@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/ecosystems/rubyutils.js

@@ -16,6 +16,7 @@ import { build, Purl } from "@cdxgen/cdx-purl";
 // utils.js does not import rubyutils.js, so importing from it here is safe and
 // does not introduce a cyclic dependency.
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { readRegularTextFile } from "../core/boundedFile.js";
 import { shouldFetchLicense } from "../core/env.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
@@ -29,6 +30,12 @@ import {
   recordPolicyDegradationFromError,
 } from "../inventory/fetchBatch.js";
 import { genericPurl } from "../inventory/purl.js";
+import {
+  createRubyRuntimeComponent,
+  defaultGemInstall,
+  parseRubyVersion,
+} from "../inventory/rubyBuildInfo.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 
 // FIXME. This has to get removed, once we improve the module detection one-liner.
 // If you're a Rubyist, please help us improve this code.
@@ -1562,6 +1569,40 @@ function listGemBindirFiles(gemspecFile, bindir = "bin") {
   }
 }
 
+/**
+ * Whether gemspec text is really a Marshal dump. RubyGems' spec cache stores
+ * Marshal-dumped specifications in files named `<gem>-<version>.gemspec`; they
+ * start with the Marshal 4.8 header bytes 0x04 0x08 and hold no Ruby source to
+ * parse, so reading one would leave only the file name to guess from.
+ *
+ * @param {string} gemspecData file contents
+ * @returns {boolean} true for a Marshal dump
+ */
+function isMarshalData(gemspecData) {
+  return (
+    typeof gemspecData === "string" &&
+    gemspecData.charCodeAt(0) === 4 &&
+    gemspecData.charCodeAt(1) === 8
+  );
+}
+
+/**
+ * Whether a gemspec is a default gem, one that ships with Ruby: RubyGems
+ * keeps them under `specifications/default/`.
+ *
+ * @param {string} gemspecFile path of the gemspec, either separator
+ * @returns {boolean}
+ */
+export function isDefaultGemspecPath(gemspecFile) {
+  if (typeof gemspecFile !== "string") {
+    return false;
+  }
+  return (
+    defaultGemInstall(gemspecFile) !== undefined ||
+    gemspecFile.replaceAll("\\", "/").includes("/specifications/default/")
+  );
+}
+
 /**
  * Method to parse Gemspec file contents.
  *
@@ -1593,7 +1634,7 @@ export async function parseGemspecData(gemspecData, gemspecFile, options = {}) {
   if (gemspecFile) {
     pkg.name = basename(gemspecFile).replace(".gemspec", "");
   }
-  if (!gemspecData) {
+  if (!gemspecData || isMarshalData(gemspecData)) {
     return pkgList;
   }
   let versionHackMatch = false;
@@ -1948,6 +1989,12 @@ export async function parseGemspecData(gemspecData, gemspecFile, options = {}) {
   }
   if (gemspecFile) {
     pkg.properties.push({ name: "internal:SrcFile", value: gemspecFile });
+    // RubyGems keeps the gems that ship with Ruby itself, such as resolv and
+    // net-http, under specifications/default. They are updated with Ruby, so
+    // their advisories are often fixed by a Ruby release.
+    if (isDefaultGemspecPath(gemspecFile)) {
+      pkg.properties.push({ name: "cdx:gem:defaultGem", value: "true" });
+    }
     // Did we find the version number from the directory name? Let's reduce the confidence and set the correct technique
     pkg.evidence = {
       identity: {
@@ -1967,9 +2014,11 @@ export async function parseGemspecData(gemspecData, gemspecFile, options = {}) {
     // `spec.email` holds the contact addresses of the gem, not of an author.
     // An address can only be attributed when there is one per author, in the
     // same order, or when the gem has a single author.
-    const emails = (lists.email || []).filter(
-      (email) => email.includes("@") && !email.includes(" "),
-    );
+    // Only a valid `idn-email` may reach `organizationalContact.email`; the
+    // schema asserts the format, so anything else fails BOM validation.
+    const emails = (lists.email || [])
+      .map((email) => `${email}`.trim())
+      .filter(isValidIdnEmail);
     pkg.authors = lists.authors.map((name, i) => {
       let email;
       if (emails.length === lists.authors.length) {
@@ -2858,30 +2907,434 @@ export function rubyRequirementToVers(requirements) {
   return `vers:gem/${constraints.map((c) => c.text).join("|")}`;
 }
 
+// Ruby engines a version manager or Bundler can name. MRI is `ruby`.
+const RUBY_ENGINES = new Set(["ruby", "jruby", "truffleruby"]);
+const MAX_PIN_FILE_BYTES = 64 * 1024;
+const MAX_GEMFILE_BYTES = 1024 * 1024;
+const MAX_LOCKFILE_BYTES = 16 * 1024 * 1024;
+
+// An exact version, or a partial one such as `3.3` that pins a series and is
+// read as the requirement `~> 3.3.0`.
+function rubyPin(engine, text, source) {
+  const value = `${text || ""}`.trim();
+  if (!value || value.length > 64) {
+    return undefined;
+  }
+  if (engine === "ruby") {
+    const version = parseRubyVersion(value);
+    if (version) {
+      return { engine, version, source };
+    }
+    if (/^\d+\.\d+$/.test(value)) {
+      return { engine, requirement: `~> ${value}.0`, source };
+    }
+    if (/^\d+$/.test(value)) {
+      return { engine, requirement: `~> ${value}.0`, source };
+    }
+    return undefined;
+  }
+  return /^\d+(\.\d+){1,3}$/.test(value)
+    ? { engine, version: value, source }
+    : undefined;
+}
+
+/**
+ * Read the Ruby a `.ruby-version` file selects, as rbenv, chruby, rvm, asdf
+ * and mise read it: `3.3.6`, `ruby-3.3.6`, `3.3`, `jruby-9.4.8.0`,
+ * `truffleruby-24.1.0`, `truffleruby+graalvm-24.1.0`. Only the first word
+ * counts; comments and blank lines are skipped.
+ *
+ * @param {string} text file contents
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export function parseRubyVersionFile(text) {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  for (const rawLine of text.slice(0, MAX_PIN_FILE_BYTES).split(/\r?\n/)) {
+    const line = rawLine.split("#")[0].trim().split(/\s+/)[0];
+    if (!line) {
+      continue;
+    }
+    const dash = line.indexOf("-");
+    if (dash > 0 && !/^\d/.test(line)) {
+      const engine = line.slice(0, dash).split("+")[0];
+      if (!RUBY_ENGINES.has(engine)) {
+        return undefined;
+      }
+      return rubyPin(engine, line.slice(dash + 1), ".ruby-version");
+    }
+    return rubyPin("ruby", line, ".ruby-version");
+  }
+  return undefined;
+}
+
+/**
+ * Read the Ruby an asdf `.tool-versions` file selects: the first version on
+ * the `ruby` line, e.g. `ruby 3.3.6 3.2.2`.
+ *
+ * @param {string} text file contents
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export function parseToolVersionsRuby(text) {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  for (const rawLine of text.slice(0, MAX_PIN_FILE_BYTES).split(/\r?\n/)) {
+    const words = rawLine.split("#")[0].trim().split(/\s+/);
+    if (words[0] !== "ruby" || !words[1]) {
+      continue;
+    }
+    const value = words[1];
+    const dash = value.indexOf("-");
+    if (dash > 0 && !/^\d/.test(value)) {
+      const engine = value.slice(0, dash).split("+")[0];
+      return RUBY_ENGINES.has(engine)
+        ? rubyPin(engine, value.slice(dash + 1), ".tool-versions")
+        : undefined;
+    }
+    return rubyPin("ruby", value, ".tool-versions");
+  }
+  return undefined;
+}
+
+/**
+ * Read the Ruby a mise configuration selects from its `[tools]` table:
+ * `ruby = "3.3.6"`, `ruby = ["3.3.6", "3.2"]` or `ruby = { version = "3.3.6" }`.
+ *
+ * @param {string} text mise.toml contents
+ * @param {string} [source="mise.toml"] the file name, for the result
+ * @returns {{engine: string, version?: string, requirement?: string, source: string}|undefined}
+ */
+export function parseMiseRuby(text, source = "mise.toml") {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  let inTools = false;
+  for (const rawLine of text.slice(0, MAX_PIN_FILE_BYTES).split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (line.startsWith("[")) {
+      // `[tools]`, `[ tools ]` and `[tools] # pinned` open the same table
+      inTools = line.split("#")[0].replace(/\s+/g, "") === "[tools]";
+      continue;
+    }
+    if (!inTools || !/^["']?ruby["']?\s*=/.test(line)) {
+      continue;
+    }
+    const value = line.slice(line.indexOf("=") + 1).trim();
+    const quoted = /["']([^"']+)["']/.exec(
+      value.startsWith("{") ? value.slice(value.indexOf("version")) : value,
+    );
+    return quoted ? rubyPin("ruby", quoted[1], source) : undefined;
+  }
+  return undefined;
+}
+
+/**
+ * Read the `ruby` directive of a Gemfile: `ruby "3.3.6"`, `ruby "~> 3.3"`,
+ * `ruby "3.1.4", engine: "jruby", engine_version: "9.4.8.0"`, or
+ * `ruby file: ".ruby-version"`. The Gemfile is never evaluated, so a
+ * directive built from an expression, such as `ruby RUBY_VERSION`, says
+ * nothing.
+ *
+ * @param {string} text Gemfile contents
+ * @returns {{engine: string, version?: string, requirement?: string,
+ *   file?: string, source: string}|undefined}
+ */
+export function parseGemfileRubyDirective(text) {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  for (const rawLine of text.slice(0, 1024 * 1024).split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!/^ruby[\s(]/.test(line)) {
+      continue;
+    }
+    let rest = line.slice(4).trim();
+    if (rest.startsWith("(")) {
+      rest = rest.slice(1).trim();
+    }
+    const fileMatch = /^file:\s*/.exec(rest);
+    if (fileMatch) {
+      const literal = readRubyStringLiteral(rest.slice(fileMatch[0].length));
+      return literal?.value && !literal.interpolated
+        ? { engine: "ruby", file: literal.value, source: "Gemfile" }
+        : undefined;
+    }
+    const literal = readRubyStringLiteral(rest);
+    if (!literal?.value || literal.interpolated) {
+      return undefined;
+    }
+    // `ruby "3.2.2" if ENV["LEGACY"]` holds only on some machines; a later
+    // unconditional directive, if any, is the project's.
+    if (/(^|[\s,)])(if|unless)\s/.test(literal.rest)) {
+      continue;
+    }
+    const keyword = (name) => {
+      const index = rest.indexOf(`${name}:`);
+      if (index === -1) {
+        return undefined;
+      }
+      const value = readRubyStringLiteral(
+        rest.slice(index + name.length + 1).trim(),
+      );
+      return value && !value.interpolated ? value.value : undefined;
+    };
+    const engine = keyword("engine");
+    const engineVersion = keyword("engine_version");
+    if (engine && engine !== "ruby") {
+      if (!RUBY_ENGINES.has(engine) || !engineVersion) {
+        return undefined;
+      }
+      const pin = rubyPin(engine, engineVersion, "Gemfile");
+      return pin ? { ...pin, rubyVersion: literal.value } : undefined;
+    }
+    const value = literal.value.trim();
+    const exact = parseRubyVersion(value);
+    if (exact) {
+      return { engine: "ruby", version: exact, source: "Gemfile" };
+    }
+    return rubyRequirementToVers([value]) !== undefined
+      ? { engine: "ruby", requirement: value, source: "Gemfile" }
+      : undefined;
+  }
+  return undefined;
+}
+
 /**
- * Describe the Ruby runtime the gems require as one external `platform`
+ * Read the `RUBY VERSION` section of a Gemfile.lock, which Bundler writes when
+ * the Gemfile has a `ruby` directive: `ruby 3.3.6p108`, `ruby 3.4.0p-1` for a
+ * pre-release, or `ruby 3.1.4p0 (jruby 9.4.8.0)` for another engine.
+ *
+ * @param {string} text Gemfile.lock contents
+ * @returns {{engine: string, version: string, patchlevel?: string,
+ *   rubyVersion?: string, source: string}|undefined}
+ */
+export function parseGemfileLockRubyVersion(text) {
+  if (typeof text !== "string") {
+    return undefined;
+  }
+  const lines = text.split(/\r?\n/);
+  for (let index = 0; index < lines.length; index++) {
+    if (lines[index].trim() !== "RUBY VERSION") {
+      continue;
+    }
+    const value = (lines[index + 1] || "").trim();
+    const match =
+      /^ruby (\d+\.\d+\.\d+)(?:p(-?\d+))?(?: \((jruby|truffleruby) (\d+(?:\.\d+){1,3})\))?$/.exec(
+        value,
+      );
+    if (!match) {
+      return undefined;
+    }
+    if (match[3]) {
+      return {
+        engine: match[3],
+        version: match[4],
+        rubyVersion: match[1],
+        source: "Gemfile.lock",
+      };
+    }
+    const result = {
+      engine: "ruby",
+      version: match[1],
+      source: "Gemfile.lock",
+    };
+    if (match[2] !== undefined && match[2] !== "-1") {
+      result.patchlevel = match[2];
+    } else if (match[2] === "-1") {
+      // A pre-release or development build, whose tag Bundler does not record
+      result.prerelease = true;
+    }
+    return result;
+  }
+  return undefined;
+}
+
+// A pin file is read only when it is a regular file inside the project and
+// within a size cap: a repository can commit `.tool-versions -> /dev/zero` or
+// a FIFO, which an unbounded read would never finish.
+function readPinFile(file, projectRoot, maxBytes = MAX_PIN_FILE_BYTES) {
+  return readRegularTextFile(file, maxBytes, projectRoot);
+}
+
+/**
+ * Collect every Ruby a project directory declares, from the Gemfile.lock
+ * `RUBY VERSION` section, `.ruby-version`, `.tool-versions`, mise.toml and the
+ * Gemfile `ruby` directive. Each declaration names its source.
+ *
+ * @param {string} projectPath project directory
+ * @param {string} [lockData] Gemfile.lock contents, when already read
+ * @returns {Array<{engine: string, version?: string, requirement?: string,
+ *   patchlevel?: string, source: string, path: string}>}
+ */
+export function collectProjectRubyDeclarations(projectPath, lockData) {
+  const declarations = [];
+  const add = (declaration, path) => {
+    if (declaration) {
+      declarations.push({ ...declaration, path });
+    }
+  };
+  const lockFile = join(projectPath, "Gemfile.lock");
+  add(
+    parseGemfileLockRubyVersion(
+      lockData === undefined
+        ? readPinFile(lockFile, projectPath, MAX_LOCKFILE_BYTES)
+        : lockData,
+    ),
+    lockFile,
+  );
+  const versionFile = join(projectPath, ".ruby-version");
+  add(parseRubyVersionFile(readPinFile(versionFile, projectPath)), versionFile);
+  const toolVersions = join(projectPath, ".tool-versions");
+  add(
+    parseToolVersionsRuby(readPinFile(toolVersions, projectPath)),
+    toolVersions,
+  );
+  for (const name of ["mise.toml", ".mise.toml", ".config/mise.toml"]) {
+    const miseFile = join(projectPath, name);
+    add(parseMiseRuby(readPinFile(miseFile, projectPath), name), miseFile);
+  }
+  const gemfile = join(projectPath, "Gemfile");
+  const directive = parseGemfileRubyDirective(
+    readPinFile(gemfile, projectPath, MAX_GEMFILE_BYTES),
+  );
+  if (directive?.file) {
+    // `ruby file: ".ruby-version"` reads the version from that file, relative
+    // to the Gemfile; a path out of the project is not followed.
+    const target = resolve(projectPath, directive.file);
+    const inside = relative(resolve(projectPath), target);
+    if (inside && !inside.startsWith("..") && !isAbsolute(inside)) {
+      // Bundler reads .tool-versions and mise.toml through `ruby file:` too
+      const text = readPinFile(target, projectPath);
+      const name = basename(target);
+      const fromFile =
+        name === ".tool-versions"
+          ? parseToolVersionsRuby(text)
+          : name.endsWith(".toml")
+            ? parseMiseRuby(text)
+            : parseRubyVersionFile(text);
+      add(fromFile ? { ...fromFile, source: "Gemfile" } : undefined, gemfile);
+    }
+  } else {
+    add(directive, gemfile);
+  }
+  return declarations;
+}
+
+// The Ruby a lockfile was resolved with is what the project ran on; the pin
+// files say what developers select; the Gemfile says what Bundler accepts.
+const DECLARATION_PRECEDENCE = [
+  "Gemfile.lock",
+  ".ruby-version",
+  ".tool-versions",
+  "mise.toml",
+  ".mise.toml",
+  ".config/mise.toml",
+  "Gemfile",
+];
+
+/**
+ * Settle the Ruby a project runs on from its declarations: the exact version
+ * of the most authoritative source that has one, and the requirements of the
+ * sources that only constrain it.
+ *
+ * @param {Array<Object>} declarations result of collectProjectRubyDeclarations
+ * @returns {{engine: string, version?: string, patchlevel?: string,
+ *   prerelease?: boolean, rubyVersion?: string, source?: string,
+ *   requirements: string[], conflicts: string[]}|undefined}
+ */
+export function resolveProjectRuby(declarations) {
+  if (!declarations?.length) {
+    return undefined;
+  }
+  const ordered = [...declarations].sort(
+    (a, b) =>
+      DECLARATION_PRECEDENCE.indexOf(a.source) -
+      DECLARATION_PRECEDENCE.indexOf(b.source),
+  );
+  let exact = ordered.find((declaration) => declaration.version);
+  // Bundler records a pre-release as `ruby 3.4.0p-1`, without its tag. A pin
+  // that names the tag of that same version says which pre-release it is.
+  const lockedPrerelease = exact?.prerelease ? exact : undefined;
+  if (lockedPrerelease) {
+    exact =
+      ordered.find(
+        (declaration) =>
+          declaration.engine === lockedPrerelease.engine &&
+          declaration.version?.startsWith(`${lockedPrerelease.version}-`),
+      ) || lockedPrerelease;
+  }
+  const requirements = ordered
+    .filter((declaration) => declaration.requirement)
+    .map((declaration) => declaration.requirement);
+  const result = {
+    engine: exact?.engine || "ruby",
+    requirements,
+    conflicts: [],
+  };
+  if (exact) {
+    for (const key of [
+      "version",
+      "patchlevel",
+      "prerelease",
+      "rubyVersion",
+      "source",
+    ]) {
+      if (exact[key] !== undefined) {
+        result[key] = exact[key];
+      }
+    }
+    for (const other of ordered) {
+      if (
+        other !== exact &&
+        other !== lockedPrerelease &&
+        other.version &&
+        (other.engine !== exact.engine || other.version !== exact.version)
+      ) {
+        result.conflicts.push(
+          `${other.source}: ${other.engine} ${other.version}`,
+        );
+      }
+    }
+  }
+  return result;
+}
+
+/**
+ * Describe the Ruby runtime of a project as one external `platform`
  * component, and make the components that declare a `required_ruby_version`
  * depend on it (discussion 4409).
  *
- * The component stands for the Ruby the bundle as a whole runs on, so its
- * `versionRange` is the intersection of every requirement that could be read,
- * in the `vers` syntax CycloneDX mandates for the field. Each component's own
- * requirement stays in its `cdx:gem:rubyVersionSpecifiers` property. One
- * runtime component per distinct requirement would describe the same
- * interpreter many times over: a modest bundle spells `>= 2.x` a dozen ways.
+ * When the project pins a Ruby (Gemfile.lock `RUBY VERSION`, `.ruby-version`,
+ * `.tool-versions`, mise or the Gemfile `ruby` directive), the component names
+ * that version, `pkg:generic/ruby@3.3.6`, with the CPE a scanner matches
+ * interpreter advisories by. The requirements of the gems then stay in the
+ * `cdx:ruby:requiredVersionRange` property, since CycloneDX allows a
+ * `versionRange` only on a component without a version.
+ *
+ * Without a pin, the component stands for the Ruby the bundle as a whole runs
+ * on, so its `versionRange` is the intersection of every requirement that
+ * could be read, in the `vers` syntax CycloneDX mandates for the field. Each
+ * component's own requirement stays in its `cdx:gem:rubyVersionSpecifiers`
+ * property. One runtime component per distinct requirement would describe the
+ * same interpreter many times over: a modest bundle spells `>= 2.x` a dozen
+ * ways.
  *
  * The type is `platform`, the CycloneDX type for a runtime environment that
  * interprets software, and the one cdxgen gives the Ruby it finds in the
- * build environment. The purl names no version, since a range is not one.
+ * build environment. A range is not a version, so an unpinned purl names none.
  *
- * `isExternal` and `versionRange` are CycloneDX 1.7 fields, and without them
- * the component would claim the product bundles its interpreter, so the caller
- * decides whether the BOM should carry it at all.
+ * `isExternal` and `versionRange` are CycloneDX 1.7 fields. A pinned runtime
+ * also carries the `cdx:ruby:isExternal` property, which says the interpreter
+ * comes with the deployment environment in a BOM of an older spec; the caller
+ * decides whether such a BOM should carry an unpinned runtime at all.
  *
  * @param {Array} pkgList Components
  * @param {object} parentComponent The metadata.component, when the project is
  *   itself a gem
  * @param {Array} dependencies Dependency edges
+ * @param {object} [projectRuby] result of resolveProjectRuby
  * @returns {{pkgList: Array, dependencies: Array}} Components and edges with
  *   the runtime component added
  */
@@ -2889,6 +3342,7 @@ export function addRubyRuntimeComponent(
   pkgList,
   parentComponent,
   dependencies,
+  projectRuby,
 ) {
   const requirements = [];
   const declaringRefs = new Set();
@@ -2905,29 +3359,85 @@ export function addRubyRuntimeComponent(
       declaringRefs.add(component["bom-ref"]);
     }
   }
-  if (!declaringRefs.size) {
+  for (const requirement of projectRuby?.requirements || []) {
+    if (rubyRequirementToVers([requirement]) !== undefined) {
+      requirements.push(requirement);
+    }
+  }
+  const pinned = projectRuby?.version;
+  if (!pinned && !requirements.length) {
     return { pkgList, dependencies };
   }
-  const runtimeRef = genericPurl("ruby");
-  const runtimeComponent = {
-    type: "platform",
-    name: "ruby",
-    scope: "required",
-    // The interpreter comes with the deployment environment, not with the
-    // product the BOM describes
-    isExternal: true,
-    purl: runtimeRef,
-    "bom-ref": runtimeRef,
-  };
-  const versionRange = rubyRequirementToVers(requirements);
-  if (versionRange) {
-    runtimeComponent.versionRange = versionRange;
+  if (projectRuby && parentComponent?.["bom-ref"]) {
+    declaringRefs.add(parentComponent["bom-ref"]);
+  }
+  const versionRange = requirements.length
+    ? rubyRequirementToVers(requirements)
+    : undefined;
+  let runtimeComponent;
+  if (pinned) {
+    runtimeComponent = createRubyRuntimeComponent(pinned, {
+      engine: projectRuby.engine,
+      // Bundler records no tag for a pre-release, so no CPE can name it
+      withCpe: !projectRuby.prerelease,
+    });
+    runtimeComponent.scope = "required";
+    runtimeComponent.isExternal = true;
+    const properties = [
+      { name: "cdx:ruby:isExternal", value: "true" },
+      { name: "cdx:ruby:versionSource", value: projectRuby.source },
+    ];
+    if (projectRuby.prerelease) {
+      // Not the release of that number, and no tag says which pre-release
+      properties.push({ name: "cdx:ruby:prerelease", value: "true" });
+    }
+    if (projectRuby.patchlevel !== undefined) {
+      properties.push({
+        name: "cdx:ruby:patchlevel",
+        value: projectRuby.patchlevel,
+      });
+    }
+    if (projectRuby.rubyVersion) {
+      properties.push({
+        name: "cdx:ruby:languageVersion",
+        value: projectRuby.rubyVersion,
+      });
+    }
+    if (versionRange) {
+      properties.push({
+        name: "cdx:ruby:requiredVersionRange",
+        value: versionRange,
+      });
+    }
+    if (projectRuby.conflicts?.length) {
+      properties.push({
+        name: "cdx:ruby:conflictingDeclarations",
+        value: projectRuby.conflicts.join(", "),
+      });
+    }
+    runtimeComponent.properties = properties;
   } else {
-    thoughtLog(
-      "The Ruby version requirements of the gems exclude each other, so the Ruby runtime component carries no version range.",
-      { requirements },
-    );
+    const runtimeRef = genericPurl("ruby");
+    runtimeComponent = {
+      type: "platform",
+      name: "ruby",
+      scope: "required",
+      // The interpreter comes with the deployment environment, not with the
+      // product the BOM describes
+      isExternal: true,
+      purl: runtimeRef,
+      "bom-ref": runtimeRef,
+    };
+    if (versionRange) {
+      runtimeComponent.versionRange = versionRange;
+    } else {
+      thoughtLog(
+        "The Ruby version requirements of the gems exclude each other, so the Ruby runtime component carries no version range.",
+        { requirements },
+      );
+    }
   }
+  const runtimeRef = runtimeComponent["bom-ref"];
   const describedRefs = new Set(dependencies.map((d) => d.ref));
   const outDependencies = dependencies.map((d) =>
     declaringRefs.has(d.ref)

package/lib/ecosystems/rusi.js

@@ -14,6 +14,7 @@ import {
   reportPluginRunFailure,
   resolvePluginSourceDir,
 } from "../core/pluginRun.js";
+import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 
@@ -821,6 +822,15 @@ export function runRusiAnalysis(src, outputFile, options = {}) {
   if (!executable || !src || !outputFile) {
     return false;
   }
+  // rusi runs cargo and rustc on the project, which follow its
+  // `.cargo/config.toml` and `rust-toolchain.toml` and can compile its build
+  // scripts, so it waits for permission to run the project's tooling.
+  if (!isProjectToolingAllowed(options)) {
+    console.log(
+      "Skipping rusi since dependency installation is disabled. Rust evidence needs cargo to run on the project.",
+    );
+    return false;
+  }
 
   // cdxgen may run with its working directory already inside the project
   // while the source argument is relative to a repository root; a plain