
-        );
-        const sliceResult = createDosaiMethodsSlice(
-          resolve(path),
-          resolve(slicesFile),
-          options,
-        );
-        if (!sliceResult && DEBUG_MODE) {
+      // resolve (not join) so a fully-qualified --deps-slices-file is used
+      // as-is: join would append it to the scan path, which is never a valid
+      // path on Windows and silently loses the .NET evidence elsewhere
+      // (issue 4394). A relative value still resolves against the scan path.
+      // Without --deps-slices-file the slice goes to a directory of this run:
+      // a fixed name in the shared temp directory was reused by every later
+      // scan, of any project, as if it were that project's evidence.
+      const slicesDir = options.depsSlicesFile
+        ? undefined
+        : safeMkdtempSync(join(getTmpDir(), "cdxgen-dosai-"));
+      const slicesFile = options.depsSlicesFile
+        ? resolve(path, options.depsSlicesFile)
+        : join(slicesDir, "dosai.json");
+      try {
+        // Create the slices file if it doesn't exist
+        if (!safeExistsSync(slicesFile)) {
+          thoughtLog(
+            "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
+          );
+          const sliceResult = createDosaiMethodsSlice(
+            resolve(path),
+            resolve(slicesFile),
+            options,
+          );
+          // A stopped run has already said so and what to change; the debug
+          // output would show no dosai error for it (issue 4438).
+          if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
+            // Visible without debug output: otherwise the components silently
+            // lose the dependency-slice evidence while the scan still exits 0.
+            // --evidence (which implies --deep) runs dosai again during evinse
+            // and can still add occurrences, so this names only what is lost.
+            // Debug output comes from the environment, not a CLI flag (issue
+            // 4438).
+            console.warn(
+              "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with CDXGEN_DEBUG_MODE=debug for the dosai errors.",
+            );
+          }
+        } else if (DEBUG_MODE) {
           console.log(
-            "Slicing with dosai was unsuccessful. Check the errors reported in the logs above.",
+            `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
           );
         }
+        pkgList = addEvidenceForDotnet(pkgList, slicesFile, {
+          srcPath: resolve(path),
+        });
+        const methodsSlice = readDosaiMethodsReport(slicesFile, {
+          sections: ["Metadata", "Services", "ApiEndpoints"],
+        });
+        // Provider-backed Services[] first so bom-refs, trust zones, and data
+        // classifications survive; ApiEndpoints derivation fills in the rest.
+        const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
+        collectDosaiServicesFromMethods(methodsSlice, servicesMap);
+        services = normalizeDosaiServiceMap(servicesMap);
+      } finally {
+        if (slicesDir) {
+          safeRmSync(slicesDir, { recursive: true, force: true });
+        }
       }
-      pkgList = addEvidenceForDotnet(pkgList, slicesFile);
-      const methodsSlice = readDosaiJsonFile(slicesFile);
-      // Provider-backed Services[] first so bom-refs, trust zones, and data
-      // classifications survive; ApiEndpoints derivation fills in the rest.
-      const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
-      collectDosaiServicesFromMethods(methodsSlice, servicesMap);
-      services = normalizeDosaiServiceMap(servicesMap);
     }
   }
-  // Parent dependency tree
+  // Parent dependency tree. A single project file already contributed an
+  // entry for the same parent, so the lock file roots are merged into it
+  // rather than added as a second entry for the same ref.
   if (parentDependsOn.size && parentComponent?.["bom-ref"]) {
-    dependencies.splice(0, 0, {
-      ref: parentComponent["bom-ref"],
-      dependsOn: Array.from(parentDependsOn).sort(),
-    });
+    dependencies = mergeDependencies(
+      [
+        {
+          ref: parentComponent["bom-ref"],
+          dependsOn: Array.from(parentDependsOn).sort(),
+        },
+      ],
+      dependencies,
+      parentComponent,
+    );
   }
   if (shouldFetchLicense()) {
     const retMap = await getNugetMetadata(pkgList, dependencies);
@@ -2271,34 +2455,41 @@ export function createPerlBom(path, options) {
 /**
  * Function to create bom string for Terraform and OpenTofu projects.
  *
- * The `.terraform.lock.hcl` file pins the providers the configuration
- * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ * The workspace assembly turns the provider lock file, the module manifest
+ * `init` writes and the configuration files into module and provider
+ * components with a dependency graph and offline licenses. When metadata
+ * fetching is enabled, the public registries add licenses, repository URLs
+ * and registry flags to components the offline pass could not resolve.
  *
  * @param {string} path to the project
  * @param {Object} options Parse options from the cli
- * @returns {Object} BOM object
+ * @returns {Promise<Object>} BOM object
  */
-export function createTerraformBom(path, options) {
-  let pkgList = [];
-  const lockFiles = getAllFiles(
+export async function createTerraformBom(path, options) {
+  const parentComponent = createDefaultParentComponent(
     path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    "generic",
     options,
   );
-  for (const lockFile of lockFiles) {
-    if (DEBUG_MODE) {
-      console.log(`Parsing ${lockFile}`);
-    }
-    const result = parseTerraformLockFile(lockFile);
-    if (result.pkgList?.length) {
-      pkgList = pkgList.concat(result.pkgList);
-    }
+  const { pkgList, dependencies, parentProperties, srcFiles } =
+    parseTerraformWorkspace(path, options, parentComponent["bom-ref"]);
+  // No module or provider found (for example, resources only, or a stray
+  // .tf in a JS repo): emit nothing, including no root applications, so
+  // multi-type scans do not gain an empty Terraform parent.
+  if (!pkgList.some((p) => p.type === "library")) {
+    return {};
   }
-  if (pkgList.length) {
-    return buildBomNSData(options, pkgList, "terraform", {
-      src: path,
-      filename: lockFiles.join(", "),
-    });
+  parentComponent.properties = [
+    ...(parentComponent.properties || []),
+    ...parentProperties,
+  ];
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    await getTerraformRegistryMetadata(pkgList);
   }
-  return {};
+  return buildBomNSData(options, pkgList, "terraform", {
+    src: path,
+    filename: srcFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
 }