@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/nodeBuildInfo.js

@@ -0,0 +1,218 @@
+// Bounded Node.js build-version reader for unpackaged `node` binaries.
+//
+// The Node.js the Docker Official images, the release tarballs, nvm, fnm and
+// volta install is not owned by any package manager, so a BOM sees it only as
+// a file. Its version decides whether the runtime is affected by advisories
+// such as CVE-2026-111497 (fixed in 22.23.4, 24.22.1 and 26.12.1).
+//
+// Two markers are compiled into the binary:
+// - the release URLs, `https://nodejs.org/download/<channel>/v<version>/`,
+//   which a build configured with release URLs (every nodejs.org build)
+//   carries for process.release.sourceUrl and headersUrl
+//   https://github.com/nodejs/node/blob/v24.22.0/src/node_metadata.cc#L191-L197
+// - `node.js/v<version>`, NUL-terminated, the inspector's /json/version
+//   Browser string, which every build with the inspector carries; it is the
+//   fallback for a build without release URLs.
+//   https://github.com/nodejs/node/blob/v24.22.0/src/inspector_socket_server.cc#L117
+//
+// process.versions.brotli is not a usable signal: Node.js backports the
+// decoder fix without changing it (24.22.1 still reports 1.2.0). The decoder
+// state is read separately, by brotliDecoder.js.
+
+import { basename } from "node:path";
+
+import { scanFileMarkers } from "../core/boundedFile.js";
+import { applyPurl, tryBuildPurl } from "./purl.js";
+
+const RELEASE_URL_MARKER = Buffer.from("https://nodejs.org/download/");
+const USER_AGENT_MARKER = Buffer.from("node.js/v");
+const MAX_VERSION_LENGTH = 64;
+const VERSION_RE = /^(\d+\.\d+\.\d+)(?:-([0-9A-Za-z][0-9A-Za-z.]*))?$/;
+const CHANNELS = new Set(["release", "rc", "nightly", "test", "v8-canary"]);
+
+/**
+ * The most node-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export const MAX_NODE_PROBES = 64;
+
+/**
+ * Whether a file name is one the Node.js runtime is installed under.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean} true for `node`, `nodejs` and `node.exe`
+ */
+export function isNodeBinaryName(fileName) {
+  if (typeof fileName !== "string" || !fileName) {
+    return false;
+  }
+  const name = basename(fileName.replaceAll("\\", "/"));
+  return name === "node" || name === "nodejs" || name === "node.exe";
+}
+
+/**
+ * Parse a Node.js version in the grammar the release tooling produces:
+ * `24.22.1`, `25.0.0-rc.1`, `26.0.0-nightly20260301abcdef`.
+ *
+ * @param {string} text candidate version, without the leading `v`
+ * @returns {string|undefined} the version, or undefined
+ */
+export function parseNodeVersion(text) {
+  if (typeof text !== "string" || !text || text.length > MAX_VERSION_LENGTH) {
+    return undefined;
+  }
+  return VERSION_RE.test(text) ? text : undefined;
+}
+
+function versionFromReleaseUrl(after) {
+  // <channel>/v<version>/...
+  const text = after.toString("latin1");
+  const slash = text.indexOf("/");
+  if (slash <= 0) {
+    return undefined;
+  }
+  const channel = text.slice(0, slash);
+  if (!CHANNELS.has(channel) || text[slash + 1] !== "v") {
+    return undefined;
+  }
+  const end = text.indexOf("/", slash + 2);
+  if (end === -1) {
+    return undefined;
+  }
+  const version = parseNodeVersion(text.slice(slash + 2, end));
+  return version ? { version, channel } : undefined;
+}
+
+function versionFromUserAgent(after) {
+  const end = after.indexOf(0);
+  if (end <= 0) {
+    return undefined;
+  }
+  return parseNodeVersion(after.toString("latin1", 0, end));
+}
+
+/**
+ * Read the Node.js version a `node` binary was built as.
+ *
+ * @param {string} absPath absolute path of the binary
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, channel?: string}|undefined}
+ *   source is `release-url` or `binary`
+ */
+export function readNodeBuildVersion(absPath, rootDir) {
+  const scan = scanFileMarkers(
+    absPath,
+    rootDir,
+    [RELEASE_URL_MARKER, USER_AGENT_MARKER],
+    { contextBytes: MAX_VERSION_LENGTH + 32, maxHits: 8 },
+  );
+  if (!scan || scan.skipped) {
+    return undefined;
+  }
+  const [releaseHits, userAgentHits] = scan.hits;
+  const fromBinary = userAgentHits
+    .map((hit) => versionFromUserAgent(hit.after))
+    .find(Boolean);
+  for (const hit of releaseHits) {
+    const release = versionFromReleaseUrl(hit.after);
+    // The headers URL names the release a binary was published as. A binary
+    // whose own version string disagrees is not that release, so the URL is
+    // used only when the two agree or the version string is missing.
+    if (release && (!fromBinary || fromBinary === release.version)) {
+      return {
+        version: release.version,
+        source: "release-url",
+        channel: release.channel,
+      };
+    }
+  }
+  return fromBinary ? { version: fromBinary, source: "binary" } : undefined;
+}
+
+/**
+ * The CPE that lets a downstream scanner match a Node.js version. NVD names the
+ * product node.js and keeps a pre-release in the update field.
+ *
+ * @param {string} version Node.js version
+ * @returns {string} CPE 2.3 string
+ */
+export function nodeCpe(version) {
+  const match = VERSION_RE.exec(version || "");
+  if (!match) {
+    return `cpe:2.3:a:nodejs:node.js:${version}:*:*:*:*:*:*:*`;
+  }
+  const update = match[2] ? match[2].replaceAll(".", "").toLowerCase() : "*";
+  return `cpe:2.3:a:nodejs:node.js:${match[1]}:${update}:*:*:*:*:*:*`;
+}
+
+/**
+ * A Node.js runtime is one `platform` component per distinct version, like the
+ * PHP and Go stdlib components. Its identity is `pkg:generic/node`: it is only
+ * used where no package manager owns the runtime.
+ *
+ * @param {string} version Node.js version
+ * @returns {Object} component with `purl`, `bom-ref` and `cpe`
+ */
+export function createNodeRuntimeComponent(version) {
+  return applyPurl(
+    { type: "platform", name: "node", version, cpe: nodeCpe(version) },
+    tryBuildPurl({ type: "generic", name: "node", version }),
+  );
+}
+
+/**
+ * The properties a node file component carries once its build is known.
+ *
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export function nodeBuildProperties(build) {
+  const properties = [
+    { name: "cdx:node:buildVersion", value: build.version },
+    { name: "cdx:node:buildVersionSource", value: build.source },
+  ];
+  if (build.channel) {
+    properties.push({ name: "cdx:node:releaseChannel", value: build.channel });
+  }
+  return properties;
+}
+
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export function createNodeRuntimeInventory() {
+  return { runtimeComponents: [], dependencies: [], runtimeRefs: new Set() };
+}
+
+/**
+ * Tag a node file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createNodeRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ */
+export function attachNodeBuild(inventory, component, build) {
+  component.properties.push(...nodeBuildProperties(build));
+  const runtime = createNodeRuntimeComponent(build.version);
+  const runtimeRef = runtime["bom-ref"];
+  if (!runtimeRef) {
+    return;
+  }
+  if (!inventory.runtimeRefs.has(runtimeRef)) {
+    inventory.runtimeRefs.add(runtimeRef);
+    inventory.runtimeComponents.push(runtime);
+    inventory.dependencies.push({ ref: runtimeRef, dependsOn: [] });
+  }
+  if (component["bom-ref"]) {
+    inventory.dependencies.push({
+      ref: component["bom-ref"],
+      dependsOn: [runtimeRef],
+    });
+  }
+}

package/lib/inventory/nodeHostProbe.js

@@ -0,0 +1,202 @@
+// Bounded, read-only probe for the Node.js no package manager owns on a live
+// host, for `-t os` / obom. The release tarballs, the nodejs.org installer and
+// the version managers (nvm, fnm, volta, asdf, mise, n) put Node.js where no
+// package database records it, so an OBOM sees neither the runtime nor the
+// Brotli decoder compiled into it.
+//
+// Candidates come from fixed directories and from each version manager's
+// tree under the home directories, one wildcard level at a time, never from a
+// walk of the file system. The ownership rules, caps and degradations are the
+// shared host-runtime probe's.
+
+import { join } from "node:path";
+
+import {
+  isDryRun,
+  readEnvironmentVariable,
+  recordActivity,
+} from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import {
+  attachBrotliDecoder,
+  createBrotliInventory,
+  finishBrotliInventory,
+  readBrotliDecoder,
+} from "./brotliDecoder.js";
+import {
+  isDirectory,
+  listDirectory,
+  probeHostRuntime,
+} from "./hostRuntimeProbe.js";
+import {
+  attachNodeBuild,
+  createNodeRuntimeInventory,
+  isNodeBinaryName,
+  MAX_NODE_PROBES,
+  readNodeBuildVersion,
+} from "./nodeBuildInfo.js";
+
+// The most directories one wildcard pattern may expand to.
+const MAX_EXPANDED_DIRECTORIES = 256;
+
+// Relative to the root.
+const POSIX_DIRECTORIES = {
+  linux: ["usr/local/bin", "opt/*/bin", "usr/local/n/versions/node/*/bin"],
+  darwin: ["usr/local/bin", "opt/homebrew/bin", "opt/*/bin"],
+};
+
+// Relative to a home directory.
+const VERSION_MANAGER_DIRECTORIES = [
+  ".nvm/versions/node/*/bin",
+  ".local/share/fnm/node-versions/*/installation/bin",
+  ".fnm/node-versions/*/installation/bin",
+  "Library/Application Support/fnm/node-versions/*/installation/bin",
+  ".volta/tools/image/node/*/bin",
+  ".asdf/installs/nodejs/*/bin",
+  ".local/share/mise/installs/node/*/bin",
+];
+
+const HOME_PARENTS = {
+  linux: ["home"],
+  darwin: ["Users"],
+};
+
+/**
+ * Expand a relative directory pattern whose `*` segments match one directory
+ * name each.
+ *
+ * @param {string} base absolute directory the pattern hangs off
+ * @param {string} pattern `/`-separated relative pattern
+ * @returns {string[]} existing directories, at most MAX_EXPANDED_DIRECTORIES
+ */
+function expandDirectories(base, pattern) {
+  let current = [base];
+  for (const segment of pattern.split("/")) {
+    const next = [];
+    for (const directory of current) {
+      if (segment !== "*") {
+        next.push(join(directory, segment));
+        continue;
+      }
+      for (const name of listDirectory(directory)) {
+        const child = join(directory, name);
+        if (isDirectory(child)) {
+          next.push(child);
+        }
+        if (next.length >= MAX_EXPANDED_DIRECTORIES) {
+          break;
+        }
+      }
+    }
+    current = next.slice(0, MAX_EXPANDED_DIRECTORIES);
+  }
+  return current.filter(isDirectory);
+}
+
+function homeDirectories(context) {
+  const { rootPath, platform } = context;
+  const homes = [];
+  if (platform === "linux") {
+    homes.push(join(rootPath, "root"));
+  }
+  for (const parent of HOME_PARENTS[platform] || []) {
+    for (const name of listDirectory(join(rootPath, parent))) {
+      const home = join(rootPath, parent, name);
+      if (isDirectory(home)) {
+        homes.push(home);
+      }
+    }
+  }
+  return homes.slice(0, MAX_EXPANDED_DIRECTORIES);
+}
+
+// Where the Node.js MSI installs, by itself or for Chocolatey's nodejs.install.
+function windowsInstallDirectory(context) {
+  const programFiles =
+    context.readEnv("ProgramFiles") || join(context.rootPath, "Program Files");
+  return join(programFiles, "nodejs");
+}
+
+function candidateDirectories(context) {
+  const { rootPath, platform } = context;
+  const directories = [];
+  if (platform === "win32") {
+    directories.push({ directory: windowsInstallDirectory(context) });
+    const appData = context.readEnv("APPDATA");
+    if (appData) {
+      for (const directory of expandDirectories(appData, "nvm/*")) {
+        directories.push({ directory });
+      }
+    }
+    return directories;
+  }
+  for (const pattern of POSIX_DIRECTORIES[platform] || []) {
+    for (const directory of expandDirectories(rootPath, pattern)) {
+      directories.push({ directory });
+    }
+  }
+  for (const home of homeDirectories(context)) {
+    for (const pattern of VERSION_MANAGER_DIRECTORIES) {
+      for (const directory of expandDirectories(home, pattern)) {
+        directories.push({ directory });
+      }
+    }
+  }
+  return directories;
+}
+
+function readBuild(context, candidate) {
+  const node = readNodeBuildVersion(candidate.real, context.realRoot);
+  if (!node) {
+    return undefined;
+  }
+  return { node, brotli: readBrotliDecoder(candidate.real, context.realRoot) };
+}
+
+/**
+ * Look for Node.js no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `node` binary
+ * with the cdx:node and cdx:brotli properties, one `platform` component per
+ * Node.js version with its CPE, and the brotli component when a binary embeds
+ * a decoder.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export function probeHostNode(options = {}) {
+  return probeHostRuntime(options, {
+    label: "Node.js",
+    ecosystem: "npm",
+    capability: "node-host-probe",
+    remediationId: "npm.host-probe.package-db-unreadable",
+    maxProbes: MAX_NODE_PROBES,
+    chocolateyPackages: ["nodejs", "nodejs-lts", "nodejs.install"],
+    chocolateyDirectories: (context) => [windowsInstallDirectory(context)],
+    directories: candidateDirectories,
+    classify: (name) => (isNodeBinaryName(name) ? "node" : undefined),
+    readBuild,
+    createInventory: () => ({
+      node: createNodeRuntimeInventory(),
+      brotli: createBrotliInventory(),
+    }),
+    attach: (inventory, component, build) => {
+      attachNodeBuild(inventory.node, component, build.node);
+      if (build.brotli) {
+        attachBrotliDecoder(inventory.brotli, component, build.brotli);
+      }
+    },
+    finish: (inventory) => {
+      const brotli = finishBrotliInventory(inventory.brotli);
+      return {
+        components: [...inventory.node.runtimeComponents, ...brotli.components],
+        dependencies: [...inventory.node.dependencies, ...brotli.dependencies],
+      };
+    },
+    hooks: {
+      isDryRun,
+      readEnvironmentVariable,
+      recordActivity,
+      recordDegradation,
+    },
+  });
+}

package/lib/inventory/osPackagePurl.js

@@ -0,0 +1,244 @@
+// The one place that decides what purl an operating-system package gets.
+//
+// A package found by `cdxgen -t docker <image>` and by `obom` run inside that
+// image must be the same package, so the OBOM rows, the file-to-package
+// resolver and the container scan all name a deb, an rpm or an apk package with
+// the vendor and the qualifiers set here and in getDistroInfo(): `arch`,
+// `distro`, `distro_name` and, when the package has one, `epoch`. A pacman
+// package has the vendor and only the `arch` qualifier the alpm type defines.
+// Homebrew, MacPorts and snap packages have no distro, so their purl is the
+// name and the version; a flatpak adds the `arch` and `branch` of its ref.
+//
+// None of these purls has a subpath. A subpath names a path inside a package;
+// the dpkg directory or the source rpm of a row is not one.
+
+import { getDistroInfo, isCleanDistroQualifier } from "./osinfo.js";
+import { tryBuildPurl } from "./purl.js";
+
+/**
+ * The purl types an OS scan builds from what a package manager reports.
+ * deb, rpm, apk and alpm belong to a distro; brew, macports, snap and flatpak
+ * belong to none. brew, macports, snap and flatpak are not purl-spec types;
+ * cdx-purl builds them as it builds `pkg:chocolatey`.
+ */
+export const OS_PACKAGE_PURL_TYPES = new Set([
+  "deb",
+  "rpm",
+  "apk",
+  "alpm",
+  "brew",
+  "macports",
+  "snap",
+  "flatpak",
+]);
+
+/**
+ * Whether a purl type is one of the OS package managers handled here.
+ *
+ * @param {string|undefined} type Purl type
+ * @returns {boolean} true for the types in OS_PACKAGE_PURL_TYPES
+ */
+export function isOsPackagePurlType(type) {
+  return OS_PACKAGE_PURL_TYPES.has(type);
+}
+
+/**
+ * Whether a value names an architecture. rpm says `(none)` and trivy says
+ * `None` for a package that has none, such as an rpm's `gpg-pubkey` key record;
+ * neither is an architecture, and neither belongs in a purl.
+ *
+ * @param {string|undefined|null} arch Architecture as a package manager reports it
+ * @returns {boolean} true for a real architecture
+ */
+export function isRealArchitecture(arch) {
+  const value = `${arch ?? ""}`.trim().toLowerCase();
+  return value !== "" && value !== "(none)" && value !== "none";
+}
+
+function isDigits(text) {
+  if (!text) {
+    return false;
+  }
+  for (let i = 0; i < text.length; i++) {
+    const code = text.charCodeAt(i);
+    if (code < 48 || code > 57) {
+      return false;
+    }
+  }
+  return true;
+}
+
+// An epoch is a non-negative integer, and 0 is the same as none. Anything else
+// ("", "(none)", "null") is no epoch.
+function normaliseEpoch(value) {
+  const text = `${value ?? ""}`.trim();
+  if (!isDigits(text)) {
+    return undefined;
+  }
+  const digits = text.replace(/^0+/, "");
+  return digits || undefined;
+}
+
+// dpkg writes a version as [epoch:]upstream[-revision]. A colon is only ever an
+// epoch's separator when what comes before it is all digits.
+function debVersionEpoch(version) {
+  const colon = version.indexOf(":");
+  if (colon <= 0) {
+    return undefined;
+  }
+  const prefix = version.slice(0, colon);
+  return isDigits(prefix) ? prefix : undefined;
+}
+
+/**
+ * The epoch of an OS package, as the `epoch` qualifier carries it.
+ *
+ * An rpm keeps its epoch in a field of its own. A deb keeps it in its version
+ * (`2:93`), so the version is read first. Epoch 0 and no epoch are the same,
+ * and apk and Homebrew packages have none.
+ *
+ * @param {{type: string, version?: string, epoch?: string|number}} pkg Package
+ * @returns {string|undefined} The epoch without leading zeros, or undefined
+ */
+export function osPackageEpoch(pkg) {
+  switch (pkg?.type) {
+    case "rpm":
+      return normaliseEpoch(pkg.epoch);
+    case "deb": {
+      const fromVersion = debVersionEpoch(`${pkg.version ?? ""}`);
+      return fromVersion === undefined
+        ? normaliseEpoch(pkg.epoch)
+        : normaliseEpoch(fromVersion);
+    }
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * The version an OS package carries on its component and in its purl.
+ *
+ * - rpm: `[epoch:]version-release`, the form the container scan writes. The
+ *   purl spec keeps the epoch out of an rpm version, but the container scan
+ *   puts it in the version as well as in the `epoch` qualifier, and an OBOM must
+ *   name the package the same way.
+ * - deb: the version exactly as dpkg reports it, epoch included.
+ * - macports: `version_revision`, the form `port installed` prints.
+ * - apk, alpm, brew, snap and flatpak: the version as it is. A pacman version
+ *   already holds its epoch and release (`1:1.3.2-4`).
+ *
+ * @param {{type: string, version?: string, release?: string, epoch?: string|number, revision?: string|number}} pkg Package
+ * @returns {string} The version, or an empty string when the package has none
+ */
+export function osPackageVersion(pkg) {
+  const version = `${pkg?.version ?? ""}`;
+  if (!version) {
+    return "";
+  }
+  switch (pkg.type) {
+    case "rpm": {
+      const release = `${pkg.release ?? ""}`;
+      const evr = release ? `${version}-${release}` : version;
+      const epoch = osPackageEpoch(pkg);
+      return epoch ? `${epoch}:${evr}` : evr;
+    }
+    case "deb": {
+      if (debVersionEpoch(version) !== undefined) {
+        return version;
+      }
+      const epoch = normaliseEpoch(pkg.epoch);
+      return epoch ? `${epoch}:${version}` : version;
+    }
+    case "macports": {
+      // Revision 0 is a real revision: `port installed` prints `@3.6.0_0`.
+      const revision = `${pkg.revision ?? ""}`.trim();
+      return isDigits(revision) ? `${version}_${revision}` : version;
+    }
+    default:
+      return version;
+  }
+}
+
+/**
+ * Build the purl of an OS package.
+ *
+ * deb, rpm and apk purls take their vendor (`ubuntu`, `almalinux`, `alpine`,
+ * `wolfi`) and the `distro` and `distro_name` qualifiers from the distro, plus
+ * `arch` and `epoch` from the package. alpm purls take the vendor (`arch`,
+ * `manjaro`) and `arch` only: that is all the alpm type defines, and an Arch
+ * system is rolling, with no release to name. A qualifier with no value is
+ * left out. brew, macports and snap purls carry neither vendor nor qualifiers;
+ * a flatpak purl carries the `arch` and `branch` of the flatpak ref.
+ *
+ * @param {Object} pkg The package
+ * @param {string} pkg.type One of OS_PACKAGE_PURL_TYPES
+ * @param {string} pkg.name Package name; a flatpak's application ID
+ * @param {string} [pkg.version] deb: the dpkg version. rpm: the version tag only. apk: version-rN. macports: the version without its revision.
+ * @param {string} [pkg.release] rpm release tag
+ * @param {string|number} [pkg.epoch] rpm epoch tag
+ * @param {string|number} [pkg.revision] MacPorts revision
+ * @param {string} [pkg.arch] Package architecture
+ * @param {string} [pkg.branch] flatpak branch (`stable`, `48`)
+ * @param {{namespace?: string, distroId?: string, distroName?: string}} [distro]
+ *   What getDistroInfo() reports; read from the host's os-release when left out
+ * @returns {string|null} The purl, or null when the parts do not form a valid one
+ */
+export function buildOsPackagePurl(pkg, distro) {
+  const type = pkg?.type;
+  const name = `${pkg?.name ?? ""}`;
+  if (!isOsPackagePurlType(type) || !name) {
+    return null;
+  }
+  const version = osPackageVersion(pkg) || null;
+  switch (type) {
+    case "brew":
+    case "macports":
+    case "snap":
+      return tryBuildPurl({ type, name, version });
+    case "flatpak": {
+      const qualifiers = {};
+      if (isRealArchitecture(pkg.arch)) {
+        qualifiers.arch = `${pkg.arch}`.trim();
+      }
+      const branch = `${pkg.branch ?? ""}`.trim();
+      if (branch) {
+        qualifiers.branch = branch;
+      }
+      return tryBuildPurl({
+        type,
+        name,
+        version,
+        qualifiers: Object.keys(qualifiers).length ? qualifiers : null,
+      });
+    }
+    default:
+      break;
+  }
+  const { namespace, distroId, distroName } = distro || getDistroInfo();
+  if (!namespace) {
+    return null;
+  }
+  const qualifiers = {};
+  if (isRealArchitecture(pkg.arch)) {
+    qualifiers.arch = `${pkg.arch}`.trim();
+  }
+  if (type !== "alpm") {
+    if (isCleanDistroQualifier(distroId)) {
+      qualifiers.distro = distroId;
+    }
+    if (isCleanDistroQualifier(distroName)) {
+      qualifiers.distro_name = distroName;
+    }
+    const epoch = osPackageEpoch(pkg);
+    if (epoch) {
+      qualifiers.epoch = epoch;
+    }
+  }
+  return tryBuildPurl({
+    type,
+    namespace,
+    name,
+    version,
+    qualifiers: Object.keys(qualifiers).length ? qualifiers : null,
+  });
+}