@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/cli/nativeBom.js

@@ -1,7 +1,7 @@
 import { Buffer } from "node:buffer";
 import { readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
@@ -23,11 +23,17 @@ import {
 import {
   checksumFile,
   getAllFiles,
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr, isMac } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
+import { readCrateArchiveValues } from "../ecosystems/cargoCache.js";
 import {
   buildDependentPurl,
   collapseCmakeVersions,
@@ -35,7 +41,11 @@ import {
   resolveCmakeContext,
   withoutScrapedFetchDependency,
 } from "../ecosystems/cmakeResolver.js";
-import { getCppModules } from "../ecosystems/cppEvidence.js";
+import {
+  emptyCppBuildContext,
+  resolveCppBuildContext,
+} from "../ecosystems/cppBuildContext.js";
+import { getCppModules, hasCppSources } from "../ecosystems/cppEvidence.js";
 import {
   getCratesMetadata,
   getSwiftPackageMetadata,
@@ -50,6 +60,7 @@ import {
 } from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
+  compareGoVersions,
   isGoModWhyNotNeeded,
   parseGoListDep,
   parseGoModData,
@@ -58,6 +69,7 @@ import {
   parseGoModWhy,
   parseGopkgData,
   parseGosumData,
+  parseGosumHashes,
 } from "../ecosystems/parsers-go.js";
 import { parseJuliaProject } from "../ecosystems/parsers-julia.js";
 import {
@@ -115,7 +127,9 @@ import {
 } from "../ecosystems/parsers-rust.js";
 import { parseSpackLock } from "../ecosystems/parsers-spack.js";
 import { parseStackProject } from "../ecosystems/parsers-stack.js";
+import { findVendoredCode } from "../ecosystems/vendoredCode.js";
 import { resolveZigGraph } from "../ecosystems/zigResolver.js";
+import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
@@ -190,6 +204,30 @@ export function getCargoCacheDir() {
       );
 }
 
+/**
+ * Add a Go module of the project, a nested go.mod or a go.work member, under
+ * the parent component. A module that is already the parent, one of its
+ * subcomponents, or a component (a directory replacement inside the project)
+ * is not added again, so no bom-ref appears twice.
+ *
+ * @param {Object} parentComponent The project's parent component
+ * @param {Object} moduleComponent The module to add
+ * @param {Object[]} pkgList Components found so far
+ */
+function addGoSubComponent(parentComponent, moduleComponent, pkgList) {
+  const ref = moduleComponent?.["bom-ref"];
+  if (
+    !ref ||
+    ref === parentComponent["bom-ref"] ||
+    parentComponent.components?.some((c) => c["bom-ref"] === ref) ||
+    pkgList.some((c) => c["bom-ref"] === ref)
+  ) {
+    return;
+  }
+  parentComponent.components = parentComponent.components || [];
+  parentComponent.components.push(moduleComponent);
+}
+
 /**
  * Function to create bom string for Go projects
  *
@@ -305,6 +343,20 @@ export async function createGoBom(path, options) {
         }
       }
     }
+    // go mod why answers for a module path, but go.sum also names versions
+    // that only took part in version selection. Only a version whose content
+    // go.sum holds a checksum for was ever downloaded, and of those, MVS
+    // builds the highest.
+    const builtVersions = {};
+    for (const apkg of pkgList) {
+      const built = builtVersions[apkg.name];
+      if (
+        apkg._integrity &&
+        (!built || compareGoVersions(apkg.version, built) > 0)
+      ) {
+        builtVersions[apkg.name] = apkg.version;
+      }
+    }
     // A module go reports as unneeded is optional, but only when every module
     // was checked: once go mod why fails, the answers are incomplete, and a
     // tool failure is not evidence that a module is unused.
@@ -313,7 +365,9 @@ export async function createGoBom(path, options) {
         continue;
       }
       if (requiredModules.has(apkg.name)) {
-        apkg.scope = "required";
+        if (builtVersions[apkg.name] === apkg.version) {
+          apkg.scope = "required";
+        }
       } else if (!circuitBreak && unneededModules.has(apkg.name)) {
         apkg.scope = "optional";
       }
@@ -339,12 +393,9 @@ export async function createGoBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const gosumData = readFileSync(f, { encoding: "utf-8" });
-      const dlist = await parseGosumData(gosumData);
-      if (dlist?.length) {
-        dlist.forEach((pkg) => {
-          gosumMap[`${pkg.name}@${pkg.version}`] = pkg._integrity;
-        });
-      }
+      // Only the hashes are needed here; reading them costs no registry
+      // round trip. The components come from go.mod and the go list output.
+      Object.assign(gosumMap, parseGosumHashes(gosumData));
     }
   }
 
@@ -379,6 +430,9 @@ export async function createGoBom(path, options) {
     });
 
     let rootParentComponent = null;
+    // Whether the go toolchain resolved a module graph. A module without
+    // dependencies resolves to no components, and that is a complete answer.
+    let resolvedByToolchain = false;
     // Use the go list -deps and go mod why commands to generate a good quality BOM for non-docker invocations
     if (
       !hasAnyProjectType(["docker", "oci", "container", "os"], options, false)
@@ -398,13 +452,15 @@ export async function createGoBom(path, options) {
           console.log("Executing go list -deps in", basePath);
         }
         // TODO: Replacing this with -json gives us more interesting data points such as GoFiles, Imports, and Deps
+        // The fields after Dir name the module content checksum and, for a
+        // module a replace directive swapped out, the replacement Go builds.
         let result = safeSpawnSync(
           "go",
           [
             "list",
             "-deps",
             "-f",
-            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}{{end}}'",
+            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}|{{.Sum}}|{{with .Replace}}{{.Path}}{{end}}|{{with .Replace}}{{.Version}}{{end}}|{{with .Replace}}{{.Sum}}{{end}}{{end}}'",
             "./...",
           ],
           {
@@ -448,7 +504,9 @@ export async function createGoBom(path, options) {
         const stdout = result.stdout;
         if (stdout) {
           let cmdOutput = Buffer.from(stdout).toString();
-          const retMap = await parseGoListDep(cmdOutput, gosumMap);
+          const retMap = await parseGoListDep(cmdOutput, gosumMap, {
+            mainModuleDir: basePath,
+          });
           if (retMap.pkgList?.length) {
             pkgList = pkgList.concat(retMap.pkgList);
           }
@@ -457,6 +515,7 @@ export async function createGoBom(path, options) {
             retMap.parentComponent &&
             Object.keys(retMap.parentComponent).length
           ) {
+            resolvedByToolchain = true;
             if (!rootParentComponent) {
               // First (shallowest) module becomes the root
               rootParentComponent = retMap.parentComponent;
@@ -464,12 +523,18 @@ export async function createGoBom(path, options) {
               parentComponent = rootParentComponent;
             } else {
               // Subsequent modules become subcomponents
-              if (!parentComponent.components) {
-                parentComponent.components = [];
-              }
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
+          // The other members of a go.work workspace are modules of the same
+          // project, which no registry holds.
+          for (const workspaceModule of retMap.workspaceModules || []) {
+            addGoSubComponent(parentComponent, workspaceModule, pkgList);
+          }
           if (DEBUG_MODE) {
             console.log("Executing go mod graph in", basePath);
           }
@@ -519,8 +584,11 @@ export async function createGoBom(path, options) {
             }
             // Retain the parent component hierarchy
             if (Object.keys(retMap.parentComponent).length) {
-              parentComponent.components = parentComponent.components || [];
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
         } else {
@@ -533,6 +601,7 @@ export async function createGoBom(path, options) {
             shell: isWin,
           });
           if (result.stdout) {
+            resolvedByToolchain = true;
             const cmdOutput = Buffer.from(result.stdout).toString();
             // The arguments to parseGoModGraph are slightly different to force inclusion of all packages
             const retMap = await parseGoModGraph(
@@ -561,8 +630,11 @@ export async function createGoBom(path, options) {
                 parentComponent = rootParentComponent;
               } else {
                 // Subsequent modules become subcomponents
-                parentComponent.components = parentComponent.components || [];
-                parentComponent.components.push(retMap.parentComponent);
+                addGoSubComponent(
+                  parentComponent,
+                  retMap.parentComponent,
+                  pkgList,
+                );
               }
             }
           } else {
@@ -584,7 +656,7 @@ export async function createGoBom(path, options) {
           }
         }
       }
-      if (pkgList.length && !shouldManuallyParse) {
+      if ((pkgList.length || resolvedByToolchain) && !shouldManuallyParse) {
         return buildBomNSData(options, pkgList, "golang", {
           dependencies,
           parentComponent,
@@ -727,11 +799,19 @@ function cargoAnswersVersion(cwd) {
  * @param {string} [filterPlatform] Target triple to resolve the graph for
  * @returns {object|undefined} Parsed `cargo metadata` output
  */
-function runCargoMetadata(cargoTomlFile, filterPlatform) {
-  const basePath = dirname(cargoTomlFile);
+function runCargoMetadata(cargoTomlFile, filterPlatform, options = {}) {
+  // cargo reads `.cargo/config.toml` (rustc, rustc-wrapper, [env]) and rustup
+  // reads `rust-toolchain.toml` from the working directory, and `cargo
+  // metadata` runs rustc to learn the target. Without permission to run the
+  // project's tooling, cargo starts outside the project and stays offline.
+  const toolingAllowed = isProjectToolingAllowed(options);
+  const basePath = toolingAllowed ? dirname(cargoTomlFile) : getTmpDir();
   const platformArgs = filterPlatform
     ? ["--filter-platform", filterPlatform]
     : [];
+  if (!toolingAllowed) {
+    platformArgs.push("--offline");
+  }
   // `--locked` keeps the user's lock file untouched; a workspace that is out of
   // date with its lock file needs the retry without it.
   for (const lockArgs of [["--locked"], []]) {
@@ -805,7 +885,7 @@ function annotateCargoDependencyKinds(
     let anyMetadata = false;
     let everyMetadata = true;
     for (const cargoTomlFile of cargoFiles) {
-      const metadata = runCargoMetadata(cargoTomlFile);
+      const metadata = runCargoMetadata(cargoTomlFile, undefined, options);
       if (!metadata) {
         everyMetadata = false;
         continue;
@@ -819,7 +899,11 @@ function annotateCargoDependencyKinds(
       visitedWorkspaceRoots.add(workspaceRoot);
       anyMetadata = true;
       if (CARGO_TARGET) {
-        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        const targetMetadata = runCargoMetadata(
+          cargoTomlFile,
+          CARGO_TARGET,
+          options,
+        );
         if (targetMetadata) {
           for (const key of parseCargoMetadataResolve(targetMetadata)
             .resolvedKeys) {
@@ -957,13 +1041,31 @@ export async function createRustBom(path, options) {
     `${options.multiProject ? "**/" : ""}Cargo.toml`,
     options,
   );
+  // `cargo check` compiles the project, running its build scripts and
+  // procedural macros, so --deep runs it only when the project's own tooling
+  // may run.
+  const cargoToolingAllowed = isProjectToolingAllowed(options);
+  if (
+    options.deep &&
+    cargoFiles.length &&
+    !cargoToolingAllowed &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    reportProjectToolingSkipped(
+      options,
+      null,
+      "Skipping 'cargo check' since dependency installation is disabled. Build scripts and procedural macros are not run, so the files each crate uses are not recorded.",
+    );
+  }
   // Attempt to build or generate lock files automatically
   for (const f of cargoFiles) {
     // If there are no cargo.lock files, we can attempt a cargo install when
     //    options.deep is true or options.lifecycle == build or post-build with installDeps
     // Why the need for installDeps? It currently defaults to true, so let's obey if someone wants no installs
     if (
-      (options.deep && !hasAnyProjectType(["oci"], options, false)) ||
+      (options.deep &&
+        cargoToolingAllowed &&
+        !hasAnyProjectType(["oci"], options, false)) ||
       (options.installDeps &&
         !safeExistsSync(f.replace(".toml", ".lock")) &&
         ["build", "post-build"].includes(options.lifecycle))
@@ -1163,7 +1265,9 @@ export function buildCargoCacheComponent(crateFile) {
 
 /**
  * Enriches a cargo cache component with a SHA-256 hash and filename-based
- * identity evidence (confidence 0.5). Hash computation failures are ignored.
+ * identity evidence (confidence 0.5), and with what the archive's own manifest
+ * says: its licence, description and repository, read from the archive without
+ * extracting it anywhere. Hash computation failures are ignored.
  *
  * @param {string} crateFile Absolute path to the `.crate` archive
  * @param {object} [component] Component produced by `buildCargoCacheComponent`
@@ -1183,6 +1287,33 @@ export async function enrichCargoCacheComponent(crateFile, component) {
   } catch {
     // continue without hashes
   }
+  const archive = await readCrateArchiveValues(
+    crateFile,
+    component.name,
+    component.version,
+  );
+  if (archive) {
+    if (archive.values.license && !component.license) {
+      component.license = archive.values.license;
+    }
+    if (archive.values.licenses && !component.licenses) {
+      component.licenses = archive.values.licenses;
+    }
+    if (archive.values.description && !component.description) {
+      component.description = archive.values.description;
+    }
+    if (archive.values.repository && !component.repository) {
+      component.repository = { url: archive.values.repository };
+    }
+    if (archive.values.homepage && !component.homepage) {
+      component.homepage = { url: archive.values.homepage };
+    }
+    component.properties = component.properties || [];
+    component.properties.push({
+      name: "cdx:cargo:metadataSource",
+      value: "local-registry",
+    });
+  }
   component.evidence = {
     identity: {
       field: "purl",
@@ -1365,6 +1496,7 @@ export function createCppBom(path, options) {
   }
   let pkgList = [];
   let parentComponentDependencies = [];
+  const subProjects = [];
   if (conanLockFiles.length) {
     for (const f of conanLockFiles) {
       if (DEBUG_MODE) {
@@ -1477,8 +1609,17 @@ export function createCppBom(path, options) {
         Object.keys(retMap.parentComponent).length &&
         !addedParentComponentsMap[retMap.parentComponent.name]
       ) {
+        // a project() below the scan root is a part of this project, not a
+        // dependency of it
         retMap.parentComponent.type = "library";
-        pkgList.push(retMap.parentComponent);
+        const subprojectDir = relative(scanRoot, resolve(dirname(f)))
+          .split(sep)
+          .join("/");
+        retMap.parentComponent.properties = [
+          ...(retMap.parentComponent.properties || []),
+          { name: "cdx:cmake:subprojectDir", value: subprojectDir || "." },
+        ];
+        subProjects.push(retMap.parentComponent);
         addedParentComponentsMap[retMap.parentComponent.name] = true;
       }
       // Retain the dependency tree from cmake
@@ -1522,6 +1663,29 @@ export function createCppBom(path, options) {
         boundaries: new Map(),
       }
     : resolveCmakeContext(path, options);
+  // How the project is built: its presets and compilers (formulation), its
+  // hardening options (project properties) and its own include directories.
+  const isImageScan = hasAnyProjectType(
+    ["docker", "oci", "container", "os"],
+    options,
+    false,
+  );
+  // Code carried in the tree under a license of its own, outside the sources
+  // of the dependencies CMake already knows and the build trees
+  const vendored = isImageScan
+    ? { components: [], dirs: [] }
+    : findVendoredCode(path, options, [
+        ...[...(cmakeContext.boundaries || new Map())]
+          .filter(([, e]) => e?.kind === "fetch" || e?.kind === "submodule")
+          .map(([dir]) => resolve(path, dir)),
+        ...cmakeBuildDirCandidates(path, options),
+      ]);
+  if (vendored.components.length) {
+    pkgList = pkgList.concat(vendored.components);
+  }
+  const buildContext = isImageScan
+    ? emptyCppBuildContext()
+    : resolveCppBuildContext(path, options, cmakeContext, vendored.dirs);
   if (cmakeContext.rootProject?.version && parentComponent) {
     const resolvedVersion = cmakeContext.rootProject.version;
     const scrapedVersion = parentComponent.version;
@@ -1651,30 +1815,44 @@ export function createCppBom(path, options) {
     // We collect OS packages with the word dev in the name using osquery here
     // rpm, deb and ebuild are supported
     // TODO: For archlinux and alpine users we need a different mechanism to collect this information
-    for (const queryCategory of Object.keys(cosDbQueries)) {
-      const queryObj = cosDbQueries[queryCategory];
-      const results = executeOsQuery(queryObj.query);
-      const dlist = convertOSQueryResults(
-        queryCategory,
-        queryObj,
-        results,
-        true,
-        {
-          deb: executeDpkgList,
-          rpm: executeRpmList,
-          apk: executeApkList,
-          ebuild: executeEqueryList,
-          alpm: executeAlpmList,
-        },
-      );
-      if (dlist?.length) {
-        osPkgsList = osPkgsList.concat(dlist);
+    // The packages only resolve the headers named by the usages slice, so
+    // they are not queried when there is neither a slice to reuse nor a C or
+    // C++ source for atom to read.
+    if (
+      (options.usagesSlicesFile && safeExistsSync(options.usagesSlicesFile)) ||
+      hasCppSources(path, options)
+    ) {
+      for (const queryCategory of Object.keys(cosDbQueries)) {
+        const queryObj = cosDbQueries[queryCategory];
+        const results = executeOsQuery(queryObj.query);
+        const dlist = convertOSQueryResults(
+          queryCategory,
+          queryObj,
+          results,
+          true,
+          {
+            deb: executeDpkgList,
+            rpm: executeRpmList,
+            apk: executeApkList,
+            ebuild: executeEqueryList,
+            alpm: executeAlpmList,
+          },
+        );
+        if (dlist?.length) {
+          osPkgsList = osPkgsList.concat(dlist);
+        }
       }
     }
     // Now we check with atom and attempt to detect all external modules via usages
     // We pass the current list of packages so that we enhance the current list and replace
     // components inadvertently. For example, we might resolved a name, version and url information already via cmake
-    const retMap = getCppModules(path, options, osPkgsList, pkgList);
+    const retMap = getCppModules(
+      path,
+      options,
+      osPkgsList,
+      pkgList,
+      buildContext.isFirstPartyHeader,
+    );
     if (retMap.pkgList?.length) {
       pkgList = pkgList.concat(retMap.pkgList);
     }
@@ -1718,6 +1896,33 @@ export function createCppBom(path, options) {
     ]);
   }
 
+  if (subProjects.length) {
+    if (parentComponent) {
+      parentComponent.components = parentComponent.components || [];
+      for (const sub of subProjects) {
+        if (
+          !parentComponent.components.some(
+            (c) => c["bom-ref"] === sub["bom-ref"],
+          ) &&
+          sub["bom-ref"] !== parentComponent["bom-ref"]
+        ) {
+          parentComponent.components.push(sub);
+        }
+      }
+    } else {
+      // with no project at the scan root there is nothing to nest them under
+      pkgList = pkgList.concat(subProjects);
+    }
+  }
+  if (parentComponent && buildContext.parentProperties.length) {
+    parentComponent.properties = (parentComponent.properties || []).filter(
+      (p) =>
+        !buildContext.parentProperties.some(
+          (bp) => bp.name === p.name && bp.value === p.value,
+        ),
+    );
+    parentComponent.properties.push(...buildContext.parentProperties);
+  }
   if (parentComponent) {
     sanitizeUnresolvedPurl(parentComponent);
     if (parentComponent.components) {
@@ -1734,6 +1939,7 @@ export function createCppBom(path, options) {
     src: path,
     parentComponent,
     dependencies,
+    formulationList: buildContext.formulationComponents,
   });
 }
 
@@ -1761,11 +1967,35 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("LEIN_ARGS")) {
       LEIN_ARGS = readEnvironmentVariable("LEIN_ARGS").split(" ");
     }
+    // `lein deps :tree-data` evaluates project.clj, which is a Clojure
+    // program, so it belongs to the dependency-tooling surface disabled by
+    // --no-install-deps and the pre-build lifecycle.
+    const leinToolingAllowed = isProjectToolingAllowed(options);
     for (const f of leinFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const basePath = dirname(f);
+      if (!leinToolingAllowed) {
+        reportProjectToolingSkipped(
+          options,
+          "clojure.lein.tooling-disabled",
+          "Skipping 'lein deps :tree-data' since dependency installation is disabled. Only the dependencies declared in project.clj will be used.",
+          {
+            ecosystem: "clojure",
+            tool: "lein",
+            impact: "transitive-deps",
+            detail:
+              "Dependency installation is disabled, so project.clj was not evaluated and only its directly declared dependencies are available.",
+          },
+        );
+        const leinData = readFileSync(f, { encoding: "utf-8" });
+        const dlist = parseLeiningenData(leinData);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+        continue;
+      }
       console.log("Executing", LEIN_CMD, "in", basePath);
       const result = safeSpawnSync(LEIN_CMD, LEIN_ARGS, {
         cwd: basePath,
@@ -2126,7 +2356,39 @@ export async function createSwiftBom(path, options) {
     );
   }
   if (swiftFiles.length) {
+    // A SwiftPM manifest is a Swift program, so `swift package dump-package`
+    // and `show-dependencies` execute the scanned project's code (and fetch
+    // missing dependencies). They belong to the dependency-tooling surface
+    // disabled by --no-install-deps and the pre-build lifecycle; the BOM then
+    // comes from Package.resolved alone.
+    const swiftToolingAllowed = isProjectToolingAllowed(options);
+    if (!swiftToolingAllowed) {
+      reportProjectToolingSkipped(
+        options,
+        "swift.tooling-disabled",
+        "Skipping 'swift package show-dependencies' since dependency installation is disabled. Only the packages in Package.resolved will be used.",
+        {
+          ecosystem: "swift",
+          tool: "swift",
+          impact: "transitive-deps",
+          detail:
+            "Dependency installation is disabled, so the Package.swift manifest was not evaluated and only the packages from Package.resolved are available.",
+        },
+      );
+      // The manifest is not run, so a project without Package.resolved still
+      // gets a parent component named after its directory.
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = createDefaultParentComponent(
+          swiftFiles[0],
+          "swift",
+          options,
+        );
+      }
+    }
     for (const f of swiftFiles) {
+      if (!swiftToolingAllowed) {
+        break;
+      }
       const basePath = dirname(f);
       if (completedPath.includes(basePath)) {
         continue;
@@ -2328,7 +2590,7 @@ export async function createCocoaBom(path, options) {
       "application",
     );
     const podfileLock = loadYaml(readFileSync(lockFile, "utf-8"));
-    const pods = await parsePodfileLock(podfileLock, projectPath);
+    const pods = await parsePodfileLock(podfileLock, projectPath, path);
     const allObjects = new Map();
     if (options) {
       // Every remote podspec the scan below reads is known from the lockfile,
@@ -2352,10 +2614,33 @@ export async function createCocoaBom(path, options) {
       allDependencies.set(name, podDependencies);
     }
     const targetDependencies = new Map();
-    if (
-      !readEnvironmentVariable("COCOA_INCLUDED_TARGETS") &&
-      !readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
-    ) {
+    // `pod ipc podfile-json` evaluates the Podfile, which is a Ruby program,
+    // so per-target filtering through it belongs to the dependency-tooling
+    // surface disabled by --no-install-deps and the pre-build lifecycle. A
+    // gated scan then keeps every pod the lockfile resolved (the union across
+    // targets) instead of the configured target subset.
+    const cocoaTargetsConfigured =
+      readEnvironmentVariable("COCOA_INCLUDED_TARGETS") ||
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS");
+    const cocoaToolingAllowed = isProjectToolingAllowed(options);
+    // True only when target names the Podfile actually resolved are known, so
+    // the include/exclude filters below can be applied to real targets.
+    let targetFilteringActive = false;
+    if (!cocoaTargetsConfigured || !cocoaToolingAllowed) {
+      if (cocoaTargetsConfigured) {
+        reportProjectToolingSkipped(
+          options,
+          "cocoa.podfile-json.tooling-disabled",
+          "Skipping 'pod ipc podfile-json' since dependency installation is disabled. Every pod from Podfile.lock is included without per-target filtering.",
+          {
+            ecosystem: "cocoa",
+            tool: "pod",
+            impact: "components",
+            detail:
+              "Dependency installation is disabled, so the Podfile was not evaluated and target filtering fell back to all pods resolved in Podfile.lock.",
+          },
+        );
+      }
       targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
     } else {
       const result = executePodCommand(
@@ -2363,18 +2648,39 @@ export async function createCocoaBom(path, options) {
         projectPath,
         options,
       );
-      const resolvedPodFile = JSON.parse(result.stdout);
-      parsePodfileTargets(
-        resolvedPodFile["target_definitions"][0],
-        targetDependencies,
-      );
+      let resolvedPodFile;
+      try {
+        resolvedPodFile = JSON.parse(result.stdout);
+      } catch (_e) {
+        resolvedPodFile = undefined;
+      }
+      if (resolvedPodFile?.target_definitions?.length) {
+        parsePodfileTargets(
+          resolvedPodFile["target_definitions"][0],
+          targetDependencies,
+        );
+        targetFilteringActive = true;
+      } else {
+        // pod failed or printed nothing usable (it refuses to run as root,
+        // for one), and an unparseable Podfile used to abort the whole scan.
+        // Keep every locked pod rather than none.
+        console.log(
+          "The Podfile could not be resolved with CocoaPods, so all pods from Podfile.lock are included without per-target filtering.",
+        );
+        targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
+      }
     }
     const usedTargets = new Set(
-      readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
+      targetFilteringActive && readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
         ? readEnvironmentVariable("COCOA_INCLUDED_TARGETS").split(",")
         : targetDependencies.keys(),
     );
-    if (readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")) {
+    // Without the resolved Podfile there are no target names to exclude, and
+    // excluding the lockfile's stand-in "Pods" target would drop every pod.
+    if (
+      targetFilteringActive &&
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
+    ) {
       readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
         .split(",")
         .forEach((excludedTarget) => {