@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/mcpConfigParser.js

@@ -1,12 +1,11 @@
 import { readFileSync } from "node:fs";
 import { basename } from "node:path";
 
-import * as toml from "smol-toml";
-
 import {
   sanitizeBomPropertyValue,
   sanitizeBomUrl,
 } from "../core/propertySanitizer.js";
+import { parseToml } from "../core/toml.js";
 import { parseJsonLike } from "./jsonLike.js";
 import { classifyMcpReference } from "./mcp.js";
 import {
@@ -813,7 +812,7 @@ export const mcpConfigParser = {
       let configJson;
       try {
         configJson = filePath.toLowerCase().endsWith(".toml")
-          ? toml.parse(raw)
+          ? parseToml(raw)
           : parseJsonLike(raw);
       } catch {
         continue;

package/lib/inventory/osPackagePurl.js

@@ -0,0 +1,244 @@
+// The one place that decides what purl an operating-system package gets.
+//
+// A package found by `cdxgen -t docker <image>` and by `obom` run inside that
+// image must be the same package, so the OBOM rows, the file-to-package
+// resolver and the container scan all name a deb, an rpm or an apk package with
+// the vendor and the qualifiers set here and in getDistroInfo(): `arch`,
+// `distro`, `distro_name` and, when the package has one, `epoch`. A pacman
+// package has the vendor and only the `arch` qualifier the alpm type defines.
+// Homebrew, MacPorts and snap packages have no distro, so their purl is the
+// name and the version; a flatpak adds the `arch` and `branch` of its ref.
+//
+// None of these purls has a subpath. A subpath names a path inside a package;
+// the dpkg directory or the source rpm of a row is not one.
+
+import { getDistroInfo, isCleanDistroQualifier } from "./osinfo.js";
+import { tryBuildPurl } from "./purl.js";
+
+/**
+ * The purl types an OS scan builds from what a package manager reports.
+ * deb, rpm, apk and alpm belong to a distro; brew, macports, snap and flatpak
+ * belong to none. brew, macports, snap and flatpak are not purl-spec types;
+ * cdx-purl builds them as it builds `pkg:chocolatey`.
+ */
+export const OS_PACKAGE_PURL_TYPES = new Set([
+  "deb",
+  "rpm",
+  "apk",
+  "alpm",
+  "brew",
+  "macports",
+  "snap",
+  "flatpak",
+]);
+
+/**
+ * Whether a purl type is one of the OS package managers handled here.
+ *
+ * @param {string|undefined} type Purl type
+ * @returns {boolean} true for the types in OS_PACKAGE_PURL_TYPES
+ */
+export function isOsPackagePurlType(type) {
+  return OS_PACKAGE_PURL_TYPES.has(type);
+}
+
+/**
+ * Whether a value names an architecture. rpm says `(none)` and trivy says
+ * `None` for a package that has none, such as an rpm's `gpg-pubkey` key record;
+ * neither is an architecture, and neither belongs in a purl.
+ *
+ * @param {string|undefined|null} arch Architecture as a package manager reports it
+ * @returns {boolean} true for a real architecture
+ */
+export function isRealArchitecture(arch) {
+  const value = `${arch ?? ""}`.trim().toLowerCase();
+  return value !== "" && value !== "(none)" && value !== "none";
+}
+
+function isDigits(text) {
+  if (!text) {
+    return false;
+  }
+  for (let i = 0; i < text.length; i++) {
+    const code = text.charCodeAt(i);
+    if (code < 48 || code > 57) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// An epoch is a non-negative integer, and 0 is the same as none. Anything else
+// ("", "(none)", "null") is no epoch.
+function normaliseEpoch(value) {
+  const text = `${value ?? ""}`.trim();
+  if (!isDigits(text)) {
+    return undefined;
+  }
+  const digits = text.replace(/^0+/, "");
+  return digits || undefined;
+}
+
+// dpkg writes a version as [epoch:]upstream[-revision]. A colon is only ever an
+// epoch's separator when what comes before it is all digits.
+function debVersionEpoch(version) {
+  const colon = version.indexOf(":");
+  if (colon <= 0) {
+    return undefined;
+  }
+  const prefix = version.slice(0, colon);
+  return isDigits(prefix) ? prefix : undefined;
+}
+
+/**
+ * The epoch of an OS package, as the `epoch` qualifier carries it.
+ *
+ * An rpm keeps its epoch in a field of its own. A deb keeps it in its version
+ * (`2:93`), so the version is read first. Epoch 0 and no epoch are the same,
+ * and apk and Homebrew packages have none.
+ *
+ * @param {{type: string, version?: string, epoch?: string|number}} pkg Package
+ * @returns {string|undefined} The epoch without leading zeros, or undefined
+ */
+export function osPackageEpoch(pkg) {
+  switch (pkg?.type) {
+    case "rpm":
+      return normaliseEpoch(pkg.epoch);
+    case "deb": {
+      const fromVersion = debVersionEpoch(`${pkg.version ?? ""}`);
+      return fromVersion === undefined
+        ? normaliseEpoch(pkg.epoch)
+        : normaliseEpoch(fromVersion);
+    }
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * The version an OS package carries on its component and in its purl.
+ *
+ * - rpm: `[epoch:]version-release`, the form the container scan writes. The
+ *   purl spec keeps the epoch out of an rpm version, but the container scan
+ *   puts it in the version as well as in the `epoch` qualifier, and an OBOM must
+ *   name the package the same way.
+ * - deb: the version exactly as dpkg reports it, epoch included.
+ * - macports: `version_revision`, the form `port installed` prints.
+ * - apk, alpm, brew, snap and flatpak: the version as it is. A pacman version
+ *   already holds its epoch and release (`1:1.3.2-4`).
+ *
+ * @param {{type: string, version?: string, release?: string, epoch?: string|number, revision?: string|number}} pkg Package
+ * @returns {string} The version, or an empty string when the package has none
+ */
+export function osPackageVersion(pkg) {
+  const version = `${pkg?.version ?? ""}`;
+  if (!version) {
+    return "";
+  }
+  switch (pkg.type) {
+    case "rpm": {
+      const release = `${pkg.release ?? ""}`;
+      const evr = release ? `${version}-${release}` : version;
+      const epoch = osPackageEpoch(pkg);
+      return epoch ? `${epoch}:${evr}` : evr;
+    }
+    case "deb": {
+      if (debVersionEpoch(version) !== undefined) {
+        return version;
+      }
+      const epoch = normaliseEpoch(pkg.epoch);
+      return epoch ? `${epoch}:${version}` : version;
+    }
+    case "macports": {
+      // Revision 0 is a real revision: `port installed` prints `@3.6.0_0`.
+      const revision = `${pkg.revision ?? ""}`.trim();
+      return isDigits(revision) ? `${version}_${revision}` : version;
+    }
+    default:
+      return version;
+  }
+}
+
+/**
+ * Build the purl of an OS package.
+ *
+ * deb, rpm and apk purls take their vendor (`ubuntu`, `almalinux`, `alpine`,
+ * `wolfi`) and the `distro` and `distro_name` qualifiers from the distro, plus
+ * `arch` and `epoch` from the package. alpm purls take the vendor (`arch`,
+ * `manjaro`) and `arch` only: that is all the alpm type defines, and an Arch
+ * system is rolling, with no release to name. A qualifier with no value is
+ * left out. brew, macports and snap purls carry neither vendor nor qualifiers;
+ * a flatpak purl carries the `arch` and `branch` of the flatpak ref.
+ *
+ * @param {Object} pkg The package
+ * @param {string} pkg.type One of OS_PACKAGE_PURL_TYPES
+ * @param {string} pkg.name Package name; a flatpak's application ID
+ * @param {string} [pkg.version] deb: the dpkg version. rpm: the version tag only. apk: version-rN. macports: the version without its revision.
+ * @param {string} [pkg.release] rpm release tag
+ * @param {string|number} [pkg.epoch] rpm epoch tag
+ * @param {string|number} [pkg.revision] MacPorts revision
+ * @param {string} [pkg.arch] Package architecture
+ * @param {string} [pkg.branch] flatpak branch (`stable`, `48`)
+ * @param {{namespace?: string, distroId?: string, distroName?: string}} [distro]
+ *   What getDistroInfo() reports; read from the host's os-release when left out
+ * @returns {string|null} The purl, or null when the parts do not form a valid one
+ */
+export function buildOsPackagePurl(pkg, distro) {
+  const type = pkg?.type;
+  const name = `${pkg?.name ?? ""}`;
+  if (!isOsPackagePurlType(type) || !name) {
+    return null;
+  }
+  const version = osPackageVersion(pkg) || null;
+  switch (type) {
+    case "brew":
+    case "macports":
+    case "snap":
+      return tryBuildPurl({ type, name, version });
+    case "flatpak": {
+      const qualifiers = {};
+      if (isRealArchitecture(pkg.arch)) {
+        qualifiers.arch = `${pkg.arch}`.trim();
+      }
+      const branch = `${pkg.branch ?? ""}`.trim();
+      if (branch) {
+        qualifiers.branch = branch;
+      }
+      return tryBuildPurl({
+        type,
+        name,
+        version,
+        qualifiers: Object.keys(qualifiers).length ? qualifiers : null,
+      });
+    }
+    default:
+      break;
+  }
+  const { namespace, distroId, distroName } = distro || getDistroInfo();
+  if (!namespace) {
+    return null;
+  }
+  const qualifiers = {};
+  if (isRealArchitecture(pkg.arch)) {
+    qualifiers.arch = `${pkg.arch}`.trim();
+  }
+  if (type !== "alpm") {
+    if (isCleanDistroQualifier(distroId)) {
+      qualifiers.distro = distroId;
+    }
+    if (isCleanDistroQualifier(distroName)) {
+      qualifiers.distro_name = distroName;
+    }
+    const epoch = osPackageEpoch(pkg);
+    if (epoch) {
+      qualifiers.epoch = epoch;
+    }
+  }
+  return tryBuildPurl({
+    type,
+    namespace,
+    name,
+    version,
+    qualifiers: Object.keys(qualifiers).length ? qualifiers : null,
+  });
+}

package/lib/inventory/osPackageResolver.js

@@ -1,13 +1,13 @@
 import { readFileSync, realpathSync } from "node:fs";
 import { join, relative } from "node:path";
 
-import { build } from "@cdxgen/cdx-purl";
 import { globSync } from "glob";
 
 import { DEBUG_MODE, recordSymlinkResolution } from "../core/activity.js";
 import { safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { getDistroInfo } from "./osinfo.js";
+import { buildOsPackagePurl } from "./osPackagePurl.js";
 
 // ---------------------------------------------------------------------------
 // Caches
@@ -48,58 +48,34 @@ function parseAlpinePackage(pkgStr) {
 // ---------------------------------------------------------------------------
 // Build a PackageURL string from resolved package info.
 //
-// Distro qualifiers (distro, distro_name) are taken from /etc/os-release via
-// getDistroInfo() so they are always accurate, never hardcoded.
+// deb, rpm, apk and Homebrew packages are named by buildOsPackagePurl, the
+// function the OBOM rows use as well, so a file and the package that owns it
+// share one identity with the package an OBOM or a container scan lists. The
+// distro qualifiers come from /etc/os-release via getDistroInfo(), never from
+// a hard-coded table.
 //
-// "brew" is not an official PackageURL type — Homebrew packages are emitted
-// as pkg:generic with a package_manager=homebrew qualifier.
+// Homebrew has no official purl type yet, but cdx-purl builds pkg:brew, as the
+// OBOM does for its homebrew_packages rows. A brew purl carries no qualifiers:
+// this used to pass an `arch` that the generic type it fell back to does not
+// allow, so build() threw and a file of a Homebrew package got no purl at all.
 // ---------------------------------------------------------------------------
 function buildPurl(pkgInfo) {
-  let purlType = pkgInfo.type;
-  let namespace;
-  const qualifiers = {};
-
-  if (pkgInfo.arch) {
-    qualifiers.arch = pkgInfo.arch;
-  }
-
-  if (purlType === "deb" || purlType === "apk" || purlType === "rpm") {
-    const di = getDistroInfo();
-    namespace = di.namespace;
-
-    // distro qualifier: ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17")
-    if (di.distroId) {
-      qualifiers.distro = di.distroId;
-    }
-    // distro_name qualifier: codename (e.g. "jammy", "bookworm")
-    if (di.distroName) {
-      qualifiers.distro_name = di.distroName;
-    }
-  } else if (purlType === "brew") {
-    // No official brew purl type — fall back to generic. This used to add a
-    // `package_manager=homebrew` qualifier, which generic does not allow, so
-    // build() threw and the catch below swallowed it: Homebrew packages silently
-    // received no purl at all on macOS. The provenance is instead recorded as a
-    // property by the caller.
-    purlType = "generic";
-  }
+  const distro =
+    pkgInfo.type === "brew" || !pkgInfo.type ? undefined : getDistroInfo();
+  return buildOsPackagePurl(pkgInfo, distro) || "";
+}
 
-  const finalQualifiers = Object.keys(qualifiers).length
-    ? qualifiers
-    : undefined;
+// apk names an architecture its own way, which is not the way node does.
+const APK_ARCHITECTURES = {
+  x64: "x86_64",
+  arm64: "aarch64",
+  ia32: "x86",
+  ppc64: "ppc64le",
+  loong64: "loongarch64",
+};
 
-  try {
-    return build({
-      type: purlType,
-      namespace: namespace || undefined || null,
-      name: pkgInfo.name,
-      version: pkgInfo.version || undefined || null,
-      qualifiers: finalQualifiers || null,
-      subpath: undefined || null,
-    });
-  } catch (_e) {
-    return "";
-  }
+function apkArchitecture() {
+  return APK_ARCHITECTURES[process.arch] || process.arch;
 }
 
 // ---------------------------------------------------------------------------
@@ -111,7 +87,7 @@ function buildPurl(pkgInfo) {
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export function resolvePackageForFile(filePath) {
   if (!filePath) {
@@ -190,27 +166,30 @@ function _resolveLinux(filePath) {
       return {
         name,
         version,
-        arch: process.arch === "x64" ? "x86_64" : process.arch,
+        arch: apkArchitecture(),
         type: "apk",
       };
     }
   }
 
-  // 3. RPM-based (rpm -qf)
+  // 3. RPM-based (rpm -qf). The epoch is part of an rpm's identity; %{EPOCH} is
+  // (none) for a package without one, so the conditional makes that a 0, which
+  // means the same.
   const rpmRes = safeSpawnSync("rpm", [
     "-qf",
     "--qf",
-    "%{NAME} %{VERSION}-%{RELEASE} %{ARCH}\n",
+    "%{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION}-%{RELEASE} %{ARCH}\n",
     filePath,
   ]);
   if (rpmRes && rpmRes.status === 0 && rpmRes.stdout) {
     const line = rpmRes.stdout.split("\n")[0].trim();
     const parts = line.split(" ");
-    if (parts.length >= 3) {
+    if (parts.length >= 4) {
       return {
         name: parts[0],
-        version: parts[1],
-        arch: parts[2],
+        epoch: parts[1],
+        version: parts[2],
+        arch: parts[3],
         type: "rpm",
       };
     }
@@ -233,7 +212,7 @@ function _resolveDarwin(filePath) {
           name: segments[0],
           version: segments[1],
           arch: process.arch,
-          type: "brew", // remapped to pkg:generic in buildPurl
+          type: "brew",
         };
       }
     }
@@ -379,6 +358,9 @@ function shouldPreferUsrMergedExecutablePath(file, existingFile) {
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
@@ -388,6 +370,7 @@ export function collectSharedLibs(
   ldConf,
   ldConfDirPattern,
   excludePaths = [],
+  extraLibGlobs = [],
 ) {
   if (!libPaths) {
     return [];
@@ -399,6 +382,37 @@ export function collectSharedLibs(
   const ignoreList = [
     "**/*.{h,c,cpp,hpp,man,txt,md,htm,html,jar,ear,war,zip,tar,egg,keepme,gitignore,json,js,py,pyc}",
   ];
+  const addCandidate = (file) => {
+    let resolvedFile = file;
+    try {
+      resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
+      recordSymlinkResolution(join(basePath, file), resolvedFile, {
+        basePath,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
+      });
+    } catch (err) {
+      recordSymlinkResolution(join(basePath, file), undefined, {
+        basePath,
+        errorCode: err?.code || err?.name,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Failed to resolve shared library candidate ${file}.`,
+        status: "failed",
+      });
+      // Broken symlinks or permission errors can prevent realpath resolution.
+    }
+    if (
+      excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
+      excludedPathSet.has(resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"))
+    ) {
+      return;
+    }
+    sharedLibs.push(file);
+  };
   const allLdConfDirs = ldConfDirPattern ? [ldConfDirPattern] : [];
   collectAllLdConfs(basePath, ldConf, allLdConfDirs, libPaths);
   if (allLdConfDirs.length) {
@@ -428,37 +442,25 @@ export function collectSharedLibs(
         ignore: ignoreList,
       });
       for (const file of files) {
-        let resolvedFile = file;
-        try {
-          resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
-          recordSymlinkResolution(join(basePath, file), resolvedFile, {
-            basePath,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
-          });
-        } catch (err) {
-          recordSymlinkResolution(join(basePath, file), undefined, {
-            basePath,
-            errorCode: err?.code || err?.name,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Failed to resolve shared library candidate ${file}.`,
-            status: "failed",
-          });
-          // Broken symlinks or permission errors can prevent realpath resolution.
-        }
-        if (
-          excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
-          excludedPathSet.has(
-            resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"),
-          )
-        ) {
-          continue;
-        }
-        sharedLibs.push(file);
+        addCandidate(file);
+      }
+    } catch (_err) {
+      // ignore
+    }
+  }
+  for (const pattern of extraLibGlobs) {
+    try {
+      const files = globSync(pattern, {
+        cwd: basePath,
+        absolute: false,
+        nocase: true,
+        nodir: true,
+        dot: true,
+        follow: true,
+        ignore: ignoreList,
+      });
+      for (const file of files) {
+        addCandidate(file);
       }
     } catch (_err) {
       // ignore