@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/cli/index.js

@@ -44,12 +44,14 @@ import {
   parseOpenapiSpecData,
   parsePrivadoFile,
 } from "../ecosystems/parsers-misc.js";
+import { hasTerraformConfiguration } from "../ecosystems/parsers-terraform.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
   buildDependencyTrackBomRequest,
   getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
 import { optionIncludesAiInventoryProjectType } from "../inventory/aiInventory.js";
+import { readApkInstalledDb } from "../inventory/apkInstalledDb.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   mergeDependencies,
@@ -57,7 +59,10 @@ import {
   trimComponents,
 } from "../inventory/depsUtils.js";
 import { buildDynamicComponents } from "../inventory/dynamic.js";
-import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  convertApkPackages,
+  convertOSQueryResults,
+} from "../inventory/evidenceUtils.js";
 import {
   createHbomDocument,
   ensureHbomRuntimeSupport,
@@ -65,6 +70,8 @@ import {
   hasHbomProjectType,
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
+import { orderParentCandidates } from "../inventory/parentSelection.js";
+import { probeHostPhp } from "../inventory/phpHostProbe.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
@@ -84,6 +91,7 @@ import {
   exportArchive,
   exportImage,
   getPkgPathList,
+  isFollowableManifestImage,
   isImageReference,
   parseImageName,
 } from "../managers/docker.js";
@@ -270,6 +278,37 @@ export function createOSBom(_path, options) {
       );
     }
   } // for
+  // osquery has no apk table, so the packages of an Alpine, Wolfi or Chainguard
+  // host come from the apk installed database, after the osquery categories and
+  // as a category of their own. They are all components: the OS itself is the
+  // first row of the first osquery category, as before.
+  if (_platform() === "linux") {
+    const apkInventory = readApkInstalledDb();
+    if (apkInventory.state === "unreadable") {
+      recordDegradation("os.apk-installed-db.unreadable", {
+        ecosystem: "generic",
+        tool: "apk",
+        impact: "components",
+        path: apkInventory.path,
+        detail:
+          "The apk installed database exists but could not be read in full, so the packages it lists are missing from the OBOM.",
+      });
+    }
+    if (apkInventory.packages.length) {
+      pkgList = pkgList.concat(
+        convertApkPackages(apkInventory.packages).sort((a, b) =>
+          a.name.localeCompare(b.name),
+        ),
+      );
+    }
+  }
+  // The package tables cannot see a PHP that no package manager installed. Its
+  // edges stay out: an OBOM has no dependency graph, and a partial one makes
+  // post-processing infer the OS root's dependencies from these files alone.
+  const hostPhp = probeHostPhp({ executeOsQuery, packageComponents: pkgList });
+  if (hostPhp.components.length) {
+    pkgList = pkgList.concat(hostPhp.components);
+  }
   const hostTrustInventory = enrichOSComponentsWithTrustData(pkgList);
   if (hostTrustInventory?.components?.length) {
     pkgList = hostTrustInventory.components;
@@ -513,11 +552,14 @@ export async function createContainerSpecLikeBom(path, options) {
             if (imageBomData?.bomJson?.components) {
               components = components.concat(imageBomData.bomJson.components);
             }
+            doneimages.push(img.image);
+            if (!isFollowableManifestImage(img.image, imageObj)) {
+              continue;
+            }
             const bomData = await createBom(img.image, {
               specVersion: options.specVersion,
               projectType: ["oci"],
             });
-            doneimages.push(img.image);
             if (bomData) {
               if (bomData.components?.length) {
                 // Inject properties
@@ -732,6 +774,7 @@ export async function createMultiXBom(pathList, options) {
   let dependencies = [];
   let bomData;
   let formulationList = [];
+  let metadataProperties = [];
   let parentComponent = determineParentComponent(options) || {};
   let parentSubComponents = [];
   const setProjectTypeActivityContext = (projectType, sourcePath) => {
@@ -865,6 +908,7 @@ export async function createMultiXBom(pathList, options) {
         dependencies: [],
         options: { ...sharedOptions },
         parentSubComponents: [],
+        metadataProperties: [],
       };
     }
   };
@@ -877,6 +921,20 @@ export async function createMultiXBom(pathList, options) {
     let components = [];
     let dependencies = [];
     let parentSubComponents = [];
+    let metadataProperties = [];
+    // Each builder detects the project of its own ecosystem. A builder that sets
+    // options.parentComponent to force its project into its own BOM must not
+    // make that project the next builder's too, or the next ecosystem's project
+    // is lost: every builder starts from the parent the caller gave.
+    const callerParent = options.parentComponent;
+    const withOwnParent = async (build) => {
+      options.parentComponent = callerParent;
+      try {
+        return await build();
+      } finally {
+        options.parentComponent = callerParent;
+      }
+    };
     setActivityContext({
       projectType: Array.isArray(options.projectType)
         ? options.projectType.join(",")
@@ -923,7 +981,7 @@ export async function createMultiXBom(pathList, options) {
         }
       }
       setProjectTypeActivityContext(exactAiInventoryType || "js", path);
-      bomData = await createNodejsBom(path, options);
+      bomData = await withOwnParent(() => createNodejsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (exactAiInventoryType) {
           thoughtLog(
@@ -973,7 +1031,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("java", path);
-      bomData = await createJavaBom(path, options);
+      bomData = await withOwnParent(() => createJavaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} java packages.`,
@@ -1038,7 +1096,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("py", path);
-      bomData = await createPythonBom(path, options);
+      bomData = await withOwnParent(() => createPythonBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} python packages.`,
@@ -1059,6 +1117,17 @@ export async function createMultiXBom(pathList, options) {
         ) {
           parentSubComponents.push(bomData.parentComponent);
         }
+        // Retain metadata.component.components. uv workspace members are
+        // nested under the python project, so hoisting them keeps them
+        // siblings of the other sub-components instead of riding one level
+        // deeper (or being dropped by the same-name collapse) when another
+        // ecosystem's project becomes the parent.
+        if (bomData.parentComponent?.components?.length) {
+          parentSubComponents = parentSubComponents.concat(
+            bomData.parentComponent.components,
+          );
+          delete bomData.parentComponent.components;
+        }
       }
       if (bomData?.formulationList?.length) {
         formulationList = formulationList.concat(bomData.formulationList);
@@ -1071,7 +1140,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("go", path);
-      bomData = await createGoBom(path, options);
+      bomData = await withOwnParent(() => createGoBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(`I found ${bomData.bomJson.components.length} go packages.`);
         if (DEBUG_MODE) {
@@ -1099,7 +1168,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("rust", path);
-      bomData = await createRustBom(path, options);
+      bomData = await withOwnParent(() => createRustBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} rust packages.`,
@@ -1136,7 +1205,13 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("php", path);
-      bomData = createPHPBom(path, options);
+      bomData = await withOwnParent(() => createPHPBom(path, options));
+      // A lock with no packages can still hold the project's platform data.
+      if (bomData?.metadataProperties?.length) {
+        metadataProperties = metadataProperties.concat(
+          bomData.metadataProperties,
+        );
+      }
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} php packages.`,
@@ -1173,7 +1248,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("ruby", path);
-      bomData = await createRubyBom(path, options);
+      bomData = await withOwnParent(() => createRubyBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `We got ${bomData.bomJson.components.length} ruby packages.`,
@@ -1209,8 +1284,13 @@ export async function createMultiXBom(pathList, options) {
         thoughtLog("**CSHARP**: What about csharp and fsharp projects?");
       }
       setProjectTypeActivityContext("csharp", path);
-      bomData = await createCsharpBom(path, options);
-      if (bomData?.bomJson?.components?.length) {
+      bomData = await withOwnParent(() => createCsharpBom(path, options));
+      // Every project the scan read has a dependency entry of its own, so a
+      // project that uses no packages is kept along with its parent.
+      if (
+        bomData?.bomJson?.components?.length ||
+        bomData?.bomJson?.dependencies?.length
+      ) {
         thoughtLog(
           `There are ${bomData.bomJson.components.length} csharp packages.`,
         );
@@ -1246,7 +1326,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("dart", path);
-      bomData = await createDartBom(path, options);
+      bomData = await withOwnParent(() => createDartBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} pub packages.`,
@@ -1276,7 +1356,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("haskell", path);
-      bomData = createHaskellBom(path, options);
+      bomData = await withOwnParent(() => createHaskellBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} hackage packages.`,
@@ -1306,7 +1386,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("elixir", path);
-      bomData = createElixirBom(path, options);
+      bomData = await withOwnParent(() => createElixirBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} mix packages.`,
@@ -1336,7 +1416,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("c", path);
-      bomData = createCppBom(path, options);
+      bomData = await withOwnParent(() => createCppBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cpp packages.`,
@@ -1358,6 +1438,10 @@ export async function createMultiXBom(pathList, options) {
           parentSubComponents.push(bomData.parentComponent);
         }
       }
+      // presets and compilers describe the build, whatever it depends on
+      if (bomData?.formulationList?.length) {
+        formulationList = formulationList.concat(bomData.formulationList);
+      }
     }
     if (hasAnyProjectType(["oci", "clojure"], options)) {
       if (!hasAnyProjectType(["oci"], options, false)) {
@@ -1366,7 +1450,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("clojure", path);
-      bomData = createClojureBom(path, options);
+      bomData = await withOwnParent(() => createClojureBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} clojure packages.`,
@@ -1396,7 +1480,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("github", path);
-      bomData = createGitHubBom(path, options);
+      bomData = await withOwnParent(() => createGitHubBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} github action packages as well. Should I convert these to formulation instead 🤔`,
@@ -1426,7 +1510,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cloudbuild", path);
-      bomData = createCloudBuildBom(path, options);
+      bomData = await withOwnParent(() => createCloudBuildBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cloudbuild packages.`,
@@ -1456,7 +1540,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("swift", path);
-      bomData = await createSwiftBom(path, options);
+      bomData = await withOwnParent(() => createSwiftBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} swift packages here.`,
@@ -1494,7 +1578,7 @@ export async function createMultiXBom(pathList, options) {
         detail:
           "Components are being inferred by scanning jar/war/ear files from disk.",
       });
-      bomData = await createJarBom(path, options);
+      bomData = await withOwnParent(() => createJarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} jar packages as well.`,
@@ -1519,7 +1603,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "cocoa"], options)) {
       setProjectTypeActivityContext("cocoa", path);
-      bomData = await createCocoaBom(path, options);
+      bomData = await withOwnParent(() => createCocoaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1538,7 +1622,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "nix"], options)) {
       setProjectTypeActivityContext("nix", path);
-      bomData = await createNixBom(path, options);
+      bomData = await withOwnParent(() => createNixBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1560,7 +1644,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["caxa"], options, false)) {
       setProjectTypeActivityContext("caxa", path);
-      bomData = await createCaxaBom(path, options);
+      bomData = await withOwnParent(() => createCaxaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1582,7 +1666,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["asar"], options, false)) {
       setProjectTypeActivityContext("asar", path);
-      bomData = await createAsarBom(path, options);
+      bomData = await withOwnParent(() => createAsarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1604,7 +1688,9 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["vscode-extension"], options, false)) {
       setProjectTypeActivityContext("vscode-extension", path);
-      bomData = await createVscodeExtensionBom(path, options);
+      bomData = await withOwnParent(() =>
+        createVscodeExtensionBom(path, options),
+      );
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1647,7 +1733,9 @@ export async function createMultiXBom(pathList, options) {
           sharedOptions.__didScanChromeExtensions = true;
         }
         setProjectTypeActivityContext("chrome-extension", path);
-        bomData = await createChromeExtensionBom(path, options);
+        bomData = await withOwnParent(() =>
+          createChromeExtensionBom(path, options),
+        );
         if (bomData?.bomJson?.components?.length) {
           if (DEBUG_MODE) {
             console.log(
@@ -1668,6 +1756,34 @@ export async function createMultiXBom(pathList, options) {
         }
       }
     }
+    if (hasAnyProjectType(["terraform"], options)) {
+      thoughtLog(
+        "**TERRAFORM**: Looking for Terraform and OpenTofu modules and providers. The registry metadata fetch is opt-in, so I will rely on the lock file, the module manifest and the configuration files.",
+      );
+      setProjectTypeActivityContext("terraform", path);
+      bomData = await withOwnParent(() => createTerraformBom(path, options));
+      if (bomData?.bomJson?.components?.length) {
+        thoughtLog(
+          `I found ${bomData.bomJson.components.length} terraform components. Should I also resolve their licenses from the registry when FETCH_LICENSE is enabled?`,
+        );
+        if (DEBUG_MODE) {
+          console.log(
+            `Found ${bomData.bomJson.components.length} terraform components at ${path}`,
+          );
+        }
+        components = components.concat(bomData.bomJson.components);
+        dependencies = mergeDependencies(
+          dependencies,
+          bomData.bomJson.dependencies,
+        );
+        if (
+          bomData.parentComponent &&
+          Object.keys(bomData.parentComponent).length
+        ) {
+          parentSubComponents.push(bomData.parentComponent);
+        }
+      }
+    }
     // Collect any crypto keys
     if (
       options.specVersion >= 1.6 &&
@@ -1680,7 +1796,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cbom", path);
-      bomData = await createCryptoCertsBom(path, options);
+      bomData = await withOwnParent(() => createCryptoCertsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} crypto assets.`,
@@ -1691,9 +1807,18 @@ export async function createMultiXBom(pathList, options) {
           );
         }
         components = components.concat(bomData.bomJson.components);
+        if (bomData.dependencies?.length) {
+          dependencies = mergeDependencies(dependencies, bomData.dependencies);
+        }
       }
     }
-    return { components, dependencies, options, parentSubComponents };
+    return {
+      components,
+      dependencies,
+      options,
+      parentSubComponents,
+      metadataProperties,
+    };
   };
   const pathResults = [];
   // A container scan walks hundreds of paths, so the phase carries a bar and
@@ -1756,6 +1881,9 @@ export async function createMultiXBom(pathList, options) {
     parentSubComponents = parentSubComponents.concat(
       pathResult.parentSubComponents,
     );
+    metadataProperties = metadataProperties.concat(
+      pathResult.metadataProperties,
+    );
     if (pathResult.options.services?.length) {
       sharedOptions.services = mergeServices(
         sharedOptions.services || [],
@@ -1771,7 +1899,7 @@ export async function createMultiXBom(pathList, options) {
     !options.lastWorkingDir.includes("/home/")
   ) {
     setProjectTypeActivityContext("jar", options.lastWorkingDir);
-    bomData = createJarBom(options.lastWorkingDir, options);
+    bomData = await createJarBom(options.lastWorkingDir, options);
     if (bomData?.bomJson?.components?.length) {
       if (DEBUG_MODE) {
         console.log(
@@ -1797,14 +1925,24 @@ export async function createMultiXBom(pathList, options) {
       thoughtLog("**METADATA**: Tweaking the parent component hierarchy.");
     }
     if (!parentComponent || !Object.keys(parentComponent).length) {
-      parentComponent = parentSubComponents[0];
+      // the project whose manifest sits at the scan root describes the
+      // repository; ties keep the order the ecosystems were scanned in
+      parentComponent = orderParentCandidates(
+        parentSubComponents,
+        pathList,
+        options,
+      )[0];
     }
     // Our naive approach to appending to sub-components could result in same parent being included as a child
     // This is filtered out here
     parentSubComponents = parentSubComponents.filter(
       (c) => c["bom-ref"] !== parentComponent["bom-ref"],
     );
-    parentComponent.components = trimComponents(parentSubComponents);
+    // keep the parent's own sub-components (a CMake project's sub-projects)
+    parentComponent.components = trimComponents([
+      ...(parentComponent.components || []),
+      ...parentSubComponents,
+    ]);
     if (
       parentComponent.components.length === 1 &&
       parentComponent.components[0].name === parentComponent.name &&
@@ -1814,24 +1952,15 @@ export async function createMultiXBom(pathList, options) {
       delete parentComponent.components;
     }
     // Add references between the multiple sub-boms
-    let parentDependencies = dependencies.find(
-      (d) => d["ref"] === parentComponent["bom-ref"],
-    );
-    if (!parentDependencies) {
-      parentDependencies = {
-        ref: parentComponent["bom-ref"],
-      };
-      dependencies = mergeDependencies(dependencies, parentDependencies);
-    }
-    if (!parentDependencies["dependsOn"]) {
-      parentDependencies["dependsOn"] = [];
-    }
-    for (const parentSub of parentSubComponents) {
-      // Issue: 1622. We might have already captured this parent component dependency
-      if (!parentDependencies["dependsOn"].includes(parentSub["bom-ref"])) {
-        parentDependencies["dependsOn"].push(parentSub["bom-ref"]);
-      }
-    }
+    // mergeDependencies returns fresh objects and unions dependsOn per ref,
+    // so the parent edges are folded in through a single merge
+    const parentRef = parentComponent["bom-ref"];
+    const parentSubRefs = parentSubComponents
+      .map((c) => c["bom-ref"])
+      .filter((ref) => ref && ref !== parentRef);
+    dependencies = mergeDependencies(dependencies, [
+      { ref: parentRef, dependsOn: parentSubRefs },
+    ]);
   }
   // some cleanup, but not complete
   for (const path of pathList) {
@@ -1844,6 +1973,7 @@ export async function createMultiXBom(pathList, options) {
     components,
     parentComponent,
     dependencies,
+    metadataProperties,
   );
   if (formulationList.length) {
     multiResult.formulationList = formulationList;
@@ -1915,6 +2045,7 @@ export async function createDynamicBom(path, options) {
   const {
     components: pkgList,
     services: traceServices,
+    dependencies: traceDependencies,
     dryRunSummary,
   } = await buildDynamicComponents(commandStr, workingDir, traceOptions);
 
@@ -1923,6 +2054,7 @@ export async function createDynamicBom(path, options) {
     projectType: "dynamic",
     filename: commandStr,
     services: traceServices,
+    dependencies: traceDependencies || [],
   });
   // A dry run denies every side effect, so the attempted-operation counts are
   // the result. Only counts are recorded, never the paths or targets.
@@ -2464,14 +2596,10 @@ export async function createXBom(path, options) {
     return createPerlBom(path, options);
   }
 
-  // Terraform and OpenTofu providers
-  const tfLockFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
-    options,
-  );
-  if (tfLockFiles.length) {
-    return createTerraformBom(path, options);
+  // Terraform and OpenTofu providers and modules, discovered with the same
+  // patterns and exclusions the workspace assembly uses.
+  if (hasTerraformConfiguration(path, options)) {
+    return await createTerraformBom(path, options);
   }
 }
 
@@ -2861,7 +2989,7 @@ async function createBomForPath(path, options) {
     return createPerlBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
-    return createTerraformBom(path, options);
+    return await createTerraformBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);