@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/envcontext.js

@@ -20,6 +20,7 @@ import {
 } from "../core/buildLedger.js";
 import {
   CARGO_CMD,
+  COMPOSER_CMD,
   DOTNET_CMD,
   GCC_CMD,
   GO_CMD,
@@ -29,6 +30,7 @@ import {
   isDeno,
   isNode,
   NPM_CMD,
+  PHP_CMD,
   RUBY_CMD,
   RUSTC_CMD,
   SWIFT_CMD,
@@ -41,7 +43,12 @@ import {
 } from "../core/fs.js";
 import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { isValidSdkmanVersion } from "./jvmToolEnv.js";
+import {
+  createPhpRuntimeComponent,
+  parsePhpReportedVersion,
+} from "./phpBuildInfo.js";
 import { applyPurl, tryBuildPurl } from "./purl.js";
 import {
   classifySpawnRestriction,
@@ -62,6 +69,9 @@ export const GIT_COMMAND = readEnvironmentVariable("GIT_CMD") || "git";
  *  - `core.fsmonitor=false`     — a repo-set fsmonitor value is a command git runs.
  *  - `core.hooksPath=/dev/null` — prevents any hook script from executing.
  *  - `safe.bareRepository=explicit` — avoids operating on an embedded bare repo.
+ *  - `gpg.program`, `gpg.ssh.program`, `gpg.x509.program` — `%G?` in a log
+ *    format verifies signatures by running these, so pin them to the tools
+ *    on PATH instead of a program named by the repo.
  * `-c` overrides take precedence over the repo-local config. Diff-producing
  * commands (`git show`/`git diff`) additionally pass `--no-ext-diff`/
  * `--no-textconv` to block `.gitattributes`-driven external diff and textconv
@@ -74,6 +84,12 @@ const GIT_HARDENING_CONFIG_ARGS = Object.freeze([
   "core.hooksPath=/dev/null",
   "-c",
   "safe.bareRepository=explicit",
+  "-c",
+  "gpg.program=gpg",
+  "-c",
+  "gpg.ssh.program=ssh-keygen",
+  "-c",
+  "gpg.x509.program=gpgsm",
 ]);
 
 /**
@@ -84,7 +100,15 @@ const GIT_HARDENING_CONFIG_ARGS = Object.freeze([
  * @returns {Object} environment for spawning git
  */
 function hardenedGitEnv() {
-  const env = { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  // These commands only read the local repository. A partial clone would
+  // otherwise fetch missing objects through the repo's own remote and
+  // core.sshCommand settings, so turn lazy fetching and every transport off.
+  const env = {
+    ...process.env,
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_NO_LAZY_FETCH: "1",
+    GIT_ALLOW_PROTOCOL: "cdxgen-no-network",
+  };
   if (isSecureMode) {
     env.GIT_CONFIG_NOSYSTEM = "1";
     env.GIT_CONFIG_GLOBAL = "/dev/null";
@@ -337,8 +361,10 @@ function recordToolProbeResolved(tool, ecosystem, found) {
  * @param {string} tool Tool name
  * @param {string} ecosystem Ecosystem the tool belongs to
  * @param {string} command Probe command that failed
+ * @param {string} [detail] What to say when the command is not restricted,
+ *   instead of the default that no command answered
  */
-function recordToolProbeFailure(tool, ecosystem, command) {
+function recordToolProbeFailure(tool, ecosystem, command, detail) {
   if (!isLedgerEnabled()) {
     return;
   }
@@ -362,7 +388,7 @@ function recordToolProbeFailure(tool, ecosystem, command) {
       ecosystem,
       tool,
       source: "PATH",
-      detail: `No ${tool} command answered the version probe.`,
+      detail: detail || `No ${tool} command answered the version probe.`,
     });
   }
 }
@@ -579,6 +605,124 @@ export function collectRubyInfo(dir) {
   return undefined;
 }
 
+/**
+ * The first line of a command's output, without its line end.
+ *
+ * @param {string|undefined} output Output of getCommandOutput
+ * @returns {string} First line, or an empty string
+ */
+function firstOutputLine(output) {
+  return `${output || ""}`.split(/\r?\n/, 1)[0].trim();
+}
+
+/**
+ * A toolchain component for the formulation section. Formulation shares the
+ * document's bom-ref namespace with the inventory, which can hold the very same
+ * `pkg:generic/php@<version>` runtime (an image scanned with
+ * --include-formulation), so like the other toolchains it carries no bom-ref.
+ *
+ * @param {Object} component component built with applyPurl
+ * @returns {Object} the component without its bom-ref
+ */
+function formulationToolchain(component) {
+  delete component["bom-ref"];
+  return component;
+}
+
+/**
+ * Collect the PHP version of the PHP found on the PATH.
+ *
+ * `-n` stops PHP loading any php.ini, so a PHPRC or an auto_prepend_file cannot
+ * run code, and `-v` is used rather than `-r 'echo PHP_VERSION;'` because the
+ * shell on Windows does not quote arguments. The first line is
+ * `PHP 8.5.11 (cli) (built: Sep 22 2026 13:32:06) (NTS)`.
+ *
+ * The identity is `pkg:generic/php`: a probe of the PATH cannot tell which
+ * package manager, if any, installed this PHP. A banner with a distro revision,
+ * such as Ubuntu 22.04's `PHP 8.1.2-1ubuntu2.14`, is recorded as reported but
+ * without a CPE: the distro backports fixes under the old upstream number.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the PHP details
+ */
+export function collectPhpInfo(dir) {
+  const output = getCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
+  const banner = firstOutputLine(output);
+  const reported = banner.startsWith("PHP ")
+    ? parsePhpReportedVersion(banner.slice("PHP ".length))
+    : undefined;
+  if (reported) {
+    recordToolProbeResolved("php", "php", reported.version);
+    return formulationToolchain(
+      createPhpRuntimeComponent(reported.version, {
+        withCpe: !reported.distroRevision,
+      }),
+    );
+  }
+  recordToolProbeFailure(
+    "php",
+    "php",
+    PHP_CMD,
+    output
+      ? "The php version probe did not print a PHP version banner."
+      : undefined,
+  );
+  return undefined;
+}
+
+/**
+ * Collect the Composer version.
+ *
+ * `--no-plugins` and `--no-scripts` keep the plugins and scripts of the
+ * project in the working directory from running, which `composer --version`
+ * would otherwise let a plugin do. It needs no network. The banner is
+ * `Composer version 2.10.3 2026-08-27 13:34:23`, but an older Composer on a
+ * newer PHP prints deprecation notices above it, so the first line that starts
+ * with it is read; the line after it names the PHP Composer runs on, with its
+ * path, and is never read. The banner must start its line: an indented echo of
+ * the project's composer.json in an error block does not count. Only a stable
+ * release is recorded: a pre-release or a snapshot has no version a CPE can
+ * name.
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing the Composer details
+ */
+export function collectComposerInfo(dir) {
+  const output = getCommandOutput(COMPOSER_CMD, dir, [
+    "--version",
+    "--no-plugins",
+    "--no-scripts",
+    "--no-interaction",
+  ]);
+  const token =
+    /^Composer version (\S+)/m.exec(
+      `${output || ""}`.slice(0, 64 * 1024),
+    )?.[1] || "";
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("composer", "php", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "composer",
+          version: token,
+          cpe: `cpe:2.3:a:getcomposer:composer:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "generic", name: "composer", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure(
+    "composer",
+    "php",
+    COMPOSER_CMD,
+    output
+      ? "The composer version probe did not print a stable Composer version."
+      : undefined,
+  );
+  return undefined;
+}
+
 /**
  * Method to run a swift command
  *
@@ -594,12 +738,23 @@ export function runSwiftCommand(dir, args) {
  * Collect toolchain information components for the current environment.
  *
  * Probes the working directory for java, dotnet, python, node, gcc, rust, go,
- * and ruby toolchains and returns one component per detected tool.
+ * ruby, php and composer toolchains and returns one component per detected
+ * tool.
  *
  * @param {string} dir Working directory to inspect
+ * @param {Object} [options] CLI options, which decide whether the project's
+ *   own toolchain files may choose the tools that run
  * @returns {Object[]} Array of toolchain component objects; empty when nothing is detected
  */
-export function collectEnvInfo(dir) {
+export function collectEnvInfo(dir, options = undefined) {
+  // Version managers pick the toolchain from files in the working directory.
+  // rust-toolchain.toml can name an absolute toolchain path and global.json
+  // can name SDK paths, so unless the project's tooling may run, the probes
+  // run outside the scanned project and report the toolchains installed on
+  // the host.
+  if (!isProjectToolingAllowed(options)) {
+    dir = getTmpDir();
+  }
   const infoComponents = [];
   let cmp = collectJavaInfo(dir);
   if (cmp) {
@@ -633,6 +788,14 @@ export function collectEnvInfo(dir) {
   if (cmp) {
     infoComponents.push(cmp);
   }
+  cmp = collectPhpInfo(dir);
+  if (cmp) {
+    infoComponents.push(cmp);
+  }
+  cmp = collectComposerInfo(dir);
+  if (cmp) {
+    infoComponents.push(cmp);
+  }
   return infoComponents;
 }