@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/cli/nativeBom.js

@@ -23,11 +23,16 @@ import {
 import {
   checksumFile,
   getAllFiles,
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { dirNameStr, isMac } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import { readCrateArchiveValues } from "../ecosystems/cargoCache.js";
 import {
   buildDependentPurl,
@@ -40,7 +45,12 @@ import {
   emptyCppBuildContext,
   resolveCppBuildContext,
 } from "../ecosystems/cppBuildContext.js";
-import { getCppModules, hasCppSources } from "../ecosystems/cppEvidence.js";
+import {
+  getCppModules,
+  hasCppSources,
+  installedVcpkgPorts,
+  parseVcpkgManifest,
+} from "../ecosystems/cppEvidence.js";
 import {
   getCratesMetadata,
   getSwiftPackageMetadata,
@@ -55,6 +65,7 @@ import {
 } from "../ecosystems/parsers-elm.js";
 import { parseGleamProject } from "../ecosystems/parsers-gleam.js";
 import {
+  compareGoVersions,
   isGoModWhyNotNeeded,
   parseGoListDep,
   parseGoModData,
@@ -126,6 +137,10 @@ import { resolveZigGraph } from "../ecosystems/zigResolver.js";
 import { cmakeBuildDirCandidates } from "../inventory/cmakeBuildDirs.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  clojureMirrorArgs,
+  leiningenMirrorArgs,
+} from "../inventory/mavenCentralMirror.js";
 import { applyPurl, nixBomRef, tryBuildPurl } from "../inventory/purl.js";
 import {
   classifyProbeResult,
@@ -198,6 +213,30 @@ export function getCargoCacheDir() {
       );
 }
 
+/**
+ * Add a Go module of the project, a nested go.mod or a go.work member, under
+ * the parent component. A module that is already the parent, one of its
+ * subcomponents, or a component (a directory replacement inside the project)
+ * is not added again, so no bom-ref appears twice.
+ *
+ * @param {Object} parentComponent The project's parent component
+ * @param {Object} moduleComponent The module to add
+ * @param {Object[]} pkgList Components found so far
+ */
+function addGoSubComponent(parentComponent, moduleComponent, pkgList) {
+  const ref = moduleComponent?.["bom-ref"];
+  if (
+    !ref ||
+    ref === parentComponent["bom-ref"] ||
+    parentComponent.components?.some((c) => c["bom-ref"] === ref) ||
+    pkgList.some((c) => c["bom-ref"] === ref)
+  ) {
+    return;
+  }
+  parentComponent.components = parentComponent.components || [];
+  parentComponent.components.push(moduleComponent);
+}
+
 /**
  * Function to create bom string for Go projects
  *
@@ -313,6 +352,20 @@ export async function createGoBom(path, options) {
         }
       }
     }
+    // go mod why answers for a module path, but go.sum also names versions
+    // that only took part in version selection. Only a version whose content
+    // go.sum holds a checksum for was ever downloaded, and of those, MVS
+    // builds the highest.
+    const builtVersions = {};
+    for (const apkg of pkgList) {
+      const built = builtVersions[apkg.name];
+      if (
+        apkg._integrity &&
+        (!built || compareGoVersions(apkg.version, built) > 0)
+      ) {
+        builtVersions[apkg.name] = apkg.version;
+      }
+    }
     // A module go reports as unneeded is optional, but only when every module
     // was checked: once go mod why fails, the answers are incomplete, and a
     // tool failure is not evidence that a module is unused.
@@ -321,7 +374,9 @@ export async function createGoBom(path, options) {
         continue;
       }
       if (requiredModules.has(apkg.name)) {
-        apkg.scope = "required";
+        if (builtVersions[apkg.name] === apkg.version) {
+          apkg.scope = "required";
+        }
       } else if (!circuitBreak && unneededModules.has(apkg.name)) {
         apkg.scope = "optional";
       }
@@ -384,6 +439,9 @@ export async function createGoBom(path, options) {
     });
 
     let rootParentComponent = null;
+    // Whether the go toolchain resolved a module graph. A module without
+    // dependencies resolves to no components, and that is a complete answer.
+    let resolvedByToolchain = false;
     // Use the go list -deps and go mod why commands to generate a good quality BOM for non-docker invocations
     if (
       !hasAnyProjectType(["docker", "oci", "container", "os"], options, false)
@@ -403,13 +461,15 @@ export async function createGoBom(path, options) {
           console.log("Executing go list -deps in", basePath);
         }
         // TODO: Replacing this with -json gives us more interesting data points such as GoFiles, Imports, and Deps
+        // The fields after Dir name the module content checksum and, for a
+        // module a replace directive swapped out, the replacement Go builds.
         let result = safeSpawnSync(
           "go",
           [
             "list",
             "-deps",
             "-f",
-            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}{{end}}'",
+            "'{{with .Module}}{{.Path}}|{{.Version}}|{{.Indirect}}|{{.GoMod}}|{{.GoVersion}}|{{.Main}}|{{.Time}}|{{.Deprecated}}|{{.GoModSum}}|{{.Dir}}|{{.Sum}}|{{with .Replace}}{{.Path}}{{end}}|{{with .Replace}}{{.Version}}{{end}}|{{with .Replace}}{{.Sum}}{{end}}{{end}}'",
             "./...",
           ],
           {
@@ -453,7 +513,9 @@ export async function createGoBom(path, options) {
         const stdout = result.stdout;
         if (stdout) {
           let cmdOutput = Buffer.from(stdout).toString();
-          const retMap = await parseGoListDep(cmdOutput, gosumMap);
+          const retMap = await parseGoListDep(cmdOutput, gosumMap, {
+            mainModuleDir: basePath,
+          });
           if (retMap.pkgList?.length) {
             pkgList = pkgList.concat(retMap.pkgList);
           }
@@ -462,6 +524,7 @@ export async function createGoBom(path, options) {
             retMap.parentComponent &&
             Object.keys(retMap.parentComponent).length
           ) {
+            resolvedByToolchain = true;
             if (!rootParentComponent) {
               // First (shallowest) module becomes the root
               rootParentComponent = retMap.parentComponent;
@@ -469,12 +532,18 @@ export async function createGoBom(path, options) {
               parentComponent = rootParentComponent;
             } else {
               // Subsequent modules become subcomponents
-              if (!parentComponent.components) {
-                parentComponent.components = [];
-              }
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
+          // The other members of a go.work workspace are modules of the same
+          // project, which no registry holds.
+          for (const workspaceModule of retMap.workspaceModules || []) {
+            addGoSubComponent(parentComponent, workspaceModule, pkgList);
+          }
           if (DEBUG_MODE) {
             console.log("Executing go mod graph in", basePath);
           }
@@ -524,8 +593,11 @@ export async function createGoBom(path, options) {
             }
             // Retain the parent component hierarchy
             if (Object.keys(retMap.parentComponent).length) {
-              parentComponent.components = parentComponent.components || [];
-              parentComponent.components.push(retMap.parentComponent);
+              addGoSubComponent(
+                parentComponent,
+                retMap.parentComponent,
+                pkgList,
+              );
             }
           }
         } else {
@@ -538,6 +610,7 @@ export async function createGoBom(path, options) {
             shell: isWin,
           });
           if (result.stdout) {
+            resolvedByToolchain = true;
             const cmdOutput = Buffer.from(result.stdout).toString();
             // The arguments to parseGoModGraph are slightly different to force inclusion of all packages
             const retMap = await parseGoModGraph(
@@ -566,8 +639,11 @@ export async function createGoBom(path, options) {
                 parentComponent = rootParentComponent;
               } else {
                 // Subsequent modules become subcomponents
-                parentComponent.components = parentComponent.components || [];
-                parentComponent.components.push(retMap.parentComponent);
+                addGoSubComponent(
+                  parentComponent,
+                  retMap.parentComponent,
+                  pkgList,
+                );
               }
             }
           } else {
@@ -589,7 +665,7 @@ export async function createGoBom(path, options) {
           }
         }
       }
-      if (pkgList.length && !shouldManuallyParse) {
+      if ((pkgList.length || resolvedByToolchain) && !shouldManuallyParse) {
         return buildBomNSData(options, pkgList, "golang", {
           dependencies,
           parentComponent,
@@ -732,11 +808,19 @@ function cargoAnswersVersion(cwd) {
  * @param {string} [filterPlatform] Target triple to resolve the graph for
  * @returns {object|undefined} Parsed `cargo metadata` output
  */
-function runCargoMetadata(cargoTomlFile, filterPlatform) {
-  const basePath = dirname(cargoTomlFile);
+function runCargoMetadata(cargoTomlFile, filterPlatform, options = {}) {
+  // cargo reads `.cargo/config.toml` (rustc, rustc-wrapper, [env]) and rustup
+  // reads `rust-toolchain.toml` from the working directory, and `cargo
+  // metadata` runs rustc to learn the target. Without permission to run the
+  // project's tooling, cargo starts outside the project and stays offline.
+  const toolingAllowed = isProjectToolingAllowed(options);
+  const basePath = toolingAllowed ? dirname(cargoTomlFile) : getTmpDir();
   const platformArgs = filterPlatform
     ? ["--filter-platform", filterPlatform]
     : [];
+  if (!toolingAllowed) {
+    platformArgs.push("--offline");
+  }
   // `--locked` keeps the user's lock file untouched; a workspace that is out of
   // date with its lock file needs the retry without it.
   for (const lockArgs of [["--locked"], []]) {
@@ -810,7 +894,7 @@ function annotateCargoDependencyKinds(
     let anyMetadata = false;
     let everyMetadata = true;
     for (const cargoTomlFile of cargoFiles) {
-      const metadata = runCargoMetadata(cargoTomlFile);
+      const metadata = runCargoMetadata(cargoTomlFile, undefined, options);
       if (!metadata) {
         everyMetadata = false;
         continue;
@@ -824,7 +908,11 @@ function annotateCargoDependencyKinds(
       visitedWorkspaceRoots.add(workspaceRoot);
       anyMetadata = true;
       if (CARGO_TARGET) {
-        const targetMetadata = runCargoMetadata(cargoTomlFile, CARGO_TARGET);
+        const targetMetadata = runCargoMetadata(
+          cargoTomlFile,
+          CARGO_TARGET,
+          options,
+        );
         if (targetMetadata) {
           for (const key of parseCargoMetadataResolve(targetMetadata)
             .resolvedKeys) {
@@ -962,13 +1050,31 @@ export async function createRustBom(path, options) {
     `${options.multiProject ? "**/" : ""}Cargo.toml`,
     options,
   );
+  // `cargo check` compiles the project, running its build scripts and
+  // procedural macros, so --deep runs it only when the project's own tooling
+  // may run.
+  const cargoToolingAllowed = isProjectToolingAllowed(options);
+  if (
+    options.deep &&
+    cargoFiles.length &&
+    !cargoToolingAllowed &&
+    !hasAnyProjectType(["oci"], options, false)
+  ) {
+    reportProjectToolingSkipped(
+      options,
+      null,
+      "Skipping 'cargo check' since dependency installation is disabled. Build scripts and procedural macros are not run, so the files each crate uses are not recorded.",
+    );
+  }
   // Attempt to build or generate lock files automatically
   for (const f of cargoFiles) {
     // If there are no cargo.lock files, we can attempt a cargo install when
     //    options.deep is true or options.lifecycle == build or post-build with installDeps
     // Why the need for installDeps? It currently defaults to true, so let's obey if someone wants no installs
     if (
-      (options.deep && !hasAnyProjectType(["oci"], options, false)) ||
+      (options.deep &&
+        cargoToolingAllowed &&
+        !hasAnyProjectType(["oci"], options, false)) ||
       (options.installDeps &&
         !safeExistsSync(f.replace(".toml", ".lock")) &&
         ["build", "post-build"].includes(options.lifecycle))
@@ -1709,10 +1815,33 @@ export function createCppBom(path, options) {
   // The need for java >= 21 with atom is causing confusions since there could be C projects
   // inside of other project types. So we currently limit this analyis only when -t argument
   // is used.
-  if (
-    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
-    (!options.createMultiXBom || options.deep)
-  ) {
+  if (!isImageScan && options.createMultiXBom && !options.deep) {
+    // The atom analysis below is skipped in this mode, but a vcpkg manifest is
+    // read without running anything, and its declared ports are as much a
+    // part of the project as CMake's find_package names.
+    const manifest = parseVcpkgManifest(path, {
+      installedPorts: installedVcpkgPorts(path, options),
+      isListed: (name) =>
+        pkgList.some(
+          (p) => !p.group && p.name?.toLowerCase() === `${name}`.toLowerCase(),
+        ),
+    });
+    if (manifest.pkgList.length) {
+      pkgList = pkgList.concat(manifest.pkgList);
+      if (!parentComponent && manifest.parentComponent) {
+        parentComponent = manifest.parentComponent;
+      }
+      if (parentComponent?.["bom-ref"]) {
+        dependencies = mergeDependencies(dependencies, [
+          {
+            ref: parentComponent["bom-ref"],
+            dependsOn: manifest.pkgList.map((p) => p["bom-ref"]),
+          },
+        ]);
+      }
+    }
+  }
+  if (!isImageScan && (!options.createMultiXBom || options.deep)) {
     let osPkgsList = [];
     // Case 1: Development libraries installed in this OS environment might be used for build
     // We collect OS packages with the word dev in the name using osquery here
@@ -1870,11 +1999,39 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("LEIN_ARGS")) {
       LEIN_ARGS = readEnvironmentVariable("LEIN_ARGS").split(" ");
     }
+    const leinProjectContent = safeExistsSync(leinFiles[0])
+      ? readFileSync(leinFiles[0], { encoding: "utf-8" })
+      : undefined;
+    LEIN_ARGS = leiningenMirrorArgs(LEIN_ARGS, leinProjectContent);
+    // `lein deps :tree-data` evaluates project.clj, which is a Clojure
+    // program, so it belongs to the dependency-tooling surface disabled by
+    // --no-install-deps and the pre-build lifecycle.
+    const leinToolingAllowed = isProjectToolingAllowed(options);
     for (const f of leinFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
       const basePath = dirname(f);
+      if (!leinToolingAllowed) {
+        reportProjectToolingSkipped(
+          options,
+          "clojure.lein.tooling-disabled",
+          "Skipping 'lein deps :tree-data' since dependency installation is disabled. Only the dependencies declared in project.clj will be used.",
+          {
+            ecosystem: "clojure",
+            tool: "lein",
+            impact: "transitive-deps",
+            detail:
+              "Dependency installation is disabled, so project.clj was not evaluated and only its directly declared dependencies are available.",
+          },
+        );
+        const leinData = readFileSync(f, { encoding: "utf-8" });
+        const dlist = parseLeiningenData(leinData);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+        continue;
+      }
       console.log("Executing", LEIN_CMD, "in", basePath);
       const result = safeSpawnSync(LEIN_CMD, LEIN_ARGS, {
         cwd: basePath,
@@ -1937,6 +2094,7 @@ export function createClojureBom(path, options) {
     if (readEnvironmentVariable("CLJ_ARGS")) {
       CLJ_ARGS = readEnvironmentVariable("CLJ_ARGS").split(" ");
     }
+    CLJ_ARGS = clojureMirrorArgs(CLJ_ARGS);
     for (const f of ednFiles) {
       const basePath = dirname(f);
       console.log("Executing", CLJ_CMD, "in", basePath);
@@ -2235,7 +2393,39 @@ export async function createSwiftBom(path, options) {
     );
   }
   if (swiftFiles.length) {
+    // A SwiftPM manifest is a Swift program, so `swift package dump-package`
+    // and `show-dependencies` execute the scanned project's code (and fetch
+    // missing dependencies). They belong to the dependency-tooling surface
+    // disabled by --no-install-deps and the pre-build lifecycle; the BOM then
+    // comes from Package.resolved alone.
+    const swiftToolingAllowed = isProjectToolingAllowed(options);
+    if (!swiftToolingAllowed) {
+      reportProjectToolingSkipped(
+        options,
+        "swift.tooling-disabled",
+        "Skipping 'swift package show-dependencies' since dependency installation is disabled. Only the packages in Package.resolved will be used.",
+        {
+          ecosystem: "swift",
+          tool: "swift",
+          impact: "transitive-deps",
+          detail:
+            "Dependency installation is disabled, so the Package.swift manifest was not evaluated and only the packages from Package.resolved are available.",
+        },
+      );
+      // The manifest is not run, so a project without Package.resolved still
+      // gets a parent component named after its directory.
+      if (!Object.keys(parentComponent).length) {
+        parentComponent = createDefaultParentComponent(
+          swiftFiles[0],
+          "swift",
+          options,
+        );
+      }
+    }
     for (const f of swiftFiles) {
+      if (!swiftToolingAllowed) {
+        break;
+      }
       const basePath = dirname(f);
       if (completedPath.includes(basePath)) {
         continue;
@@ -2461,10 +2651,33 @@ export async function createCocoaBom(path, options) {
       allDependencies.set(name, podDependencies);
     }
     const targetDependencies = new Map();
-    if (
-      !readEnvironmentVariable("COCOA_INCLUDED_TARGETS") &&
-      !readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
-    ) {
+    // `pod ipc podfile-json` evaluates the Podfile, which is a Ruby program,
+    // so per-target filtering through it belongs to the dependency-tooling
+    // surface disabled by --no-install-deps and the pre-build lifecycle. A
+    // gated scan then keeps every pod the lockfile resolved (the union across
+    // targets) instead of the configured target subset.
+    const cocoaTargetsConfigured =
+      readEnvironmentVariable("COCOA_INCLUDED_TARGETS") ||
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS");
+    const cocoaToolingAllowed = isProjectToolingAllowed(options);
+    // True only when target names the Podfile actually resolved are known, so
+    // the include/exclude filters below can be applied to real targets.
+    let targetFilteringActive = false;
+    if (!cocoaTargetsConfigured || !cocoaToolingAllowed) {
+      if (cocoaTargetsConfigured) {
+        reportProjectToolingSkipped(
+          options,
+          "cocoa.podfile-json.tooling-disabled",
+          "Skipping 'pod ipc podfile-json' since dependency installation is disabled. Every pod from Podfile.lock is included without per-target filtering.",
+          {
+            ecosystem: "cocoa",
+            tool: "pod",
+            impact: "components",
+            detail:
+              "Dependency installation is disabled, so the Podfile was not evaluated and target filtering fell back to all pods resolved in Podfile.lock.",
+          },
+        );
+      }
       targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
     } else {
       const result = executePodCommand(
@@ -2472,18 +2685,39 @@ export async function createCocoaBom(path, options) {
         projectPath,
         options,
       );
-      const resolvedPodFile = JSON.parse(result.stdout);
-      parsePodfileTargets(
-        resolvedPodFile["target_definitions"][0],
-        targetDependencies,
-      );
+      let resolvedPodFile;
+      try {
+        resolvedPodFile = JSON.parse(result.stdout);
+      } catch (_e) {
+        resolvedPodFile = undefined;
+      }
+      if (resolvedPodFile?.target_definitions?.length) {
+        parsePodfileTargets(
+          resolvedPodFile["target_definitions"][0],
+          targetDependencies,
+        );
+        targetFilteringActive = true;
+      } else {
+        // pod failed or printed nothing usable (it refuses to run as root,
+        // for one), and an unparseable Podfile used to abort the whole scan.
+        // Keep every locked pod rather than none.
+        console.log(
+          "The Podfile could not be resolved with CocoaPods, so all pods from Podfile.lock are included without per-target filtering.",
+        );
+        targetDependencies.set("Pods", podfileLock["DEPENDENCIES"]);
+      }
     }
     const usedTargets = new Set(
-      readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
+      targetFilteringActive && readEnvironmentVariable("COCOA_INCLUDED_TARGETS")
         ? readEnvironmentVariable("COCOA_INCLUDED_TARGETS").split(",")
         : targetDependencies.keys(),
     );
-    if (readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")) {
+    // Without the resolved Podfile there are no target names to exclude, and
+    // excluding the lockfile's stand-in "Pods" target would drop every pod.
+    if (
+      targetFilteringActive &&
+      readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
+    ) {
       readEnvironmentVariable("COCOA_EXCLUDED_TARGETS")
         .split(",")
         .forEach((excludedTarget) => {