@cdxgen/cdxgen 13.4.0 → 13.6.0

package/lib/cli/index.js

@@ -50,7 +50,9 @@ import {
   buildDependencyTrackBomRequest,
   getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
+import { collectObomIdeInventory } from "../helpers/vsixutils.js";
 import { optionIncludesAiInventoryProjectType } from "../inventory/aiInventory.js";
+import { readApkInstalledDb } from "../inventory/apkInstalledDb.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
 import {
   mergeDependencies,
@@ -58,7 +60,10 @@ import {
   trimComponents,
 } from "../inventory/depsUtils.js";
 import { buildDynamicComponents } from "../inventory/dynamic.js";
-import { convertOSQueryResults } from "../inventory/evidenceUtils.js";
+import {
+  convertApkPackages,
+  convertOSQueryResults,
+} from "../inventory/evidenceUtils.js";
 import {
   createHbomDocument,
   ensureHbomRuntimeSupport,
@@ -66,15 +71,28 @@ import {
   hasHbomProjectType,
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
+import { probeHostNode } from "../inventory/nodeHostProbe.js";
+import { markOsInstalledLanguagePackages } from "../inventory/osPackageResolver.js";
 import { orderParentCandidates } from "../inventory/parentSelection.js";
+import { probeHostPhp } from "../inventory/phpHostProbe.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
 import { applyPurl, ociPurl } from "../inventory/purl.js";
+import {
+  deriveOsPackagedRubyRuntimes,
+  linkDefaultGemsToRuntimes,
+} from "../inventory/rubyBuildInfo.js";
+import { probeHostRuby } from "../inventory/rubyHostProbe.js";
 import { table } from "../inventory/table.js";
 
 export { summarizeAiInventory } from "../inventory/aiInventory.js";
 
+import { probeHostRubyGems } from "../ecosystems/gemHostProbe.js";
+import {
+  mergeHostPythonEnvironmentPackages,
+  probeHostPythonEnvironments,
+} from "../ecosystems/venvProbe.js";
 import {
   enrichOSComponentsWithTrustData,
   executeOsQuery,
@@ -86,6 +104,7 @@ import {
   exportArchive,
   exportImage,
   getPkgPathList,
+  isFollowableManifestImage,
   isImageReference,
   parseImageName,
 } from "../managers/docker.js";
@@ -234,6 +253,28 @@ switch (_platform()) {
     break;
 }
 
+/**
+ * Home directories whose editor extension folders an OBOM reads: every user's
+ * home from osquery when cdxgen runs as root, and otherwise the current
+ * user's, which is the only one it can read.
+ *
+ * @returns {string[]} Home directories
+ */
+function obomUserHomes() {
+  const ownHome = homedir();
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+    return [ownHome];
+  }
+  const homes = new Set([ownHome]);
+  for (const row of executeOsQuery("SELECT directory FROM users;") || []) {
+    const dir = row?.directory;
+    if (typeof dir === "string" && dir.startsWith("/") && safeExistsSync(dir)) {
+      homes.add(dir);
+    }
+  }
+  return [...homes];
+}
+
 /**
  * Function to create obom string for the current OS using osquery
  *
@@ -241,7 +282,7 @@ switch (_platform()) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
-export function createOSBom(_path, options) {
+export async function createOSBom(_path, options) {
   console.warn(
     "About to generate OBOM for the current OS installation. This will take several minutes ...",
   );
@@ -272,6 +313,84 @@ export function createOSBom(_path, options) {
       );
     }
   } // for
+  // osquery has no apk table, so the packages of an Alpine, Wolfi or Chainguard
+  // host come from the apk installed database, after the osquery categories and
+  // as a category of their own. They are all components: the OS itself is the
+  // first row of the first osquery category, as before.
+  if (_platform() === "linux") {
+    const apkInventory = readApkInstalledDb();
+    if (apkInventory.state === "unreadable") {
+      recordDegradation("os.apk-installed-db.unreadable", {
+        ecosystem: "generic",
+        tool: "apk",
+        impact: "components",
+        path: apkInventory.path,
+        detail:
+          "The apk installed database exists but could not be read in full, so the packages it lists are missing from the OBOM.",
+      });
+    }
+    if (apkInventory.packages.length) {
+      pkgList = pkgList.concat(
+        convertApkPackages(apkInventory.packages).sort((a, b) =>
+          a.name.localeCompare(b.name),
+        ),
+      );
+    }
+  }
+  // The package tables cannot see a PHP that no package manager installed. Its
+  // edges stay out: an OBOM has no dependency graph, and a partial one makes
+  // post-processing infer the OS root's dependencies from these files alone.
+  const hostPhp = probeHostPhp({ executeOsQuery, packageComponents: pkgList });
+  if (hostPhp.components.length) {
+    pkgList = pkgList.concat(hostPhp.components);
+  }
+  // Nor a Node.js from a release tarball or a version manager, or the Brotli
+  // decoder compiled into it.
+  const hostNode = probeHostNode({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostNode.components.length) {
+    pkgList = pkgList.concat(hostNode.components);
+  }
+  // Nor a Ruby from ruby-build, a version manager or a toolcache tarball.
+  const hostRuby = probeHostRuby({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostRuby.components.length) {
+    pkgList = pkgList.concat(hostRuby.components);
+  }
+  // A Ruby a package manager installed is also named by its upstream version.
+  pkgList = pkgList.concat(deriveOsPackagedRubyRuntimes(pkgList));
+  // osquery has no table for RubyGems; the gems of the host's gem homes are
+  // read from their specifications.
+  const hostGems = await probeHostRubyGems({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostGems.length) {
+    const knownRefs = new Set(pkgList.map((component) => component["bom-ref"]));
+    pkgList = pkgList.concat(
+      hostGems.filter((gem) => !knownRefs.has(gem["bom-ref"])),
+    );
+  }
+  // osquery reads the interpreter's own site-packages; packages installed into
+  // a virtual environment or a pyenv interpreter are read from their METADATA.
+  pkgList = mergeHostPythonEnvironmentPackages(
+    pkgList,
+    probeHostPythonEnvironments(),
+  );
+  // osquery reads the extension registry of a fixed list of editors; the
+  // editors themselves, and the extensions of the others, come from the
+  // extension folders. A root scan reads every user's home, as osquery does.
+  try {
+    pkgList = pkgList.concat(
+      collectObomIdeInventory(pkgList, { homes: obomUserHomes() }),
+    );
+  } catch (err) {
+    thoughtLog(`Unable to read the editor extension folders: ${err.message}`);
+  }
   const hostTrustInventory = enrichOSComponentsWithTrustData(pkgList);
   if (hostTrustInventory?.components?.length) {
     pkgList = hostTrustInventory.components;
@@ -515,11 +634,14 @@ export async function createContainerSpecLikeBom(path, options) {
             if (imageBomData?.bomJson?.components) {
               components = components.concat(imageBomData.bomJson.components);
             }
+            doneimages.push(img.image);
+            if (!isFollowableManifestImage(img.image, imageObj)) {
+              continue;
+            }
             const bomData = await createBom(img.image, {
               specVersion: options.specVersion,
               projectType: ["oci"],
             });
-            doneimages.push(img.image);
             if (bomData) {
               if (bomData.components?.length) {
                 // Inject properties
@@ -734,8 +856,10 @@ export async function createMultiXBom(pathList, options) {
   let dependencies = [];
   let bomData;
   let formulationList = [];
+  let metadataProperties = [];
   let parentComponent = determineParentComponent(options) || {};
   let parentSubComponents = [];
+  let osFileOwners;
   const setProjectTypeActivityContext = (projectType, sourcePath) => {
     setActivityContext({
       projectType,
@@ -756,6 +880,8 @@ export async function createMultiXBom(pathList, options) {
     const {
       osPackages,
       osPackageFiles,
+      nativeExtensionFiles,
+      ownerByPath,
       dependenciesList,
       allTypes,
       bundledSdks,
@@ -770,6 +896,7 @@ export async function createMultiXBom(pathList, options) {
       options.exportData?.inspectData?.Config,
       options,
     );
+    osFileOwners = ownerByPath;
     osPhase.succeed(
       summarizeCounts([
         [osPackages.length, "OS package", "OS packages"],
@@ -818,6 +945,7 @@ export async function createMultiXBom(pathList, options) {
     components = components.concat(osPackageFiles || []);
     components = components.concat(executables);
     components = components.concat(sharedLibs);
+    components = components.concat(nativeExtensionFiles || []);
     if (dependenciesList?.length) {
       dependencies = mergeDependencies(dependencies, dependenciesList);
     }
@@ -867,6 +995,7 @@ export async function createMultiXBom(pathList, options) {
         dependencies: [],
         options: { ...sharedOptions },
         parentSubComponents: [],
+        metadataProperties: [],
       };
     }
   };
@@ -879,6 +1008,7 @@ export async function createMultiXBom(pathList, options) {
     let components = [];
     let dependencies = [];
     let parentSubComponents = [];
+    let metadataProperties = [];
     // Each builder detects the project of its own ecosystem. A builder that sets
     // options.parentComponent to force its project into its own BOM must not
     // make that project the next builder's too, or the next ecosystem's project
@@ -1163,6 +1293,12 @@ export async function createMultiXBom(pathList, options) {
       }
       setProjectTypeActivityContext("php", path);
       bomData = await withOwnParent(() => createPHPBom(path, options));
+      // A lock with no packages can still hold the project's platform data.
+      if (bomData?.metadataProperties?.length) {
+        metadataProperties = metadataProperties.concat(
+          bomData.metadataProperties,
+        );
+      }
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} php packages.`,
@@ -1236,7 +1372,12 @@ export async function createMultiXBom(pathList, options) {
       }
       setProjectTypeActivityContext("csharp", path);
       bomData = await withOwnParent(() => createCsharpBom(path, options));
-      if (bomData?.bomJson?.components?.length) {
+      // Every project the scan read has a dependency entry of its own, so a
+      // project that uses no packages is kept along with its parent.
+      if (
+        bomData?.bomJson?.components?.length ||
+        bomData?.bomJson?.dependencies?.length
+      ) {
         thoughtLog(
           `There are ${bomData.bomJson.components.length} csharp packages.`,
         );
@@ -1753,9 +1894,18 @@ export async function createMultiXBom(pathList, options) {
           );
         }
         components = components.concat(bomData.bomJson.components);
+        if (bomData.dependencies?.length) {
+          dependencies = mergeDependencies(dependencies, bomData.dependencies);
+        }
       }
     }
-    return { components, dependencies, options, parentSubComponents };
+    return {
+      components,
+      dependencies,
+      options,
+      parentSubComponents,
+      metadataProperties,
+    };
   };
   const pathResults = [];
   // A container scan walks hundreds of paths, so the phase carries a bar and
@@ -1818,6 +1968,9 @@ export async function createMultiXBom(pathList, options) {
     parentSubComponents = parentSubComponents.concat(
       pathResult.parentSubComponents,
     );
+    metadataProperties = metadataProperties.concat(
+      pathResult.metadataProperties,
+    );
     if (pathResult.options.services?.length) {
       sharedOptions.services = mergeServices(
         sharedOptions.services || [],
@@ -1907,7 +2060,28 @@ export async function createMultiXBom(pathList, options) {
     components,
     parentComponent,
     dependencies,
-  );
+    metadataProperties,
+  );
+  // Language packages an OS package installed are judged by that package.
+  // Duplicates have merged by now, so a component found both where the distro
+  // put it and where pip did is seen whole and left unmarked.
+  markOsInstalledLanguagePackages(
+    multiResult.bomJson?.components,
+    osFileOwners,
+    options.allLayersExplodedDir,
+  );
+  // The default gems of an unpackaged Ruby, such as resolv in a Docker
+  // Official image, ship with that Ruby and are updated by its releases.
+  const defaultGemEdges = linkDefaultGemsToRuntimes(
+    multiResult.bomJson?.components,
+    options.allLayersExplodedDir,
+  );
+  if (defaultGemEdges.length && multiResult.bomJson) {
+    multiResult.bomJson.dependencies = mergeDependencies(
+      multiResult.bomJson.dependencies || [],
+      defaultGemEdges,
+    );
+  }
   if (formulationList.length) {
     multiResult.formulationList = formulationList;
   }
@@ -1978,6 +2152,7 @@ export async function createDynamicBom(path, options) {
   const {
     components: pkgList,
     services: traceServices,
+    dependencies: traceDependencies,
     dryRunSummary,
   } = await buildDynamicComponents(commandStr, workingDir, traceOptions);
 
@@ -1986,6 +2161,7 @@ export async function createDynamicBom(path, options) {
     projectType: "dynamic",
     filename: commandStr,
     services: traceServices,
+    dependencies: traceDependencies || [],
   });
   // A dry run denies every side effect, so the attempted-operation counts are
   // the result. Only counts are recorded, never the paths or targets.