@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/cli/cliOptions.js

@@ -19,6 +19,7 @@ import {
   METADATA_PROPERTY_CONFIG_KEYS,
   parseMetadataProperties,
 } from "../core/metadataProperties.js";
+import { toCamel } from "../core/paths.js";
 import {
   DEFAULT_CDX_SPEC_VERSION,
   normalizeCycloneDxComponentTypeFilter,
@@ -124,6 +125,106 @@ export function isUserProvided(value, yaDefault) {
   return value !== undefined && value !== yaDefault;
 }
 
+/**
+ * The value the operator gave an option on the command line or through its
+ * CDXGEN_* environment variable. yargs also fills options in from defaults
+ * and from a config file, which cannot be told apart in its output.
+ *
+ * @param {string} option kebab-case option name
+ * @param {object} [context]
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @param {boolean} [context.boolean] Read the option as a boolean flag
+ * @returns {string|boolean|undefined} The operator's value, or undefined
+ */
+export function operatorOptionChoice(
+  option,
+  { argv = process.argv.slice(2), env = process.env, boolean = false } = {},
+) {
+  const spellings = [...new Set([option, toCamel(option)])];
+  const toBoolean = (value) =>
+    ["true", "1"].includes(`${value}`.trim().toLowerCase());
+  let choice;
+  for (let i = 0; i < argv.length; i++) {
+    const arg = `${argv[i]}`;
+    if (arg === "--") {
+      break;
+    }
+    for (const name of spellings) {
+      if (boolean && arg === `--no-${name}`) {
+        choice = false;
+      } else if (arg === `--${name}`) {
+        const next = argv[i + 1] === undefined ? "" : `${argv[i + 1]}`;
+        if (!boolean) {
+          choice = next;
+          i++;
+        } else if (["true", "false"].includes(next.toLowerCase())) {
+          choice = toBoolean(next);
+          i++;
+        } else {
+          choice = true;
+        }
+      } else if (arg.startsWith(`--${name}=`)) {
+        const value = arg.slice(name.length + 3);
+        choice = boolean ? toBoolean(value) : value;
+      }
+    }
+  }
+  if (choice !== undefined) {
+    return choice;
+  }
+  const envValue =
+    env[`CDXGEN_${option.toUpperCase().replaceAll("-", "_")}`] ?? "";
+  if (`${envValue}`.trim() === "") {
+    return undefined;
+  }
+  return boolean ? toBoolean(envValue) : `${envValue}`;
+}
+
+/**
+ * Make the operator's choice about running the scanned project's own code
+ * final. A config file is read from the working directory, which is usually
+ * the scanned project, so it carries that project's trust. Neither the config
+ * file nor a profile or lifecycle may turn installs on when the operator
+ * disabled them, and secure mode keeps installs off unless the operator
+ * passes --install-deps. Introspection keeps the project's build tools
+ * running with installs off, which is likewise the operator's decision, so
+ * introspection asked for only by the config file does not do that.
+ *
+ * **Mutates `options` in place.**
+ *
+ * @param {object} options The options object, after applyAdvancedOptions
+ * @param {object} [context]
+ * @param {object} [context.projectConfig] Sanitized config file contents
+ * @param {boolean} [context.isSecureMode] Whether cdxgen runs in secure mode
+ * @param {string[]} [context.argv] Raw command-line arguments
+ * @param {object} [context.env] Environment variables
+ * @returns {void}
+ */
+export function applyOperatorToolingChoice(options, context = {}) {
+  const { projectConfig, argv, env } = context;
+  const secureMode = context.isSecureMode ?? isSecureMode;
+  const installChoice = operatorOptionChoice("install-deps", {
+    argv,
+    env,
+    boolean: true,
+  });
+  if (installChoice === false || (secureMode && installChoice !== true)) {
+    options.installDeps = false;
+  }
+  const configAsksIntrospect =
+    ["true", "1"].includes(`${projectConfig?.introspect}`.toLowerCase()) ||
+    projectConfig?.profile === "introspect";
+  if (
+    options.introspect === true &&
+    configAsksIntrospect &&
+    operatorOptionChoice("introspect", { argv, env, boolean: true }) !== true &&
+    operatorOptionChoice("profile", { argv, env }) !== "introspect"
+  ) {
+    options.introspectFromConfigFile = true;
+  }
+}
+
 /**
  * Combine the custom metadata properties of every source (discussion 4391):
  * the `--metadata-property` flag, the CDXGEN_METADATA_PROPERTY and
@@ -588,7 +689,9 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = false;
       options.includeCrypto = false;
-      options.installDeps = !secureMode;
+      // A profile may skip installs but never turn them back on once they
+      // were disabled, which would run the scanned project's code.
+      options.installDeps = !secureMode && options.installDeps !== false;
       break;
     case "deep-learning":
     case "ml-deep":
@@ -596,7 +699,7 @@ export function applyAdvancedOptions(options, context = {}) {
       options.deep = true;
       options.evidence = true;
       options.includeCrypto = true;
-      options.installDeps = !secureMode;
+      options.installDeps = !secureMode && options.installDeps !== false;
       options.bomAudit = true;
       break;
     default:
@@ -619,7 +722,11 @@ export function applyAdvancedOptions(options, context = {}) {
             "PREVIEW: post-build lifecycle SBOM generation is supported only for limited project types.",
         });
       }
-      options.installDeps = true;
+      // The project is already built, so installs are on only where they
+      // would have been anyway: a disabled install stays disabled.
+      if (options.installDeps !== false) {
+        options.installDeps = true;
+      }
       break;
     default:
       break;

package/lib/cli/index.js

@@ -51,6 +51,7 @@ import {
   getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
 import { optionIncludesAiInventoryProjectType } from "../inventory/aiInventory.js";
+import { readApkInstalledDb } from "../inventory/apkInstalledDb.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   mergeDependencies,
@@ -58,7 +59,10 @@ import {
   trimComponents,
 } from "../inventory/depsUtils.js";
 import { buildDynamicComponents } from "../inventory/dynamic.js";
-import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  convertApkPackages,
+  convertOSQueryResults,
+} from "../inventory/evidenceUtils.js";
 import {
   createHbomDocument,
   ensureHbomRuntimeSupport,
@@ -67,6 +71,7 @@ import {
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
 import { orderParentCandidates } from "../inventory/parentSelection.js";
+import { probeHostPhp } from "../inventory/phpHostProbe.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
@@ -86,6 +91,7 @@ import {
   exportArchive,
   exportImage,
   getPkgPathList,
+  isFollowableManifestImage,
   isImageReference,
   parseImageName,
 } from "../managers/docker.js";
@@ -272,6 +278,37 @@ export function createOSBom(_path, options) {
       );
     }
   } // for
+  // osquery has no apk table, so the packages of an Alpine, Wolfi or Chainguard
+  // host come from the apk installed database, after the osquery categories and
+  // as a category of their own. They are all components: the OS itself is the
+  // first row of the first osquery category, as before.
+  if (_platform() === "linux") {
+    const apkInventory = readApkInstalledDb();
+    if (apkInventory.state === "unreadable") {
+      recordDegradation("os.apk-installed-db.unreadable", {
+        ecosystem: "generic",
+        tool: "apk",
+        impact: "components",
+        path: apkInventory.path,
+        detail:
+          "The apk installed database exists but could not be read in full, so the packages it lists are missing from the OBOM.",
+      });
+    }
+    if (apkInventory.packages.length) {
+      pkgList = pkgList.concat(
+        convertApkPackages(apkInventory.packages).sort((a, b) =>
+          a.name.localeCompare(b.name),
+        ),
+      );
+    }
+  }
+  // The package tables cannot see a PHP that no package manager installed. Its
+  // edges stay out: an OBOM has no dependency graph, and a partial one makes
+  // post-processing infer the OS root's dependencies from these files alone.
+  const hostPhp = probeHostPhp({ executeOsQuery, packageComponents: pkgList });
+  if (hostPhp.components.length) {
+    pkgList = pkgList.concat(hostPhp.components);
+  }
   const hostTrustInventory = enrichOSComponentsWithTrustData(pkgList);
   if (hostTrustInventory?.components?.length) {
     pkgList = hostTrustInventory.components;
@@ -515,11 +552,14 @@ export async function createContainerSpecLikeBom(path, options) {
             if (imageBomData?.bomJson?.components) {
               components = components.concat(imageBomData.bomJson.components);
             }
+            doneimages.push(img.image);
+            if (!isFollowableManifestImage(img.image, imageObj)) {
+              continue;
+            }
             const bomData = await createBom(img.image, {
               specVersion: options.specVersion,
               projectType: ["oci"],
             });
-            doneimages.push(img.image);
             if (bomData) {
               if (bomData.components?.length) {
                 // Inject properties
@@ -734,6 +774,7 @@ export async function createMultiXBom(pathList, options) {
   let dependencies = [];
   let bomData;
   let formulationList = [];
+  let metadataProperties = [];
   let parentComponent = determineParentComponent(options) || {};
   let parentSubComponents = [];
   const setProjectTypeActivityContext = (projectType, sourcePath) => {
@@ -867,6 +908,7 @@ export async function createMultiXBom(pathList, options) {
         dependencies: [],
         options: { ...sharedOptions },
         parentSubComponents: [],
+        metadataProperties: [],
       };
     }
   };
@@ -879,6 +921,7 @@ export async function createMultiXBom(pathList, options) {
     let components = [];
     let dependencies = [];
     let parentSubComponents = [];
+    let metadataProperties = [];
     // Each builder detects the project of its own ecosystem. A builder that sets
     // options.parentComponent to force its project into its own BOM must not
     // make that project the next builder's too, or the next ecosystem's project
@@ -1163,6 +1206,12 @@ export async function createMultiXBom(pathList, options) {
       }
       setProjectTypeActivityContext("php", path);
       bomData = await withOwnParent(() => createPHPBom(path, options));
+      // A lock with no packages can still hold the project's platform data.
+      if (bomData?.metadataProperties?.length) {
+        metadataProperties = metadataProperties.concat(
+          bomData.metadataProperties,
+        );
+      }
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} php packages.`,
@@ -1236,7 +1285,12 @@ export async function createMultiXBom(pathList, options) {
       }
       setProjectTypeActivityContext("csharp", path);
       bomData = await withOwnParent(() => createCsharpBom(path, options));
-      if (bomData?.bomJson?.components?.length) {
+      // Every project the scan read has a dependency entry of its own, so a
+      // project that uses no packages is kept along with its parent.
+      if (
+        bomData?.bomJson?.components?.length ||
+        bomData?.bomJson?.dependencies?.length
+      ) {
         thoughtLog(
           `There are ${bomData.bomJson.components.length} csharp packages.`,
         );
@@ -1753,9 +1807,18 @@ export async function createMultiXBom(pathList, options) {
           );
         }
         components = components.concat(bomData.bomJson.components);
+        if (bomData.dependencies?.length) {
+          dependencies = mergeDependencies(dependencies, bomData.dependencies);
+        }
       }
     }
-    return { components, dependencies, options, parentSubComponents };
+    return {
+      components,
+      dependencies,
+      options,
+      parentSubComponents,
+      metadataProperties,
+    };
   };
   const pathResults = [];
   // A container scan walks hundreds of paths, so the phase carries a bar and
@@ -1818,6 +1881,9 @@ export async function createMultiXBom(pathList, options) {
     parentSubComponents = parentSubComponents.concat(
       pathResult.parentSubComponents,
     );
+    metadataProperties = metadataProperties.concat(
+      pathResult.metadataProperties,
+    );
     if (pathResult.options.services?.length) {
       sharedOptions.services = mergeServices(
         sharedOptions.services || [],
@@ -1907,6 +1973,7 @@ export async function createMultiXBom(pathList, options) {
     components,
     parentComponent,
     dependencies,
+    metadataProperties,
   );
   if (formulationList.length) {
     multiResult.formulationList = formulationList;
@@ -1978,6 +2045,7 @@ export async function createDynamicBom(path, options) {
   const {
     components: pkgList,
     services: traceServices,
+    dependencies: traceDependencies,
     dryRunSummary,
   } = await buildDynamicComponents(commandStr, workingDir, traceOptions);
 
@@ -1986,6 +2054,7 @@ export async function createDynamicBom(path, options) {
     projectType: "dynamic",
     filename: commandStr,
     services: traceServices,
+    dependencies: traceDependencies || [],
   });
   // A dry run denies every side effect, so the attempted-operation counts are
   // the result. Only counts are recorded, never the paths or targets.

package/lib/cli/jvmBom.js

@@ -7,11 +7,7 @@ import process from "node:process";
 import { build } from "@cdxgen/cdx-purl";
 import { gte, lte } from "semver";
 
-import {
-  DEBUG_MODE,
-  isSecureMode,
-  readEnvironmentVariable,
-} from "../core/activity.js";
+import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
 import { commandOutputText, recordDegradation } from "../core/buildLedger.js";
 import {
   deferFailOnError,
@@ -39,6 +35,10 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr } from "../core/paths.js";
+import {
+  isSecureModeActive,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import { extractJarArchive, getMvnMetadata } from "../ecosystems/ecosystems.js";
 import {
   buildGradleCommandArguments,
@@ -51,6 +51,7 @@ import {
   getMillCommand,
   getMillVersion,
   hasGradleInvocationFailure,
+  isProjectToolingAllowed,
   parseGradleDep,
   parseGradleInfoLogsForUrls,
   parseGradleProperties,
@@ -72,6 +73,7 @@ import {
   parseMavenTreeJson,
   parseMillDependency,
   parsePom,
+  parsePomWithLocalParents,
   readMavenModuleTrees,
 } from "../ecosystems/parsers-jvm.js";
 import {
@@ -495,6 +497,63 @@ export function discoverSbtProjectsFromCmd(
   return discoverSbtProjects(basePath);
 }
 
+/**
+ * Read one pom.xml without running Maven: the module it declares and its
+ * direct dependencies. Versions resolve from the pom's properties and
+ * dependencyManagement and from parent poms inside the scanned directory.
+ * Versions that an imported BOM or a parent outside the directory manages
+ * stay empty, and transitive dependencies are unknown.
+ *
+ * No dependency edges are produced. The build-fidelity rules (BF-JVM-001,
+ * BF-GEN-001) recognise a pom read without Maven by its missing graph, and a
+ * graph of direct edges alone would pass for a resolved one.
+ *
+ * @param {string} pomFile pom.xml to read
+ * @param {string} rootPath Scanned directory
+ * @param {Map} [cache] Parent pom results shared by the poms of one scan
+ * @returns {{moduleComponent: Object|undefined, pkgList: Object[]}}
+ */
+export function readMavenModuleStatically(pomFile, rootPath, cache) {
+  let pomMap;
+  try {
+    pomMap = parsePomWithLocalParents(pomFile, rootPath, cache);
+  } catch (_err) {
+    return { moduleComponent: undefined, pkgList: [] };
+  }
+  const pkgList = [];
+  for (const dep of pomMap?.dependencies || []) {
+    const purl = mavenPurl(
+      dep.group || undefined,
+      dep.name,
+      dep.version || undefined,
+      dep.qualifiers,
+    );
+    pkgList.push(
+      purl ? { ...dep, purl, "bom-ref": decodeURIComponent(purl) } : dep,
+    );
+  }
+  const { artifactId, groupId, packaging, version } = pomMap?.properties || {};
+  const modulePurl = artifactId
+    ? mavenPurl(groupId || undefined, artifactId, version || undefined, {
+        type: packaging || "jar",
+      })
+    : undefined;
+  if (!modulePurl) {
+    return { moduleComponent: undefined, pkgList };
+  }
+  const moduleComponent = {
+    group: groupId || "",
+    name: artifactId,
+    version: version || "",
+    qualifiers: { type: packaging || "jar" },
+    type: "application",
+    purl: modulePurl,
+    "bom-ref": decodeURIComponent(modulePurl),
+    properties: [{ name: "internal:SrcFile", value: pomFile }],
+  };
+  return { moduleComponent, pkgList };
+}
+
 /**
  * Function to create bom string for Java projects
  *
@@ -654,6 +713,55 @@ export async function createJavaBom(path, options) {
       }
       const firstPom = pomFiles.length ? pomFiles[0] : undefined;
       let mavenCmd = getMavenCommand(path, path, options);
+      // Executing Maven evaluates the pom's build section, loads `.mvn/`
+      // configuration such as jvm.config or extensions.xml, and resolves
+      // build extensions, so it belongs to the dependency-tooling surface
+      // disabled by --no-install-deps and the pre-build lifecycle. The scan
+      // then keeps only the direct dependencies each pom declares.
+      const mavenToolingAllowed = isProjectToolingAllowed(options);
+      if (!mavenToolingAllowed) {
+        reportProjectToolingSkipped(
+          options,
+          "jvm.maven.tooling-disabled",
+          "Skipping Maven since dependency installation is disabled. Only the direct dependencies declared in pom.xml files will be used.",
+          {
+            ecosystem: "java",
+            tool: "maven",
+            impact: "transitive-deps",
+            detail:
+              "Dependency installation is disabled, so Maven was not run and only the direct dependencies parsed from pom.xml are available.",
+          },
+        );
+      }
+      // Poms read without Maven: what their local parents define is shared
+      // across the scan, and each pom adds its module and direct dependencies.
+      const staticPomCache = new Map();
+      const addStaticMavenModule = (pomFile) => {
+        const staticModule = readMavenModuleStatically(
+          pomFile,
+          path,
+          staticPomCache,
+        );
+        if (staticModule.pkgList.length) {
+          pkgList = pkgList.concat(staticModule.pkgList);
+        }
+        const moduleComponent = staticModule.moduleComponent;
+        if (!moduleComponent) {
+          return;
+        }
+        if (!Object.keys(parentComponent).length) {
+          parentComponent = moduleComponent;
+          parentComponent.components = [];
+        } else if (
+          parentComponent["bom-ref"] !== moduleComponent["bom-ref"] &&
+          !parentComponent.components?.some(
+            (c) => c["bom-ref"] === moduleComponent["bom-ref"],
+          )
+        ) {
+          parentComponent.components = parentComponent.components || [];
+          parentComponent.components.push(moduleComponent);
+        }
+      };
       // Pom files whose own tree a recursive run of their aggregator already
       // returned. Each is skipped when its turn comes, so a reactor is run
       // once from its aggregator instead of once per member.
@@ -668,6 +776,12 @@ export async function createJavaBom(path, options) {
           }
           continue;
         }
+        // Without Maven every pom is read on its own, Quarkus modules too:
+        // the plugin run that would have covered them does not happen.
+        if (!mavenToolingAllowed) {
+          addStaticMavenModule(f);
+          continue;
+        }
         if (
           isQuarkus &&
           !options.deep &&
@@ -688,10 +802,7 @@ export async function createJavaBom(path, options) {
               `Parsing ${f} without Maven: the repository rate limited Maven in this scan.`,
             );
           }
-          const dlist = parsePom(f)?.dependencies || [];
-          if (dlist.length) {
-            pkgList = pkgList.concat(dlist);
-          }
+          addStaticMavenModule(f);
           continue;
         }
         if (mavenCmd?.endsWith("mvn")) {
@@ -701,7 +812,7 @@ export async function createJavaBom(path, options) {
         // user's own settings.xml, with its mirrors and credentials, still
         // applies on top of it.
         const projectSettings = projectSettingsArgs(basePath, {
-          secureMode: isSecureMode,
+          secureMode: isSecureModeActive(),
         });
         if (projectSettings.args.length) {
           console.log(
@@ -1031,11 +1142,7 @@ export async function createJavaBom(path, options) {
               thoughtLog(
                 "**MAVEN**: There appear to be build errors, so the SBOM will be incomplete.",
               );
-              const pomMap = parsePom(f);
-              const dlist = pomMap?.dependencies || [];
-              if (dlist.length) {
-                pkgList = pkgList.concat(dlist);
-              }
+              addStaticMavenModule(f);
             } else {
               // The text trees exist only when the JSON run failed and was
               // retried. Each reactor module has its own tree, and a member
@@ -1312,8 +1419,7 @@ export async function createJavaBom(path, options) {
       // `gradle properties` evaluates the project's build scripts, so it is
       // part of the dependency-tooling surface gated by --no-install-deps
       // (and the pre-build lifecycle).
-      const gradleToolingAllowed =
-        options.installDeps !== false || options.introspect === true;
+      const gradleToolingAllowed = isProjectToolingAllowed(options);
       if (gradleToolingAllowed) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
@@ -1941,7 +2047,7 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         }
-      } else if (options.installDeps === false && !options.introspect) {
+      } else if (!isProjectToolingAllowed(options)) {
         // Executing sbt evaluates the project's build definition (arbitrary
         // Scala), so it belongs to the dependency-tooling surface disabled
         // by --no-install-deps and the pre-build lifecycle.
@@ -2363,7 +2469,7 @@ export async function createJavaBom(path, options) {
 
     if (
       millFiles?.length &&
-      (options.installDeps !== false || options.introspect === true) &&
+      isProjectToolingAllowed(options) &&
       isPackageManagerAllowed(
         "mill",
         ["bazel", "sbt", "gradle", "maven"],
@@ -2572,7 +2678,7 @@ export async function createJavaBom(path, options) {
   } finally {
     // A build this scan ran can have started a Mill daemon of its own
     // without --no-server; stop those even when a later step failed.
-    stopMillDaemons(path, millDaemonsBefore);
+    stopMillDaemons(path, millDaemonsBefore, options);
   }
   // A Scala.js build bundles npm packages: scalajs-bundler installs them
   // under target, and a bundler workspace keeps its lock file beside the