@cdxgen/cdxgen 13.3.0 → 13.5.0

package/data/cbomosdb-queries.json

@@ -17,6 +17,12 @@
     "purlType": "rpm",
     "componentType": "library"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm",
+    "componentType": "library"
+  },
   "python_packages": {
     "query": "select * from python_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "Python packages installed on system.",
@@ -32,7 +38,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "List all homebrew_packages.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "library"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries among the active MacPorts ports.",
+    "purlType": "macports",
     "componentType": "library"
   },
   "authorized_keys": {

package/data/component-tags.json

@@ -164,6 +164,7 @@
       "windows_programs",
       "processor",
       "services_snapshot",
+      "apk_packages",
       "apt_sources",
       "apt_ppa_sources",
       "behavioral_reverse_shell",
@@ -180,6 +181,13 @@
       "gatekeeper",
       "vscode_extensions",
       "homebrew_packages",
+      "macports_packages",
+      "pacman_packages",
+      "snap_packages",
+      "flatpak_packages",
+      "ai_agent_skills",
+      "gpu_info",
+      "chrome_search_engines",
       "installed_applications",
       "interface_addresses",
       "kernel_info",

package/data/helpers/init.gradle

@@ -17,14 +17,51 @@ allprojects {
         // attached to the matching component instead of guessing the first repository.
         if (project.hasProperty('cdxgenResolveDistribution') &&
                 project.property('cdxgenResolveDistribution').toString() == 'true') {
-            def resolvedKeys = [] as Set
+            // Shared by every project in the build, so a dependency declared in
+            // many subprojects is probed once, and a repository host that
+            // answers 429 is left alone for the rest of the build.
+            if (!gradle.ext.has('cdxgenResolvedKeys')) {
+                gradle.ext.cdxgenResolvedKeys = java.util.concurrent.ConcurrentHashMap.newKeySet()
+                gradle.ext.cdxgenPausedHosts = java.util.concurrent.ConcurrentHashMap.newKeySet()
+            }
+            def resolvedKeys = gradle.ext.cdxgenResolvedKeys
+            def pausedHosts = gradle.ext.cdxgenPausedHosts
+            // A HEAD request answers whether the repository serves the file
+            // without downloading it. Other URL schemes, such as file:, are
+            // opened and closed.
+            def artifactExists = { String artifactUrl ->
+                try {
+                    def url = new URL(artifactUrl)
+                    if (url.protocol == 'http' || url.protocol == 'https') {
+                        if (pausedHosts.contains(url.host)) {
+                            return false
+                        }
+                        def connection = (HttpURLConnection) url.openConnection()
+                        connection.requestMethod = 'HEAD'
+                        connection.instanceFollowRedirects = true
+                        connection.connectTimeout = 10000
+                        connection.readTimeout = 10000
+                        def code = connection.responseCode
+                        connection.disconnect()
+                        if (code == 429) {
+                            pausedHosts.add(url.host)
+                        }
+                        return code >= 200 && code < 300
+                    }
+                    def stream = url.openStream()
+                    stream.close()
+                    return true
+                } catch (Exception ignored) {
+                    return false
+                }
+            }
             project.configurations.each { configuration ->
                 configuration.dependencies.each { dependency ->
                     if (dependency.group == null || dependency.version == null) {
                         return
                     }
                     def depKey = String.format("%s:%s:%s", dependency.group, dependency.name, dependency.version)
-                    if (resolvedKeys.contains(depKey)) {
+                    if (!resolvedKeys.add(depKey)) {
                         return
                     }
                     def groupPath = dependency.group.replace('.', '/')
@@ -40,28 +77,16 @@ allprojects {
                         def jarUrl = String.format("%s%s/%s/%s/%s-%s.jar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
+                        if (artifactExists(jarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
+                            break
+                        }
                         def aarUrl = String.format("%s%s/%s/%s/%s-%s.aar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
-                        try {
-                            def inStreamJar = new URL(jarUrl).openStream()
-                            if (inStreamJar != null) {
-                                inStreamJar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
-                        }
-                        try {
-                            def inStreamAar = new URL(aarUrl).openStream()
-                            if (inStreamAar != null) {
-                                inStreamAar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
+                        if (artifactExists(aarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
+                            break
                         }
                     }
                 }

package/data/queries-darwin.json

@@ -29,6 +29,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "apps": {
     "query": "select * from apps;",
     "description": "macOS applications installed in known search paths (e.g., /Applications).",
@@ -47,6 +59,12 @@
     "purlType": "swid",
     "componentType": "application"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "certificates": {
     "query": "SELECT * FROM certificates WHERE path != 'Other People';",
     "description": "List all certificates in the trust store.",
@@ -74,7 +92,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages;",
     "description": "Homebrew formula and cask inventory including auto-update behavior.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "application"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages;",
+    "description": "Retrieves the active ports of the MacPorts registry.",
+    "purlType": "macports",
     "componentType": "application"
   },
   "npm_packages": {

package/data/queries-win.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "browser_plugins": {
     "query": "select browser_plugins.* from users join browser_plugins using (uid);",
     "description": "Retrieves the list of C/NPAPI browser plugin in the target system.",
@@ -88,6 +100,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, uid, type, gid FROM users;",
     "description": "Local and domain-backed user account inventory on Windows endpoints.",
@@ -167,7 +185,7 @@
     "componentType": "data"
   },
   "windows_bitlocker_info": {
-    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status FROM bitlocker_info;",
+    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status, protector_types FROM bitlocker_info;",
     "description": "BitLocker protection and encryption state for local drives.",
     "purlType": "swid",
     "componentType": "data"

package/data/queries.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "deb_packages": {
     "query": "select * from deb_packages;",
     "description": "Retrieves all the installed DEB packages in the target Linux system.",
@@ -69,6 +81,29 @@
     "description": "Retrieves all the installed RPM packages in the target Linux system.",
     "purlType": "rpm"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages;",
+    "description": "Retrieves all the packages pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm"
+  },
+  "snap_packages": {
+    "query": "select * from snap_packages;",
+    "description": "Retrieves the installed snap packages at their current revision.",
+    "purlType": "snap",
+    "componentType": "application"
+  },
+  "flatpak_packages": {
+    "query": "select app_id as name, name as display_name, version, arch, branch, commit_hash, origin, runtime, type, installation, summary, description, license, homepage, developer_name from flatpak_packages;",
+    "description": "Retrieves the Flatpak applications and runtimes installed system-wide and for each user.",
+    "purlType": "flatpak",
+    "componentType": "application"
+  },
+  "homebrew_packages": {
+    "query": "SELECT * FROM homebrew_packages;",
+    "description": "Homebrew formula and cask inventory including auto-update behavior.",
+    "purlType": "brew",
+    "componentType": "application"
+  },
   "python_packages": {
     "query": "select * from python_packages;",
     "description": "Python packages installed on system.",
@@ -85,6 +120,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, shell, uid, gid FROM users;",
     "description": "Local user inventory for account and shell posture analysis.",