@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/osinfo.js

@@ -49,14 +49,34 @@ export const OS_DISTRO_ALIAS = {
   "ubuntu-24.10": "oracular",
   "ubuntu-25.04": "plucky",
   "ubuntu-25.10": "questing",
+  "ubuntu-26.04": "resolute",
+  "ubuntu-26.10": "stonking",
   "debian-15": "duke",
   "debian-14": "forky",
   "debian-14.5": "forky",
   "debian-13": "trixie",
+  "debian-13.7": "trixie",
+  "debian-13.6": "trixie",
   "debian-13.5": "trixie",
+  "debian-13.4": "trixie",
+  "debian-13.3": "trixie",
+  "debian-13.2": "trixie",
+  "debian-13.1": "trixie",
   "debian-12": "bookworm",
-  "debian-12.5": "bookworm",
+  "debian-12.15": "bookworm",
+  "debian-12.14": "bookworm",
+  "debian-12.13": "bookworm",
+  "debian-12.12": "bookworm",
+  "debian-12.11": "bookworm",
+  "debian-12.10": "bookworm",
+  "debian-12.9": "bookworm",
+  "debian-12.8": "bookworm",
+  "debian-12.7": "bookworm",
   "debian-12.6": "bookworm",
+  "debian-12.5": "bookworm",
+  "debian-12.4": "bookworm",
+  "debian-12.2": "bookworm",
+  "debian-12.1": "bookworm",
   "debian-11": "bullseye",
   "debian-11.5": "bullseye",
   "debian-10": "buster",
@@ -256,15 +276,20 @@ export function _resetOsReleaseCache() {
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}
@@ -290,6 +315,8 @@ export function getDistroInfo(root = "/") {
     case "alpine":
     case "alpaquita":
     case "openwrt":
+    case "wolfi":
+    case "chainguard":
       purlType = "apk";
       break;
     case "sles":
@@ -312,11 +339,23 @@ export function getDistroInfo(root = "/") {
     case "photon":
       purlType = "rpm";
       break;
+    case "arch":
+    case "archarm":
+    case "manjaro":
+    case "endeavouros":
+    case "cachyos":
+    case "steamos":
+    case "artix":
+      purlType = "alpm";
+      break;
     default:
       if (idLike.includes("debian") || idLike.includes("ubuntu")) {
         purlType = "deb";
       } else if (idLike.includes("alpine")) {
         purlType = "apk";
+      } else if (idLike.split(/\s+/u).includes("arch")) {
+        // A token, not a substring: ID_LIKE is a space-separated list.
+        purlType = "alpm";
       } else if (
         idLike.includes("rhel") ||
         idLike.includes("centos") ||
@@ -343,41 +382,50 @@ export function getDistroInfo(root = "/") {
       namespace = "debian";
     } else if (idLike.includes("ubuntu")) {
       namespace = "ubuntu";
+    } else if (purlType === "alpm") {
+      namespace = "arch";
     } else {
       namespace = "linux";
     }
   }
 
-  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17"),
-  // canonicalising the vendor prefix so one release has a single qualifier
-  // value (e.g. "mariner-2.0" and "azurelinux-3.0" -> "azure-linux-2.0"/
-  // "azure-linux-3.0")
-  let distroId = versionId ? `${rawId}-${versionId}` : rawId;
-  distroId = canonicalDistroQualifier(distroId);
+  // Build distroId = ID-VERSION_ID as os-release writes it (e.g. "fedora-25",
+  // "alpine-3.24.3"), canonicalising the vendor prefix so one release has a
+  // single qualifier value (e.g. "mariner-2.0" and "azurelinux-3.0" ->
+  // "azure-linux-2.0"/"azure-linux-3.0")
+  const releaseId = versionId ? `${rawId}-${versionId}` : rawId;
+  const distroId = canonicalDistroQualifier(releaseId);
 
-  // Special-case Alpine: truncate to major.minor
-  if (purlType === "apk" && versionId) {
+  // distro_name is a release codename or a token OS_DISTRO_ALIAS knows
+  // ("bookworm", "jammy", "rhel", "alpine-3.24"), never a product display
+  // name: "AlmaLinux" or "Rocky Linux 9" has no place in a purl, since RPM
+  // distros track packages flat and a display name there breaks vulnerability
+  // matching. A product name counts only when it resolves through the alias
+  // table, which holds the RHEL names.
+  let distroName = (info.VERSION_CODENAME || "").toLowerCase();
+  if (!distroName) {
+    const productName = (
+      info.CENTOS_MANTISBT_PROJECT ||
+      info.REDHAT_BUGZILLA_PRODUCT ||
+      info.REDHAT_SUPPORT_PRODUCT ||
+      ""
+    ).toLowerCase();
+    if (productName && Object.hasOwn(OS_DISTRO_ALIAS, productName)) {
+      distroName = OS_DISTRO_ALIAS[productName];
+    }
+  }
+  // Alpine names its release series: 3.24.3 belongs to alpine-3.24, the unit
+  // its security data is kept in.
+  if (rawId === "alpine" && versionId) {
     const parts = versionId.split(".");
     if (parts.length >= 2) {
-      distroId = `${rawId}-${parts[0]}.${parts[1]}`;
+      distroName = `alpine-${parts[0]}.${parts[1]}`;
     }
   }
-
-  // Determine codename / alias
-  let distroName =
-    info.VERSION_CODENAME ||
-    info.CENTOS_MANTISBT_PROJECT ||
-    info.REDHAT_BUGZILLA_PRODUCT ||
-    info.REDHAT_SUPPORT_PRODUCT ||
-    "";
-  distroName = distroName.toLowerCase();
-
-  // Resolve well-known display name aliases
-  if (distroName.includes(" ") && OS_DISTRO_ALIAS[distroName]) {
-    distroName = OS_DISTRO_ALIAS[distroName];
-  }
-  if (!distroName && OS_DISTRO_ALIAS[distroId]) {
-    distroName = OS_DISTRO_ALIAS[distroId];
+  // The alias of the release itself (ubuntu-24.04 -> noble) wins over the
+  // codename the file carries.
+  if (versionId && Object.hasOwn(OS_DISTRO_ALIAS, releaseId)) {
+    distroName = OS_DISTRO_ALIAS[releaseId];
   }
 
   return { purlType, namespace, distroId, distroName };

package/lib/inventory/osqueryTransform.js

@@ -1,4 +1,5 @@
 import { getDistroInfo } from "./osinfo.js";
+import { buildOsPackagePurl, osPackageVersion } from "./osPackagePurl.js";
 import { tryBuildPurl } from "./purl.js";
 
 /**
@@ -62,6 +63,8 @@ export function deriveOsQueryPublisher(res) {
     res.creator ||
     res.manufacturer ||
     res.provider ||
+    res.packager ||
+    res.developer_name ||
     "";
   return publisher === "null" ? "" : publisher;
 }
@@ -174,7 +177,10 @@ export function shouldCreateOsQueryPurl(componentType) {
 
 // Purl types whose type rules require a namespace. For OS package types the
 // namespace is the distro vendor (`pkg:deb/debian/...`, `pkg:rpm/redhat/...`),
-// which osquery does not report but /etc/os-release does.
+// which osquery does not report but /etc/os-release does. deb, rpm and apk rows
+// are named by createOsQueryPackageIdentity; this covers the other types that
+// need a vendor (portage's ebuild) and a caller that asks for one of the three
+// directly.
 const NAMESPACE_REQUIRED_TYPES = new Set([
   "deb",
   "rpm",
@@ -216,10 +222,9 @@ export function createOsQueryPurl(
   if (type === "swid" && !finalQualifiers.tag_id) {
     finalQualifiers.tag_id = name;
   }
-  // The Linux OS package queries (deb_packages, rpm_packages, portage) yield no
-  // group, but their purl types require a namespace. Derive the vendor from
-  // /etc/os-release the same way osPackageResolver does, so these keep a valid
-  // purl instead of losing one.
+  // Rows with no group whose purl type requires a namespace get the vendor from
+  // /etc/os-release, the way osPackageResolver does, so they keep a valid purl
+  // instead of losing one.
   let namespace = group || null;
   if (!namespace && NAMESPACE_REQUIRED_TYPES.has(type)) {
     namespace = getDistroInfo().namespace || null;
@@ -237,6 +242,110 @@ export function createOsQueryPurl(
   });
 }
 
+/**
+ * The version and purl of a row from an OS package table: `deb_packages`,
+ * `rpm_packages`, `pacman_packages`, `homebrew_packages`, `macports_packages`,
+ * `snap_packages`, `flatpak_packages` or the rows of the apk database.
+ *
+ * Such a row is named the way the package manager's own scan names it: deb,
+ * rpm and apk with the vendor and the `arch`, `distro`, `distro_name` and
+ * `epoch` qualifiers of the container scan, an rpm version joined to its
+ * release, a MacPorts version joined to its revision, a flatpak by its
+ * application ID with the `arch` and `branch` of its ref. A row's `path`,
+ * `admindir` or source file is not a path inside the package, so none of them
+ * becomes a subpath.
+ *
+ * @param {string} purlType One of OS_PACKAGE_PURL_TYPES
+ * @param {Object} res osquery row
+ * @param {string} name Component name derived from the row
+ * @param {Object} [distro] What getDistroInfo() reports; the host's by default
+ * @returns {{version: string, purl: string|null}} The component version and the purl, which is null when the row cannot be expressed as one
+ */
+export function createOsQueryPackageIdentity(purlType, res, name, distro) {
+  const pkg = {
+    type: purlType,
+    name,
+    version: res.version,
+    arch: res.arch,
+  };
+  if (purlType === "rpm") {
+    pkg.release = res.release;
+    pkg.epoch = res.epoch;
+  } else if (purlType === "macports") {
+    pkg.revision = res.revision;
+  } else if (purlType === "flatpak") {
+    pkg.branch = res.branch;
+  }
+  return {
+    version: osPackageVersion(pkg),
+    purl: buildOsPackagePurl(pkg, distro),
+  };
+}
+
+// Columns of an OS package table that are named or dropped on their way to a
+// property. A bare `source` is the source package of a deb, the source rpm file
+// of an rpm and the pkgbase of a pacman package, and `type` says whether a
+// Homebrew entry is a formula or a cask, a snap an app or a base, a flatpak an
+// app or a runtime, so each takes the name that says which. The dpkg
+// administrative directory and the pacman database path are the same for every
+// package and say nothing about one.
+const OS_PACKAGE_PROPERTY_NAMES = {
+  deb: { source: "cdx:deb:source", admindir: undefined },
+  rpm: { source: "cdx:rpm:sourceRpm" },
+  apk: { origin: "cdx:apk:origin" },
+  alpm: { source: "cdx:alpm:pkgbase", dbpath: undefined },
+  brew: { type: "cdx:homebrew:type" },
+  macports: {
+    variants: "cdx:macports:variants",
+    requested: "cdx:macports:requested",
+  },
+  snap: {
+    type: "cdx:snap:type",
+    revision: "cdx:snap:revision",
+    channel: "cdx:snap:channel",
+    confinement: "cdx:snap:confinement",
+  },
+  flatpak: {
+    display_name: "cdx:flatpak:displayName",
+    commit_hash: "cdx:flatpak:commit",
+    origin: "cdx:flatpak:origin",
+    installation: "cdx:flatpak:installation",
+    type: "cdx:flatpak:type",
+    runtime: "cdx:flatpak:runtime",
+  },
+};
+
+/**
+ * The columns of an OS package row that give its licence and its home page.
+ * They become the component's `licenses` and a `website` reference rather than
+ * properties. `separator` splits a licence column that lists several: pacman
+ * keeps one licence per entry, which osquery joins with commas.
+ */
+export const OS_PACKAGE_LICENSE_COLUMNS = {
+  alpm: { license: "licenses", separator: ",", website: "url" },
+  snap: { license: "license" },
+  flatpak: { license: "license", website: "homepage" },
+};
+
+/**
+ * The property name an OS package table column is emitted under.
+ *
+ * @param {string|undefined} purlType Purl type of the table
+ * @param {string} column Column name
+ * @returns {string|undefined} The property name, or undefined when the column is not emitted
+ */
+export function osPackagePropertyName(purlType, column) {
+  const fields = OS_PACKAGE_LICENSE_COLUMNS[purlType];
+  if (fields && (column === fields.license || column === fields.website)) {
+    return undefined;
+  }
+  const names = OS_PACKAGE_PROPERTY_NAMES[purlType];
+  if (names && Object.hasOwn(names, column)) {
+    return names[column];
+  }
+  return column;
+}
+
 function _deriveCertificateFormat(certificateFileExtension) {
   switch ((certificateFileExtension || "").toLowerCase()) {
     case "pem":

package/lib/inventory/parentSelection.js

@@ -0,0 +1,146 @@
+/**
+ * Which detected project becomes the parent (`metadata.component`) when one
+ * scan covers several ecosystems and no parent was given.
+ *
+ * Each ecosystem detects its own project from its own manifest. The project
+ * whose manifest sits at the scan root describes the repository; one found
+ * deeper is a part of it (a web client in `tools/ui/`, a helper script's
+ * `pyproject.toml`). So candidates are ordered by how deep their ecosystem's
+ * manifests sit, the scan root first, and ties keep the ecosystem order the
+ * scan ran in.
+ */
+
+import { readdirSync } from "node:fs";
+import { dirname, relative, resolve, sep } from "node:path";
+
+import { getAllFiles } from "../core/fs.js";
+
+/**
+ * Manifest file names (or `*.ext` suffixes) per purl type: the files a
+ * project of that ecosystem is described by.
+ */
+const MANIFESTS_BY_PURL_TYPE = {
+  npm: ["package.json"],
+  pypi: [
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "Pipfile",
+    "requirements.txt",
+    "uv.lock",
+    "poetry.lock",
+    "pixi.toml",
+  ],
+  generic: [
+    "CMakeLists.txt",
+    "meson.build",
+    "conanfile.txt",
+    "conanfile.py",
+    "vcpkg.json",
+    "xmake.lua",
+  ],
+  maven: ["pom.xml", "build.gradle", "build.gradle.kts", "build.sbt"],
+  golang: ["go.mod"],
+  cargo: ["Cargo.toml"],
+  composer: ["composer.json"],
+  gem: ["Gemfile", "*.gemspec"],
+  nuget: ["*.csproj", "*.fsproj", "*.vbproj", "*.sln", "packages.config"],
+  pub: ["pubspec.yaml"],
+  hex: ["mix.exs"],
+  hackage: ["*.cabal", "stack.yaml"],
+  swift: ["Package.swift"],
+  cocoapods: ["Podfile"],
+  clojars: ["deps.edn", "project.clj"],
+};
+
+/** The purl type of a component, or `undefined`. */
+function purlTypeOf(component) {
+  const purl = `${component?.purl || ""}`;
+  if (!purl.startsWith("pkg:")) {
+    return undefined;
+  }
+  const rest = purl.slice(4);
+  const end = rest.search(/[/@?#]/);
+  return (end < 0 ? rest : rest.slice(0, end)).toLowerCase();
+}
+
+function matchesManifest(name, patterns) {
+  return patterns.some((p) =>
+    p.startsWith("*.") ? name.endsWith(p.slice(1)) : name === p,
+  );
+}
+
+/**
+ * How deep the shallowest manifest of an ecosystem sits under a scan root:
+ * 0 for one at the root itself, `Infinity` when there is none (or the
+ * ecosystem is not one this module knows).
+ *
+ * @param {string} root Scan root
+ * @param {string} purlType Purl type of the ecosystem
+ * @param {Object} options CLI options (exclusions)
+ * @returns {number}
+ */
+export function manifestDepth(root, purlType, options = {}) {
+  const patterns = MANIFESTS_BY_PURL_TYPE[purlType];
+  if (!patterns || !root) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const absRoot = resolve(root);
+  try {
+    if (readdirSync(absRoot).some((name) => matchesManifest(name, patterns))) {
+      return 0;
+    }
+  } catch (_err) {
+    return Number.POSITIVE_INFINITY;
+  }
+  const glob =
+    patterns.length === 1 ? `**/${patterns[0]}` : `**/{${patterns.join(",")}}`;
+  const files = getAllFiles(absRoot, glob, options);
+  let depth = Number.POSITIVE_INFINITY;
+  for (const f of files) {
+    const rel = relative(absRoot, dirname(resolve(f)));
+    if (!rel || rel.startsWith("..")) {
+      continue;
+    }
+    depth = Math.min(depth, rel.split(sep).length);
+  }
+  return depth;
+}
+
+/**
+ * Order parent candidates by the depth of their ecosystem's manifests under
+ * the scan roots (the shallowest first). The sort is stable, so candidates of
+ * equal depth keep the order the ecosystems were scanned in.
+ *
+ * @param {Object[]} candidates Detected parent components, in scan order
+ * @param {string[]} roots Scan roots
+ * @param {Object} options CLI options
+ * @returns {Object[]} The candidates, reordered
+ */
+export function orderParentCandidates(candidates, roots, options = {}) {
+  const depthByType = new Map();
+  const depthOf = (component) => {
+    const type = purlTypeOf(component);
+    if (!type) {
+      return Number.POSITIVE_INFINITY;
+    }
+    if (!depthByType.has(type)) {
+      depthByType.set(
+        type,
+        Math.min(
+          Number.POSITIVE_INFINITY,
+          ...(roots || []).map((r) => manifestDepth(r, type, options)),
+        ),
+      );
+    }
+    return depthByType.get(type);
+  };
+  return candidates
+    .map((component, index) => ({
+      component,
+      index,
+      depth: depthOf(component),
+    }))
+    .sort((a, b) => a.depth - b.depth || a.index - b.index)
+    .map((c) => c.component);
+}