@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/audit/index.js

@@ -47,6 +47,7 @@ import {
   resolveGitUrlFromPurl,
   resolvePurlSourceDirectory,
   sanitizeRemoteUrlForLogs,
+  validateAndRejectGitSource,
 } from "../inventory/source.js";
 import { executeOsQuery } from "../managers/binary.js";
 import { getBomWithOras } from "../managers/oci.js";
@@ -390,6 +391,27 @@ function targetSlug(target) {
   return `${target.type}-${normalized || "package"}-${version}-${digest}`;
 }
 
+/**
+ * Build a deterministic directory name for a repository checkout, keyed by
+ * the repository URL and the ref it is cloned at.
+ *
+ * Keying by the coordinates rather than the package means the packages of
+ * one monorepo share a single checkout instead of each cloning the whole
+ * repository, while a different ref, which is a different snapshot of the
+ * tree, never shares one.
+ *
+ * @param {string} repoUrl Repository URL
+ * @param {string | undefined} gitRef Ref the checkout is cloned at
+ * @returns {string} slug string
+ */
+function repositoryCheckoutSlug(repoUrl, gitRef) {
+  const digest = createHash("sha256")
+    .update(`${repoUrl}\n${gitRef || ""}`)
+    .digest("hex")
+    .slice(0, 16);
+  return `repo-${digest}`;
+}
+
 /**
  * Ensure a parent directory exists before writing a file.
  *
@@ -1286,6 +1308,17 @@ export function buildTargetContextFindings(target) {
  * @returns {void}
  */
 function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
+  // The repository URL comes from registry metadata, so it gets the same
+  // protocol and host checks as a URL sent to the server.
+  const validationError = validateAndRejectGitSource(repoUrl);
+  if (validationError) {
+    const error = new Error(
+      `${validationError.error}: ${validationError.details}`,
+    );
+    error.errorType = "clone";
+    error.retryable = false;
+    throw error;
+  }
   const gitArgs = [
     "-c",
     "alias.clone=",
@@ -1295,6 +1328,8 @@ function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
     "safe.bareRepository=explicit",
     "-c",
     "core.hooksPath=/dev/null",
+    "-c",
+    "core.symlinks=false",
     "clone",
     "--template=",
     "--depth",
@@ -1378,7 +1413,12 @@ async function ensureCheckout(target, resolution, workspaceDir, gitRef) {
   if (!safeExistsSync(resolvedWorkspaceDir)) {
     safeMkdirSync(resolvedWorkspaceDir, { recursive: true });
   }
-  const cloneDir = join(resolvedWorkspaceDir, targetSlug(target));
+  // One checkout per repository and ref, so packages of the same monorepo
+  // share it; each package still keeps its own cache and report directory.
+  const cloneDir = join(
+    resolvedWorkspaceDir,
+    repositoryCheckoutSlug(resolution.repoUrl, gitRef),
+  );
   if (safeExistsSync(join(cloneDir, ".git"))) {
     return {
       cleanup: false,
@@ -2635,11 +2675,17 @@ export async function runAuditFromBoms(inputBoms, options) {
       total: extractedTargets.targets.length,
       type: "run:start",
     });
-    // Every target's repository lookup is known here, before the first clone,
-    // so they are resolved in one round rather than one per iteration below.
-    await prefetchGitUrlSources(
-      extractedTargets.targets.map((target) => target.purl),
-    );
+    // Every target's repository lookup is known here, before the first
+    // clone, so they are resolved in one round rather than one per iteration
+    // below. A target whose cached child BOM already answers it is resolved
+    // from the workspace alone, so only the targets that will be cloned take
+    // part in the round.
+    const purlsToResolve = extractedTargets.targets
+      .filter((target) => !loadCachedChildBom(options.workspaceDir, target))
+      .map((target) => target.purl);
+    if (purlsToResolve.length) {
+      await prefetchGitUrlSources(purlsToResolve);
+    }
   }
   for (const [index, target] of extractedTargets.targets.entries()) {
     const targetIndex = index + 1;

package/lib/cli/bomAssembly.js

@@ -45,6 +45,7 @@ import {
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../inventory/bomUtils.js";
+import { mergeDuplicateCryptoComponents } from "../inventory/certificates.js";
 import { mergeServices, trimComponents } from "../inventory/depsUtils.js";
 import {
   attachIdentityTools,
@@ -457,6 +458,11 @@ export const addLifecyclesSection = (options) => {
 /**
  * Function to create metadata block
  *
+ * @param {Object} [parentComponent] Component the BOM describes
+ * @param {Object} [options] CLI options
+ * @param {Object} [context] Generator context. `context.metadataProperties`
+ *   holds facts of a manifest that has no component to carry them, such as the
+ *   platform data of a composer.lock whose composer.json names no project.
  */
 export function addMetadata(parentComponent = {}, options = {}, context = {}) {
   // DO NOT fork this project to just change the vendor or author's name
@@ -752,7 +758,7 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
             });
             let appLanguage;
             // TODO: Move these lists to a config file.
-            for (const lang in [
+            for (const lang of [
               "java",
               "node",
               "dotnet",
@@ -828,6 +834,9 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
     // AI provenance/oversight detection (`-t ai-provenance`) is injected into the
     // BOM document root (bomJson.properties) after post-processing, not into
     // metadata.properties. See ensureAiProvenanceProperties/ensureAiOversightProperties.
+    if (context?.metadataProperties?.length) {
+      mproperties.push(...context.metadataProperties);
+    }
     if (mproperties.length) {
       metadata.properties = mproperties;
     }
@@ -1602,6 +1611,10 @@ export const buildBomNSData = (options, pkgInfo, ptype, context) => {
     if (context?.formulationList?.length) {
       bomNSData.formulationList = context.formulationList;
     }
+    // createMultiXBom rebuilds the metadata block, so these are handed on.
+    if (context?.metadataProperties?.length) {
+      bomNSData.metadataProperties = context.metadataProperties;
+    }
     // Carry language-specific provenance citations (e.g. PEP 770 embedded
     // SBOMs) so postProcess can attach them in the single root-level citations
     // section it builds.
@@ -1933,16 +1946,28 @@ export function emitAiInventorySummary(aiInventory, discoveryPath) {
  * @param {Array} components Components
  * @param {Object} parentComponent Parent component
  * @param {Array} dependencies Dependencies
+ * @param {Array} [metadataProperties] Properties for the metadata block, from
+ *   generators whose manifest has no component to carry them
  *
  * @returns {Object} Object including BOM Json
  */
-export function dedupeBom(options, components, parentComponent, dependencies) {
+export function dedupeBom(
+  options,
+  components,
+  parentComponent,
+  dependencies,
+  metadataProperties = [],
+) {
   if (!components) {
     return {};
   }
   if (!dependencies) {
     dependencies = [];
   }
+  // Certificate components from different producers (trustinspector rootfs,
+  // the source-directory scan, observed chains) share a bom-ref; merge their
+  // occurrences and properties before the generic trim.
+  components = mergeDuplicateCryptoComponents(components);
   components = trimComponents(components);
   // Let's apply some common tweaks
   // Convert evidence.identity section to an object for 1.5
@@ -1971,7 +1996,7 @@ export function dedupeBom(options, components, parentComponent, dependencies) {
         ),
         serialNumber: serialNum,
         version: 1,
-        metadata: addMetadata(parentComponent, options, {}),
+        metadata: addMetadata(parentComponent, options, { metadataProperties }),
         components,
         services: options.services || [],
         dependencies,

package/lib/cli/cliOptions.js

@@ -19,6 +19,7 @@ import {
   METADATA_PROPERTY_CONFIG_KEYS,
   parseMetadataProperties,
 } from "../core/metadataProperties.js";
+import { toCamel } from "../core/paths.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
   normalizeCycloneDxComponentTypeFilter,
@@ -124,6 +125,106 @@ export function isUserProvided(value, yaDefault) {
   return value !== undefined && value !== yaDefault;
 }
 
+/**
+ * The value the operator gave an option on the command line or through its
+ * CDXGEN_* environment variable. yargs also fills options in from defaults
+ * and from a config file, which cannot be told apart in its output.
+ *
+ * @param {string} option kebab-case option name
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @param {boolean} [context.boolean] Read the option as a boolean flag
+ * @returns {string|boolean|undefined} The operator's value, or undefined
+ */
+export function operatorOptionChoice(
+  option,
+  { argv = process.argv.slice(2), env = process.env, boolean = false } = {},
+) {
+  const spellings = [...new Set([option, toCamel(option)])];
+  const toBoolean = (value) =>
+    ["true", "1"].includes(`${value}`.trim().toLowerCase());
+  let choice;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = `${argv[i]}`;
+    if (arg === "--") {
+      break;
+    }
+    for (const name of spellings) {
+      if (boolean && arg === `--no-${name}`) {
+        choice = false;
+      } else if (arg === `--${name}`) {
+        const next = argv[i + 1] === undefined ? "" : `${argv[i + 1]}`;
+        if (!boolean) {
+          choice = next;
+          i++;
+        } else if (["true", "false"].includes(next.toLowerCase())) {
+          choice = toBoolean(next);
+          i++;
+        } else {
+          choice = true;
+        }
+      } else if (arg.startsWith(`--${name}=`)) {
+        const value = arg.slice(name.length + 3);
+        choice = boolean ? toBoolean(value) : value;
+      }
+    }
+  }
+  if (choice !== undefined) {
+    return choice;
+  }
+  const envValue =
+    env[`CDXGEN_${option.toUpperCase().replaceAll("-", "_")}`] ?? "";
+  if (`${envValue}`.trim() === "") {
+    return undefined;
+  }
+  return boolean ? toBoolean(envValue) : `${envValue}`;
+}
+
+/**
+ * Make the operator's choice about running the scanned project's own code
+ * final. A config file is read from the working directory, which is usually
+ * the scanned project, so it carries that project's trust. Neither the config
+ * file nor a profile or lifecycle may turn installs on when the operator
+ * disabled them, and secure mode keeps installs off unless the operator
+ * passes --install-deps. Introspection keeps the project's build tools
+ * running with installs off, which is likewise the operator's decision, so
+ * introspection asked for only by the config file does not do that.
+ *
+ * **Mutates `options` in place.**
+ *
+ * @param {object} options The options object, after applyAdvancedOptions
+ * @param {object} [context]
+ * @param {object} [context.projectConfig] Sanitized config file contents
+ * @param {boolean} [context.isSecureMode] Whether cdxgen runs in secure mode
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @returns {void}
+ */
+export function applyOperatorToolingChoice(options, context = {}) {
+  const { projectConfig, argv, env } = context;
+  const secureMode = context.isSecureMode ?? isSecureMode;
+  const installChoice = operatorOptionChoice("install-deps", {
+    argv,
+    env,
+    boolean: true,
+  });
+  if (installChoice === false || (secureMode && installChoice !== true)) {
+    options.installDeps = false;
+  }
+  const configAsksIntrospect =
+    ["true", "1"].includes(`${projectConfig?.introspect}`.toLowerCase()) ||
+    projectConfig?.profile === "introspect";
+  if (
+    options.introspect === true &&
+    configAsksIntrospect &&
+    operatorOptionChoice("introspect", { argv, env, boolean: true }) !== true &&
+    operatorOptionChoice("profile", { argv, env }) !== "introspect"
+  ) {
+    options.introspectFromConfigFile = true;
+  }
+}
+
 /**
  * Combine the custom metadata properties of every source (discussion 4391):
  * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
@@ -588,7 +689,9 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = false;
       options.includeCrypto = false;
-      options.installDeps = !secureMode;
+      // A profile may skip installs but never turn them back on once they
+      // were disabled, which would run the scanned project's code.
+      options.installDeps = !secureMode && options.installDeps !== false;
       break;
     case "deep-learning":
     case "ml-deep":
@@ -596,7 +699,7 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = true;
       options.includeCrypto = true;
-      options.installDeps = !secureMode;
+      options.installDeps = !secureMode && options.installDeps !== false;
       options.bomAudit = true;
       break;
     default:
@@ -619,7 +722,11 @@ export function applyAdvancedOptions(options, context = {}) {
             "PREVIEW: post-build lifecycle SBOM generation is supported only for limited project types.",
         });
       }
-      options.installDeps = true;
+      // The project is already built, so installs are on only where they
+      // would have been anyway: a disabled install stays disabled.
+      if (options.installDeps !== false) {
+        options.installDeps = true;
+      }
       break;
     default:
       break;