@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/evinser/evinser.js

@@ -5,6 +5,7 @@ import process from "node:process";
 import { Purl } from "@cdxgen/cdx-purl";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
 import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import {
   getAllFiles,
@@ -15,6 +16,7 @@ import {
   safeRmSync,
   safeWriteSync,
 } from "../core/fs.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { hasCppSources } from "../ecosystems/cppEvidence.js";
 import {
   createIncludeAttributor,
@@ -23,11 +25,11 @@ import {
 import {
   analyzeGolemProject,
   collectGolemEvidence,
+  collectGolemServices,
   isGolemGoLanguage,
 } from "../ecosystems/golem.js";
 import {
   collectGradleDependencies,
-  getGradleCommand,
   getMavenCommand,
 } from "../ecosystems/gradleutils.js";
 import {
@@ -52,6 +54,7 @@ import {
   isScalasemLanguage,
 } from "../ecosystems/scalasem.js";
 import {
+  atomBuildToolArgs,
   atomCompileCommandsArgs,
   buildAtomCommandEnv,
   executeAtom,
@@ -77,7 +80,10 @@ import {
   collectDosaiServicesFromMethods,
   createDosaiDataFlowSlice,
   createDosaiMethodsSlice,
-  dosaiRunWasStopped,
+  dosaiFailureReported,
+  dosaiOmittedSections,
+  dosaiReportFileOmittedSections,
+  dosaiSectionsCdxgenReads,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   persistDosaiSemanticsReport,
@@ -401,9 +407,25 @@ export async function catalogMavenDeps(
   options = {},
 ) {
   let jarNSMapping = readNamespaceMap(dirPath, options);
-  if (!jarNSMapping) {
+  if (!jarNSMapping && !isProjectToolingAllowed(options)) {
+    // `mvn dependency:copy-dependencies` evaluates the project's build and
+    // its `.mvn` configuration, so only the local repository is read.
+    console.log(
+      options.withDeepJarCollector
+        ? "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Only the jars already in the local Maven repository are used."
+        : "Skipping 'mvn dependency:copy-dependencies' since dependency installation is disabled. Pass --with-deep-jar-collector to use the jars already in the local Maven repository.",
+    );
+    if (options.withDeepJarCollector) {
+      jarNSMapping = await collectMvnDependencies(
+        undefined,
+        undefined,
+        true,
+        true,
+      );
+    }
+  } else if (!jarNSMapping) {
     console.log("About to collect jar dependencies for the path", dirPath);
-    const mavenCmd = getMavenCommand(dirPath, dirPath);
+    const mavenCmd = getMavenCommand(dirPath, dirPath, options);
     // collect all jars including from the cache if data-flow mode is enabled
     jarNSMapping = await collectMvnDependencies(
       mavenCmd,
@@ -457,10 +479,10 @@ export async function catalogGradleDeps(
     console.log(
       "About to collect jar dependencies from the gradle cache. This would take a while ...",
     );
-    const gradleCmd = getGradleCommand(dirPath, dirPath);
-    // collect all jars including from the cache if data-flow mode is enabled
+    // Only the Gradle cache is read, so no Gradle command is resolved: that
+    // would probe the project's own gradlew.
     jarNSMapping = await collectGradleDependencies(
-      gradleCmd,
+      undefined,
       dirPath,
       false,
       true,
@@ -645,9 +667,9 @@ export async function createSlice(
             resolve(slicesFile),
             options,
           );
-    // A stopped run has already said why; it says nothing about whether the
-    // project is supported (issue 4438).
-    if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
+    // A stopped run, or one the .NET host refused to start, has already said
+    // why; it says nothing about whether the project is supported (issue 4438).
+    if (!sliceResult && !dosaiFailureReported(resolve(slicesFile))) {
       console.warn(
         `Unable to generate ${sliceType} slice using dosai. Check if this is a supported .NET project.`,
       );
@@ -658,6 +680,13 @@ export async function createSlice(
       slicesFile,
     };
   }
+  const buildToolArgs = atomBuildToolArgs(language, options);
+  if (!buildToolArgs) {
+    console.log(
+      `Skipping the ${sliceType} slice for ${resolve(filePath)} since dependency installation is disabled and the installed atom cannot be stopped from running Maven. Upgrade atom to slice this project without its build.`,
+    );
+    return { tempDir: sliceOutputDir, tempDirOwned };
+  }
   console.log(
     `Creating ${sliceType} slice for ${resolve(filePath)}. Please wait ...`,
   );
@@ -706,6 +735,7 @@ export async function createSlice(
     args.push(readEnvironmentVariable("ATOM_SLICE_DEPTH"));
   }
   args.push(...atomCompileCommandsArgs(filePath, language, options));
+  args.push(...buildToolArgs);
   args.push(resolve(filePath));
   const atomExcludeEnv = buildAtomCommandEnv(options, language);
   // Execute atom
@@ -1143,6 +1173,49 @@ export function mergeServiceDefinitions(target, source) {
   return target;
 }
 
+/**
+ * Collect the services of a Go project for the golem evidence path (#4498).
+ *
+ * Two sources are kept and merged by service name, the way the Scala path
+ * merges a user-provided spec into its report's services. They roll services
+ * up differently — golem per server, OpenAPI per path and method — so a
+ * route both name appears under both entries:
+ *
+ * - the golem report itself, whose `services[]` section rolls the registered
+ *   routes up per server (a gin engine, a net/http listener) with methods and
+ *   frameworks, and the outbound hosts it calls into `kind: "external"`
+ *   services flagged as trust-boundary crossings;
+ * - an OpenAPI document, either the one `--openapi-spec-file` names or the
+ *   `openapi.json` an earlier `atom-tools convert -t go` left in the repo,
+ *   which is reused when present so `golem`/`atom-tools` and `cdxgen` can be
+ *   run as separate steps.
+ *
+ * @param {object|null|undefined} golemReport Parsed golem analysis report,
+ *   when one was produced; a missing or `null` report adds no services.
+ * @param {string} dirPath Project directory the report was produced from.
+ * @param {Object} options Command line options.
+ * @param {Object} [servicesMap={}] Service map to populate.
+ * @returns {Object} The service map
+ */
+export function collectGoServices(
+  golemReport,
+  dirPath,
+  options = {},
+  servicesMap = {},
+) {
+  servicesMap = collectGolemServices(golemReport, servicesMap);
+  const openapiSpecFile = resolve(
+    dirPath,
+    options.openapiSpecFile || "openapi.json",
+  );
+  if (safeExistsSync(openapiSpecFile)) {
+    const openapiServices = {};
+    detectServicesFromOpenAPI("go", openapiSpecFile, openapiServices);
+    mergeServiceDefinitions(servicesMap, openapiServices);
+  }
+  return servicesMap;
+}
+
 /**
  * Function to analyze the project
  *
@@ -1183,6 +1256,7 @@ export async function analyzeProject(dbObjMap, options) {
 
   if (isGolemGoLanguage(language)) {
     const golemReport = analyzeGolemProject(dirPath, options);
+    servicesMap = collectGoServices(golemReport, dirPath, options, servicesMap);
     if (golemReport && Object.keys(golemReport).length) {
       const golemEvidence = collectGolemEvidence(golemReport, [
         bomJson.metadata?.component,
@@ -1329,24 +1403,58 @@ export async function analyzeProject(dbObjMap, options) {
       options.withDataFlow = true;
       options.includeCrypto = true;
     }
+    let needsUsagesRun = true;
     if (
       options.usagesSlicesFile &&
       usableSlicesFile(options.usagesSlicesFile)
     ) {
       usageSlice = readDosaiMethodsReport(options.usagesSlicesFile);
       usagesSlicesFile = options.usagesSlicesFile;
+      needsUsagesRun = false;
+      // A user-supplied usages slice is used as given. When it was written
+      // with --sections and left out a section cdxgen reads, the evidence
+      // lacks that input; persistDosaiSemanticsReport reports separately
+      // that the persisted report is partial.
+      const missingInputs = dosaiSectionsCdxgenReads(
+        dosaiOmittedSections(usageSlice),
+      );
+      if (missingInputs.length) {
+        recordDegradation("dosai.usages.trimmed-report", {
+          ecosystem: "csharp",
+          tool: "dosai",
+          impact: "components",
+          command: `usages ${usagesSlicesFile}`,
+          detail: `The supplied dosai methods report was written without sections cdxgen reads: ${missingInputs.join(", ")}. The evidence from those sections is missing. Run dosai methods without --sections, or with every section cdxgen reads.`,
+        });
+      }
     } else if (usableSlicesFile(options.depsSlicesFile)) {
       // createCsharpBom already ran dosai methods on this tree for --deep runs
       // and wrote the deps slice. For dosai, that output IS the usages slice,
-      // so reuse it instead of invoking dosai a second time.
-      if (DEBUG_MODE) {
-        console.log(
-          `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
-        );
+      // so reuse it instead of invoking dosai a second time - unless it was
+      // written with --sections (a --deep run that performs no evidence
+      // analysis trims it): evinse persists this file as the full native
+      // report, so it must not build on a trimmed one and dosai runs again.
+      const omittedSections = dosaiReportFileOmittedSections(
+        options.depsSlicesFile,
+      );
+      if (omittedSections.length) {
+        if (DEBUG_MODE) {
+          console.log(
+            `The dosai deps slices file "${options.depsSlicesFile}" omits sections (${omittedSections.join(", ")}); running dosai for the full usages report.`,
+          );
+        }
+      } else {
+        if (DEBUG_MODE) {
+          console.log(
+            `Reusing the dosai deps slices file "${options.depsSlicesFile}" for the usages analysis.`,
+          );
+        }
+        usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
+        usagesSlicesFile = options.depsSlicesFile;
+        needsUsagesRun = false;
       }
-      usageSlice = readDosaiMethodsReport(options.depsSlicesFile);
-      usagesSlicesFile = options.depsSlicesFile;
-    } else {
+    }
+    if (needsUsagesRun) {
       retMap = await createSlice(language, dirPath, "usages", options);
       if (retMap?.slicesFile && safeExistsSync(retMap.slicesFile)) {
         usageSlice = readDosaiMethodsReport(retMap.slicesFile);

package/lib/evinser/swiftsem.js

@@ -20,6 +20,7 @@ import {
   safeRmSync,
   safeSpawnSync,
 } from "../core/fs.js";
+import { isProjectToolingAllowed } from "../ecosystems/gradleutils.js";
 import { splitCommandArgs } from "../ecosystems/parsers-js.js";
 import { collectSwiftProductionTargets } from "../ecosystems/parsers-misc.js";
 import { runSwiftCommand } from "../inventory/envcontext.js";
@@ -585,6 +586,45 @@ export function sanitizeSwiftModuleArgs(tokens) {
   return args;
 }
 
+// Compiler arguments that load code into the compiler or the SourceKit
+// service: macro plugins and their search paths, and the clang arguments
+// (`-Xcc -fplugin=...`) behind -Xcc.
+const SWIFT_CODE_LOADING_ARGS = new Set([
+  "-plugin-path",
+  "-external-plugin-path",
+  "-load-plugin-executable",
+  "-load-plugin-library",
+  "-in-process-plugin-server-path",
+  "-Xcc",
+]);
+
+/**
+ * Remove the arguments that would make SourceKit load code named by the
+ * project. A `.build` directory that cdxgen did not create is project content,
+ * so the compiler arguments read from it are cleaned this way whenever the
+ * project's own tooling may not run.
+ *
+ * @param {Array<String>} args Sanitized compiler arguments
+ * @returns {Array<String>} Arguments without plugin and clang pass-through flags
+ */
+export function withoutSwiftPluginArgs(args) {
+  const kept = [];
+  for (let i = 0; i < (args || []).length; i++) {
+    const token = args[i];
+    if (SWIFT_CODE_LOADING_ARGS.has(token)) {
+      i++;
+      continue;
+    }
+    // -Xfrontend <plugin flag> -Xfrontend <value>
+    if (token === "-Xfrontend" && SWIFT_CODE_LOADING_ARGS.has(args[i + 1])) {
+      i += 3;
+      continue;
+    }
+    kept.push(token);
+  }
+  return kept;
+}
+
 /**
  * Read the sources listed in a response or file-list file (`@<path>`), one
  * path per line.
@@ -2198,7 +2238,16 @@ export function createSemanticsSlices(basePath, options) {
   if (!pkgSwiftFiles.length) {
     return undefined;
   }
-  const toolchain = resolveSwiftToolchain(basePath);
+  // A SwiftPM manifest is a Swift program and the verbose build compiles the
+  // project, so both belong to the dependency-tooling surface disabled by
+  // --no-install-deps and the pre-build lifecycle. Evidence then comes from
+  // the .build artifacts a previous build left and import declarations.
+  const toolingAllowed = isProjectToolingAllowed(options);
+  // swiftly picks a toolchain from the project's .swift-version, so the
+  // toolchain is resolved outside the project when its tooling may not run
+  const toolchain = resolveSwiftToolchain(
+    toolingAllowed ? basePath : getTmpDir(),
+  );
   const sourcekittenEnv = sourcekittenEnvForToolchain(toolchain);
   // Without a working sourcekitten, the evidence is limited to the import
   // declarations of the modules the build describes
@@ -2211,13 +2260,22 @@ export function createSemanticsSlices(basePath, options) {
         : "",
     );
   }
+  if (!toolingAllowed) {
+    console.log(
+      "Skipping 'swift package dump-package' and the swift build for evidence since dependency installation is disabled. Evidence is limited to the build artifacts already in the project, without their compiler plugins.",
+    );
+  }
   // Package.swift contains the root targets, including which ones are tests
-  const packageMetadata = parseDumpPackage(dumpPackage(basePath));
+  const packageMetadata = toolingAllowed
+    ? parseDumpPackage(dumpPackage(basePath))
+    : undefined;
   const userCompilerArgs = process?.env?.SWIFT_COMPILER_ARGS;
   const userSdkArgs = process?.env?.SWIFT_SDK_ARGS;
   // A clean verbose debug build reveals the compiler arguments of every module
   const buildOutput =
-    userCompilerArgs && userSdkArgs ? undefined : verboseBuild(basePath);
+    !toolingAllowed || (userCompilerArgs && userSdkArgs)
+      ? undefined
+      : verboseBuild(basePath);
   const buildPlan = collectSwiftBuildPlan(
     basePath,
     buildOutput,
@@ -2267,7 +2325,9 @@ export function createSemanticsSlices(basePath, options) {
       moduleArgs[moduleName] = [
         ...(userCompilerArgs
           ? splitSwiftCommandArgs(`${userCompilerArgs} ${userSdkArgs || ""}`)
-          : amodule.args),
+          : toolingAllowed
+            ? amodule.args
+            : withoutSwiftPluginArgs(amodule.args)),
         "-module-cache-path",
         moduleCachePath,
       ];
@@ -2284,12 +2344,15 @@ export function createSemanticsSlices(basePath, options) {
     }
     // Sources that belong to no known module, for example when the build
     // failed, are indexed with the merged arguments of the root modules
-    const fallbackArgs = userCompilerArgs
+    let fallbackArgs = userCompilerArgs
       ? splitSwiftCommandArgs(`${userCompilerArgs} ${userSdkArgs || ""}`)
       : extractCompilerParamsFromBuild(
           buildOutput,
           packageMetadata?.rootModules,
         ).compilerArgs;
+    if (!userCompilerArgs && !toolingAllowed) {
+      fallbackArgs = withoutSwiftPluginArgs(fallbackArgs);
+    }
     // Sources of test and dependency modules are never indexed
     const plannedSources = new Set();
     for (const amodule of Object.values(buildPlan.modules)) {

package/lib/inventory/agentSkillSpec.js

@@ -0,0 +1,17 @@
+/**
+ * Whether the frontmatter of a SKILL.md satisfies the open Agent Skills
+ * constraints (agentskills.io): a name of 1-64 lowercase letters, digits and
+ * hyphens, and a description of 1-1024 characters.
+ *
+ * @param {{name?: unknown, description?: unknown}|undefined} metadata Frontmatter values
+ * @returns {boolean} true when both constraints hold
+ */
+export function isAgentSkillSpecValid(metadata) {
+  return (
+    typeof metadata?.name === "string" &&
+    /^[a-z0-9-]{1,64}$/u.test(metadata.name) &&
+    typeof metadata?.description === "string" &&
+    metadata.description.length >= 1 &&
+    metadata.description.length <= 1024
+  );
+}

package/lib/inventory/apkInstalledDb.js

@@ -0,0 +1,243 @@
+// Bounded, read-only reader of the apk installed database.
+//
+// osquery has no apk table, so an Alpine, Wolfi or Chainguard host would have no
+// OS package inventory in an OBOM, and the PHP host probe needs the same
+// database to tell which PHP files a package owns. Both read it through here, so
+// what the OBOM lists and what the probe treats as owned follow one parser: the
+// same file, location order, caps and record rules.
+//
+// The database is `/lib/apk/db/installed`. A usr-merged system keeps it at
+// `/usr/lib/apk/db/installed` (and `/lib` is a link to `/usr/lib`, so the two
+// names are one file), and Alpaquita keeps it under `/var/lib/apk/db`. The first
+// of those that exists is the database. One that exists but cannot be read
+// leaves the packages unknown: it is reported as unreadable, never read in part
+// and never skipped for the next name.
+//
+// A record is a run of `<letter>:<value>` lines ended by a blank line. P: names
+// the package, V: its version, A: its architecture, o: its origin (the source
+// package), m: its maintainer, L: its licence, U: its home page and T: its
+// description. F: names a directory and each R: after it a file in that
+// directory. A record may start with C: (Alpine) or P: (Wolfi).
+
+import { statSync } from "node:fs";
+import { join } from "node:path";
+import process from "node:process";
+
+import { isDryRun, recordActivity } from "../core/activity.js";
+import { safeExistsSync, safeReadFileSync } from "../core/fs.js";
+import { thoughtLog } from "../core/logger.js";
+
+/** The database, or the packages it lists, past these is unreadable rather than read in part. */
+export const MAX_APK_DATABASE_BYTES = 64 * 1024 * 1024;
+export const MAX_APK_PACKAGES = 100000;
+
+/** Where apk keeps the installed database, relative to the root, in the order they are tried. */
+export const APK_INSTALLED_DB_PATHS = [
+  "lib/apk/db/installed",
+  "usr/lib/apk/db/installed",
+  "var/lib/apk/db/installed",
+];
+
+// No field of a package record is longer than this once read.
+const MAX_FIELD_LENGTH = 4096;
+
+const FIELD_NAMES = {
+  P: "name",
+  V: "version",
+  A: "arch",
+  o: "origin",
+  m: "maintainer",
+  L: "license",
+  U: "url",
+  T: "description",
+};
+
+function readBounded(file, maxBytes) {
+  try {
+    const stats = statSync(file);
+    if (!stats.isFile() || stats.size > maxBytes) {
+      return undefined;
+    }
+  } catch {
+    return undefined;
+  }
+  const text = safeReadFileSync(file, "utf-8");
+  // A file that grew between the stat and the read is over the cap too.
+  return typeof text === "string" && text.length <= maxBytes ? text : undefined;
+}
+
+function newRecord() {
+  return { fields: {}, fileCount: 0, files: [], touched: false };
+}
+
+/**
+ * Parse the text of an installed database.
+ *
+ * @param {string} text Database text
+ * @param {Set<string>|undefined} wantedFiles Absolute paths whose owner is wanted
+ * @param {number} maxPackages Most packages to accept
+ * @returns {{packages: Object[], malformed: number, overflow: boolean}}
+ */
+function parseDatabase(text, wantedFiles, maxPackages) {
+  const packages = [];
+  let malformed = 0;
+  let overflow = false;
+  let record = newRecord();
+  let directory = "";
+  const finishRecord = () => {
+    const { fields, fileCount, files, touched } = record;
+    record = newRecord();
+    directory = "";
+    if (!touched) {
+      return;
+    }
+    // A package with no name or no version cannot be named by a purl.
+    if (!fields.name || !fields.version) {
+      malformed++;
+      return;
+    }
+    packages.push({ ...fields, fileCount, files });
+    if (packages.length > maxPackages) {
+      overflow = true;
+    }
+  };
+  let position = 0;
+  while (position <= text.length && !overflow) {
+    let end = text.indexOf("\n", position);
+    if (end === -1) {
+      end = text.length;
+    }
+    let line = text.slice(position, end);
+    position = end + 1;
+    if (line.endsWith("\r")) {
+      line = line.slice(0, -1);
+    }
+    if (line === "") {
+      finishRecord();
+      continue;
+    }
+    if (line.length < 2 || line[1] !== ":") {
+      continue;
+    }
+    const letter = line[0];
+    const value = line.slice(2);
+    if (Object.hasOwn(FIELD_NAMES, letter)) {
+      record.touched = true;
+      if (value) {
+        record.fields[FIELD_NAMES[letter]] =
+          value.length > MAX_FIELD_LENGTH
+            ? value.slice(0, MAX_FIELD_LENGTH)
+            : value;
+      }
+    } else if (letter === "F") {
+      record.touched = true;
+      directory = value;
+    } else if (letter === "R") {
+      record.touched = true;
+      record.fileCount++;
+      if (wantedFiles) {
+        const file = `/${directory ? `${directory}/` : ""}${value}`;
+        if (wantedFiles.has(file)) {
+          record.files.push(file);
+        }
+      }
+    }
+  }
+  if (!overflow) {
+    finishRecord();
+  }
+  return { packages, malformed, overflow };
+}
+
+/**
+ * Read the packages of the apk installed database.
+ *
+ * @param {Object} [options] Read options
+ * @param {string} [options.rootPath="/"] Directory the database paths hang off;
+ *   tests point it at a built tree
+ * @param {string} [options.databaseFile] Read this file instead of looking
+ *   under `rootPath`
+ * @param {Set<string>} [options.wantedFiles] Absolute paths whose owner is
+ *   wanted. A package comes back with the ones it owns in `files`; the other
+ *   files of a package are only counted, so a large database stays small.
+ * @param {number} [options.maxBytes] Largest database to read, 64 MiB by default
+ * @param {number} [options.maxPackages] Most packages to accept, 100000 by default
+ * @param {string} [options.platform] `linux` by default for the process; an apk
+ *   database exists on Linux only
+ * @returns {{state: string, path?: string, packages: Object[], malformed: number}}
+ *   `state` is `ok`, `absent` (no database, or not Linux), `unreadable` (a
+ *   database that could not be read in full) or `skipped` (a dry run).
+ *   `malformed` counts the records left out for having no name or version.
+ *   Each package has `name`, `version` and `fileCount`, `files`, and, when the
+ *   record has them, `arch`, `origin`, `maintainer`, `license`, `url` and
+ *   `description`.
+ */
+export function readApkInstalledDb(options = {}) {
+  const result = (state, extra = {}) => ({
+    state,
+    packages: [],
+    malformed: 0,
+    ...extra,
+  });
+  const platform = options.platform || process.platform;
+  if (platform !== "linux") {
+    return result("absent");
+  }
+  const rootPath = options.rootPath || "/";
+  if (isDryRun) {
+    recordActivity({
+      capability: "apk-installed-db",
+      kind: "read",
+      reason:
+        "Dry run mode blocks reading the apk installed database, which lives outside the project.",
+      status: "blocked",
+      target: options.databaseFile || rootPath,
+    });
+    return result("skipped");
+  }
+  const candidates = options.databaseFile
+    ? [options.databaseFile]
+    : APK_INSTALLED_DB_PATHS.map((location) => join(rootPath, location));
+  const file = candidates.find((candidate) => safeExistsSync(candidate));
+  if (!file) {
+    return result("absent");
+  }
+  const unreadable = (reason) => {
+    thoughtLog(`The apk installed database ${file} was not read: ${reason}.`);
+    recordActivity({
+      capability: "apk-installed-db",
+      kind: "read",
+      reason: `The apk installed database ${file} could not be read: ${reason}.`,
+      status: "failed",
+      target: file,
+    });
+    return result("unreadable", { path: file });
+  };
+  const maxBytes = options.maxBytes ?? MAX_APK_DATABASE_BYTES;
+  const text = readBounded(file, maxBytes);
+  if (text === undefined) {
+    return unreadable(`it is not a file of at most ${maxBytes} bytes`);
+  }
+  const maxPackages = options.maxPackages ?? MAX_APK_PACKAGES;
+  const { packages, malformed, overflow } = parseDatabase(
+    text,
+    options.wantedFiles,
+    maxPackages,
+  );
+  if (overflow) {
+    return unreadable(`it lists more than ${maxPackages} packages`);
+  }
+  if (malformed) {
+    thoughtLog(
+      `${malformed} record(s) of the apk installed database ${file} have no name or no version and were left out.`,
+    );
+  }
+  recordActivity({
+    capability: "apk-installed-db",
+    kind: "read",
+    reason: `Read ${packages.length} package(s) from the apk installed database ${file}.`,
+    status: "completed",
+    target: file,
+  });
+  return result("ok", { path: file, packages, malformed });
+}

package/lib/inventory/atomUtils.js

@@ -30,6 +30,7 @@ import {
 import { TRACE_MODE } from "../core/logger.js";
 import { dirNameStr, isWin } from "../core/paths.js";
 import { formatDuration, reapProcessTree } from "../core/processTree.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { readJsonFile } from "../parsers/largeJson.js";
 import { cmakeBuildDirCandidates } from "./cmakeBuildDirs.js";
 
@@ -314,6 +315,38 @@ export function atomCompileCommandsArgs(src, language, options = {}) {
   return ["--frontend-args", `compile-commands=${database}`];
 }
 
+/**
+ * The arguments that stop atom's Java frontend from running the scanned
+ * project's build. In its default delombok mode, atom runs
+ * `mvn dependency:build-classpath` inside a Maven project, which loads the
+ * project's `.mvn` configuration and build extensions, so delombok and
+ * dependency fetching are turned off whenever the project's own tooling may
+ * not run.
+ *
+ * @param {string} language atom `-l` value
+ * @param {Object} options CLI options
+ * @returns {string[]|undefined} Arguments to add to the atom command, or
+ *   undefined when the installed atom cannot be told to leave the build alone
+ */
+export function atomBuildToolArgs(language, options = {}) {
+  if (
+    `${language}`.toLowerCase() !== "java" ||
+    isProjectToolingAllowed(options)
+  ) {
+    return [];
+  }
+  const keys = atomFrontendArgKeys(language);
+  if (!keys.has("delombok-mode")) {
+    return undefined;
+  }
+  return [
+    "--frontend-args",
+    keys.has("fetch-dependencies")
+      ? "delombok-mode=no-delombok,fetch-dependencies=false"
+      : "delombok-mode=no-delombok",
+  ];
+}
+
 // Absolute ceiling on atom's heap. Past this point a larger heap buys a
 // collector that runs less often rather than an analysis that succeeds where it
 // otherwise would not, while the reservation itself is what pushes a build