@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/core/pluginRun.js

@@ -0,0 +1,184 @@
+/**
+ * Shared plumbing for plugin (rusi/golem/kosi) invocations: resolving the
+ * directory to analyze, and reporting a failed run.
+ */
+
+import { isAbsolute, join, normalize, resolve, sep } from "node:path";
+import process from "node:process";
+
+import { DEBUG_MODE } from "./activity.js";
+import { deferFailOnError } from "./deferredExit.js";
+import { safeExistsSync } from "./fs.js";
+
+/**
+ * The working directory, when a relative source argument names it.
+ *
+ * cdxgen is frequently launched with its working directory already set to the
+ * project (depscan does exactly that) while the path argument stays relative
+ * to some repository root, e.g. cwd `/work/repo/test/data/app` with argument
+ * `test/data/app`. A plain `path.resolve` then produces the doubled
+ * `/work/repo/test/data/app/test/data/app`. This recognises that shape and
+ * nothing looser: the argument's path segments must be the trailing segments
+ * of the working directory, so a mistyped argument run from some other
+ * project is never silently redirected to that project.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string} [cwd] Working directory; defaults to `process.cwd()`.
+ * @returns {string|undefined} The absolute working directory when the
+ *   argument names it, otherwise undefined.
+ */
+export function cwdNamedByRelativeSource(src, cwd = process.cwd()) {
+  if (typeof src !== "string" || !src || isAbsolute(src)) {
+    return undefined;
+  }
+  // normalize() converts separators to the platform's, so one split on sep
+  // handles both "a/b" and "a\\b" on Windows; on POSIX a backslash is an
+  // ordinary file-name character and must not split.
+  const relParts = normalize(src)
+    .split(sep)
+    .filter((part) => part && part !== ".");
+  if (!relParts.length || relParts.includes("..")) {
+    return undefined;
+  }
+  const absCwd = resolve(cwd);
+  const cwdParts = absCwd.split(sep).filter(Boolean);
+  if (relParts.length > cwdParts.length) {
+    return undefined;
+  }
+  const tail = cwdParts.slice(cwdParts.length - relParts.length);
+  const caseInsensitive = process.platform === "win32";
+  const same = (a, b) =>
+    caseInsensitive ? a.toLowerCase() === b.toLowerCase() : a === b;
+  return relParts.every((part, i) => same(part, tail[i])) ? absCwd : undefined;
+}
+
+/**
+ * Resolve the source path argument once, at cdxgen's entry point.
+ *
+ * Everything downstream — the BOM generators, evinse, and the rusi/golem/kosi
+ * launchers — resolves the argument against the working directory, so the
+ * doubled-directory shape has to be corrected before any of them run;
+ * correcting it only in the plugin launchers leaves the main BOM built from a
+ * directory that does not exist.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string} [cwd] Working directory; defaults to `process.cwd()`.
+ * @returns {{path: string, rewritten: boolean, missing: boolean}} `path` is
+ *   the argument to use: unchanged when it resolves to an existing path, the
+ *   working directory when the argument names it (`rewritten`), and otherwise
+ *   unchanged with `missing` set.
+ */
+export function resolveSourcePathArgument(src, cwd = process.cwd()) {
+  if (typeof src !== "string" || !src) {
+    return { path: src, rewritten: false, missing: false };
+  }
+  if (safeExistsSync(resolve(cwd, src))) {
+    return { path: src, rewritten: false, missing: false };
+  }
+  const named = cwdNamedByRelativeSource(src, cwd);
+  if (named) {
+    return { path: named, rewritten: true, missing: false };
+  }
+  return { path: src, rewritten: false, missing: true };
+}
+
+/**
+ * Resolve the directory a plugin should analyze.
+ *
+ * The entry point already corrects the doubled-directory shape (see
+ * resolveSourcePathArgument); this is the same rule for callers that reach a
+ * plugin launcher directly (evinse, the library API). An existing directory
+ * wins and an absolute path is never rewritten. Otherwise the working
+ * directory is used only when the argument names it AND it carries the
+ * project marker the plugin needs (a `Cargo.toml` for rusi, a `go.mod` for
+ * golem). Anything else keeps the resolved path so the plugin's own error
+ * names the directory that was actually attempted.
+ *
+ * @param {string} src The source path as the caller typed it.
+ * @param {string[]} markerFiles File names that, present in the working
+ *   directory, identify it as the project the plugin should analyze.
+ * @returns {string} The directory to pass to the plugin.
+ */
+export function resolvePluginSourceDir(src, markerFiles = []) {
+  const resolved = resolve(src);
+  if (safeExistsSync(resolved) || isAbsolute(src)) {
+    return resolved;
+  }
+  const cwd = cwdNamedByRelativeSource(src);
+  if (!cwd) {
+    return resolved;
+  }
+  for (const marker of markerFiles) {
+    if (marker && safeExistsSync(join(cwd, marker))) {
+      console.error(
+        `Resolved source directory ${resolved} does not exist; the working directory ${cwd} is the project the argument names (found ${marker}), using it instead.`,
+      );
+      return cwd;
+    }
+  }
+  return resolved;
+}
+
+/**
+ * Report a failed plugin run, keeping the two failure classes apart.
+ *
+ * A spawn error means the plugin binary itself could not run — not installed,
+ * not executable, blocked by the command policy — which is an installation
+ * problem. A non-zero exit status or a missing report means the plugin ran
+ * and the analysis failed, which must not be dressed up as an installation
+ * problem: the message names the directory and says the reachability
+ * evidence will be missing, because a silent degradation is what let a
+ * doubled `--dir` go unnoticed in the first place.
+ *
+ * Under `--fail-on-error` the failure additionally claims the process exit
+ * status through the deferred-exit contract.
+ *
+ * @param {Object} run What ran and how it failed.
+ * @param {string} run.tool Plugin name, e.g. "rusi".
+ * @param {string} run.ecosystem Ecosystem the plugin serves, e.g. "rust".
+ * @param {string} run.executable The binary that was invoked.
+ * @param {string[]} run.args The arguments it was invoked with.
+ * @param {string} run.dir The directory that was analyzed.
+ * @param {Object} run.result The spawn result.
+ * @param {string} run.outputFile The report file the plugin should have written.
+ * @param {Object} [run.options] CLI options, for the `--fail-on-error` contract.
+ * @returns {void}
+ */
+export function reportPluginRunFailure({
+  tool,
+  ecosystem,
+  executable,
+  args,
+  dir,
+  result,
+  outputFile,
+  options,
+}) {
+  const command = `${executable} ${(args || []).join(" ")}`.trim();
+  if (result?.error) {
+    console.error(
+      `${tool} plugin could not be executed for ${dir}: ${result.error.message}. Check if the ${tool} plugin was installed successfully.`,
+    );
+  } else {
+    const status =
+      typeof result?.status === "number" ? result.status : "unknown";
+    const reason = safeExistsSync(outputFile)
+      ? "exited unsuccessfully"
+      : "wrote no report";
+    console.error(
+      `${tool} analysis ${reason} for directory ${dir} (exit status ${status}); ${ecosystem} reachability evidence will be missing from the BOM.`,
+    );
+  }
+  if (DEBUG_MODE && (result?.stdout || result?.stderr)) {
+    console.error(result.stdout, result.stderr);
+  }
+  deferFailOnError(options, {
+    ecosystem,
+    tool,
+    detail: result?.error
+      ? `${tool} plugin could not be executed: ${result.error.message}`
+      : `${tool} analysis failed for directory ${dir}`,
+    exitCode: typeof result?.status === "number" ? result.status : undefined,
+    command,
+  });
+}

package/lib/core/processTree.js

@@ -0,0 +1,100 @@
+/**
+ * Helpers for external commands stopped by cdxgen's spawn timeout.
+ *
+ * Layer 0: this module imports nothing outside `lib/core`, so both the atom
+ * and the dosai runners (layer 2) can share it.
+ */
+
+import { DEBUG_MODE } from "./activity.js";
+import { safeSpawnSync } from "./fs.js";
+import { isWin } from "./paths.js";
+
+/**
+ * A duration for a message: seconds to one decimal below a minute, minutes to
+ * one decimal from there.
+ *
+ * @param {number} ms Duration in milliseconds
+ * @returns {string} Human-readable duration
+ */
+export function formatDuration(ms) {
+  if (ms >= 60_000) {
+    const minutes = Math.round(ms / 6_000) / 10;
+    return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  }
+  return `${Math.round(ms / 100) / 10} seconds`;
+}
+
+/**
+ * Stop the descendants a timed-out run left behind on Windows.
+ *
+ * The spawn timeout terminates only the process cdxgen spawned, and Windows
+ * neither kills nor re-parents its children: a shell's command, a runtime's
+ * workers, or the build hosts a .NET analyzer starts keep running while still
+ * pointing at the dead process's pid. `taskkill /T` on that pid finds nothing,
+ * because the root is already gone. The live descendants are therefore found
+ * by parent pid in a process snapshot and stopped, limited to processes
+ * created after the run started. The root's own children must also predate
+ * its end: once the root is gone its pid can be handed to an unrelated
+ * process, whose children would otherwise look like the run's. Elsewhere this
+ * does nothing: an orphan is re-parented and can no longer be told apart.
+ *
+ * @param {number|undefined} rootPid pid of the process cdxgen spawned
+ * @param {number} startedAt Epoch milliseconds at which the run started
+ * @param {number} [endedAt] Epoch milliseconds at which the spawned process ended
+ * @param {string} [toolName] Name of the tool, for the debug message
+ * @returns {number[]} The pids that were stopped
+ */
+export function reapProcessTree(
+  rootPid,
+  startedAt,
+  endedAt = Date.now(),
+  toolName = "external",
+) {
+  if (!isWin || !Number.isInteger(rootPid) || rootPid <= 0) {
+    return [];
+  }
+  // All three values are integers, so interpolating them cannot inject anything.
+  const since = Math.max(0, Math.floor(startedAt) - 1000);
+  const until = Math.max(since, Math.floor(endedAt) + 1000);
+  const script = [
+    `$root = ${rootPid}`,
+    `$since = [DateTimeOffset]::FromUnixTimeMilliseconds(${since}).UtcDateTime`,
+    `$until = [DateTimeOffset]::FromUnixTimeMilliseconds(${until}).UtcDateTime`,
+    "$children = @{}",
+    "foreach ($p in Get-CimInstance Win32_Process -Property ProcessId,ParentProcessId,CreationDate) {",
+    "  if (-not $p.CreationDate) { continue }",
+    "  $created = $p.CreationDate.ToUniversalTime()",
+    "  if ($created -lt $since) { continue }",
+    "  if ([int]$p.ParentProcessId -eq $root -and $created -gt $until) { continue }",
+    "  $children[[int]$p.ParentProcessId] += @([int]$p.ProcessId)",
+    "}",
+    "$found = [System.Collections.Generic.List[int]]::new()",
+    "$queue = [System.Collections.Generic.Queue[int]]::new()",
+    "$queue.Enqueue($root)",
+    "while ($queue.Count) {",
+    "  foreach ($child in @($children[$queue.Dequeue()])) {",
+    "    if ($child -and -not $found.Contains($child)) { $found.Add($child); $queue.Enqueue($child) }",
+    "  }",
+    "}",
+    "foreach ($child in $found) { Stop-Process -Id $child -Force -ErrorAction SilentlyContinue }",
+    "$found -join ','",
+  ].join("\n");
+  const result = safeSpawnSync(
+    "powershell",
+    ["-NoProfile", "-NonInteractive", "-Command", script],
+    { timeout: 60000 },
+  );
+  const reaped = `${result?.stdout || ""}`
+    .trim()
+    .split(",")
+    .map((pid) => Number.parseInt(pid, 10))
+    .filter((pid) => pid > 0);
+  if (DEBUG_MODE) {
+    console.log(
+      reaped.length
+        ? `Stopped ${reaped.length} process(es) the timed-out ${toolName} run left behind: ${reaped.join(", ")}.`
+        : `The timed-out ${toolName} run left no processes behind.`,
+    );
+  }
+  return reaped;
+}

package/lib/core/projectConfig.js

@@ -45,6 +45,7 @@ const ANNOUNCED_OPTIONS = new Set([
   "api-key",
   "include-formulation",
   "install-deps",
+  "introspect",
   "deep",
   "tea-publish",
   "tea-fetch",

package/lib/core/projectTooling.js

@@ -0,0 +1,97 @@
+/**
+ * Policy for running the scanned project's own build tooling.
+ *
+ * Build tools such as Maven, Gradle, Poetry, MSBuild, SwiftPM, Leiningen and
+ * CocoaPods read configuration or run code that ships with the project
+ * (`.mvn/jvm.config`, `.poetry/plugins`, `Directory.Build.rsp`, `Package.swift`,
+ * `project.clj`, podspecs). Running them on an untrusted project runs that
+ * project's code, so they belong to the same surface as dependency
+ * installation and are skipped whenever installation is disabled.
+ */
+import { isSecureMode, readEnvironmentVariable } from "./activity.js";
+import { recordDegradation } from "./buildLedger.js";
+
+/**
+ * Whether secure mode is on right now. `isSecureMode` is read once when the
+ * modules load, but the `cdxgen-secure` command turns secure mode on later,
+ * by setting CDXGEN_SECURE_MODE before the scan starts.
+ *
+ * @returns {boolean} true when secure mode is on
+ */
+export function isSecureModeActive() {
+  return (
+    isSecureMode ||
+    ["true", "1"].includes(readEnvironmentVariable("CDXGEN_SECURE_MODE"))
+  );
+}
+
+/**
+ * Whether the scan may run the scanned project's own build tooling, such as
+ * wrapper scripts or build definitions that Maven, Gradle, sbt, Mill, Poetry,
+ * PDM, MSBuild, SwiftPM, Leiningen and CocoaPods evaluate.
+ *
+ * Tooling follows `options.installDeps`, which defaults to off in secure mode
+ * when a caller does not set it. Introspection mode exists to observe the
+ * project's own toolchain, so it keeps that tooling on even when dependency
+ * installation is disabled, as long as the operator asked for it rather than
+ * a config file in the scanned project. Secure mode still wins:
+ * CDXGEN_INTROSPECT alone must not make a secure-mode scan run the scanned
+ * project's code.
+ *
+ * @param {Object} [options] CLI options
+ * @returns {boolean} true when project tooling may run
+ */
+export function isProjectToolingAllowed(options) {
+  const secureMode = isSecureModeActive();
+  const installDeps = options?.installDeps ?? !secureMode;
+  if (installDeps !== false) {
+    return true;
+  }
+  return (
+    options?.introspect === true &&
+    options?.introspectFromConfigFile !== true &&
+    !secureMode
+  );
+}
+
+// The skips already reported for each scan, keyed by the scan's options.
+// Callers without options share one key.
+const reportedSkips = new WeakMap();
+const noOptionsKey = {};
+
+/**
+ * Tell the user that a tool was skipped because project tooling is not
+ * allowed, and record the matching degradation for the fidelity report.
+ * Each skip is reported once per scan, however many manifests it applies to.
+ * A skip that only costs evidence, not BOM content, passes no remediation id
+ * and is only shown.
+ *
+ * @param {Object} options CLI options of the scan
+ * @param {string|null} remediationId Remediation id from
+ *   data/remediations.json, or null for a message only
+ * @param {string} message Console message shown to the user
+ * @param {Object} [fields] Degradation fields (ecosystem, tool, impact, detail)
+ * @returns {void}
+ */
+export function reportProjectToolingSkipped(
+  options,
+  remediationId,
+  message,
+  fields,
+) {
+  const key = options && typeof options === "object" ? options : noOptionsKey;
+  let reported = reportedSkips.get(key);
+  if (!reported) {
+    reported = new Set();
+    reportedSkips.set(key, reported);
+  }
+  const skipKey = remediationId || message;
+  if (reported.has(skipKey)) {
+    return;
+  }
+  reported.add(skipKey);
+  console.log(message);
+  if (remediationId) {
+    recordDegradation(remediationId, fields);
+  }
+}

package/lib/core/propertySanitizer.js

@@ -26,6 +26,15 @@ const JSON_PROPERTY_NAMES = new Set([
 ]);
 const URL_PATTERN = /https?:\/\/[^\s<>"'),\]}]+/giu;
 const MAX_STRUCTURE_DEPTH = 6;
+// What an RFC 3986 path may hold as it is: unreserved characters, sub-delims,
+// ":", "@", "/" and well-formed percent-escapes. A query or fragment may also
+// hold "?". Everything else is percent-encoded.
+const URI_PATH_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/%]/gu;
+const URI_QUERY_UNSAFE =
+  /%(?![0-9A-Fa-f]{2})|[^A-Za-z0-9\-._~!$&'()*+,;=:@/?%]/gu;
+const URI_SCHEME_AUTHORITY = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#]*/u;
+const UTF8_ENCODER = new TextEncoder();
 
 function sanitizeUrlForBom(value) {
   const input = String(value || "").trim();
@@ -146,6 +155,69 @@ export function sanitizeBomUrl(value) {
   return sanitizeUrlForBom(value);
 }
 
+function percentEncodeUnsafe(text, unsafe) {
+  return text.replace(unsafe, (character) =>
+    Array.from(
+      UTF8_ENCODER.encode(character),
+      (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`,
+    ).join(""),
+  );
+}
+
+/**
+ * Percent-encode what an RFC 3986 URI reference cannot hold as it is, so a
+ * route template or URL can be emitted where CycloneDX expects an
+ * iri-reference, such as `services[].endpoints[]`. The braces of a route
+ * template, spaces, `<>`, `[]` outside an IPv6 host, `|`, `^`, non-ASCII
+ * characters and a `%` that starts no escape are encoded:
+ * `/users/{id}` becomes `/users/%7Bid%7D`. The scheme and authority of an
+ * absolute URL are kept as written, the query and fragment stay a query and
+ * fragment, and existing escapes are kept, so encoding twice changes
+ * nothing. Nothing is removed; strip credentials with {@link sanitizeBomUrl}
+ * first.
+ *
+ * @param {unknown} value Route template, path or URL
+ * @returns {string} The encoded reference
+ */
+export function encodeUriReference(value) {
+  const text = String(value ?? "");
+  const authority = URI_SCHEME_AUTHORITY.exec(text)?.[0] ?? "";
+  const rest = text.slice(authority.length);
+  const queryStart = rest.indexOf("?");
+  const fragmentStart = rest.indexOf("#");
+  const pathEnd = Math.min(
+    queryStart < 0 ? rest.length : queryStart,
+    fragmentStart < 0 ? rest.length : fragmentStart,
+  );
+  let encoded =
+    authority + percentEncodeUnsafe(rest.slice(0, pathEnd), URI_PATH_UNSAFE);
+  if (pathEnd === queryStart) {
+    const queryEnd = fragmentStart > queryStart ? fragmentStart : rest.length;
+    encoded += `?${percentEncodeUnsafe(rest.slice(queryStart + 1, queryEnd), URI_QUERY_UNSAFE)}`;
+  }
+  if (fragmentStart >= 0) {
+    encoded += `#${percentEncodeUnsafe(rest.slice(fragmentStart + 1), URI_QUERY_UNSAFE)}`;
+  }
+  return encoded;
+}
+
+/**
+ * Whether a value carries a token shape the BOM sanitizer redacts: cloud
+ * access keys, bearer tokens, GitHub, Slack and npm tokens, JWTs and the
+ * like. Callers that cannot splice a `[redacted]` marker into the value, such
+ * as a URL path segment, use it to drop the value instead.
+ *
+ * @param {unknown} value Value to check
+ * @returns {boolean} true when the value holds an inline credential
+ */
+export function hasInlineCredential(value) {
+  const text = String(value ?? "");
+  return INLINE_CREDENTIAL_PATTERNS.some((pattern) => {
+    pattern.lastIndex = 0;
+    return pattern.test(text);
+  });
+}
+
 /**
  * Sanitize a property value before serializing it into BOM properties.
  *

package/lib/core/runState.js

@@ -0,0 +1,39 @@
+/**
+ * State that lasts for one run.
+ *
+ * Registry answers, prefetched documents, recorded misses and local cache
+ * lookups are kept in module state, so that a package several lockfiles name
+ * costs one lookup. A run is one BOM generation. The CLI exits when it ends, but
+ * a long-lived process such as the server performs many, and nothing a run
+ * remembered should outlive it: the registries publish new releases, builds
+ * download new artifacts, and the memory belongs to the next scan.
+ *
+ * Every module that keeps such state registers a reset when it loads. The
+ * server calls {@link resetRunState} between scans. A module that has not
+ * loaded yet holds nothing to reset.
+ */
+
+/** @type {Map<string, () => void>} */
+const runResets = new Map();
+
+/**
+ * Register the function that empties a module's per-run state.
+ *
+ * @param {string} name Unique name, normally the module and what it holds
+ * @param {() => void} reset Empties that state
+ * @returns {void}
+ */
+export function registerRunReset(name, reset) {
+  runResets.set(name, reset);
+}
+
+/**
+ * Empty the per-run state of every module that registered one.
+ *
+ * @returns {void}
+ */
+export function resetRunState() {
+  for (const reset of runResets.values()) {
+    reset();
+  }
+}

package/lib/core/toml.js

@@ -0,0 +1,72 @@
+/**
+ * TOML parsing with stable, ordinary objects.
+ *
+ * smol-toml 1.9 began returning tables and inline tables with a `null`
+ * prototype so that a hostile `__proto__` key in a manifest cannot pollute
+ * `Object.prototype`. The SBOM data itself is unaffected, but cdxgen hands
+ * parsed manifests straight to callers (and `assert.deepStrictEqual` in the
+ * test suite), which compare by prototype and would see every table as a
+ * different kind of value. Re-wrapping the parse result with the standard
+ * prototype keeps the pre-1.9 contract: plain objects all the way down,
+ * `__proto__` keys included as ordinary own properties.
+ */
+
+import { parse as smolParse } from "smol-toml";
+
+/**
+ * Recursively rebuild a parsed value with `Object.prototype` roots.
+ *
+ * Class instances other than plain tables (smol-toml dates, strings, numbers)
+ * are passed through untouched, and arrays are copied only when an element
+ * actually changes, so unmodified branches keep their original identity.
+ *
+ * @param {unknown} value value produced by smol-toml's parse
+ * @returns {unknown} the same data with plain-prototype objects
+ */
+function toPlainPrototype(value) {
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  if (Array.isArray(value)) {
+    let changed = false;
+    const out = new Array(value.length);
+    for (let i = 0; i < value.length; i++) {
+      out[i] = toPlainPrototype(value[i]);
+      if (out[i] !== value[i]) {
+        changed = true;
+      }
+    }
+    return changed ? out : value;
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== null && proto !== Object.prototype) {
+    return value;
+  }
+  const out = {};
+  for (const [key, entry] of Object.entries(value)) {
+    if (key === "__proto__") {
+      // Plain assignment would re-point the new object's prototype instead
+      // of recording the key, reintroducing the pollution smol-toml guards
+      // against.
+      Object.defineProperty(out, key, {
+        value: toPlainPrototype(entry),
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      });
+    } else {
+      out[key] = toPlainPrototype(entry);
+    }
+  }
+  return out;
+}
+
+/**
+ * Parse a TOML document into plain objects.
+ *
+ * @param {string} text TOML source
+ * @returns {Object} parsed document whose tables use `Object.prototype`
+ */
+export function parseToml(text) {
+  return toPlainPrototype(smolParse(text));
+}

package/lib/ecosystems/asarutils.js

@@ -30,6 +30,7 @@ import {
 } from "../inventory/analyzer.js";
 import { tryBuildPurl } from "../inventory/purl.js";
 import { xml2js } from "../parsers/xml.js";
+import { resolveNpmLicense } from "./npmutils.js";
 
 const ASAR_JS_ANALYSIS_EXTENSIONS = new Set([
   ".cjs",
@@ -1040,8 +1041,9 @@ function createArchiveParentComponent(
         ? primaryPackageJson.author
         : primaryPackageJson.author?.name || "";
   }
-  if (primaryPackageJson?.license) {
-    component.license = primaryPackageJson.license;
+  const license = resolveNpmLicense(primaryPackageJson);
+  if (license) {
+    component.license = license;
   }
   if (primaryPackageJson?.repository) {
     const repositoryUrl =

package/lib/ecosystems/bunutils.js

@@ -3,8 +3,8 @@ import { dirname } from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
-import { shouldFetchLicense, shouldFetchVCS } from "../core/env.js";
+import { DEBUG_MODE } from "../core/activity.js";
+import { shouldFetchPackageMetadata } from "../core/env.js";
 import { safeExistsSync } from "../core/fs.js";
 import { getNpmMetadata } from "./ecosystems.js";
 import {
@@ -554,11 +554,9 @@ export async function parseBunLock(bunLockFile, options = {}) {
     });
   }
 
-  if (
-    shouldFetchLicense() ||
-    shouldFetchVCS() ||
-    readEnvironmentVariable("FETCH_LICENSE") === "true"
-  ) {
+  // The shared metadata gate: FETCH_LICENSE and the provenance fetch that
+  // --bom-audit turns on both reach the registry from here.
+  if (shouldFetchPackageMetadata()) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch npm registry metadata for ${pkgList.length} packages in parseBunLock`,