@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/inventory/spdx.js

@@ -440,6 +440,150 @@ export function licenseIdFromText(content) {
   return undefined;
 }
 
+// The GNU licenses by the title line their text opens with, and their SPDX
+// ids by version.
+const GNU_LICENSE_TITLES = {
+  "GNU AFFERO GENERAL PUBLIC LICENSE": { 3: "AGPL-3.0-only" },
+  "GNU LESSER GENERAL PUBLIC LICENSE": {
+    3: "LGPL-3.0-only",
+    2.1: "LGPL-2.1-only",
+    2: "LGPL-2.0-only",
+  },
+  "GNU LIBRARY GENERAL PUBLIC LICENSE": {
+    2.1: "LGPL-2.1-only",
+    2: "LGPL-2.0-only",
+  },
+  "GNU GENERAL PUBLIC LICENSE": {
+    3: "GPL-3.0-only",
+    2: "GPL-2.0-only",
+    1: "GPL-1.0-only",
+  },
+};
+
+// Phrases that only the grant of one license carries, so finding one anywhere
+// in a notice means that license is granted, not merely mentioned.
+const LICENSE_GRANT_PHRASES = [
+  ["PERMISSION IS HEREBY GRANTED, FREE OF CHARGE", "MIT"],
+  [
+    "PERMISSION TO USE, COPY, MODIFY, AND/OR DISTRIBUTE THIS SOFTWARE FOR ANY PURPOSE WITH OR WITHOUT FEE IS HEREBY GRANTED",
+    "ISC",
+  ],
+  [
+    "PERMISSION IS GRANTED TO ANYONE TO USE THIS SOFTWARE FOR ANY PURPOSE",
+    "Zlib",
+  ],
+  [
+    "THIS IS FREE AND UNENCUMBERED SOFTWARE RELEASED INTO THE PUBLIC DOMAIN",
+    "Unlicense",
+  ],
+  ["BOOST SOFTWARE LICENSE - VERSION 1.0", "BSL-1.0"],
+  ["MOZILLA PUBLIC LICENSE VERSION 2.0", "MPL-2.0"],
+  ["MOZILLA PUBLIC LICENSE, VERSION 2.0", "MPL-2.0"],
+  ["MOZILLA PUBLIC LICENSE, V. 2.0", "MPL-2.0"],
+  [
+    "CREATIVE COMMONS ATTRIBUTION 4.0 INTERNATIONAL PUBLIC LICENSE",
+    "CC-BY-4.0",
+  ],
+  [
+    "CREATIVE COMMONS ATTRIBUTION-SHAREALIKE 4.0 INTERNATIONAL PUBLIC LICENSE",
+    "CC-BY-SA-4.0",
+  ],
+  ["CC0 1.0 UNIVERSAL", "CC0-1.0"],
+];
+
+/**
+ * Identify every license a notice grants, in the order the notice grants
+ * them. A notice can grant several: one LICENSE file holding an MIT grant and
+ * an Apache-2.0 grant (gopkg.in/yaml.v3), or a choice of licenses followed by
+ * each full text (github.com/spdx/tools-golang). A license text quotes others
+ * (the GNU GPL names the GNU Lesser GPL, the MPL names the GNU licenses), so
+ * only phrases that a grant carries count: a GNU license is found by its title
+ * standing on a line of its own, the others by a sentence of their grant.
+ * A notice none of these phrases match falls back to {@link guessLicenseId}.
+ *
+ * @param {string} content License file contents
+ * @returns {string[]} SPDX license ids or expressions; empty when none is
+ *   recognized
+ */
+export function guessLicenseIds(content) {
+  if (typeof content !== "string" || !content.trim()) {
+    return [];
+  }
+  const text = content.replace(/\s+/g, " ").toUpperCase();
+  const found = [];
+  const add = (at, id) => {
+    if (at >= 0 && id) {
+      found.push({ at, id });
+    }
+  };
+  // Walk the lines alongside `text`, so a title line is placed in it.
+  let offset = 0;
+  for (const line of content.split("\n")) {
+    const normalized = line.replace(/\s+/g, " ").trim().toUpperCase();
+    const at = normalized ? text.indexOf(normalized, offset) : -1;
+    if (at < 0) {
+      continue;
+    }
+    offset = at + normalized.length;
+    const ids = GNU_LICENSE_TITLES[normalized];
+    if (ids) {
+      const version = text
+        .slice(offset, offset + 60)
+        .match(/VERSION (\d(?:\.\d)?)/)?.[1];
+      add(at, ids[version]);
+    }
+  }
+  for (const marker of [
+    "APACHE LICENSE VERSION 2.0",
+    "APACHE LICENSE, VERSION 2.0",
+    "APACHE LICENSE 2.0",
+  ]) {
+    add(
+      text.indexOf(marker),
+      text.includes("LLVM EXCEPTION")
+        ? "Apache-2.0 WITH LLVM-exception"
+        : "Apache-2.0",
+    );
+  }
+  for (const [phrase, id] of LICENSE_GRANT_PHRASES) {
+    add(text.indexOf(phrase), id);
+  }
+  // A notice can hold several BSD texts (one per copyright holder), each read
+  // up to where the next one starts.
+  const bsdPhrase = "REDISTRIBUTION AND USE IN SOURCE AND BINARY FORMS";
+  for (
+    let bsdAt = text.indexOf(bsdPhrase);
+    bsdAt >= 0;
+    bsdAt = text.indexOf(bsdPhrase, bsdAt + bsdPhrase.length)
+  ) {
+    const nextAt = text.indexOf(bsdPhrase, bsdAt + bsdPhrase.length);
+    const clauses = text.slice(
+      bsdAt,
+      Math.min(bsdAt + 2000, nextAt < 0 ? text.length : nextAt),
+    );
+    add(
+      bsdAt,
+      clauses.includes("ALL ADVERTISING MATERIALS MENTIONING")
+        ? "BSD-4-Clause"
+        : clauses.includes("NEITHER THE NAME") ||
+            clauses.includes("THE NAME OF THE AUTHOR MAY NOT BE USED")
+          ? "BSD-3-Clause"
+          : "BSD-2-Clause",
+    );
+  }
+  const ids = [];
+  for (const { id } of found.sort((a, b) => a.at - b.at)) {
+    if (!ids.includes(id)) {
+      ids.push(id);
+    }
+  }
+  if (ids.length) {
+    return ids;
+  }
+  const guessed = guessLicenseId(content);
+  return guessed ? [guessed] : [];
+}
+
 /**
  * Method to guess the spdx license id from license contents
  *

package/lib/inventory/traceRunner.js

@@ -195,7 +195,7 @@ export function resolveSaferExecBinary() {
  * @param {boolean} [options.denyPersistenceWrites] - Deny writes to auto-execution and persistence locations
  * @param {boolean} [options.privateTmp] - Private tmpfs /tmp and /var/tmp (Linux)
  * @param {string} [options.protectHome] - Home isolation: read-only, tmpfs, or off (Linux)
- * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, proxy egress decisions, and the dry-run summary
+ * @returns {Promise<{libPaths: string[], httpAccessEntries: Object[], cryptoEntries?: Object[], cryptoComponents?: Object[], cryptoResult?: Object, egressEntries?: Object[], dryRunSummary?: Object}>} Collected libraries, HTTP URLs, crypto observations, proxy egress decisions, and the dry-run summary
  * @throws {Error} When the @cdxgen/safer-exec tracing runtime is not installed
  *   (for example after pruning it from a standalone payload), since the traced
  *   command could never run and the BOM would silently be empty
@@ -531,6 +531,9 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
         httpAccessEntries: [...collectedUrls, ...urls],
         cryptoEntries: [...collectedCrypto, ...cryptoLogs],
         cryptoComponents,
+        // The CRYPTO result from the report channel: the cipher entries carry
+        // the certificate chains servers presented (safer-exec ≥ 1.2.0).
+        cryptoResult: result?.crypto,
         egressEntries: parseEgressEntries(result.auditLog),
         dryRunSummary,
       };
@@ -541,6 +544,7 @@ export async function executeAndTrace(commandStr, workingDir, options = {}) {
       httpAccessEntries: collectedUrls,
       cryptoEntries: collectedCrypto,
       cryptoComponents,
+      cryptoResult: result?.crypto,
       egressEntries: [],
       dryRunSummary,
     };

package/lib/inventory/tracedCrypto.js

@@ -3,6 +3,11 @@ import { join } from "node:path";
 
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr } from "../core/paths.js";
+import {
+  CertificateCollector,
+  certRecordFromObservedChainEntry,
+  toWellFormedText,
+} from "./certificates.js";
 import { applyAlgorithmProperties } from "./cryptoAlgorithmFamily.js";
 
 const cryptoOids = JSON.parse(
@@ -270,6 +275,130 @@ export function normalizeTracedCryptoComponents(cbomComponents) {
   return Array.from(byRef.values());
 }
 
+// safer-exec walks at most this many certificates of one server's chain
+// (tlsobserve maxChainCerts); a longer array did not come from it, so only the
+// first entries are read.
+const MAX_CHAIN_CERTS = 10;
+
+/**
+ * The bom-ref normalizeTracedCryptoComponents gives the protocol component of
+ * a negotiated TLS version: safer-exec's CBOM names it "TLSv1.2" with the
+ * version the prefix leaves ("1.2").
+ *
+ * @param {string} protocol negotiated protocol name from the crypto result
+ * @returns {string} protocol component bom-ref
+ */
+function tracedProtocolBomRef(protocol) {
+  const name = String(protocol || "");
+  const version = name.startsWith("TLSv") ? name.slice("TLSv".length) : name;
+  return `crypto/protocol/${encodeURIComponent(name)}@${encodeURIComponent(version || "unknown")}`;
+}
+
+/**
+ * Builds the shared certificate model for the chains servers presented in TLS
+ * ≤ 1.2 handshakes, from the `chain` arrays of safer-exec's crypto result
+ * (report channel, safer-exec ≥ 1.2.0; earlier releases and TLS 1.3 entries
+ * carry no chain and yield nothing). The records go through the shared
+ * certificate collector, so bom-refs, properties and dedup match certificates
+ * found on disk. A presented chain is untrusted server input: no issuer edges
+ * are inferred from it, and the certificate and public-key components link
+ * through the collector as every producer's do. Each TLS protocol component
+ * provides the certificates and keys presented under it — the edge safer-
+ * exec's own CBOM records — which answers which servers presented a key.
+ *
+ * @param {Object} cryptoResult safer-exec CRYPTO result (`result.crypto`)
+ * @param {Set<string>} protocolRefs bom-refs of the protocol components in the BOM;
+ *   a provides edge is only emitted for a protocol that is actually present
+ * @returns {{components: Object[], dependencies: Object[]}} certificate,
+ *   public-key and algorithm components, and the protocol provides edges
+ */
+export function observedChainComponents(
+  cryptoResult,
+  protocolRefs = new Set(),
+) {
+  const collector = new CertificateCollector();
+  // Protocol name -> {certSha256, spkiSha256} pairs in presentation order,
+  // leaf first; sorted to refs at the end so the output never depends on the
+  // connection order the engine happened to report.
+  const chainEntriesByProtocol = new Map();
+  // The collector keeps the first record's fields for a certSha256, so two
+  // servers presenting one hash with conflicting text would otherwise make
+  // the name (and bom-ref) depend on connection order; sort first.
+  const ciphers = (
+    Array.isArray(cryptoResult?.ciphers) ? cryptoResult.ciphers : []
+  )
+    .map((cipher) => [JSON.stringify(cipher) ?? "", cipher])
+    .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+    .map(([, cipher]) => cipher);
+  for (const cipher of ciphers) {
+    const chain = cipher?.chain;
+    if (!Array.isArray(chain) || chain.length === 0) {
+      // safer-exec ≤ 1.1.2, or a TLS 1.3 handshake (encrypted Certificate
+      // message): no chain was observed.
+      continue;
+    }
+    const host = typeof cipher.host === "string" ? cipher.host : "";
+    for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+      const record = certRecordFromObservedChainEntry(entry, { host });
+      if (record) {
+        collector.addRecord(record);
+      }
+    }
+    // A protocol name is free text from the report channel; it only reaches a
+    // bom-ref through encodeURIComponent, so it must be well-formed.
+    const protocol = toWellFormedText(cipher.protocol);
+    if (protocol) {
+      let entries = chainEntriesByProtocol.get(protocol);
+      if (!entries) {
+        entries = [];
+        chainEntriesByProtocol.set(protocol, entries);
+      }
+      for (const entry of chain.slice(0, MAX_CHAIN_CERTS)) {
+        const certSha256 = String(entry?.certSha256 || "").toLowerCase();
+        const spkiSha256 = String(entry?.spkiSha256 || "").toLowerCase();
+        if (certSha256.length === 64) {
+          entries.push({ certSha256, spkiSha256 });
+        }
+      }
+    }
+  }
+  const { components, dependencies } = collector.build();
+  // The collector's components identify their asset by the hash in `version`
+  // (certSha256 for certificates, spkiSha256 for public keys).
+  const certRefBySha = new Map();
+  const keyRefBySpki = new Map();
+  for (const component of components) {
+    const assetType = component.cryptoProperties?.assetType;
+    if (assetType === "certificate") {
+      certRefBySha.set(component.version, component["bom-ref"]);
+    } else if (assetType === "related-crypto-material") {
+      keyRefBySpki.set(component.version, component["bom-ref"]);
+    }
+  }
+  const outputDependencies = [...dependencies];
+  for (const [protocol, entries] of chainEntriesByProtocol) {
+    const protocolRef = tracedProtocolBomRef(protocol);
+    if (!protocolRefs.has(protocolRef)) {
+      continue;
+    }
+    const provides = [
+      ...new Set(
+        entries.flatMap(({ certSha256, spkiSha256 }) => [
+          certRefBySha.get(certSha256),
+          keyRefBySpki.get(spkiSha256),
+        ]),
+      ),
+    ]
+      .filter((ref) => ref)
+      .sort();
+    if (provides.length) {
+      outputDependencies.push({ ref: protocolRef, provides });
+    }
+  }
+  outputDependencies.sort((left, right) => left.ref.localeCompare(right.ref));
+  return { components, dependencies: outputDependencies };
+}
+
 /**
  * Maps the crypto libraries safer-exec reported to the paths they were loaded
  * from.