@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/ecosystems/parsers-misc.js

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { readdirSync, readFileSync } from "node:fs";
 import {
   sep as _sep,
   basename,
@@ -13,11 +13,17 @@ import {
 import { build, Purl } from "@cdxgen/cdx-purl";
 import { parse as _load } from "yaml";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  hasDangerousUnicode,
+  readEnvironmentVariable,
+} from "../core/activity.js";
+import { readRegularTextFile } from "../core/boundedFile.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import { shouldFetchLicense } from "../core/env.js";
 import {
+  getTmpDir,
   safeExistsSync,
   safeSpawnSync,
   safeWriteSync,
@@ -25,6 +31,10 @@ import {
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { isWin } from "../core/paths.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import { registerRunReset } from "../core/runState.js";
 import { mesonWrapDB } from "../core/state.js";
 import { isGitHubUrl } from "../core/urls.js";
@@ -43,7 +53,13 @@ import {
   tryBuildPurl,
 } from "../inventory/purl.js";
 import { getLicenses, spdxLicenses } from "../inventory/spdx.js";
-import { cmakeFetchDependencies } from "../parsers/cmakeLists.js";
+import {
+  cmakeFetchDependencies,
+  cmakeSetVariables,
+  expandCmakeVariables,
+  parseCmakeCommands,
+} from "../parsers/cmakeLists.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 import { submodulePurlCoordinates } from "../parsers/gitmodules.js";
 import { getDartMetadata } from "./ecosystems.js";
 import { parsePkgJson } from "./parsers-js.js";
@@ -1555,11 +1571,146 @@ export function parseComposerJson(composerJsonFile) {
   return { rootRequires, moduleParent };
 }
 
+// Composer's platform packages stand for what the runtime provides, and none
+// is installable, so none has a purl or an edge in the dependency graph. These
+// are the ones that describe PHP: PHP and its build flavours, HHVM, and the
+// extensions and system libraries PHP was built with. composer,
+// composer-plugin-api and composer-runtime-api are platform packages too, but
+// they describe Composer, so they are left out.
+// https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L39
+const COMPOSER_PLATFORM_NAMES = new Set([
+  "php",
+  "php-64bit",
+  "php-ipv6",
+  "php-zts",
+  "php-debug",
+  "hhvm",
+]);
+
+function isComposerPlatformRequirement(name) {
+  return (
+    COMPOSER_PLATFORM_NAMES.has(name) ||
+    name.startsWith("ext-") ||
+    name.startsWith("lib-")
+  );
+}
+
+// What the lock records about the platform is a constraint, or the version a
+// project told Composer to assume. It is a fact about the project's
+// requirements, never the version of anything that runs, so it is kept as a
+// property and never becomes a component.
+const COMPOSER_PLATFORM_SECTIONS = [
+  ["platform", "cdx:composer:platform:"],
+  ["platform-dev", "cdx:composer:platformDev:"],
+  ["platform-overrides", "cdx:composer:platformOverride:"],
+];
+const COMPOSER_REQUIRE_PREFIX = "cdx:composer:require:";
+const MAX_COMPOSER_PLATFORM_VALUE_LENGTH = 256;
+// A real lock names a few dozen platform packages per map at most; the cap
+// keeps a crafted one from turning each map into thousands of properties.
+const MAX_COMPOSER_PLATFORM_ENTRIES = 128;
+
+function isComposerPlatformKey(key) {
+  return /^[A-Za-z0-9._-]{1,100}$/.test(key);
+}
+
+/**
+ * The value a platform entry carries as a property: a constraint or version
+ * string, or `false`, which `config.platform` uses to disable a package:
+ * https://github.com/composer/composer/blob/2.10.3/src/Composer/Repository/PlatformRepository.php#L125
+ *
+ * @param {unknown} value value from the lock
+ * @returns {string|undefined} property value, or undefined when it is not one
+ */
+function composerPlatformValue(value) {
+  if (value === false) {
+    return "false";
+  }
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const trimmed = value.trim();
+  if (
+    !trimmed ||
+    trimmed.length > MAX_COMPOSER_PLATFORM_VALUE_LENGTH ||
+    hasDangerousUnicode(trimmed) ||
+    /[\t\n\r]/.test(trimmed)
+  ) {
+    return undefined;
+  }
+  return trimmed;
+}
+
+/**
+ * Turn a map of platform entries into properties named `<prefix><name>`, in
+ * name order, at most MAX_COMPOSER_PLATFORM_ENTRIES of them. Over the cap the
+ * PHP and HHVM entries are kept first, since `ext-*` sorts before `php`. An
+ * array (Composer writes an empty section as `[]`) or any other shape holds no
+ * entries.
+ *
+ * @param {unknown} entries map of requirement name to constraint
+ * @param {string} prefix property name prefix
+ * @param {function(string): boolean} [keep] which names to keep
+ * @returns {{name: string, value: string}[]} properties
+ */
+function composerPlatformProperties(entries, prefix, keep = () => true) {
+  if (!entries || typeof entries !== "object" || Array.isArray(entries)) {
+    return [];
+  }
+  const kept = [];
+  for (const key of Object.keys(entries).sort()) {
+    const value = composerPlatformValue(entries[key]);
+    if (value !== undefined && isComposerPlatformKey(key) && keep(key)) {
+      kept.push({ key, value });
+    }
+  }
+  let selected = kept;
+  if (kept.length > MAX_COMPOSER_PLATFORM_ENTRIES) {
+    const runtimes = kept.filter(({ key }) => COMPOSER_PLATFORM_NAMES.has(key));
+    const others = kept
+      .filter(({ key }) => !COMPOSER_PLATFORM_NAMES.has(key))
+      .slice(0, MAX_COMPOSER_PLATFORM_ENTRIES - runtimes.length);
+    const chosen = new Set([...runtimes, ...others]);
+    selected = kept.filter((entry) => chosen.has(entry));
+  }
+  return selected.map(({ key, value }) => ({ name: `${prefix}${key}`, value }));
+}
+
+/**
+ * A CycloneDX `organizationalContact` from an author record in package
+ * metadata. The schema asserts `idn-email` on the address, so one that is not
+ * a valid address is dropped rather than failing BOM validation; an author with
+ * neither a name nor a valid address yields nothing.
+ *
+ * @param {{name?: string, email?: unknown}} author Author as the manifest has it
+ * @returns {Array<{name?: string, email?: string}>} Zero or one contact
+ */
+function contactFromAuthor(author) {
+  const contact = {};
+  if (typeof author?.name === "string" && author.name.trim()) {
+    contact.name = author.name;
+  }
+  const email = typeof author?.email === "string" ? author.email.trim() : "";
+  if (isValidIdnEmail(email)) {
+    contact.email = email;
+  }
+  return Object.keys(contact).length ? [contact] : [];
+}
+
 /**
  * Parse composer lock file
  *
  * @param {string} pkgLockFile composer.lock file
  * @param {array} rootRequires require section from composer.json
+ * @returns {{pkgList: Object[], dependenciesList: Object[], rootList: Object[], platformProperties: {name: string, value: string}[]}|Array}
+ *   The locked packages, the dependency edges between them, the packages the
+ *   root requires, and the lock's `platform`, `platform-dev` and
+ *   `platform-overrides` entries as `cdx:composer:*` properties. The platform
+ *   entries are constraints and assumed versions, not the PHP that runs; the
+ *   caller puts them on the module component. Every locked package carries its
+ *   own `php`, `hhvm`, `ext-*` and `lib-*` requirements as
+ *   `cdx:composer:require:<name>` properties. A lock that is not valid JSON
+ *   gives an empty array.
  */
 export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgList = [];
@@ -1568,16 +1719,12 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
   const pkgNamePurlMap = {};
   const rootList = [];
   const rootRequiresMap = {};
+  let platformProperties = [];
   if (rootRequires) {
     for (const rr of Object.keys(rootRequires)) {
       // Skip platform requirements (php, hhvm, ext-*, lib-*) — they are never
       // Composer package names and must not be used to identify root packages.
-      if (
-        rr === "php" ||
-        rr === "hhvm" ||
-        rr.startsWith("ext-") ||
-        rr.startsWith("lib-")
-      ) {
+      if (isComposerPlatformRequirement(rr)) {
         continue;
       }
       rootRequiresMap[rr] = true;
@@ -1592,6 +1739,11 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
       return [];
     }
     if (lockData) {
+      for (const [section, prefix] of COMPOSER_PLATFORM_SECTIONS) {
+        platformProperties = platformProperties.concat(
+          composerPlatformProperties(lockData[section], prefix),
+        );
+      }
       const packages = {};
       if (lockData["packages"]) {
         packages["required"] = lockData["packages"];
@@ -1664,9 +1816,10 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
             apkg.distribution = { url: distUrl };
           }
           if (pkg?.authors?.length) {
-            apkg.authors = pkg.authors.map((a) => {
-              return { name: a.name, email: a.email };
-            });
+            const authors = pkg.authors.flatMap(contactFromAuthor);
+            if (authors.length) {
+              apkg.authors = authors;
+            }
           }
           if (pkg?.keywords?.length) {
             apkg.tags = pkg.keywords;
@@ -1687,6 +1840,13 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
               });
             }
           }
+          apkg.properties.push(
+            ...composerPlatformProperties(
+              pkg.require,
+              COMPOSER_REQUIRE_PREFIX,
+              isComposerPlatformRequirement,
+            ),
+          );
           pkgList.push(apkg);
           dependenciesMap[purl] = new Set();
           pkgNamePurlMap[pkg.name] = purl;
@@ -1726,6 +1886,7 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
     pkgList,
     dependenciesList,
     rootList,
+    platformProperties,
   };
 }
 
@@ -2629,6 +2790,130 @@ export function cmakeFetchDependencyComponent(dep, srcFile) {
   return component;
 }
 
+const MAX_MESON_WRAPS = 256;
+const MAX_MESON_WRAP_BYTES = 64 * 1024;
+
+function upstreamVersionOf(text) {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  const value = text.trim().replace(/^v(?=\d)/, "");
+  return /^\d+(\.\d+)*([-+._~][0-9A-Za-z.]+)?$/.test(value) ? value : undefined;
+}
+
+// `brotli-1.1.0`, `brotli-1.1.0.tar.gz`: the version after the last `-` that
+// starts a number.
+function versionFromArchiveName(name) {
+  if (typeof name !== "string") {
+    return undefined;
+  }
+  const stem = name.replace(/\.(tar\.gz|tar\.xz|tar\.bz2|tgz|zip|tar)$/i, "");
+  const dash = stem.search(/-\d[^-]*$/);
+  return dash === -1 ? undefined : upstreamVersionOf(stem.slice(dash + 1));
+}
+
+/**
+ * Read the wrap files of a meson project's subprojects directory: which
+ * dependency names each wrap provides, and the version it pins.
+ * https://mesonbuild.com/Wrap-dependency-system-manual.html
+ *
+ * A WrapDB wrap records `wrapdb_version = <upstream>-<wrap revision>`; any wrap
+ * names its unpacked `directory` and its archive, which carry the upstream
+ * version; a git wrap pins a `revision` that is often a version tag.
+ *
+ * @param {string} subprojectsDir path of the subprojects directory
+ * @returns {Map<string, {wrap: string, version: string, source: string, revision?: string}>}
+ *   by provided dependency name, lower-case
+ */
+export function readMesonWraps(subprojectsDir) {
+  const provided = new Map();
+  let wrapFiles = [];
+  try {
+    wrapFiles = readdirSync(subprojectsDir)
+      .filter((name) => name.endsWith(".wrap"))
+      .sort()
+      .slice(0, MAX_MESON_WRAPS);
+  } catch {
+    return provided;
+  }
+  for (const wrapFile of wrapFiles) {
+    // A regular file only: a FIFO named *.wrap would block a plain read.
+    const text = readRegularTextFile(
+      join(subprojectsDir, wrapFile),
+      MAX_MESON_WRAP_BYTES,
+    );
+    if (text === undefined) {
+      continue;
+    }
+    const sections = {};
+    let section = "";
+    for (const rawLine of text.split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith("#") || line.startsWith(";")) {
+        continue;
+      }
+      if (line.startsWith("[") && line.endsWith("]")) {
+        section = line.slice(1, -1).trim();
+        sections[section] = sections[section] || {};
+        continue;
+      }
+      const equals = line.indexOf("=");
+      if (equals <= 0 || !section) {
+        continue;
+      }
+      sections[section][line.slice(0, equals).trim()] = line
+        .slice(equals + 1)
+        .trim();
+    }
+    const body = sections["wrap-file"] || sections["wrap-git"] || {};
+    let version;
+    let source;
+    let revision;
+    if (body.wrapdb_version) {
+      const dash = body.wrapdb_version.lastIndexOf("-");
+      version = upstreamVersionOf(
+        dash > 0 ? body.wrapdb_version.slice(0, dash) : body.wrapdb_version,
+      );
+      revision = dash > 0 ? body.wrapdb_version.slice(dash + 1) : undefined;
+      source = "wrapdb_version";
+    }
+    if (!version && sections["wrap-file"]) {
+      version =
+        versionFromArchiveName(body.directory) ||
+        versionFromArchiveName(body.source_filename);
+      source = version ? "directory" : undefined;
+    }
+    if (!version && sections["wrap-git"]) {
+      version = upstreamVersionOf(body.revision);
+      source = version ? "revision" : undefined;
+    }
+    if (!version) {
+      continue;
+    }
+    const wrap = wrapFile.slice(0, -".wrap".length);
+    const entry = { wrap, version, source, ...(revision ? { revision } : {}) };
+    const names = new Set([wrap.toLowerCase()]);
+    const provide = sections.provide || {};
+    for (const [key, value] of Object.entries(provide)) {
+      if (key === "dependency_names" || key === "program_names") {
+        for (const name of value.split(",")) {
+          if (name.trim()) {
+            names.add(name.trim().toLowerCase());
+          }
+        }
+      } else {
+        names.add(key.toLowerCase());
+      }
+    }
+    for (const name of names) {
+      if (!provided.has(name)) {
+        provided.set(name, entry);
+      }
+    }
+  }
+  return provided;
+}
+
 /**
  * Parse a CMake-like build file (CMakeLists.txt, meson.build, etc.) and extract the
  * parent component and list of dependency packages.
@@ -2646,6 +2931,11 @@ export function cmakeFetchDependencyComponent(dep, srcFile) {
  */
 export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
   const rawData = readFileSync(cmakeListFile, { encoding: "utf-8" });
+  // The wraps a meson project ships pin the versions of the subprojects its
+  // dependency() calls fall back to.
+  const mesonWraps = basename(cmakeListFile).startsWith("meson")
+    ? readMesonWraps(join(dirname(cmakeListFile), "subprojects"))
+    : new Map();
   let cmakeListData = rawData;
   const pkgList = [];
   const pkgAddedMap = {};
@@ -2653,6 +2943,25 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
   const versionsMap = {};
   let parentComponent = {};
   const templateValues = {};
+  // The parent component is built the same way whether its name and version
+  // came from the parsed project() command or from the line loop below.
+  const toParentComponent = (parentName, parentVersion) => {
+    const component = {
+      group: options.projectGroup || "",
+      name: parentName,
+      version: parentVersion || options.projectVersion || "",
+      type: "application",
+    };
+    component["purl"] = build({
+      type: pkgType,
+      namespace: component.group || null,
+      name: component.name,
+      version: component.version || null,
+      subpath: null,
+    });
+    component["bom-ref"] = decodeURIComponent(component["purl"]);
+    return component;
+  };
   // A dependency fetched at configure time is the same package a find_package()
   // of the same name asks for: the fetched component, with its source and pin,
   // stands for both.
@@ -2668,6 +2977,38 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
       fetchedNames.add(dep.name.toLowerCase());
       pkgList.push(component);
     }
+    // A project() call may span several lines, which the line loop below
+    // cannot rejoin, so the parent name and version are read from the parsed
+    // commands instead. The first argument is the project name and the
+    // VERSION keyword is followed by the version.
+    const commands = parseCmakeCommands(rawData);
+    const variables = cmakeSetVariables(commands);
+    const projectCommand = commands.find(
+      (command) => command.name === "project",
+    );
+    if (projectCommand?.args.length) {
+      const args = projectCommand.args.map((arg) =>
+        expandCmakeVariables(arg, variables),
+      );
+      const parentName = args[0].replace(":", "").trim();
+      let parentVersion;
+      const versionIndex = args.findIndex(
+        (arg) => arg.toLowerCase() === "version",
+      );
+      if (versionIndex > -1 && args.length > versionIndex + 1) {
+        parentVersion = args[versionIndex + 1];
+      }
+      // A `${VAR}` that no `set()` in this file defines stays literal. It is
+      // not a version, and percent-encoding it into a purl publishes the
+      // variable name as the version, so the field is left empty instead.
+      // CMakeCache.txt carries the evaluated value when a build tree exists.
+      if (parentVersion?.includes("$")) {
+        parentVersion = undefined;
+      }
+      if (parentName.length && !parentName.includes("$")) {
+        parentComponent = toParentComponent(parentName, parentVersion);
+      }
+    }
   }
   cmakeListData = cmakeListData
     .replace(/^ {2}/g, "")
@@ -2728,23 +3069,7 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
         parentVersion = undefined;
       }
       if (parentName?.length && !parentName.includes("$")) {
-        parentComponent = {
-          group: options.projectGroup || "",
-          name: parentName,
-          version: parentVersion || options.projectVersion || "",
-          type: "application",
-        };
-        const safePath = path ? path.replace(/^\/+/, "") : null;
-        parentComponent["purl"] = build({
-          type: pkgType,
-          namespace: parentComponent.group || null,
-          name: parentComponent.name,
-          version: parentComponent.version || null,
-          subpath: safePath,
-        });
-        parentComponent["bom-ref"] = decodeURIComponent(
-          parentComponent["purl"],
-        );
+        parentComponent = toParentComponent(parentName, parentVersion);
       }
     } else if (CMAKE_FIND_COMMANDS.has(command)) {
       let tmpB = commandArgs.split(")")[0].split(" ");
@@ -2886,7 +3211,26 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
         // wrap match has since replaced, so the scraped name is the fallback.
         const versionSpecifier =
           versionSpecifiersMap[n] || versionSpecifiersMap[scrapedName];
-        const version = versionsMap[n] || versionsMap[scrapedName] || "";
+        let version = versionsMap[n] || versionsMap[scrapedName] || "";
+        const localWrap =
+          mesonWraps.get(scrapedName.toLowerCase()) ||
+          mesonWraps.get(n.toLowerCase());
+        if (localWrap && !version) {
+          version = localWrap.version;
+          props.push({ name: "cdx:meson:wrap", value: localWrap.wrap });
+          props.push({
+            name: "cdx:meson:wrap:versionSource",
+            value: localWrap.source,
+          });
+          if (localWrap.revision) {
+            props.push({
+              name: "cdx:meson:wrap:revision",
+              value: localWrap.revision,
+            });
+          }
+          // A pinned wrap is a stronger identity than a name match alone.
+          confidence = Math.max(confidence, 0.7);
+        }
         if (versionSpecifier) {
           props.push({
             name: "cdx:build:versionSpecifiers",
@@ -3608,6 +3952,12 @@ async function fullScanCocoaPod(dependency, component, options) {
         value: podspecLocation,
       });
     }
+    // A Ruby podspec is a program that only `pod` can read, and it comes from
+    // the scanned project or a repository its lockfile names. Without
+    // permission to run the project's tooling, only JSON podspecs are read,
+    // directly and without `pod`.
+    const toolingAllowed = isProjectToolingAllowed(options);
+    const isRemote = podspecLocation.startsWith("http");
     let replacements = [];
     if (
       podspecLocation.endsWith(".podspec") &&
@@ -3624,34 +3974,50 @@ async function fullScanCocoaPod(dependency, component, options) {
         "COCOA_PODSPEC_JSON_REPLACEMENTS",
       ).split(";");
     }
-    if (replacements || podspecLocation.startsWith("http")) {
-      let podspecContent;
-      if (podspecLocation.startsWith("http")) {
-        let httpResult;
-        for (const candidate of podspecCandidates(podspecLocation)) {
-          try {
-            httpResult =
-              prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
-              (await gatedGet(candidate, { responseType: "text" }));
-            podspecLocation = candidate;
-          } catch (_err) {
-            continue;
-          }
-          component.properties.find(
-            ({ name }) => name === "cdx:pods:podspecLocation",
-          ).value = podspecLocation;
-          podspecLocation = `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`;
-          podspecContent = httpResult.body;
-          break;
+    let podspecContent;
+    if (isRemote) {
+      let httpResult;
+      for (const candidate of podspecCandidates(podspecLocation)) {
+        if (!toolingAllowed && !candidate.endsWith(".json")) {
+          continue;
         }
-      } else {
-        podspecContent = readFileSync(podspecLocation, "utf-8");
+        try {
+          httpResult =
+            prefetchedResponse(cocoaPodspecPrefetch, candidate) ||
+            (await gatedGet(candidate, { responseType: "text" }));
+          podspecLocation = candidate;
+        } catch (_err) {
+          continue;
+        }
+        component.properties.find(
+          ({ name }) => name === "cdx:pods:podspecLocation",
+        ).value = podspecLocation;
+        podspecContent = httpResult.body;
+        break;
       }
       // A location none of the candidates served contributes nothing: the
       // component keeps what the lockfile already said about the pod.
       if (podspecContent === undefined) {
         return;
       }
+    } else if (!toolingAllowed && !podspecLocation.endsWith(".json")) {
+      reportProjectToolingSkipped(
+        options,
+        "cocoa.podspec.tooling-disabled",
+        "Skipping 'pod ipc spec' for Ruby podspecs since dependency installation is disabled. Their pods keep the details from Podfile.lock.",
+        {
+          ecosystem: "cocoa",
+          tool: "pod",
+          impact: "licenses",
+          detail:
+            "Dependency installation is disabled, so Ruby podspecs were not evaluated and their pods lack license and author details.",
+        },
+      );
+      return;
+    } else if (replacements.length || !toolingAllowed) {
+      podspecContent = readFileSync(podspecLocation, "utf-8");
+    }
+    if (podspecContent !== undefined) {
       for (const replacement of replacements) {
         const replacementPair = replacement.split("=");
         let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");
@@ -3661,18 +4027,28 @@ async function fullScanCocoaPod(dependency, component, options) {
         const repl = replacementPair[1].replaceAll("<NEWLINE>", "\n");
         podspecContent = podspecContent.replaceAll(match, repl);
       }
-      podspecLocation = join(
-        dirname(podspecLocation),
-        `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+    }
+    if (!toolingAllowed) {
+      // Only JSON podspecs reach this point, and they need no `pod`
+      result = { stdout: podspecContent };
+    } else {
+      if (podspecContent !== undefined) {
+        // A downloaded podspec goes to the temporary directory; a local one
+        // with replacements stays beside the original, whose relative paths
+        // its Ruby may read.
+        podspecLocation = join(
+          isRemote ? getTmpDir() : dirname(podspecLocation),
+          `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
+        );
+        safeWriteSync(podspecLocation, podspecContent);
+        temporaryFiles.add(podspecLocation);
+      }
+      result = executePodCommand(
+        ["ipc", "spec", "--silent", podspecLocation],
+        undefined,
+        options,
       );
-      safeWriteSync(podspecLocation, podspecContent);
-      temporaryFiles.add(podspecLocation);
     }
-    result = executePodCommand(
-      ["ipc", "spec", "--silent", podspecLocation],
-      undefined,
-      options,
-    );
   } else {
     let dependencyName = dependency.name;
     if (dependencyName.includes("/")) {
@@ -3737,9 +4113,7 @@ async function fullScanCocoaPod(dependency, component, options) {
     component.authors = [];
     if (podspec.authors.constructor === Object) {
       Object.entries(podspec.authors).forEach(([name, email]) => {
-        email.includes("@")
-          ? component.authors.push({ name, email })
-          : component.authors.push({ name });
+        component.authors.push(...contactFromAuthor({ name, email }));
       });
     } else if (podspec.authors.constructor === Array) {
       podspec.authors.forEach((name) => {