@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/ecosystems/parsers-bazel.js

@@ -79,12 +79,62 @@ export function parseModuleBazel(moduleFile) {
     });
   }
 
+  // Overrides replace where a bazel_dep comes from, and Bazel then ignores
+  // the version the bazel_dep names.
+  // https://bazel.build/external/module#overrides
+  const overrides = new Map();
+  for (const kind of [
+    "local_path_override",
+    "git_override",
+    "archive_override",
+    "single_version_override",
+  ]) {
+    for (const call of findAllCalls(src, kind)) {
+      const moduleName = scalarArg(call, "module_name");
+      if (moduleName && !overrides.has(moduleName)) {
+        overrides.set(moduleName, {
+          kind,
+          version: scalarArg(call, "version"),
+          remote: scalarArg(call, "remote"),
+          revision:
+            scalarArg(call, "commit") ||
+            scalarArg(call, "tag") ||
+            scalarArg(call, "branch"),
+          url: scalarArg(call, "urls") || scalarArg(call, "url"),
+        });
+      }
+    }
+  }
+
   for (const call of findAllCalls(src, "bazel_dep")) {
     const name = scalarArg(call, "name");
-    const version = scalarArg(call, "version");
+    let version = scalarArg(call, "version");
     const repoName = scalarArg(call, "repo_name");
     if (!name || !version) continue;
-    pkgList.push(buildBcrPackage(repoName || name, name, version, moduleFile));
+    const override = overrides.get(name);
+    // A module taken from a local directory is the project's own tree, not a
+    // BCR release, and the version it declares is not what gets built.
+    if (override?.kind === "local_path_override") continue;
+    if (override?.kind === "single_version_override" && override.version) {
+      version = override.version;
+    }
+    // A git or archive override fetches the module from elsewhere, so it is
+    // no BCR release: the purl names where it comes from instead of the BCR.
+    const source = overrideSource(override);
+    const pkg = buildBcrPackage(
+      repoName || name,
+      name,
+      source ? null : version,
+      moduleFile,
+      source,
+    );
+    if (override && override.kind !== "single_version_override") {
+      pkg.properties.push({
+        name: "cdx:bazel:override",
+        value: override.kind.replace(/_override$/, ""),
+      });
+    }
+    pkgList.push(pkg);
   }
 
   for (const call of findAllCalls(src, "maven.artifact")) {
@@ -425,6 +475,37 @@ function buildEcosystemPackage(coords, context) {
   return pkg;
 }
 
+/**
+ * Where a git_override or archive_override takes a module from, as purl
+ * qualifiers and an external reference.
+ *
+ * @param {Object|undefined} override override recorded for the module
+ * @returns {{qualifiers: Object, externalReferences: Object[]}|undefined}
+ *   undefined for no override, or one that keeps the module a BCR release
+ */
+function overrideSource(override) {
+  if (override?.kind === "git_override") {
+    if (!override.remote) {
+      return { qualifiers: {}, externalReferences: [] };
+    }
+    const vcsUrl = `git+${override.remote}${override.revision ? `@${override.revision}` : ""}`;
+    return {
+      qualifiers: { vcs_url: vcsUrl },
+      externalReferences: [{ type: "vcs", url: override.remote }],
+    };
+  }
+  if (override?.kind === "archive_override") {
+    if (!override.url) {
+      return { qualifiers: {}, externalReferences: [] };
+    }
+    return {
+      qualifiers: { download_url: override.url },
+      externalReferences: [{ type: "distribution", url: override.url }],
+    };
+  }
+  return undefined;
+}
+
 /**
  * Build a component record for a BCR (Bazel Central Registry) module.
  *
@@ -435,26 +516,46 @@ function buildEcosystemPackage(coords, context) {
  * @param {string} moduleName Canonical module name
  * @param {string} version Resolved version
  * @param {string} srcFile Source file for evidence
+ * @param {{qualifiers: Object, externalReferences: Object[]}} [source] where
+ *   an override takes the module from, in place of the BCR
  * @returns {object} Package record
  */
-function buildBcrPackage(displayRepoName, moduleName, version, srcFile) {
+function buildBcrPackage(
+  displayRepoName,
+  moduleName,
+  version,
+  srcFile,
+  source,
+) {
   const purl = tryBuildPurl({
     type: "bazel",
     name: moduleName,
     version,
-    qualifiers: { repository_url: BCR_DEFAULT_REPOSITORY_URL },
+    qualifiers: source
+      ? source.qualifiers
+      : { repository_url: BCR_DEFAULT_REPOSITORY_URL },
   });
   return {
     name: moduleName,
-    version,
+    ...(version ? { version } : {}),
     type: "library",
     scope: "required",
     purl,
     "bom-ref": decodeURIComponent(purl),
+    ...(source?.externalReferences.length
+      ? { externalReferences: source.externalReferences }
+      : {}),
     properties: [
       { name: "internal:SrcFile", value: srcFile },
       { name: "cdx:bazel:module", value: moduleName },
-      { name: "cdx:bazel:repository_url", value: BCR_DEFAULT_REPOSITORY_URL },
+      ...(source
+        ? []
+        : [
+            {
+              name: "cdx:bazel:repository_url",
+              value: BCR_DEFAULT_REPOSITORY_URL,
+            },
+          ]),
       ...(displayRepoName !== moduleName
         ? [{ name: "cdx:bazel:repo_name", value: displayRepoName }]
         : []),

package/lib/ecosystems/parsers-dotnet.js

@@ -1,5 +1,13 @@
 import { readFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  isAbsolute,
+  join,
+  posix,
+  resolve,
+  win32,
+} from "node:path";
 
 import { build } from "@cdxgen/cdx-purl";
 
@@ -182,7 +190,10 @@ export function resolveInstalledNugetVersion(range, installedVersions = []) {
  * @returns {string} Project directory
  */
 export function dotnetManifestProjectDir(manifestFile, projectPath) {
-  if (projectPath) {
+  // A path recorded on another operating system, such as `D:\src\App.csproj`
+  // read on Linux, is not absolute here and would resolve against the working
+  // directory.
+  if (projectPath && isAbsolute(projectPath)) {
     const projectDir = dirname(resolve(projectPath));
     if (safeExistsSync(projectDir)) {
       return projectDir;
@@ -192,6 +203,55 @@ export function dotnetManifestProjectDir(manifestFile, projectPath) {
   return basename(dir) === "obj" ? dirname(dir) : dir;
 }
 
+/**
+ * The path, on this machine, of the project file a project.assets.json belongs to.
+ *
+ * Restore records the project file and the directory it wrote the assets file
+ * to (`outputPath`) as absolute paths on the machine that ran it, which can be
+ * a CI agent, a container, another operating system, or this tree reached
+ * through another path. Where the project file sits relative to that
+ * directory does not change when the tree moves, so the project file is that
+ * offset applied to the directory the assets file is in. An assets file that
+ * records no output path is taken to be in its project's `obj/`. The recorded
+ * path itself is used only when no offset can be worked out, as when restore
+ * wrote to another drive than the project's.
+ *
+ * Nothing is read from disk: the name is spelled as restore recorded it, which
+ * can differ in case from the file a case-insensitive file system holds.
+ *
+ * @param {string} assetsFile project.assets.json path
+ * @param {string} [projectPath] Project file restore recorded
+ * @param {string} [outputPath] Directory restore recorded writing the assets file to
+ * @returns {string|undefined} Project file path, or undefined when none can be named
+ */
+export function dotnetRestoredProjectFile(assetsFile, projectPath, outputPath) {
+  if (!assetsFile || typeof projectPath !== "string" || !projectPath.trim()) {
+    return undefined;
+  }
+  // Read the recorded paths the way the machine that wrote them would
+  const recorded =
+    win32.isAbsolute(projectPath) && !posix.isAbsolute(projectPath)
+      ? win32
+      : posix;
+  const assetsDir = dirname(resolve(assetsFile));
+  let offset;
+  if (typeof outputPath === "string" && outputPath.trim()) {
+    const relativePath = recorded.relative(outputPath, projectPath);
+    // Across two drives there is no relative path, only the recorded one
+    if (!recorded.isAbsolute(relativePath)) {
+      offset = relativePath.split(recorded.sep);
+    }
+  } else if (basename(assetsDir) === "obj") {
+    offset = ["..", recorded.basename(projectPath)];
+  }
+  // The offset must end at a file, not at the output directory or a parent
+  const fileName = offset?.at(-1);
+  if (fileName && fileName !== "." && fileName !== "..") {
+    return resolve(assetsDir, ...offset);
+  }
+  return isAbsolute(projectPath) ? resolve(projectPath) : undefined;
+}
+
 /**
  * Index the MSBuild properties that props files define, by the directory each
  * file sits in and across the whole scan, so the candidates for every project
@@ -853,8 +913,12 @@ function evaluateMsbuildProperties(projFile, names) {
  * @param {Object} restoredNames Package ids as this project's restore output spells them,
  *        keyed by lowercased id. NuGet ids are case-insensitive, so a reference spelled
  *        differently names the same package and takes the restored spelling.
+ * @param {{name: string, version: (string|undefined)}} [projectIdentity] Package id and
+ *        version this project's project.assets.json records for the project. They name the
+ *        project in place of what the project file states.
  *
- * @returns {Object} Containing parent component, package, and dependencies
+ * @returns {Object} Containing parent component, package, dependencies, and the
+ *   `$(Name)` version labels left unresolved without msbuild
  */
 export function parseCsProjData(
   csProjData,
@@ -865,6 +929,7 @@ export function parseCsProjData(
   centralVersions = {},
   fallbackVersions = {},
   restoredNames = {},
+  projectIdentity = undefined,
 ) {
   const pkgList = [];
   const parentComponent = { type: "application", properties: [] };
@@ -909,21 +974,21 @@ export function parseCsProjData(
       ? pkgVersionLabelCandidates[label][0]
       : undefined);
   let msbuildValues = {};
-  if (msbuildInstalled) {
-    const unresolved = new Set();
-    for (const item of project.ItemGroup || []) {
-      for (const reference of item.PackageReference || []) {
-        const label = labelOf(
-          reference.$?.VersionOverride ||
-            reference.VersionOverride?.[0]._?.[0] ||
-            reference.$?.Version ||
-            reference.Version?.[0]._?.[0],
-        );
-        if (label && staticLabelValue(label) === undefined) {
-          unresolved.add(label);
-        }
+  const unresolved = new Set();
+  for (const item of project.ItemGroup || []) {
+    for (const reference of item.PackageReference || []) {
+      const label = labelOf(
+        reference.$?.VersionOverride ||
+          reference.VersionOverride?.[0]._?.[0] ||
+          reference.$?.Version ||
+          reference.Version?.[0]._?.[0],
+      );
+      if (label && staticLabelValue(label) === undefined) {
+        unresolved.add(label);
       }
     }
+  }
+  if (msbuildInstalled) {
     msbuildValues = evaluateMsbuildProperties(projFile, [...unresolved].sort());
   }
   // SDK-style projects declare their version through the MSBuild properties
@@ -1351,6 +1416,32 @@ export function parseCsProjData(
     // version set from a build-time property is unknown, not 1.0.0.
     parentComponent.version = "1.0.0";
   }
+  // Only a build knows the value of a property that references another one
+  const literal = (value) =>
+    value && !value.includes("$(") ? value : undefined;
+  // NuGet names a project's package by its PackageId, which defaults to the
+  // assembly name, so a PackageId the project file states names the project.
+  const declaredPackageId = literal(ownProperties.PackageId);
+  if (declaredPackageId) {
+    parentComponent.name = declaredPackageId;
+  }
+  // Restore evaluated the project with everything MSBuild imports and every
+  // property it was given: a Version from Directory.Build.props, `-p:Version`
+  // or `$(BuildNumber)`, a PackageId. Its project.assets.json roots the
+  // restored dependency tree at that identity, so naming the project from its
+  // file alone would make it two components.
+  if (projectIdentity?.name) {
+    parentComponent.name = projectIdentity.name;
+    parentComponent.version = projectIdentity.version;
+  }
+  // The assembly the project builds keeps its name when the package differs
+  const declaredAssemblyName = literal(ownProperties.AssemblyName);
+  if (declaredAssemblyName && declaredAssemblyName !== parentComponent.name) {
+    parentComponent.properties.push({
+      name: "cdx:dotnet:assembly_name",
+      value: declaredAssemblyName,
+    });
+  }
   // The purl is built once every PropertyGroup has been read, so a version
   // declared after OutputType is not lost. A project that states no version
   // gets a versionless purl: "latest" is not a version.
@@ -1370,6 +1461,8 @@ export function parseCsProjData(
     pkgList,
     parentComponent,
     dependencies,
+    // Version labels no static source settled, which only msbuild could
+    unresolvedVersionLabels: msbuildInstalled ? [] : [...unresolved].sort(),
   };
 }
 
@@ -1417,8 +1510,10 @@ export function isReferencedDotnetPackageFile(packageFile) {
  *
  * @param {string} csProjData Raw JSON string of the project.assets.json file
  * @param {string} assetsJsonFile Path to the project.assets.json file, used for evidence properties
- * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined) }}
- *          `projectPath` is the project file the restore output belongs to, as restore recorded it
+ * @returns {{ pkgList: Object[], dependenciesList: Object[], projectPath: (string|undefined), outputPath: (string|undefined), projectIdentity: ({name: string, version: (string|undefined)}|undefined) }}
+ *          `projectPath` is the project file the restore output belongs to and `outputPath` the
+ *          directory restore wrote it to, both as restore recorded them. `projectIdentity` is the
+ *          package id and version restore evaluated for the project, which root the dependency tree.
  */
 export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
   // extract name, operator, version from .NET package representation
@@ -1646,6 +1741,10 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
     pkgList,
     dependenciesList,
     projectPath,
+    outputPath: csProjData.project?.restore?.outputPath,
+    projectIdentity: rootRef
+      ? { name: rootPkg.name, version: rootPkg.version }
+      : undefined,
   };
 }