@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/inventory/osPackageResolver.js

@@ -1,13 +1,13 @@
 import { readFileSync, realpathSync } from "node:fs";
 import { join, relative } from "node:path";
 
-import { build } from "@cdxgen/cdx-purl";
 import { globSync } from "glob";
 
 import { DEBUG_MODE, recordSymlinkResolution } from "../core/activity.js";
 import { safeExistsSync, safeSpawnSync } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
 import { getDistroInfo } from "./osinfo.js";
+import { buildOsPackagePurl } from "./osPackagePurl.js";
 
 // ---------------------------------------------------------------------------
 // Caches
@@ -48,58 +48,34 @@ function parseAlpinePackage(pkgStr) {
 // ---------------------------------------------------------------------------
 // Build a PackageURL string from resolved package info.
 //
-// Distro qualifiers (distro, distro_name) are taken from /etc/os-release via
-// getDistroInfo() so they are always accurate, never hardcoded.
+// deb, rpm, apk and Homebrew packages are named by buildOsPackagePurl, the
+// function the OBOM rows use as well, so a file and the package that owns it
+// share one identity with the package an OBOM or a container scan lists. The
+// distro qualifiers come from /etc/os-release via getDistroInfo(), never from
+// a hard-coded table.
 //
-// "brew" is not an official PackageURL type — Homebrew packages are emitted
-// as pkg:generic with a package_manager=homebrew qualifier.
+// Homebrew has no official purl type yet, but cdx-purl builds pkg:brew, as the
+// OBOM does for its homebrew_packages rows. A brew purl carries no qualifiers:
+// this used to pass an `arch` that the generic type it fell back to does not
+// allow, so build() threw and a file of a Homebrew package got no purl at all.
 // ---------------------------------------------------------------------------
 function buildPurl(pkgInfo) {
-  let purlType = pkgInfo.type;
-  let namespace;
-  const qualifiers = {};
-
-  if (pkgInfo.arch) {
-    qualifiers.arch = pkgInfo.arch;
-  }
-
-  if (purlType === "deb" || purlType === "apk" || purlType === "rpm") {
-    const di = getDistroInfo();
-    namespace = di.namespace;
-
-    // distro qualifier: ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17")
-    if (di.distroId) {
-      qualifiers.distro = di.distroId;
-    }
-    // distro_name qualifier: codename (e.g. "jammy", "bookworm")
-    if (di.distroName) {
-      qualifiers.distro_name = di.distroName;
-    }
-  } else if (purlType === "brew") {
-    // No official brew purl type — fall back to generic. This used to add a
-    // `package_manager=homebrew` qualifier, which generic does not allow, so
-    // build() threw and the catch below swallowed it: Homebrew packages silently
-    // received no purl at all on macOS. The provenance is instead recorded as a
-    // property by the caller.
-    purlType = "generic";
-  }
+  const distro =
+    pkgInfo.type === "brew" || !pkgInfo.type ? undefined : getDistroInfo();
+  return buildOsPackagePurl(pkgInfo, distro) || "";
+}
 
-  const finalQualifiers = Object.keys(qualifiers).length
-    ? qualifiers
-    : undefined;
+// apk names an architecture its own way, which is not the way node does.
+const APK_ARCHITECTURES = {
+  x64: "x86_64",
+  arm64: "aarch64",
+  ia32: "x86",
+  ppc64: "ppc64le",
+  loong64: "loongarch64",
+};
 
-  try {
-    return build({
-      type: purlType,
-      namespace: namespace || undefined || null,
-      name: pkgInfo.name,
-      version: pkgInfo.version || undefined || null,
-      qualifiers: finalQualifiers || null,
-      subpath: undefined || null,
-    });
-  } catch (_e) {
-    return "";
-  }
+function apkArchitecture() {
+  return APK_ARCHITECTURES[process.arch] || process.arch;
 }
 
 // ---------------------------------------------------------------------------
@@ -111,7 +87,7 @@ function buildPurl(pkgInfo) {
  * correctly computed purl with distro qualifiers derived from /etc/os-release.
  *
  * @param {string} filePath - Absolute path to the library file
- * @returns {{ name: string, version: string, arch: string, type: string, purl: string } | undefined}
+ * @returns {{ name: string, version: string, arch: string, type: string, epoch?: string, purl: string } | undefined}
  */
 export function resolvePackageForFile(filePath) {
   if (!filePath) {
@@ -190,27 +166,30 @@ function _resolveLinux(filePath) {
       return {
         name,
         version,
-        arch: process.arch === "x64" ? "x86_64" : process.arch,
+        arch: apkArchitecture(),
         type: "apk",
       };
     }
   }
 
-  // 3. RPM-based (rpm -qf)
+  // 3. RPM-based (rpm -qf). The epoch is part of an rpm's identity; %{EPOCH} is
+  // (none) for a package without one, so the conditional makes that a 0, which
+  // means the same.
   const rpmRes = safeSpawnSync("rpm", [
     "-qf",
     "--qf",
-    "%{NAME} %{VERSION}-%{RELEASE} %{ARCH}\n",
+    "%{NAME} %|EPOCH?{%{EPOCH}}:{0}| %{VERSION}-%{RELEASE} %{ARCH}\n",
     filePath,
   ]);
   if (rpmRes && rpmRes.status === 0 && rpmRes.stdout) {
     const line = rpmRes.stdout.split("\n")[0].trim();
     const parts = line.split(" ");
-    if (parts.length >= 3) {
+    if (parts.length >= 4) {
       return {
         name: parts[0],
-        version: parts[1],
-        arch: parts[2],
+        epoch: parts[1],
+        version: parts[2],
+        arch: parts[3],
         type: "rpm",
       };
     }
@@ -233,7 +212,7 @@ function _resolveDarwin(filePath) {
           name: segments[0],
           version: segments[1],
           arch: process.arch,
-          type: "brew", // remapped to pkg:generic in buildPurl
+          type: "brew",
         };
       }
     }
@@ -379,6 +358,9 @@ function shouldPreferUsrMergedExecutablePath(file, existingFile) {
  * @param ldConf {String} Config file used by ldconfig to locate additional paths
  * @param ldConfDirPattern {String} Config directory that can contain more .conf files for ldconfig
  * @param excludePaths {Array[String]} Container-relative paths that should be excluded from the result set
+ * @param extraLibGlobs {Array[String]} Extra container-relative globs for files
+ *   the default paths miss, such as libphp*.so under Apache's modules
+ *   directory. The existing globs are unchanged; this adds candidates only.
  *
  * @return {Array[String]} List of executables
  */
@@ -388,6 +370,7 @@ export function collectSharedLibs(
   ldConf,
   ldConfDirPattern,
   excludePaths = [],
+  extraLibGlobs = [],
 ) {
   if (!libPaths) {
     return [];
@@ -399,6 +382,37 @@ export function collectSharedLibs(
   const ignoreList = [
     "**/*.{h,c,cpp,hpp,man,txt,md,htm,html,jar,ear,war,zip,tar,egg,keepme,gitignore,json,js,py,pyc}",
   ];
+  const addCandidate = (file) => {
+    let resolvedFile = file;
+    try {
+      resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
+      recordSymlinkResolution(join(basePath, file), resolvedFile, {
+        basePath,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
+      });
+    } catch (err) {
+      recordSymlinkResolution(join(basePath, file), undefined, {
+        basePath,
+        errorCode: err?.code || err?.name,
+        metadata: {
+          resolutionKind: "shared-library",
+        },
+        reason: `Failed to resolve shared library candidate ${file}.`,
+        status: "failed",
+      });
+      // Broken symlinks or permission errors can prevent realpath resolution.
+    }
+    if (
+      excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
+      excludedPathSet.has(resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"))
+    ) {
+      return;
+    }
+    sharedLibs.push(file);
+  };
   const allLdConfDirs = ldConfDirPattern ? [ldConfDirPattern] : [];
   collectAllLdConfs(basePath, ldConf, allLdConfDirs, libPaths);
   if (allLdConfDirs.length) {
@@ -428,37 +442,25 @@ export function collectSharedLibs(
         ignore: ignoreList,
       });
       for (const file of files) {
-        let resolvedFile = file;
-        try {
-          resolvedFile = relative(basePath, realpathSync(join(basePath, file)));
-          recordSymlinkResolution(join(basePath, file), resolvedFile, {
-            basePath,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Resolved shared library candidate ${file} to ${resolvedFile}.`,
-          });
-        } catch (err) {
-          recordSymlinkResolution(join(basePath, file), undefined, {
-            basePath,
-            errorCode: err?.code || err?.name,
-            metadata: {
-              resolutionKind: "shared-library",
-            },
-            reason: `Failed to resolve shared library candidate ${file}.`,
-            status: "failed",
-          });
-          // Broken symlinks or permission errors can prevent realpath resolution.
-        }
-        if (
-          excludedPathSet.has(file.replace(/^\/+/, "").replace(/\\/g, "/")) ||
-          excludedPathSet.has(
-            resolvedFile.replace(/^\/+/, "").replace(/\\/g, "/"),
-          )
-        ) {
-          continue;
-        }
-        sharedLibs.push(file);
+        addCandidate(file);
+      }
+    } catch (_err) {
+      // ignore
+    }
+  }
+  for (const pattern of extraLibGlobs) {
+    try {
+      const files = globSync(pattern, {
+        cwd: basePath,
+        absolute: false,
+        nocase: true,
+        nodir: true,
+        dot: true,
+        follow: true,
+        ignore: ignoreList,
+      });
+      for (const file of files) {
+        addCandidate(file);
       }
     } catch (_err) {
       // ignore
@@ -491,3 +493,185 @@ function collectAllLdConfs(basePath, ldConf, allLdConfDirs, libPaths) {
     }
   }
 }
+
+// Native modules that language package managers install outside the library
+// directories the loader searches: CPython and PyPy extension modules, PHP
+// extensions, Ruby gem extensions, Node.js addons, and the native half of a
+// .NET runtime. A Brotli decoder compiled into one of them is invisible unless
+// the file is read.
+const NATIVE_EXTENSION_GLOBS = [
+  "**/site-packages/**/*.{so,pyd}",
+  "**/dist-packages/**/*.so",
+  "**/lib/php/**/*.so",
+  "**/lib/php*/modules/*.so",
+  "**/php*/ext/php_*.dll",
+  "**/gems/*/lib/**/*.{so,bundle}",
+  "**/gems/*/extensions/**/*.{so,bundle}",
+  "**/bundle/extensions/**/*.{so,bundle}",
+  "**/node_modules/**/*.node",
+  "**/dotnet/shared/*/*/*.so",
+  "**/.dotnet/shared/*/*/*.so",
+  // Of a Windows runtime's many DLLs, only this one is native and holds the
+  // decoder.
+  "**/dotnet/shared/*/*/System.IO.Compression.Native.dll",
+];
+const NATIVE_EXTENSION_IGNORES = ["proc/**", "sys/**", "dev/**"];
+
+/**
+ * The most native extension candidates one scan returns.
+ *
+ * @type {number}
+ */
+export const MAX_NATIVE_EXTENSIONS = 4096;
+
+/**
+ * Collect native extension modules under a root file system that the library
+ * collector does not see, leaving out paths a package database owns and paths
+ * already collected. Symlinks are not followed, so a link pointing out of the
+ * root is never listed.
+ *
+ * @param {string} basePath extracted root file system
+ * @param {string[]} [excludePaths] root-relative paths to leave out
+ * @returns {string[]} root-relative paths, sorted, capped at MAX_NATIVE_EXTENSIONS
+ */
+export function collectNativeExtensions(basePath, excludePaths = []) {
+  if (!basePath) {
+    return [];
+  }
+  const excluded = new Set(
+    (excludePaths || []).map((f) => f.replace(/^\/+/, "").replace(/\\/g, "/")),
+  );
+  let files = [];
+  try {
+    files = globSync(NATIVE_EXTENSION_GLOBS, {
+      cwd: basePath,
+      absolute: false,
+      nodir: true,
+      dot: true,
+      follow: false,
+      ignore: NATIVE_EXTENSION_IGNORES,
+    });
+  } catch (_err) {
+    return [];
+  }
+  const result = new Set();
+  for (const file of files) {
+    const normalized = file.replace(/\\/g, "/").replace(/^\/+/, "");
+    if (!excluded.has(normalized)) {
+      result.add(normalized);
+    }
+  }
+  return Array.from(result).sort().slice(0, MAX_NATIVE_EXTENSIONS);
+}
+
+const OS_PACKAGE_PURL_PREFIXES = [
+  "pkg:deb/",
+  "pkg:apk/",
+  "pkg:rpm/",
+  "pkg:alpm/",
+  "pkg:qpkg/",
+  "pkg:generic/",
+];
+
+/**
+ * Whether a source file is the installation record of a language package,
+ * the file a package manager writes when it installs the package: dist-info
+ * or egg-info metadata, an installed gemspec, a package.json inside
+ * node_modules, or a jar. A lock file or manifest only names packages, so an
+ * OS package owning one says nothing about who installed them.
+ *
+ * @param {string} filePath root-relative path with forward slashes
+ * @returns {boolean}
+ */
+function isInstallRecord(filePath) {
+  const parts = filePath.split("/");
+  const name = parts.at(-1) || "";
+  const parent = parts.at(-2) || "";
+  if (parent.endsWith(".dist-info") || parent.endsWith(".egg-info")) {
+    return true;
+  }
+  if (name.endsWith(".egg-info") || name.endsWith(".jar")) {
+    return true;
+  }
+  if (name.endsWith(".gemspec") && parts.includes("specifications")) {
+    return true;
+  }
+  return name === "package.json" && parts.includes("node_modules");
+}
+
+/**
+ * Mark language packages that an OS package installed. Alpine's py3-brotli
+ * ships a Brotli-1.1.0.dist-info that a Python scan reports as
+ * pkg:pypi/brotli@1.1.0, but a distro fixes it by backporting under the same
+ * upstream version, so a PyPI advisory range keeps matching after the fix. The
+ * `cdx:os:installedBy` property names the OS package that owns the
+ * installation record, so a consumer can judge the component by that package
+ * instead.
+ *
+ * A component is marked only when every installation record it was read from
+ * belongs to an OS package: a copy that pip put in a virtual environment
+ * beside the distro's is not the distro's to fix. Run it after duplicates
+ * merge, so that a merged component carries all of its records.
+ *
+ * @param {Object[]} components BOM components, mutated in place
+ * @param {Map<string, string>|undefined} ownerByPath root-relative file path to
+ *   owning OS package bom-ref
+ * @param {string} [rootDir] extracted root, stripped from absolute source paths
+ * @returns {number} how many components were marked
+ */
+export function markOsInstalledLanguagePackages(
+  components,
+  ownerByPath,
+  rootDir,
+) {
+  if (!ownerByPath?.size || !Array.isArray(components)) {
+    return 0;
+  }
+  const rootPrefix = rootDir
+    ? rootDir.replaceAll("\\", "/").replace(/\/+$/, "")
+    : undefined;
+  let marked = 0;
+  for (const component of components) {
+    const purl = component?.purl;
+    if (
+      typeof purl !== "string" ||
+      !purl.startsWith("pkg:") ||
+      OS_PACKAGE_PURL_PREFIXES.some((prefix) => purl.startsWith(prefix)) ||
+      !Array.isArray(component.properties) ||
+      component.properties.some((prop) => prop.name === "cdx:os:installedBy")
+    ) {
+      continue;
+    }
+    const owners = new Set();
+    let records = 0;
+    let unowned = 0;
+    for (const prop of component.properties) {
+      if (prop.name !== "internal:SrcFile" || typeof prop.value !== "string") {
+        continue;
+      }
+      let filePath = prop.value.replaceAll("\\", "/");
+      if (rootPrefix && filePath.startsWith(`${rootPrefix}/`)) {
+        filePath = filePath.slice(rootPrefix.length);
+      }
+      filePath = filePath.replace(/^\/+/, "");
+      if (!isInstallRecord(filePath)) {
+        continue;
+      }
+      records += 1;
+      const owner = ownerByPath.get(filePath);
+      if (owner) {
+        owners.add(owner);
+      } else {
+        unowned += 1;
+      }
+    }
+    if (!records || unowned) {
+      continue;
+    }
+    for (const owner of Array.from(owners).sort()) {
+      component.properties.push({ name: "cdx:os:installedBy", value: owner });
+    }
+    marked += 1;
+  }
+  return marked;
+}

package/lib/inventory/osinfo.js

@@ -49,14 +49,34 @@ export const OS_DISTRO_ALIAS = {
   "ubuntu-24.10": "oracular",
   "ubuntu-25.04": "plucky",
   "ubuntu-25.10": "questing",
+  "ubuntu-26.04": "resolute",
+  "ubuntu-26.10": "stonking",
   "debian-15": "duke",
   "debian-14": "forky",
   "debian-14.5": "forky",
   "debian-13": "trixie",
+  "debian-13.7": "trixie",
+  "debian-13.6": "trixie",
   "debian-13.5": "trixie",
+  "debian-13.4": "trixie",
+  "debian-13.3": "trixie",
+  "debian-13.2": "trixie",
+  "debian-13.1": "trixie",
   "debian-12": "bookworm",
-  "debian-12.5": "bookworm",
+  "debian-12.15": "bookworm",
+  "debian-12.14": "bookworm",
+  "debian-12.13": "bookworm",
+  "debian-12.12": "bookworm",
+  "debian-12.11": "bookworm",
+  "debian-12.10": "bookworm",
+  "debian-12.9": "bookworm",
+  "debian-12.8": "bookworm",
+  "debian-12.7": "bookworm",
   "debian-12.6": "bookworm",
+  "debian-12.5": "bookworm",
+  "debian-12.4": "bookworm",
+  "debian-12.2": "bookworm",
+  "debian-12.1": "bookworm",
   "debian-11": "bullseye",
   "debian-11.5": "bullseye",
   "debian-10": "buster",
@@ -256,15 +276,20 @@ export function _resetOsReleaseCache() {
  * Derive structured distro information from an os-release file.
  *
  * Returns an object with:
- *   - purlType    {string}  "deb" | "apk" | "rpm"
+ *   - purlType    {string}  "deb" | "apk" | "rpm" | "alpm" (Arch and the
+ *                           distros built on it)
  *   - namespace   {string}  canonical purl namespace (e.g. "ubuntu", "alpine",
  *                           "azure-linux" for both Azure Linux and CBL-Mariner)
  *   - distroId    {string}  ID + "-" + VERSION_ID with a canonical vendor
- *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0")
- *   - distroName  {string}  codename/alias          (e.g. "jammy")
+ *                           prefix (e.g. "ubuntu-22.04", "azure-linux-3.0",
+ *                           "alpine-3.24.3")
+ *   - distroName  {string}  release codename, or a token OS_DISTRO_ALIAS knows
+ *                           (e.g. "jammy", "rhel", "alpine-3.24"); empty when
+ *                           the distro has neither
  *
- * Mirrors the logic in lib/managers/binary.js getOSPackages() so that both
- * callers share a single implementation.
+ * lib/managers/binary.js getOSPackages() reads its distro from here, so a
+ * container scan and an OBOM run on the same system give a package the same
+ * `distro` and `distro_name` qualifiers.
  *
  * @param {string} [root="/"] - Filesystem root to look for os-release.
  * @returns {{ purlType: string, namespace: string, distroId: string, distroName: string }}
@@ -290,6 +315,8 @@ export function getDistroInfo(root = "/") {
     case "alpine":
     case "alpaquita":
     case "openwrt":
+    case "wolfi":
+    case "chainguard":
       purlType = "apk";
       break;
     case "sles":
@@ -312,11 +339,23 @@ export function getDistroInfo(root = "/") {
     case "photon":
       purlType = "rpm";
       break;
+    case "arch":
+    case "archarm":
+    case "manjaro":
+    case "endeavouros":
+    case "cachyos":
+    case "steamos":
+    case "artix":
+      purlType = "alpm";
+      break;
     default:
       if (idLike.includes("debian") || idLike.includes("ubuntu")) {
         purlType = "deb";
       } else if (idLike.includes("alpine")) {
         purlType = "apk";
+      } else if (idLike.split(/\s+/u).includes("arch")) {
+        // A token, not a substring: ID_LIKE is a space-separated list.
+        purlType = "alpm";
       } else if (
         idLike.includes("rhel") ||
         idLike.includes("centos") ||
@@ -343,41 +382,50 @@ export function getDistroInfo(root = "/") {
       namespace = "debian";
     } else if (idLike.includes("ubuntu")) {
       namespace = "ubuntu";
+    } else if (purlType === "alpm") {
+      namespace = "arch";
     } else {
       namespace = "linux";
     }
   }
 
-  // Build distroId = ID-VERSION_ID (e.g. "fedora-25", "alpine-3.17"),
-  // canonicalising the vendor prefix so one release has a single qualifier
-  // value (e.g. "mariner-2.0" and "azurelinux-3.0" -> "azure-linux-2.0"/
-  // "azure-linux-3.0")
-  let distroId = versionId ? `${rawId}-${versionId}` : rawId;
-  distroId = canonicalDistroQualifier(distroId);
+  // Build distroId = ID-VERSION_ID as os-release writes it (e.g. "fedora-25",
+  // "alpine-3.24.3"), canonicalising the vendor prefix so one release has a
+  // single qualifier value (e.g. "mariner-2.0" and "azurelinux-3.0" ->
+  // "azure-linux-2.0"/"azure-linux-3.0")
+  const releaseId = versionId ? `${rawId}-${versionId}` : rawId;
+  const distroId = canonicalDistroQualifier(releaseId);
 
-  // Special-case Alpine: truncate to major.minor
-  if (purlType === "apk" && versionId) {
+  // distro_name is a release codename or a token OS_DISTRO_ALIAS knows
+  // ("bookworm", "jammy", "rhel", "alpine-3.24"), never a product display
+  // name: "AlmaLinux" or "Rocky Linux 9" has no place in a purl, since RPM
+  // distros track packages flat and a display name there breaks vulnerability
+  // matching. A product name counts only when it resolves through the alias
+  // table, which holds the RHEL names.
+  let distroName = (info.VERSION_CODENAME || "").toLowerCase();
+  if (!distroName) {
+    const productName = (
+      info.CENTOS_MANTISBT_PROJECT ||
+      info.REDHAT_BUGZILLA_PRODUCT ||
+      info.REDHAT_SUPPORT_PRODUCT ||
+      ""
+    ).toLowerCase();
+    if (productName && Object.hasOwn(OS_DISTRO_ALIAS, productName)) {
+      distroName = OS_DISTRO_ALIAS[productName];
+    }
+  }
+  // Alpine names its release series: 3.24.3 belongs to alpine-3.24, the unit
+  // its security data is kept in.
+  if (rawId === "alpine" && versionId) {
     const parts = versionId.split(".");
     if (parts.length >= 2) {
-      distroId = `${rawId}-${parts[0]}.${parts[1]}`;
+      distroName = `alpine-${parts[0]}.${parts[1]}`;
     }
   }
-
-  // Determine codename / alias
-  let distroName =
-    info.VERSION_CODENAME ||
-    info.CENTOS_MANTISBT_PROJECT ||
-    info.REDHAT_BUGZILLA_PRODUCT ||
-    info.REDHAT_SUPPORT_PRODUCT ||
-    "";
-  distroName = distroName.toLowerCase();
-
-  // Resolve well-known display name aliases
-  if (distroName.includes(" ") && OS_DISTRO_ALIAS[distroName]) {
-    distroName = OS_DISTRO_ALIAS[distroName];
-  }
-  if (!distroName && OS_DISTRO_ALIAS[distroId]) {
-    distroName = OS_DISTRO_ALIAS[distroId];
+  // The alias of the release itself (ubuntu-24.04 -> noble) wins over the
+  // codename the file carries.
+  if (versionId && Object.hasOwn(OS_DISTRO_ALIAS, releaseId)) {
+    distroName = OS_DISTRO_ALIAS[releaseId];
   }
 
   return { purlType, namespace, distroId, distroName };