@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/evinser/evinser.js

@@ -5,6 +5,7 @@ import process from "node:process";
 import { Purl } from "@cdxgen/cdx-purl";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import {
   getAllFiles,
@@ -15,14 +16,20 @@ import {
   safeRmSync,
   safeWriteSync,
 } from "../core/fs.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
+import { hasCppSources } from "../ecosystems/cppEvidence.js";
+import {
+  createIncludeAttributor,
+  parseCIncludeSlices,
+} from "../ecosystems/cppIncludeResolver.js";
 import {
   analyzeGolemProject,
   collectGolemEvidence,
+  collectGolemServices,
   isGolemGoLanguage,
 } from "../ecosystems/golem.js";
 import {
   collectGradleDependencies,
-  getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
 import {
@@ -40,6 +47,14 @@ import {
   isRusiRustLanguage,
 } from "../ecosystems/rusi.js";
 import {
+  analyzeScalaProject,
+  collectScalasemApiEndpoints,
+  collectScalasemEvidence,
+  collectScalasemServices,
+  isScalasemLanguage,
+} from "../ecosystems/scalasem.js";
+import {
+  atomBuildToolArgs,
   atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
@@ -53,6 +68,7 @@ import {
   collectDosaiCryptoComponents,
   findCryptoAlgos,
 } from "../inventory/cbomutils.js";
+import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { collectMvnDependencies } from "../inventory/deps.js";
 import { mergeServices } from "../inventory/depsUtils.js";
 import {
@@ -64,6 +80,10 @@ import {
   collectDosaiServicesFromMethods,
   createDosaiDataFlowSlice,
   createDosaiMethodsSlice,
+  dosaiFailureReported,
+  dosaiOmittedSections,
+  dosaiReportFileOmittedSections,
+  dosaiSectionsCdxgenReads,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
@@ -141,6 +161,81 @@ function filterAtomSliceData(sliceData, options = {}) {
   return filterAtomSlicesByExcludePatterns(sliceData, options.exclude);
 }
 
+/**
+ * The project type whose evidence a package URL type belongs to. Generic
+ * purls are left out because many collectors use that type; they count as C
+ * only when the tree holds C or C++ sources.
+ */
+const EVIDENCE_LANGUAGE_BY_PURL_TYPE = {
+  cargo: "rust",
+  cocoapods: "swift",
+  composer: "php",
+  conan: "c",
+  gem: "ruby",
+  golang: "go",
+  maven: "java",
+  npm: "js",
+  nuget: "csharp",
+  pypi: "python",
+  swift: "swift",
+};
+
+/**
+ * The evidence language of a `cdxgen --evidence` run that names no project
+ * type.
+ *
+ * A directory with a Scala build takes the scalasem path. Otherwise the
+ * generated BOM decides: Java when it lists Maven packages, as before, and
+ * else the language most of its packages belong to. A BOM with no package in
+ * a language the evidence step analyses gives no language, so no analyzer
+ * runs over sources it cannot read.
+ *
+ * @param {string} dirPath Project directory
+ * @param {Object} [bomJson] The BOM generated for the directory
+ * @param {Object} [options] CLI options, for the exclude patterns
+ * @returns {string|undefined} Project type for the evidence phase
+ */
+export function defaultEvidenceLanguage(dirPath, bomJson, options = {}) {
+  const scalaBuildFiles = [
+    "build.sbt",
+    "build.sc",
+    "build.mill",
+    "project.scala",
+  ];
+  if (
+    scalaBuildFiles.some((file) => safeExistsSync(join(dirPath || ".", file)))
+  ) {
+    return "scala";
+  }
+  const counts = new Map();
+  let cppSources;
+  for (const component of bomJson?.components || []) {
+    const purl = `${component?.purl || ""}`;
+    if (!purl.startsWith("pkg:") || !purl.includes("/")) {
+      continue;
+    }
+    const purlType = purl.slice(4, purl.indexOf("/")).toLowerCase();
+    let language = EVIDENCE_LANGUAGE_BY_PURL_TYPE[purlType];
+    if (!language && purlType === "generic") {
+      cppSources ??= hasCppSources(dirPath || ".", options);
+      language = cppSources ? "c" : undefined;
+    }
+    if (language) {
+      counts.set(language, (counts.get(language) || 0) + 1);
+    }
+  }
+  if (counts.has("java")) {
+    return "java";
+  }
+  let chosen;
+  for (const [language, count] of counts) {
+    if (!chosen || count > counts.get(chosen)) {
+      chosen = language;
+    }
+  }
+  return chosen;
+}
+
 /**
  * Build the options for the evinse phase (prepareDB, analyzeProject, and
  * createEvinseFile) from the cdxgen CLI options.
@@ -178,6 +273,18 @@ export function buildEvinseOptions(options, args, input) {
     profile: options.profile,
     jsonPretty: options.jsonPretty,
     exclude: options.exclude,
+    // Forwarded so a failed rusi/golem run can claim the --fail-on-error exit
+    // instead of degrading the reachability evidence in silence.
+    failOnError: options.failOnError,
+    // The scala analyzer reads these: a command override, the test-source
+    // switch and the install policy that decides whether builds may run.
+    scalasemCommand: options.scalasemCommand,
+    scalasemIncludeTests: options.scalasemIncludeTests,
+    scalasem: options.scalasem,
+    installDeps: options.installDeps,
+    requiredOnly: options.requiredOnly,
+    // --deep publishes the namespaces the Scala classpath join reads.
+    scalasemNamespaces: options.deep,
     // Absolute path of the deps slice createCsharpBom writes for --deep runs,
     // so analyzeProject can reuse it instead of rerunning dosai methods.
     depsSlicesFile: options.depsSlicesFile
@@ -239,7 +346,7 @@ export async function prepareDB(options) {
       await catalogMavenDeps(dirPath, purlsJars, Namespaces, options);
     }
     if (gradleFiles?.length) {
-      await catalogGradleDeps(dirPath, purlsJars, Namespaces);
+      await catalogGradleDeps(dirPath, purlsJars, Namespaces, options);
     }
   }
   for (const purl of Object.keys(purlsToSlice)) {
@@ -248,11 +355,42 @@ export async function prepareDB(options) {
   return { sequelize, Namespaces, Usages, DataFlows };
 }
 
+/**
+ * Read the jar namespace map cdxgen writes next to the BOM it generates
+ * (`<bom>.map`). The map for the BOM passed as `--input` is preferred; a
+ * `bom.json.map` in the project directory is the fallback.
+ *
+ * @param {string} dirPath Project directory scanned by evinse
+ * @param {Object} [options] CLI options, for `input`
+ * @returns {Object|undefined} The mapping, when a non-empty one exists.
+ */
+export function readNamespaceMap(dirPath, options = {}) {
+  const candidates = [
+    options?.input ? `${options.input}.map` : undefined,
+    join(dirPath, "bom.json.map"),
+  ];
+  for (const mapFile of candidates) {
+    if (!mapFile || !safeExistsSync(mapFile)) {
+      continue;
+    }
+    try {
+      const mapData = JSON.parse(fs.readFileSync(mapFile, "utf-8"));
+      if (mapData && Object.keys(mapData).length) {
+        return mapData;
+      }
+    } catch (_err) {
+      // An unreadable map is the same as no map.
+    }
+  }
+  return undefined;
+}
+
 /**
  * Collect Maven jar namespace mappings for the purls found in the SBOM.
  *
- * If a previously generated `bom.json.map` is present in `dirPath` it is reused;
- * otherwise the maven command is invoked to collect the jar dependencies. Each
+ * If cdxgen left a namespace map next to the BOM (see {@link readNamespaceMap})
+ * it is reused; otherwise the maven command is invoked to collect the jar
+ * dependencies. Each
  * resolved purl is recorded in the `purlsJars` map and persisted in the
  * `Namespaces` model.
  *
@@ -268,22 +406,26 @@ export async function catalogMavenDeps(
   Namespaces,
   options = {},
 ) {
-  let jarNSMapping;
-  if (safeExistsSync(join(dirPath, "bom.json.map"))) {
-    try {
-      const mapData = JSON.parse(
-        fs.readFileSync(join(dirPath, "bom.json.map"), "utf-8"),
+  let jarNSMapping = readNamespaceMap(dirPath, options);
+  if (!jarNSMapping && !isProjectToolingAllowed(options)) {
+    // `mvn dependency:copy-dependencies` evaluates the project's build and
+    // its `.mvn` configuration, so only the local repository is read.
+    console.log(
+      options.withDeepJarCollector
+        ? "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Only the jars already in the local Maven repository are used."
+        : "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Pass --with-deep-jar-collector to use the jars already in the local Maven repository.",
+    );
+    if (options.withDeepJarCollector) {
+      jarNSMapping = await collectMvnDependencies(
+        undefined,
+        undefined,
+        true,
+        true,
       );
-      if (mapData && Object.keys(mapData).length) {
-        jarNSMapping = mapData;
-      }
-    } catch (_err) {
-      // ignore
     }
-  }
-  if (!jarNSMapping) {
+  } else if (!jarNSMapping) {
     console.log("About to collect jar dependencies for the path", dirPath);
-    const mavenCmd = getMavenCommand(dirPath, dirPath);
+    const mavenCmd = getMavenCommand(dirPath, dirPath, options);
     // collect all jars including from the cache if data-flow mode is enabled
     jarNSMapping = await collectMvnDependencies(
       mavenCmd,
@@ -324,18 +466,28 @@ export async function catalogMavenDeps(
  * @param {Object} Namespaces Sequelize-like Namespaces model used to persist pom and namespaces
  * @returns {Promise<void>}
  */
-export async function catalogGradleDeps(dirPath, purlsJars, Namespaces) {
-  console.log(
-    "About to collect jar dependencies from the gradle cache. This would take a while ...",
-  );
-  const gradleCmd = getGradleCommand(dirPath, dirPath);
-  // collect all jars including from the cache if data-flow mode is enabled
-  const jarNSMapping = await collectGradleDependencies(
-    gradleCmd,
-    dirPath,
-    false,
-    true,
-  );
+export async function catalogGradleDeps(
+  dirPath,
+  purlsJars,
+  Namespaces,
+  options = {},
+) {
+  // The map cdxgen wrote next to the BOM already holds the namespaces; the
+  // Gradle cache is walked only without it.
+  let jarNSMapping = readNamespaceMap(dirPath, options);
+  if (!jarNSMapping) {
+    console.log(
+      "About to collect jar dependencies from the gradle cache. This would take a while ...",
+    );
+    // Only the Gradle cache is read, so no Gradle command is resolved: that
+    // would probe the project's own gradlew.
+    jarNSMapping = await collectGradleDependencies(
+      undefined,
+      dirPath,
+      false,
+      true,
+    );
+  }
   if (jarNSMapping) {
     for (const purl of Object.keys(jarNSMapping)) {
       purlsJars[purl] = jarNSMapping[purl].jarFile;
@@ -515,7 +667,9 @@ export async function createSlice(
             resolve(slicesFile),
             options,
           );
-    if (!sliceResult) {
+    // A stopped run, or one the .NET host refused to start, has already said
+    // why; it says nothing about whether the project is supported (issue 4438).
+    if (!sliceResult && !dosaiFailureReported(resolve(slicesFile))) {
       console.warn(
         `Unable to generate ${sliceType} slice using dosai. Check if this is a supported .NET project.`,
       );
@@ -526,6 +680,13 @@ export async function createSlice(
       slicesFile,
     };
   }
+  const buildToolArgs = atomBuildToolArgs(language, options);
+  if (!buildToolArgs) {
+    console.log(
+      `Skipping the ${sliceType} slice for ${resolve(filePath)} since dependency installation is disabled and the installed atom cannot be stopped from running Maven. Upgrade atom to slice this project without its build.`,
+    );
+    return { tempDir: sliceOutputDir, tempDirOwned };
+  }
   console.log(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
@@ -552,15 +713,9 @@ export async function createSlice(
         "Use an official cdxgen container image to improve the precision of endpoints detection (for SaaSBOM).",
       );
     }
-    if (["ruby", "scala"].includes(language)) {
+    if (language === "ruby") {
       args.push("--remove-atom");
     }
-    if (["scala"].includes(language)) {
-      semanticsSlicesFile = join(
-        sliceOutputDir,
-        basename(options.semanticsSlicesFile || "semantics.slices.json"),
-      );
-    }
   }
   args = args.concat([
     "-l",
@@ -580,6 +735,7 @@ export async function createSlice(
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
   args.push(...atomCompileCommandsArgs(filePath, language, options));
+  args.push(...buildToolArgs);
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -632,15 +788,6 @@ export async function createSlice(
       `openapi spec file "${join(filePath, openapiSpecFile)}" was not generated successfully. Check if atom-tools pypi package is installed and available in PATH.`,
     );
   }
-  if (
-    ["scala"].includes(language) &&
-    sliceType === "usages" &&
-    !safeExistsSync(semanticsSlicesFile)
-  ) {
-    console.log(
-      `Semantics slices file "${semanticsSlicesFile}" was not generated successfully. Try running atom cli in Java mode.`,
-    );
-  }
   return {
     tempDir: sliceOutputDir,
     tempDirOwned,
@@ -769,8 +916,8 @@ function usableSlicesFile(slicesFile) {
  * describe the same project directory and must not predate the input SBOM:
  * `cdxgen --evidence` writes a fresh SBOM before evinse runs, so an older
  * slice was made from an earlier state of the sources and is regenerated.
- * Scala slices cannot be regenerated by evinse and are reused whenever their
- * shape matches.
+ * Scala reports are handled by the scalasem analyzer, which applies its own
+ * rules.
  *
  * @param {string} language Project language
  * @param {string} slicesFile Candidate semantics slices file
@@ -797,10 +944,7 @@ export function loadReusableSemanticsSlice(
     return undefined;
   }
   if (!PROJECT_TYPE_ALIASES.swift.includes(language)) {
-    // Scala semantics slices are keyed by .scala source file names
-    return Object.keys(parsed).some((key) => key.endsWith(".scala"))
-      ? parsed
-      : undefined;
+    return undefined;
   }
   if (!(parsed.fileIndexes || parsed.buildSymbols || parsed.moduleInfos)) {
     return undefined;
@@ -818,6 +962,260 @@ export function loadReusableSemanticsSlice(
   return parsed;
 }
 
+/**
+ * The Scala evidence path: scalasem only, never atom. The branch returns
+ * early for every entry point (evinse, --evidence, cbom, saasbom) and every
+ * Scala project type, so no usages, reachables, data-flow or atom-run
+ * scalasem happens here. Slices the user passes are still read: a version 1
+ * semantics slice keeps its usedTypes join, usages and reachables slices
+ * keep their own evidence, and an OpenAPI spec keeps its services.
+ *
+ * @param {string} language Project language, normalized to `scala`.
+ * @param {string} dirPath Project directory.
+ * @param {Object} options Command line options.
+ * @param {Object} bomJson Parsed input SBOM.
+ * @param {Object[]} components Components of the input SBOM.
+ * @param {Object} purlLocationMap Occurrences seeded from the input SBOM.
+ * @param {Object} purlImportsMap Imports seeded from the input SBOM.
+ * @param {Object} dbObjMap The evinse database objects.
+ * @returns {Promise<Object>} Slice artefacts for `createEvinseFile`.
+ */
+async function analyzeScalaEvidenceProject(
+  language,
+  dirPath,
+  options,
+  bomJson,
+  components,
+  purlLocationMap,
+  purlImportsMap,
+  dbObjMap,
+) {
+  let servicesMap = {};
+  const dataFlowFrames = {};
+  let componentPropertiesMap = {};
+  let metadataProperties = [];
+  let cryptoComponents = [];
+  const cryptoGeneratePurls = {};
+  const mergeLocations = (locationMap) => {
+    for (const [purl, locations] of Object.entries(locationMap || {})) {
+      purlLocationMap[purl] ??= new Set();
+      for (const location of locations) {
+        purlLocationMap[purl].add(location);
+      }
+    }
+  };
+  const mergeFrames = (framesMap) => {
+    for (const [purl, stacks] of Object.entries(framesMap || {})) {
+      dataFlowFrames[purl] = [...(dataFlowFrames[purl] || []), ...stacks];
+    }
+  };
+  const mergeProvides = (providesMap) => {
+    for (const [purl, refs] of Object.entries(providesMap || {})) {
+      cryptoGeneratePurls[purl] ??= new Set();
+      for (const ref of refs || []) {
+        cryptoGeneratePurls[purl].add(ref);
+      }
+    }
+  };
+  const analysis = analyzeScalaProject(dirPath, options);
+  if (analysis?.report) {
+    const evidence = await collectScalasemEvidence(
+      analysis.report,
+      [bomJson.metadata?.component, ...components].filter(Boolean),
+      { ...options, scalaNamespaceMap: readNamespaceMap(dirPath, options) },
+    );
+    mergeLocations(evidence.purlLocationMap);
+    mergeFrames(evidence.dataFlowFrames);
+    mergeProvides(evidence.cryptoGeneratePurls);
+    componentPropertiesMap = evidence.componentPropertiesMap;
+    cryptoComponents = evidence.cryptoComponents;
+    metadataProperties = evidence.metadataProperties;
+    servicesMap = collectScalasemServices(analysis.report, servicesMap);
+    servicesMap = collectScalasemApiEndpoints(analysis.report, servicesMap);
+  }
+  if (analysis?.metadataProperties?.length) {
+    for (const property of analysis.metadataProperties) {
+      if (
+        !metadataProperties.some(
+          (known) =>
+            known.name === property.name && known.value === property.value,
+        )
+      ) {
+        metadataProperties.push(property);
+      }
+    }
+  }
+  // A version 1 semantics slice still goes through the usedTypes join, merged
+  // with the report evidence rather than replacing it.
+  if (analysis?.v1Slice) {
+    mergeLocations(
+      findPurlLocations(components, analysis.v1Slice).purlLocationMap,
+    );
+  }
+  // Usages and reachables slices the user made, with atom or otherwise, are
+  // read as they are for any other language; none is ever generated here.
+  let usagesSlicesFile;
+  let reachablesSlicesFile;
+  if (
+    (options.withReachables || options.includeCrypto) &&
+    usableSlicesFile(options.reachablesSlicesFile)
+  ) {
+    reachablesSlicesFile = options.reachablesSlicesFile;
+    const reachables = collectReachableFrames(
+      language,
+      filterAtomSliceData(readReachablesSlices(reachablesSlicesFile), options),
+    );
+    mergeFrames(reachables.dataFlowFrames);
+    mergeProvides(reachables.cryptoGeneratePurls);
+    const knownRefs = new Set(
+      cryptoComponents.map((asset) => asset["bom-ref"]),
+    );
+    cryptoComponents = cryptoComponents.concat(
+      (reachables.cryptoComponents || []).filter(
+        (asset) => !knownRefs.has(asset["bom-ref"]),
+      ),
+    );
+  }
+  let userDefinedTypesMap = {};
+  if (usableSlicesFile(options.usagesSlicesFile)) {
+    usagesSlicesFile = options.usagesSlicesFile;
+    const usageSlice = filterAtomSliceData(
+      readSlicesFile(usagesSlicesFile, "usages"),
+      options,
+    );
+    if (usageSlice && Object.keys(usageSlice).length) {
+      const retMap = await parseObjectSlices(
+        language,
+        usageSlice,
+        dbObjMap,
+        servicesMap,
+        purlLocationMap,
+        purlImportsMap,
+      );
+      servicesMap = retMap.servicesMap || servicesMap;
+      userDefinedTypesMap = retMap.userDefinedTypesMap || {};
+    }
+  }
+  // An OpenAPI spec the user has (atom-tools' conversion of this report, or
+  // the project's own) adds its routes to the report's: a route both name is
+  // one service.
+  const openapiSpecFile = options.openapiSpecFile
+    ? resolve(dirPath, options.openapiSpecFile)
+    : undefined;
+  if (openapiSpecFile && safeExistsSync(openapiSpecFile)) {
+    const openapiServices = {};
+    detectServicesFromOpenAPI(language, openapiSpecFile, openapiServices);
+    mergeServiceDefinitions(servicesMap, openapiServices);
+  }
+  // A BOM without a project component still needs somewhere for the run's
+  // metadata properties to live; a nameless entry would explain nothing.
+  let workspaceComponent;
+  if (!bomJson.metadata?.component) {
+    workspaceComponent = {
+      type: "application",
+      name: basename(resolve(dirPath)),
+    };
+  }
+  return {
+    purlLocationMap,
+    servicesMap,
+    dataFlowFrames,
+    componentPropertiesMap,
+    metadataProperties,
+    cryptoComponents,
+    cryptoGeneratePurls,
+    usagesSlicesFile,
+    reachablesSlicesFile,
+    semanticsSlicesFile: analysis?.reportFile,
+    userDefinedTypesMap,
+    workspaceComponent,
+  };
+}
+
+/**
+ * Merge service definitions into a services map: endpoints join, and a
+ * property another source already carries is not added again, whatever the
+ * case of an HTTP method.
+ *
+ * @param {Object} target Services map that receives the definitions.
+ * @param {Object} source Services map to merge in.
+ * @returns {Object} The target map.
+ */
+export function mergeServiceDefinitions(target, source) {
+  const sameProperty = (left, right) =>
+    left.name === right.name &&
+    (left.name === "cdx:service:httpMethod"
+      ? String(left.value).toUpperCase() === String(right.value).toUpperCase()
+      : left.value === right.value);
+  for (const [name, definition] of Object.entries(source || {})) {
+    const existing = target[name];
+    if (!existing) {
+      target[name] = definition;
+      continue;
+    }
+    existing.endpoints ??= new Set();
+    for (const endpoint of definition.endpoints || []) {
+      existing.endpoints.add(endpoint);
+    }
+    existing.properties ??= [];
+    for (const property of definition.properties || []) {
+      if (!existing.properties.some((known) => sameProperty(known, property))) {
+        existing.properties.push(property);
+      }
+    }
+    if (definition.authenticated) {
+      existing.authenticated = true;
+    }
+    if (definition.xTrustBoundary) {
+      existing.xTrustBoundary = true;
+    }
+  }
+  return target;
+}
+
+/**
+ * Collect the services of a Go project for the golem evidence path (#4498).
+ *
+ * Two sources are kept and merged by service name, the way the Scala path
+ * merges a user-provided spec into its report's services. They roll services
+ * up differently — golem per server, OpenAPI per path and method — so a
+ * route both name appears under both entries:
+ *
+ * - the golem report itself, whose `services[]` section rolls the registered
+ *   routes up per server (a gin engine, a net/http listener) with methods and
+ *   frameworks, and the outbound hosts it calls into `kind: "external"`
+ *   services flagged as trust-boundary crossings;
+ * - an OpenAPI document, either the one `--openapi-spec-file` names or the
+ *   `openapi.json` an earlier `atom-tools convert -t go` left in the repo,
+ *   which is reused when present so `golem`/`atom-tools` and `cdxgen` can be
+ *   run as separate steps.
+ *
+ * @param {object|null|undefined} golemReport Parsed golem analysis report,
+ *   when one was produced; a missing or `null` report adds no services.
+ * @param {string} dirPath Project directory the report was produced from.
+ * @param {Object} options Command line options.
+ * @param {Object} [servicesMap={}] Service map to populate.
+ * @returns {Object} The service map
+ */
+export function collectGoServices(
+  golemReport,
+  dirPath,
+  options = {},
+  servicesMap = {},
+) {
+  servicesMap = collectGolemServices(golemReport, servicesMap);
+  const openapiSpecFile = resolve(
+    dirPath,
+    options.openapiSpecFile || "openapi.json",
+  );
+  if (safeExistsSync(openapiSpecFile)) {
+    const openapiServices = {};
+    detectServicesFromOpenAPI("go", openapiSpecFile, openapiServices);
+    mergeServiceDefinitions(servicesMap, openapiServices);
+  }
+  return servicesMap;
+}
+
 /**
  * Function to analyze the project
  *
@@ -827,7 +1225,12 @@ export function loadReusableSemanticsSlice(
 export async function analyzeProject(dbObjMap, options) {
   const dirPath = options._[0] || ".";
   const languages = options.language;
-  const language = Array.isArray(languages) ? languages[0] : languages;
+  let language = Array.isArray(languages) ? languages[0] : languages;
+  // cdxgen --evidence forwards the raw project type, so -t sbt, -t mill and
+  // -t scala3 must be normalized once to behave like -l scala everywhere.
+  if (PROJECT_TYPE_ALIASES.scala.includes(language)) {
+    language = "scala";
+  }
   let usageSlice;
   let dataFlowSlice;
   let reachablesSlice;
@@ -853,6 +1256,7 @@ export async function analyzeProject(dbObjMap, options) {
 
   if (isGolemGoLanguage(language)) {
     const golemReport = analyzeGolemProject(dirPath, options);
+    servicesMap = collectGoServices(golemReport, dirPath, options, servicesMap);
     if (golemReport && Object.keys(golemReport).length) {
       const golemEvidence = collectGolemEvidence(golemReport, [
         bomJson.metadata?.component,
@@ -981,29 +1385,76 @@ export async function analyzeProject(dbObjMap, options) {
     };
   }
 
+  if (isScalasemLanguage(language)) {
+    return analyzeScalaEvidenceProject(
+      language,
+      dirPath,
+      options,
+      bomJson,
+      components,
+      purlLocationMap,
+      purlImportsMap,
+      dbObjMap,
+    );
+  }
+
   if (isDosaiDotnetLanguage(language)) {
     if (options.profile === "research") {
       options.withDataFlow = true;
       options.includeCrypto = true;
     }
+    let needsUsagesRun = true;
     if (
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
       usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+      needsUsagesRun = false;
+      // A user-supplied usages slice is used as given. When it was written
+      // with --sections and left out a section cdxgen reads, the evidence
+      // lacks that input; persistDosaiSemanticsReport reports separately
+      // that the persisted report is partial.
+      const missingInputs = dosaiSectionsCdxgenReads(
+        dosaiOmittedSections(usageSlice),
+      );
+      if (missingInputs.length) {
+        recordDegradation("dosai.usages.trimmed-report", {
+          ecosystem: "csharp",
+          tool: "dosai",
+          impact: "components",
+          command: `usages ${usagesSlicesFile}`,
+          detail: `The supplied dosai methods report was written without sections cdxgen reads: ${missingInputs.join(", ")}. The evidence from those sections is missing. Run dosai methods without --sections, or with every section cdxgen reads.`,
+        });
+      }
     } else if (usableSlicesFile(options.depsSlicesFile)) {
       // createCsharpBom already ran dosai methods on this tree for --deep runs
       // and wrote the deps slice. For dosai, that output IS the usages slice,
-      // so reuse it instead of invoking dosai a second time.
-      if (DEBUG_MODE) {
-        console.log(
-          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
-        );
+      // so reuse it instead of invoking dosai a second time - unless it was
+      // written with --sections (a --deep run that performs no evidence
+      // analysis trims it): evinse persists this file as the full native
+      // report, so it must not build on a trimmed one and dosai runs again.
+      const omittedSections = dosaiReportFileOmittedSections(
+        options.depsSlicesFile,
+      );
+      if (omittedSections.length) {
+        if (DEBUG_MODE) {
+          console.log(
+            `The dosai deps slices file "${options.depsSlicesFile}" omits sections (${omittedSections.join(", ")}); running dosai for the full usages report.`,
+          );
+        }
+      } else {
+        if (DEBUG_MODE) {
+          console.log(
+            `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+          );
+        }
+        usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+        usagesSlicesFile = options.depsSlicesFile;
+        needsUsagesRun = false;
       }
-      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
-      usagesSlicesFile = options.depsSlicesFile;
-    } else {
+    }
+    if (needsUsagesRun) {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         usageSlice = readDosaiMethodsReport(retMap.slicesFile);
@@ -1011,11 +1462,17 @@ export async function analyzeProject(dbObjMap, options) {
       }
     }
     if (usageSlice && Object.keys(usageSlice).length) {
-      const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components);
+      // dosai locations are relative to the analyzed directory; a package the
+      // BOM holds in several versions is matched by the project of the file.
+      const dosaiEvidence = collectDosaiPurlEvidence(usageSlice, components, {
+        srcPath: resolve(dirPath),
+      });
       // Confidence/evidence facts ride along as properties so an unbuilt tree (Low
       // confidence, unresolved evidence) stays distinguishable from an only-imported
       // package in the emitted BOM.
-      applyDosaiReachabilityEvidence(usageSlice, components);
+      applyDosaiReachabilityEvidence(usageSlice, components, {
+        srcPath: resolve(dirPath),
+      });
       for (const [purl, locations] of Object.entries(
         dosaiEvidence.purlLocationMap,
       )) {
@@ -1049,7 +1506,9 @@ export async function analyzeProject(dbObjMap, options) {
         }
       }
       if (dataFlowSlice && Object.keys(dataFlowSlice).length) {
-        dataFlowFrames = collectDosaiDataFlowFrames(dataFlowSlice, components);
+        dataFlowFrames = collectDosaiDataFlowFrames(dataFlowSlice, components, {
+          srcPath: resolve(dirPath),
+        });
       }
     }
     if (options.includeCrypto) {
@@ -1145,12 +1604,8 @@ export async function analyzeProject(dbObjMap, options) {
     }
   }
   // Support for semantics slicing
-  if (
-    (PROJECT_TYPE_ALIASES.swift.includes(language) ||
-      PROJECT_TYPE_ALIASES.scala.includes(language)) &&
-    components.length
-  ) {
-    // Reuse existing semantics slices for swift and scala
+  if (PROJECT_TYPE_ALIASES.swift.includes(language) && components.length) {
+    // Reuse existing semantics slices for swift
     const reusableSlice = loadReusableSemanticsSlice(
       language,
       options.semanticsSlicesFile,
@@ -1160,7 +1615,7 @@ export async function analyzeProject(dbObjMap, options) {
     if (reusableSlice) {
       semanticsSlice = reusableSlice;
       semanticsSlicesFile = options.semanticsSlicesFile;
-    } else if (PROJECT_TYPE_ALIASES.swift.includes(language)) {
+    } else {
       // Generate our own slices for swift
       retMap = await createSlice(language, dirPath, "semantics", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
@@ -1169,6 +1624,28 @@ export async function analyzeProject(dbObjMap, options) {
       }
     }
   }
+  let cIncludeLocations = new Map();
+  // A C/C++ include names the file it resolved to and the functions the
+  // including file calls from it (atom 4 and later): those functions are the
+  // usages of the component that provides the file
+  if (
+    ["c", "cpp", "c++"].includes(language) &&
+    usageSlice &&
+    Object.keys(usageSlice).length
+  ) {
+    const attributed = attributeCIncludes(
+      usageSlice,
+      components,
+      dirPath,
+      options,
+    );
+    for (const [purl, names] of attributed.symbols) {
+      purlImportsMap[purl] = Array.from(
+        new Set([...(purlImportsMap[purl] || []), ...names]),
+      );
+    }
+    cIncludeLocations = attributed.locations;
+  }
   // Parse usage slices
   if (usageSlice && Object.keys(usageSlice).length) {
     const retMap = await parseObjectSlices(
@@ -1184,7 +1661,14 @@ export async function analyzeProject(dbObjMap, options) {
     servicesMap = retMap.servicesMap;
     userDefinedTypesMap = retMap.userDefinedTypesMap;
   }
-  // Parse the semantics slices for swift and scala
+  // A component whose calls the slices do not show (code inside the project,
+  // such as a vendored library) is still used where its header is included
+  for (const [purl, includeLocations] of cIncludeLocations) {
+    if (!purlLocationMap[purl]?.size) {
+      purlLocationMap[purl] = new Set(includeLocations);
+    }
+  }
+  // Parse the semantics slices for swift
   if (
     semanticsSlice &&
     Object.keys(semanticsSlice).length &&
@@ -1192,7 +1676,25 @@ export async function analyzeProject(dbObjMap, options) {
   ) {
     // Identify the purl locations
     const retMap = parseSemanticSlices(language, components, semanticsSlice);
-    purlLocationMap = retMap.purlLocationMap;
+    // The usages step may already have locations for a purl; the semantics
+    // pass adds its own rather than replacing them.
+    for (const [apurl, locations] of Object.entries(
+      retMap.purlLocationMap || {},
+    )) {
+      purlLocationMap[apurl] ??= new Set();
+      for (const alocation of locations) {
+        purlLocationMap[apurl].add(alocation);
+      }
+    }
+  }
+  // A user-supplied OpenAPI spec must yield services even when the usages
+  // slice is empty.
+  if (
+    openapiSpecFile &&
+    safeExistsSync(openapiSpecFile) &&
+    !Object.keys(servicesMap).length
+  ) {
+    detectServicesFromOpenAPI(language, openapiSpecFile, servicesMap);
   }
   if (options.withDataFlow) {
     if (
@@ -1261,6 +1763,125 @@ export async function analyzeProject(dbObjMap, options) {
  * @param {string} [openapiSpecFile=undefined] Optional path to an OpenAPI spec used for service detection
  * @returns {Promise<Object>} Map with `purlLocationMap`, `servicesMap`, and `userDefinedTypesMap`
  */
+/**
+ * Attribute the include slices of a C/C++ usages report to the BOM
+ * components that provide the files they resolved to: each header's imported
+ * symbols (the functions the including file calls that it declares), and the
+ * include directive's location. Reports from atom releases that do not name
+ * the resolved file attribute nothing.
+ *
+ * @param {Object} usageSlice Parsed usages report
+ * @param {Object[]} components Components of the input BOM
+ * @param {string} dirPath Source directory
+ * @param {Object} options CLI options
+ * @returns {{symbols: Map<string, Set<string>>, locations: Map<string, Set<string>>}}
+ *   Imported symbols and include locations (`file#line`) by purl
+ */
+export function attributeCIncludes(
+  usageSlice,
+  components,
+  dirPath,
+  options = {},
+) {
+  const symbols = new Map();
+  const locations = new Map();
+  const includes = [...parseCIncludeSlices(usageSlice)].filter(
+    ([, e]) => e.paths.size && e.symbols.size,
+  );
+  if (!includes.length || !components?.length) {
+    return { symbols, locations };
+  }
+  const attribute = createIncludeAttributor({
+    src: dirPath,
+    components,
+    buildDirs: cmakeBuildDirCandidates(dirPath, options),
+  });
+  const withPurl = components.filter((c) => c?.purl);
+  const byName = (name, purlType) =>
+    withPurl.find(
+      (c) =>
+        c.name?.toLowerCase() === `${name}`.toLowerCase() &&
+        (!purlType || c.purl.startsWith(`pkg:${purlType}/`)),
+    );
+  const purlByHeader = new Map();
+  for (const [header, entry] of includes) {
+    const target = attribute(entry.paths);
+    let component;
+    if (target?.kind === "component") {
+      component = target.component;
+    } else if (target?.kind === "os") {
+      component =
+        withPurl.find((c) => c.purl === target.pkgInfo.purl) ||
+        byName(target.pkgInfo.name);
+    } else if (target?.kind === "vcpkg") {
+      component = byName(target.port);
+    } else if (target?.kind === "conan") {
+      component = byName(target.name, "conan") || byName(target.name);
+    }
+    if (!component?.purl) {
+      continue;
+    }
+    purlByHeader.set(header, component.purl);
+    const known = symbols.get(component.purl) || new Set();
+    for (const symbol of entry.symbols) {
+      known.add(symbol);
+    }
+    symbols.set(component.purl, known);
+  }
+  // the directives that include an attributed header and use it
+  for (const slice of usageSlice?.objectSlices || []) {
+    const purl = purlByHeader.get(slice?.fullName);
+    if (
+      !purl ||
+      !`${slice.code || ""}`.startsWith("#include") ||
+      !slice.fileName ||
+      !slice.importedSymbols?.length
+    ) {
+      continue;
+    }
+    const known = locations.get(purl) || new Set();
+    known.add(
+      slice.lineNumber
+        ? `${slice.fileName}#${slice.lineNumber}`
+        : slice.fileName,
+    );
+    locations.set(purl, known);
+  }
+  return { symbols, locations };
+}
+
+/**
+ * Seed the C/C++ imports from the include slices of a usages report (see
+ * `attributeCIncludes`).
+ *
+ * @param {Object} usageSlice Parsed usages report
+ * @param {Object[]} components Components of the input BOM
+ * @param {string} dirPath Source directory
+ * @param {Object} purlImportsMap Imports by purl, extended in place
+ * @param {Object} options CLI options
+ * @returns {Object} purlImportsMap
+ */
+export function seedCImportsFromIncludes(
+  usageSlice,
+  components,
+  dirPath,
+  purlImportsMap = {},
+  options = {},
+) {
+  const { symbols } = attributeCIncludes(
+    usageSlice,
+    components,
+    dirPath,
+    options,
+  );
+  for (const [purl, names] of symbols) {
+    purlImportsMap[purl] = Array.from(
+      new Set([...(purlImportsMap[purl] || []), ...names]),
+    );
+  }
+  return purlImportsMap;
+}
+
 export async function parseObjectSlices(
   language,
   usageSlice,
@@ -1581,11 +2202,7 @@ export async function parseSliceUsages(
  * @param {Object} semanticsSlice Semantic slice data
  * @returns {Object} Parsed metadata
  */
-export function parseSemanticSlices(language, components, semanticsSlice) {
-  // For scala, use the dedicated scalasem module.
-  if (language === "scala") {
-    return findPurlLocations(components, semanticsSlice);
-  }
+export function parseSemanticSlices(_language, components, semanticsSlice) {
   if (!components) {
     return undefined;
   }