@cdxgen/cdxgen 13.5.0 → 13.6.0

package/lib/cli/bomAssembly.js

@@ -25,6 +25,7 @@ import {
   CDXGEN_VERSION,
   frameworksList,
 } from "../core/state.js";
+import { getExecutedTools } from "../core/toolRegistry.js";
 import {
   isPkgTypeOnlyImport,
   setNpmCleanedVersionProperty,
@@ -60,7 +61,7 @@ import {
 } from "../inventory/purl.js";
 import { repairPurl } from "../inventory/sbomDocument.js";
 import { getLicenses } from "../inventory/spdx.js";
-import { getBinaryBom } from "../managers/binary.js";
+import { getBinaryBom, getPluginToolComponents } from "../managers/binary.js";
 import { isValidIriReference } from "../parsers/iri.js";
 
 /**
@@ -293,10 +294,85 @@ function anchorDetectedParent(
   return anchored;
 }
 
+/**
+ * Builds the tool components for the external helpers and build tools this
+ * run executed, from the run-scoped registry (issue #598). Bundled plugin
+ * helpers are enriched with the manifest component of the plugin package that
+ * ships them, so the plugin package's version and identity travel with the
+ * helper. Empty when the run spawned nothing external, which keeps such BOMs
+ * byte-identical to the previous behaviour.
+ *
+ * @returns {object[]} Sorted CycloneDX tool components
+ */
+export const buildExternalToolComponents = () => {
+  const recordedTools = getExecutedTools();
+  if (!recordedTools.length) {
+    return [];
+  }
+  const recordedNames = recordedTools.map((tool) => tool.name);
+  const pluginComponents = getPluginToolComponents(recordedNames);
+  const pluginByName = new Map(
+    pluginComponents.map((component) => [component.name, component]),
+  );
+  const components = [];
+  for (const tool of recordedTools) {
+    const pluginComponent = pluginByName.get(tool.name);
+    if (pluginComponent?.["bom-ref"]) {
+      components.push(pluginComponent);
+      continue;
+    }
+    const component = {
+      type: "application",
+      name: tool.name,
+    };
+    if (tool.version) {
+      component.version = tool.version;
+    }
+    components.push(component);
+  }
+  return components;
+};
+
+/**
+ * Drops the executed tools that are already present: a tool whose bom-ref or
+ * name matches an explicitly passed context tool, or whose bom-ref an earlier
+ * executed tool already carries (several bundled helpers can share one plugin
+ * package component). The context tools themselves are never touched.
+ *
+ * @param {object[]} contextTools Tool components passed in by the caller
+ * @param {object[]} executedTools Tool components from the run's registry
+ * @returns {object[]} The executed tools to append
+ */
+const newExecutedTools = (contextTools, executedTools) => {
+  const seenRefs = new Set();
+  const seenNames = new Set();
+  for (const component of contextTools) {
+    if (component?.["bom-ref"]) {
+      seenRefs.add(component["bom-ref"]);
+    }
+    if (component?.name) {
+      seenNames.add(component.name);
+    }
+  }
+  const unique = [];
+  for (const component of executedTools) {
+    const ref = component["bom-ref"];
+    if ((ref && seenRefs.has(ref)) || seenNames.has(component.name)) {
+      continue;
+    }
+    if (ref) {
+      seenRefs.add(ref);
+    }
+    unique.push(component);
+  }
+  return unique;
+};
+
 /**
  * Assembles the `metadata.tools` block, including the cdxgen tool entry and,
  * for spec versions prior to 1.5, the legacy tools array. For spec version
- * 1.6+ the author field is converted to the authors array.
+ * 1.6+ the author field is converted to the authors array. The tools this run
+ * executed follow the context tools, sorted by name, and cdxgen comes last.
  *
  * @param {object} options CLI options
  * @param {object} [context={}] Additional context carrying existing components
@@ -304,6 +380,7 @@ function anchorDetectedParent(
  *   tools array (1.4) or a components array with tool components (1.5+)
  */
 export const addToolsSection = (options, context = {}) => {
+  const externalTools = buildExternalToolComponents();
   if (options.specVersion === 1.4) {
     return [
       {
@@ -311,6 +388,11 @@ export const addToolsSection = (options, context = {}) => {
         name: "cdxgen",
         version: CDXGEN_VERSION,
       },
+      ...newExecutedTools([], externalTools).map((tool) =>
+        tool.version
+          ? { name: tool.name, version: tool.version }
+          : { name: tool.name },
+      ),
     ];
   }
   let components = [];
@@ -331,6 +413,7 @@ export const addToolsSection = (options, context = {}) => {
   } else if (tools && Object.keys(tools).length && tools.components) {
     components = components.concat(tools.components);
   }
+  components = components.concat(newExecutedTools(components, externalTools));
   const cdxToolComponent = {
     group: CDXGEN_TOOL_GROUP,
     name: CDXGEN_TOOL_NAME,
@@ -524,7 +607,13 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
           // We cannot use purl or bom-ref here since they would not match
           // purl - could have application on one side and a different type
           // bom-ref could have qualifiers on one side
-          if (fullName !== parentFullName) {
+          // A purl subpath marks a separate project that declares the
+          // parent's coordinates, such as a second Maven project or a Gradle
+          // subproject with the same group, name and version.
+          const separateProject =
+            comp.purl?.includes("#") &&
+            comp.purl.split("#")[1] !== parentComponent.purl?.split("#")[1];
+          if (fullName !== parentFullName || separateProject) {
             if (!comp["bom-ref"]) {
               comp["bom-ref"] = `pkg:${comp.type}/${decodeURIComponent(
                 fullName,

package/lib/cli/index.js

@@ -50,6 +50,7 @@ import {
   buildDependencyTrackBomRequest,
   getDependencyTrackBomApiUrl,
 } from "../helpers/remote/dependency-track.js";
+import { collectObomIdeInventory } from "../helpers/vsixutils.js";
 import { optionIncludesAiInventoryProjectType } from "../inventory/aiInventory.js";
 import { readApkInstalledDb } from "../inventory/apkInstalledDb.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
@@ -70,16 +71,28 @@ import {
   hasHbomProjectType,
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
+import { probeHostNode } from "../inventory/nodeHostProbe.js";
+import { markOsInstalledLanguagePackages } from "../inventory/osPackageResolver.js";
 import { orderParentCandidates } from "../inventory/parentSelection.js";
 import { probeHostPhp } from "../inventory/phpHostProbe.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
 import { applyPurl, ociPurl } from "../inventory/purl.js";
+import {
+  deriveOsPackagedRubyRuntimes,
+  linkDefaultGemsToRuntimes,
+} from "../inventory/rubyBuildInfo.js";
+import { probeHostRuby } from "../inventory/rubyHostProbe.js";
 import { table } from "../inventory/table.js";
 
 export { summarizeAiInventory } from "../inventory/aiInventory.js";
 
+import { probeHostRubyGems } from "../ecosystems/gemHostProbe.js";
+import {
+  mergeHostPythonEnvironmentPackages,
+  probeHostPythonEnvironments,
+} from "../ecosystems/venvProbe.js";
 import {
   enrichOSComponentsWithTrustData,
   executeOsQuery,
@@ -240,6 +253,28 @@ switch (_platform()) {
     break;
 }
 
+/**
+ * Home directories whose editor extension folders an OBOM reads: every user's
+ * home from osquery when cdxgen runs as root, and otherwise the current
+ * user's, which is the only one it can read.
+ *
+ * @returns {string[]} Home directories
+ */
+function obomUserHomes() {
+  const ownHome = homedir();
+  if (typeof process.getuid !== "function" || process.getuid() !== 0) {
+    return [ownHome];
+  }
+  const homes = new Set([ownHome]);
+  for (const row of executeOsQuery("SELECT directory FROM users;") || []) {
+    const dir = row?.directory;
+    if (typeof dir === "string" && dir.startsWith("/") && safeExistsSync(dir)) {
+      homes.add(dir);
+    }
+  }
+  return [...homes];
+}
+
 /**
  * Function to create obom string for the current OS using osquery
  *
@@ -247,7 +282,7 @@ switch (_platform()) {
  * @param {Object} options Parse options from the cli
  * @returns {Promise<Object>} Promise resolving to BOM object
  */
-export function createOSBom(_path, options) {
+export async function createOSBom(_path, options) {
   console.warn(
     "About to generate OBOM for the current OS installation. This will take several minutes ...",
   );
@@ -309,6 +344,53 @@ export function createOSBom(_path, options) {
   if (hostPhp.components.length) {
     pkgList = pkgList.concat(hostPhp.components);
   }
+  // Nor a Node.js from a release tarball or a version manager, or the Brotli
+  // decoder compiled into it.
+  const hostNode = probeHostNode({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostNode.components.length) {
+    pkgList = pkgList.concat(hostNode.components);
+  }
+  // Nor a Ruby from ruby-build, a version manager or a toolcache tarball.
+  const hostRuby = probeHostRuby({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostRuby.components.length) {
+    pkgList = pkgList.concat(hostRuby.components);
+  }
+  // A Ruby a package manager installed is also named by its upstream version.
+  pkgList = pkgList.concat(deriveOsPackagedRubyRuntimes(pkgList));
+  // osquery has no table for RubyGems; the gems of the host's gem homes are
+  // read from their specifications.
+  const hostGems = await probeHostRubyGems({
+    executeOsQuery,
+    packageComponents: pkgList,
+  });
+  if (hostGems.length) {
+    const knownRefs = new Set(pkgList.map((component) => component["bom-ref"]));
+    pkgList = pkgList.concat(
+      hostGems.filter((gem) => !knownRefs.has(gem["bom-ref"])),
+    );
+  }
+  // osquery reads the interpreter's own site-packages; packages installed into
+  // a virtual environment or a pyenv interpreter are read from their METADATA.
+  pkgList = mergeHostPythonEnvironmentPackages(
+    pkgList,
+    probeHostPythonEnvironments(),
+  );
+  // osquery reads the extension registry of a fixed list of editors; the
+  // editors themselves, and the extensions of the others, come from the
+  // extension folders. A root scan reads every user's home, as osquery does.
+  try {
+    pkgList = pkgList.concat(
+      collectObomIdeInventory(pkgList, { homes: obomUserHomes() }),
+    );
+  } catch (err) {
+    thoughtLog(`Unable to read the editor extension folders: ${err.message}`);
+  }
   const hostTrustInventory = enrichOSComponentsWithTrustData(pkgList);
   if (hostTrustInventory?.components?.length) {
     pkgList = hostTrustInventory.components;
@@ -777,6 +859,7 @@ export async function createMultiXBom(pathList, options) {
   let metadataProperties = [];
   let parentComponent = determineParentComponent(options) || {};
   let parentSubComponents = [];
+  let osFileOwners;
   const setProjectTypeActivityContext = (projectType, sourcePath) => {
     setActivityContext({
       projectType,
@@ -797,6 +880,8 @@ export async function createMultiXBom(pathList, options) {
     const {
       osPackages,
       osPackageFiles,
+      nativeExtensionFiles,
+      ownerByPath,
       dependenciesList,
       allTypes,
       bundledSdks,
@@ -811,6 +896,7 @@ export async function createMultiXBom(pathList, options) {
       options.exportData?.inspectData?.Config,
       options,
     );
+    osFileOwners = ownerByPath;
     osPhase.succeed(
       summarizeCounts([
         [osPackages.length, "OS package", "OS packages"],
@@ -859,6 +945,7 @@ export async function createMultiXBom(pathList, options) {
     components = components.concat(osPackageFiles || []);
     components = components.concat(executables);
     components = components.concat(sharedLibs);
+    components = components.concat(nativeExtensionFiles || []);
     if (dependenciesList?.length) {
       dependencies = mergeDependencies(dependencies, dependenciesList);
     }
@@ -1975,6 +2062,26 @@ export async function createMultiXBom(pathList, options) {
     dependencies,
     metadataProperties,
   );
+  // Language packages an OS package installed are judged by that package.
+  // Duplicates have merged by now, so a component found both where the distro
+  // put it and where pip did is seen whole and left unmarked.
+  markOsInstalledLanguagePackages(
+    multiResult.bomJson?.components,
+    osFileOwners,
+    options.allLayersExplodedDir,
+  );
+  // The default gems of an unpackaged Ruby, such as resolv in a Docker
+  // Official image, ship with that Ruby and are updated by its releases.
+  const defaultGemEdges = linkDefaultGemsToRuntimes(
+    multiResult.bomJson?.components,
+    options.allLayersExplodedDir,
+  );
+  if (defaultGemEdges.length && multiResult.bomJson) {
+    multiResult.bomJson.dependencies = mergeDependencies(
+      multiResult.bomJson.dependencies || [],
+      defaultGemEdges,
+    );
+  }
   if (formulationList.length) {
     multiResult.formulationList = formulationList;
   }