@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/inventory/osPackageResolver.js

@@ -1,13 +1,13 @@
 import { readFileSync, realpathSync } from "node:fs";
 import { join, relative } from "node:path";
 
-import { build } from "@cdxgen/cdx-purl";
 import { globSync } from "glob";
 
 import { DEBUG_MODE, recordSymlinkResolution } from "../core/activity.js";
 import { safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { getDistroInfo } from "./osinfo.js";
+import { buildOsPackagePurl } from "./osPackagePurl.js";
 
 // ---------------------------------------------------------------------------
 // Caches
@@ -48,58 +48,34 @@ function parseAlpinePackage(pkgStr) {
 // ---------------------------------------------------------------------------
 // Build a PackageURL string from resolved package info.
 //
-// Distro qualifiers (distro, distro_name) are taken from /etc/os-release via
-// getDistroInfo() so they are always accurate, never hardcoded.
+// deb, rpm, apk and Homebrew packages are named by buildOsPackagePurl, the
+// function the OBOM rows use as well, so a file and the package that owns it
+// share one identity with the package an OBOM or a container scan lists. The
+// distro qualifiers come from /etc/os-release via getDistroInfo(), never from
+// a hard-coded table.
 //
-// "brew" is not an official PackageURL type — Homebrew packages are emitted
-// as pkg:generic with a package_manager=homebrew qualifier.
+// Homebrew has no official purl type yet, but cdx-purl builds pkg:brew, as the
+// OBOM does for its homebrew_packages rows. A brew purl carries no qualifiers:
+// this used to pass an `arch` that the generic type it fell back to does not
+// allow, so build() threw and a file of a Homebrew package got no purl at all.
 // ---------------------------------------------------------------------------
 function buildPurl(pkgInfo) {
-  let purlType = pkgInfo.type;
-  let namespace;
-  const qualifiers = {};
-
-  if (pkgInfo.arch) {
-    qualifiers.arch = pkgInfo.arch;
-  }
-
-  if (purlType === "deb" || purlType === "apk" || purlType === "rpm") {
-    const di = getDistroInfo();
-    namespace = di.namespace;
-
-    // distro qualifier: ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17")
-    if (di.distroId) {
-      qualifiers.distro = di.distroId;
-    }
-    // distro_name qualifier: codename (e.g. "jammy", "bookworm")
-    if (di.distroName) {
-      qualifiers.distro_name = di.distroName;
-    }
-  } else if (purlType === "brew") {
-    // No official brew purl type — fall back to generic. This used to add a
-    // `package_manager=homebrew` qualifier, which generic does not allow, so
-    // build() threw and the catch below swallowed it: Homebrew packages silently
-    // received no purl at all on macOS. The provenance is instead recorded as a
-    // property by the caller.
-    purlType = "generic";
-  }
+  const distro =
+    pkgInfo.type === "brew" || !pkgInfo.type ? undefined : getDistroInfo();
+  return buildOsPackagePurl(pkgInfo, distro) || "";
+}
 
-  const finalQualifiers = Object.keys(qualifiers).length
-    ? qualifiers
-    : undefined;
+// apk names an architecture its own way, which is not the way node does.
+const APK_ARCHITECTURES = {
+  x64: "x86_64",
+  arm64: "aarch64",
+  ia32: "x86",
+  ppc64: "ppc64le",
+  loong64: "loongarch64",
+};
 
-  try {
-    return build({
-      type: purlType,
-      namespace: namespace || undefined || null,
-      name: pkgInfo.name,
-      version: pkgInfo.version || undefined || null,
-      qualifiers: finalQualifiers || null,
-      subpath: undefined || null,
-    });
-  } catch (_e) {
-    return "";
-  }
+function apkArchitecture() {
+  return APK_ARCHITECTURES[process.arch] || process.arch;
 }
 
 // ---------------------------------------------------------------------------
@@ -111,7 +87,7 @@ function buildPurl(pkgInfo) {
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export function resolvePackageForFile(filePath) {
   if (!filePath) {
@@ -190,27 +166,30 @@ function _resolveLinux(filePath) {
       return {
         name,
         version,
-        arch: process.arch === "x64" ? "x86_64" : process.arch,
+        arch: apkArchitecture(),
         type: "apk",
       };
     }
   }
 
-  // 3. RPM-based (rpm -qf)
+  // 3. RPM-based (rpm -qf). The epoch is part of an rpm's identity; %{EPOCH} is
+  // (none) for a package without one, so the conditional makes that a 0, which
+  // means the same.
   const rpmRes = safeSpawnSync("rpm", [
     "-qf",
     "--qf",
-    "%{NAME} %{VERSION}-%{RELEASE} %{ARCH}\n",
+    "%{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION}-%{RELEASE} %{ARCH}\n",
     filePath,
   ]);
   if (rpmRes && rpmRes.status === 0 && rpmRes.stdout) {
     const line = rpmRes.stdout.split("\n")[0].trim();
     const parts = line.split(" ");
-    if (parts.length >= 3) {
+    if (parts.length >= 4) {
       return {
         name: parts[0],
-        version: parts[1],
-        arch: parts[2],
+        epoch: parts[1],
+        version: parts[2],
+        arch: parts[3],
         type: "rpm",
       };
     }
@@ -233,7 +212,7 @@ function _resolveDarwin(filePath) {
           name: segments[0],
           version: segments[1],
           arch: process.arch,
-          type: "brew", // remapped to pkg:generic in buildPurl
+          type: "brew",
         };
       }
     }
@@ -379,6 +358,9 @@ function shouldPreferUsrMergedExecutablePath(file, existingFile) {
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
@@ -388,6 +370,7 @@ export function collectSharedLibs(
   ldConf,
   ldConfDirPattern,
   excludePaths = [],
+  extraLibGlobs = [],
 ) {
   if (!libPaths) {
     return [];
@@ -399,6 +382,37 @@ export function collectSharedLibs(
   const ignoreList = [
     "**/*.{h,c,cpp,hpp,man,txt,md,htm,html,jar,ear,war,zip,tar,egg,keepme,gitignore,json,js,py,pyc}",
   ];
+  const addCandidate = (file) => {
+    let resolvedFile = file;
+    try {
+      resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
+      recordSymlinkResolution(join(basePath, file), resolvedFile, {
+        basePath,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
+      });
+    } catch (err) {
+      recordSymlinkResolution(join(basePath, file), undefined, {
+        basePath,
+        errorCode: err?.code || err?.name,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Failed to resolve shared library candidate ${file}.`,
+        status: "failed",
+      });
+      // Broken symlinks or permission errors can prevent realpath resolution.
+    }
+    if (
+      excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
+      excludedPathSet.has(resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"))
+    ) {
+      return;
+    }
+    sharedLibs.push(file);
+  };
   const allLdConfDirs = ldConfDirPattern ? [ldConfDirPattern] : [];
   collectAllLdConfs(basePath, ldConf, allLdConfDirs, libPaths);
   if (allLdConfDirs.length) {
@@ -428,37 +442,25 @@ export function collectSharedLibs(
         ignore: ignoreList,
       });
       for (const file of files) {
-        let resolvedFile = file;
-        try {
-          resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
-          recordSymlinkResolution(join(basePath, file), resolvedFile, {
-            basePath,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
-          });
-        } catch (err) {
-          recordSymlinkResolution(join(basePath, file), undefined, {
-            basePath,
-            errorCode: err?.code || err?.name,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Failed to resolve shared library candidate ${file}.`,
-            status: "failed",
-          });
-          // Broken symlinks or permission errors can prevent realpath resolution.
-        }
-        if (
-          excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
-          excludedPathSet.has(
-            resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"),
-          )
-        ) {
-          continue;
-        }
-        sharedLibs.push(file);
+        addCandidate(file);
+      }
+    } catch (_err) {
+      // ignore
+    }
+  }
+  for (const pattern of extraLibGlobs) {
+    try {
+      const files = globSync(pattern, {
+        cwd: basePath,
+        absolute: false,
+        nocase: true,
+        nodir: true,
+        dot: true,
+        follow: true,
+        ignore: ignoreList,
+      });
+      for (const file of files) {
+        addCandidate(file);
       }
     } catch (_err) {
       // ignore

package/lib/inventory/osinfo.js

@@ -49,14 +49,34 @@ export const OS_DISTRO_ALIAS = {
   "ubuntu-24.10": "oracular",
   "ubuntu-25.04": "plucky",
   "ubuntu-25.10": "questing",
+  "ubuntu-26.04": "resolute",
+  "ubuntu-26.10": "stonking",
   "debian-15": "duke",
   "debian-14": "forky",
   "debian-14.5": "forky",
   "debian-13": "trixie",
+  "debian-13.7": "trixie",
+  "debian-13.6": "trixie",
   "debian-13.5": "trixie",
+  "debian-13.4": "trixie",
+  "debian-13.3": "trixie",
+  "debian-13.2": "trixie",
+  "debian-13.1": "trixie",
   "debian-12": "bookworm",
-  "debian-12.5": "bookworm",
+  "debian-12.15": "bookworm",
+  "debian-12.14": "bookworm",
+  "debian-12.13": "bookworm",
+  "debian-12.12": "bookworm",
+  "debian-12.11": "bookworm",
+  "debian-12.10": "bookworm",
+  "debian-12.9": "bookworm",
+  "debian-12.8": "bookworm",
+  "debian-12.7": "bookworm",
   "debian-12.6": "bookworm",
+  "debian-12.5": "bookworm",
+  "debian-12.4": "bookworm",
+  "debian-12.2": "bookworm",
+  "debian-12.1": "bookworm",
   "debian-11": "bullseye",
   "debian-11.5": "bullseye",
   "debian-10": "buster",
@@ -256,15 +276,20 @@ export function _resetOsReleaseCache() {
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}
@@ -290,6 +315,8 @@ export function getDistroInfo(root = "/") {
     case "alpine":
     case "alpaquita":
     case "openwrt":
+    case "wolfi":
+    case "chainguard":
       purlType = "apk";
       break;
     case "sles":
@@ -312,11 +339,23 @@ export function getDistroInfo(root = "/") {
     case "photon":
       purlType = "rpm";
       break;
+    case "arch":
+    case "archarm":
+    case "manjaro":
+    case "endeavouros":
+    case "cachyos":
+    case "steamos":
+    case "artix":
+      purlType = "alpm";
+      break;
     default:
       if (idLike.includes("debian") || idLike.includes("ubuntu")) {
         purlType = "deb";
       } else if (idLike.includes("alpine")) {
         purlType = "apk";
+      } else if (idLike.split(/\s+/u).includes("arch")) {
+        // A token, not a substring: ID_LIKE is a space-separated list.
+        purlType = "alpm";
       } else if (
         idLike.includes("rhel") ||
         idLike.includes("centos") ||
@@ -343,41 +382,50 @@ export function getDistroInfo(root = "/") {
       namespace = "debian";
     } else if (idLike.includes("ubuntu")) {
       namespace = "ubuntu";
+    } else if (purlType === "alpm") {
+      namespace = "arch";
     } else {
       namespace = "linux";
     }
   }
 
-  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17"),
-  // canonicalising the vendor prefix so one release has a single qualifier
-  // value (e.g. "mariner-2.0" and "azurelinux-3.0" -> "azure-linux-2.0"/
-  // "azure-linux-3.0")
-  let distroId = versionId ? `${rawId}-${versionId}` : rawId;
-  distroId = canonicalDistroQualifier(distroId);
+  // Build distroId = ID-VERSION_ID as os-release writes it (e.g. "fedora-25",
+  // "alpine-3.24.3"), canonicalising the vendor prefix so one release has a
+  // single qualifier value (e.g. "mariner-2.0" and "azurelinux-3.0" ->
+  // "azure-linux-2.0"/"azure-linux-3.0")
+  const releaseId = versionId ? `${rawId}-${versionId}` : rawId;
+  const distroId = canonicalDistroQualifier(releaseId);
 
-  // Special-case Alpine: truncate to major.minor
-  if (purlType === "apk" && versionId) {
+  // distro_name is a release codename or a token OS_DISTRO_ALIAS knows
+  // ("bookworm", "jammy", "rhel", "alpine-3.24"), never a product display
+  // name: "AlmaLinux" or "Rocky Linux 9" has no place in a purl, since RPM
+  // distros track packages flat and a display name there breaks vulnerability
+  // matching. A product name counts only when it resolves through the alias
+  // table, which holds the RHEL names.
+  let distroName = (info.VERSION_CODENAME || "").toLowerCase();
+  if (!distroName) {
+    const productName = (
+      info.CENTOS_MANTISBT_PROJECT ||
+      info.REDHAT_BUGZILLA_PRODUCT ||
+      info.REDHAT_SUPPORT_PRODUCT ||
+      ""
+    ).toLowerCase();
+    if (productName && Object.hasOwn(OS_DISTRO_ALIAS, productName)) {
+      distroName = OS_DISTRO_ALIAS[productName];
+    }
+  }
+  // Alpine names its release series: 3.24.3 belongs to alpine-3.24, the unit
+  // its security data is kept in.
+  if (rawId === "alpine" && versionId) {
     const parts = versionId.split(".");
     if (parts.length >= 2) {
-      distroId = `${rawId}-${parts[0]}.${parts[1]}`;
+      distroName = `alpine-${parts[0]}.${parts[1]}`;
     }
   }
-
-  // Determine codename / alias
-  let distroName =
-    info.VERSION_CODENAME ||
-    info.CENTOS_MANTISBT_PROJECT ||
-    info.REDHAT_BUGZILLA_PRODUCT ||
-    info.REDHAT_SUPPORT_PRODUCT ||
-    "";
-  distroName = distroName.toLowerCase();
-
-  // Resolve well-known display name aliases
-  if (distroName.includes(" ") && OS_DISTRO_ALIAS[distroName]) {
-    distroName = OS_DISTRO_ALIAS[distroName];
-  }
-  if (!distroName && OS_DISTRO_ALIAS[distroId]) {
-    distroName = OS_DISTRO_ALIAS[distroId];
+  // The alias of the release itself (ubuntu-24.04 -> noble) wins over the
+  // codename the file carries.
+  if (versionId && Object.hasOwn(OS_DISTRO_ALIAS, releaseId)) {
+    distroName = OS_DISTRO_ALIAS[releaseId];
   }
 
   return { purlType, namespace, distroId, distroName };

package/lib/inventory/osqueryTransform.js

@@ -1,4 +1,5 @@
 import { getDistroInfo } from "./osinfo.js";
+import { buildOsPackagePurl, osPackageVersion } from "./osPackagePurl.js";
 import { tryBuildPurl } from "./purl.js";
 
 /**
@@ -62,6 +63,8 @@ export function deriveOsQueryPublisher(res) {
     res.creator ||
     res.manufacturer ||
     res.provider ||
+    res.packager ||
+    res.developer_name ||
     "";
   return publisher === "null" ? "" : publisher;
 }
@@ -174,7 +177,10 @@ export function shouldCreateOsQueryPurl(componentType) {
 
 // Purl types whose type rules require a namespace. For OS package types the
 // namespace is the distro vendor (`pkg:deb/debian/...`, `pkg:rpm/redhat/...`),
-// which osquery does not report but /etc/os-release does.
+// which osquery does not report but /etc/os-release does. deb, rpm and apk rows
+// are named by createOsQueryPackageIdentity; this covers the other types that
+// need a vendor (portage's ebuild) and a caller that asks for one of the three
+// directly.
 const NAMESPACE_REQUIRED_TYPES = new Set([
   "deb",
   "rpm",
@@ -216,10 +222,9 @@ export function createOsQueryPurl(
   if (type === "swid" && !finalQualifiers.tag_id) {
     finalQualifiers.tag_id = name;
   }
-  // The Linux OS package queries (deb_packages, rpm_packages, portage) yield no
-  // group, but their purl types require a namespace. Derive the vendor from
-  // /etc/os-release the same way osPackageResolver does, so these keep a valid
-  // purl instead of losing one.
+  // Rows with no group whose purl type requires a namespace get the vendor from
+  // /etc/os-release, the way osPackageResolver does, so they keep a valid purl
+  // instead of losing one.
   let namespace = group || null;
   if (!namespace && NAMESPACE_REQUIRED_TYPES.has(type)) {
     namespace = getDistroInfo().namespace || null;
@@ -237,6 +242,110 @@ export function createOsQueryPurl(
   });
 }
 
+/**
+ * The version and purl of a row from an OS package table: `deb_packages`,
+ * `rpm_packages`, `pacman_packages`, `homebrew_packages`, `macports_packages`,
+ * `snap_packages`, `flatpak_packages` or the rows of the apk database.
+ *
+ * Such a row is named the way the package manager's own scan names it: deb,
+ * rpm and apk with the vendor and the `arch`, `distro`, `distro_name` and
+ * `epoch` qualifiers of the container scan, an rpm version joined to its
+ * release, a MacPorts version joined to its revision, a flatpak by its
+ * application ID with the `arch` and `branch` of its ref. A row's `path`,
+ * `admindir` or source file is not a path inside the package, so none of them
+ * becomes a subpath.
+ *
+ * @param {string} purlType One of OS_PACKAGE_PURL_TYPES
+ * @param {Object} res osquery row
+ * @param {string} name Component name derived from the row
+ * @param {Object} [distro] What getDistroInfo() reports; the host's by default
+ * @returns {{version: string, purl: string|null}} The component version and the purl, which is null when the row cannot be expressed as one
+ */
+export function createOsQueryPackageIdentity(purlType, res, name, distro) {
+  const pkg = {
+    type: purlType,
+    name,
+    version: res.version,
+    arch: res.arch,
+  };
+  if (purlType === "rpm") {
+    pkg.release = res.release;
+    pkg.epoch = res.epoch;
+  } else if (purlType === "macports") {
+    pkg.revision = res.revision;
+  } else if (purlType === "flatpak") {
+    pkg.branch = res.branch;
+  }
+  return {
+    version: osPackageVersion(pkg),
+    purl: buildOsPackagePurl(pkg, distro),
+  };
+}
+
+// Columns of an OS package table that are named or dropped on their way to a
+// property. A bare `source` is the source package of a deb, the source rpm file
+// of an rpm and the pkgbase of a pacman package, and `type` says whether a
+// Homebrew entry is a formula or a cask, a snap an app or a base, a flatpak an
+// app or a runtime, so each takes the name that says which. The dpkg
+// administrative directory and the pacman database path are the same for every
+// package and say nothing about one.
+const OS_PACKAGE_PROPERTY_NAMES = {
+  deb: { source: "cdx:deb:source", admindir: undefined },
+  rpm: { source: "cdx:rpm:sourceRpm" },
+  apk: { origin: "cdx:apk:origin" },
+  alpm: { source: "cdx:alpm:pkgbase", dbpath: undefined },
+  brew: { type: "cdx:homebrew:type" },
+  macports: {
+    variants: "cdx:macports:variants",
+    requested: "cdx:macports:requested",
+  },
+  snap: {
+    type: "cdx:snap:type",
+    revision: "cdx:snap:revision",
+    channel: "cdx:snap:channel",
+    confinement: "cdx:snap:confinement",
+  },
+  flatpak: {
+    display_name: "cdx:flatpak:displayName",
+    commit_hash: "cdx:flatpak:commit",
+    origin: "cdx:flatpak:origin",
+    installation: "cdx:flatpak:installation",
+    type: "cdx:flatpak:type",
+    runtime: "cdx:flatpak:runtime",
+  },
+};
+
+/**
+ * The columns of an OS package row that give its licence and its home page.
+ * They become the component's `licenses` and a `website` reference rather than
+ * properties. `separator` splits a licence column that lists several: pacman
+ * keeps one licence per entry, which osquery joins with commas.
+ */
+export const OS_PACKAGE_LICENSE_COLUMNS = {
+  alpm: { license: "licenses", separator: ",", website: "url" },
+  snap: { license: "license" },
+  flatpak: { license: "license", website: "homepage" },
+};
+
+/**
+ * The property name an OS package table column is emitted under.
+ *
+ * @param {string|undefined} purlType Purl type of the table
+ * @param {string} column Column name
+ * @returns {string|undefined} The property name, or undefined when the column is not emitted
+ */
+export function osPackagePropertyName(purlType, column) {
+  const fields = OS_PACKAGE_LICENSE_COLUMNS[purlType];
+  if (fields && (column === fields.license || column === fields.website)) {
+    return undefined;
+  }
+  const names = OS_PACKAGE_PROPERTY_NAMES[purlType];
+  if (names && Object.hasOwn(names, column)) {
+    return names[column];
+  }
+  return column;
+}
+
 function _deriveCertificateFormat(certificateFileExtension) {
   switch ((certificateFileExtension || "").toLowerCase()) {
     case "pem":