@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/cli/jvmBom.js

@@ -1,7 +1,7 @@
 import { Buffer } from "node:buffer";
 import { readdirSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, join, resolve, sep } from "node:path";
+import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
@@ -41,22 +41,34 @@ import {
 } from "../core/projectTooling.js";
 import { extractJarArchive, getMvnMetadata } from "../ecosystems/ecosystems.js";
 import {
+  applyGradleVerificationMetadata,
   buildGradleCommandArguments,
   buildObjectForGradleModule,
   collectGradleDependencies,
+  excludeGradleBuildTooling,
   executeParallelGradleProperties,
+  findGradleLockfiles,
+  findGradleVerificationMetadata,
   findMillDaemons,
   getGradleCommand,
   getMavenCommand,
   getMillCommand,
   getMillVersion,
+  gradleArgsFromEnv,
+  gradleDependencyTasks,
+  gradleVerificationMainArtifact,
   hasGradleInvocationFailure,
   isProjectToolingAllowed,
+  loadGradleModulesForReports,
   parseGradleDep,
   parseGradleInfoLogsForUrls,
+  parseGradleLockfiles,
   parseGradleProperties,
   parseGradleResolvedDistributions,
+  parseGradleVerificationMetadata,
   parseGradleVersionCatalog,
+  readGradleRootProjectName,
+  reconcileGradleComponents,
   recordGradleInvocationFailure,
   splitOutputByGradleProjects,
   stopMillDaemons,
@@ -91,6 +103,7 @@ import {
 } from "../ecosystems/sbtutils.js";
 import { collectScalaCliComponents } from "../ecosystems/scalacliutils.js";
 import { collectScalaJsNpmComponents } from "../ecosystems/scalasem.js";
+import { isInVendoredDir } from "../ecosystems/vendoredCode.js";
 import {
   isBuildToolRateLimited,
   noteBuildToolRateLimit,
@@ -99,6 +112,7 @@ import {
   collectJarNS,
   collectMvnDependencies,
   convertJarNSToPackages,
+  namespaceMappingOfComponents,
 } from "../inventory/deps.js";
 import { mergeDependencies, trimComponents } from "../inventory/depsUtils.js";
 import {
@@ -112,8 +126,20 @@ import {
   projectSettingsArgs,
 } from "../inventory/jvmLocalRepos.js";
 import { readGradleWrapperVersion } from "../inventory/jvmToolEnv.js";
-import { applyPurl, mavenPurl } from "../inventory/purl.js";
+import {
+  bazelMirrorArgs,
+  coursierMirrorEnv,
+  gradleMirrorInitScriptArgs,
+  mavenMirrorSettingsArgs,
+  mavenWrapperMirrorEnv,
+  sbtMirrorEnv,
+} from "../inventory/mavenCentralMirror.js";
+import { applyPurl, mavenPurl, tryBuildPurl } from "../inventory/purl.js";
 import { publishedArtifactId } from "../inventory/scalaCoords.js";
+import {
+  mergeScalaDuplicateComponents,
+  rekeyNamespaceMapping,
+} from "../inventory/scalaDedupe.js";
 import {
   buildBomNSData,
   createDefaultParentComponent,
@@ -253,6 +279,67 @@ export async function collectSbtDependencyJars(pkgList, known = {}) {
   return nsMapping;
 }
 
+/**
+ * Keep apart two independent Maven projects that declare the same
+ * coordinates, such as sample projects in `one/` and `two/` that both call
+ * themselves `com.example:demo:0.0.1-SNAPSHOT`. When `component` has the
+ * bom-ref of the parent or of a module already collected but comes from a
+ * different pom.xml, it gets the directory of its pom, relative to the scan
+ * root, as the purl subpath, and the dependency entries that name it follow.
+ *
+ * @param {Object} component Root component of a Maven tree, updated in place
+ * @param {Object} parentComponent Parent component and the modules under it
+ * @param {string} rootPath Directory being scanned
+ * @param {Object[]} dependenciesList Dependency entries of the tree, updated in place
+ * @returns {boolean} True when the component got a distinct identity
+ */
+export function separateDuplicateMavenProject(
+  component,
+  parentComponent,
+  rootPath,
+  dependenciesList = [],
+) {
+  const ref = component?.["bom-ref"];
+  if (!ref || !component.purl) {
+    return false;
+  }
+  const holder = [parentComponent, ...(parentComponent?.components || [])].find(
+    (candidate) => candidate?.["bom-ref"] === ref,
+  );
+  const srcFile = (c) =>
+    c?.properties?.find((p) => p.name === "internal:SrcFile")?.value;
+  const ownPom = srcFile(component);
+  const holderPom = srcFile(holder);
+  if (!ownPom || !holderPom || resolve(ownPom) === resolve(holderPom)) {
+    return false;
+  }
+  const subpath = relative(resolve(rootPath), dirname(resolve(ownPom)))
+    .split(sep)
+    .filter((segment) => segment && segment !== "..")
+    .join("/");
+  const purl =
+    subpath &&
+    tryBuildPurl({
+      type: "maven",
+      namespace: component.group || null,
+      name: component.name,
+      version: component.version || null,
+      qualifiers: component.qualifiers || { type: "jar" },
+      subpath,
+    });
+  if (!purl) {
+    return false;
+  }
+  applyPurl(component, purl);
+  const newRef = component["bom-ref"];
+  for (const entry of dependenciesList) {
+    if (entry.ref === ref) {
+      entry.ref = newRef;
+    }
+  }
+  return true;
+}
+
 /**
  * The purls and bom-refs of a parent component and the module components
  * nested under it.
@@ -565,6 +652,33 @@ export async function createJavaBom(path, options) {
   let jarNSMapping = {};
   let pkgList = [];
   let dependencies = [];
+  // The committed gradle/verification-metadata.xml of this build, if any,
+  // and the metadata parsed from it exactly once. These live at function
+  // scope because the fallback runs inside the Gradle block below while the
+  // enrichment runs after getMvnMetadata, outside the try that guards the
+  // per-tool sections, so a deferred failure keeps the enrichment too.
+  let gradleVerificationFile;
+  let gradleVerificationRootDir;
+  let gradleVerificationData;
+  let gradleVerificationParsed = false;
+  const gradleVerification = () => {
+    if (!gradleVerificationParsed) {
+      gradleVerificationParsed = true;
+      if (gradleVerificationFile) {
+        gradleVerificationData = parseGradleVerificationMetadata(
+          gradleVerificationFile,
+          { rootDir: gradleVerificationRootDir },
+        );
+        if (gradleVerificationData) {
+          const { configuration } = gradleVerificationData;
+          thoughtLog(
+            `${gradleVerificationFile} records ${configuration.trustedKeyCount} trusted key(s), ${configuration.trustedArtifactRuleCount} trust rule(s), ${configuration.ignoredKeyCount} ignored key(s) and ${configuration.keyServerCount} key server(s).`,
+          );
+        }
+      }
+    }
+    return gradleVerificationData;
+  };
   // cyclone-dx-maven plugin creates a component for the app under metadata
   // This is subsequently referred to in the dependencies list
   let parentComponent = {};
@@ -814,6 +928,17 @@ export async function createJavaBom(path, options) {
         const projectSettings = projectSettingsArgs(basePath, {
           secureMode: isSecureModeActive(),
         });
+        // When the mirror switch is on, Maven resolves Central from the
+        // mirror through a generated global settings file; a project
+        // settings.xml is merged into that copy so its repositories and its
+        // own mirror survive. A settings file the user named keeps winning.
+        const mirrorSettingsArgs = mavenMirrorSettingsArgs(
+          projectSettings.settingsFile,
+        );
+        const mvnSettingsArgs = mirrorSettingsArgs.length
+          ? mirrorSettingsArgs
+          : projectSettings.args;
+        const mvnSpawnEnv = { ...process.env, ...mavenWrapperMirrorEnv() };
         if (projectSettings.args.length) {
           console.log(
             `Passing ${projectSettings.settingsFile} to Maven as global settings (-gs), so your own settings.xml still applies. Name a settings file in MVN_ARGS to change this.`,
@@ -839,9 +964,10 @@ export async function createJavaBom(path, options) {
         if (!useMavenDepsTree && !isBuildToolRateLimited("maven")) {
           thoughtLog("The user wants me to use the cyclonedx-maven plugin.");
           console.log(`Executing '${mavenCmd}' in`, basePath);
-          result = safeSpawnSync(mavenCmd, mvnArgs, {
+          result = safeSpawnSync(mavenCmd, mvnArgs.concat(mirrorSettingsArgs), {
             cwd: basePath,
             shell: isWin,
+            env: mvnSpawnEnv,
           });
           noteBuildToolRateLimit("maven", commandOutputText(result), {
             command: `${basename(mavenCmd)} ${mvnArgs.join(" ")}`,
@@ -906,7 +1032,7 @@ export async function createJavaBom(path, options) {
               addArgs = parseMavenArgs(readEnvironmentVariable("MVN_ARGS"));
               mvnTreeArgs = mvnTreeArgs.concat(addArgs);
             }
-            mvnTreeArgs = mvnTreeArgs.concat(projectSettings.args);
+            mvnTreeArgs = mvnTreeArgs.concat(mvnSettingsArgs);
             // For the first pom alone, we need to execute first in non-recursive mode to capture
             // the parent component. Then, we execute all of them in recursive mode
             // A rate limit the --deep copy-dependencies run met ends it too.
@@ -922,11 +1048,12 @@ export async function createJavaBom(path, options) {
               ];
               findParentComponentArgs = findParentComponentArgs.concat(
                 addArgs,
-                projectSettings.args,
+                mvnSettingsArgs,
               );
               result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
                 cwd: basePath,
                 shell: isWin,
+                env: mvnSpawnEnv,
               });
               noteBuildToolRateLimit("maven", commandOutputText(result), {
                 command: `${basename(mavenCmd)} ${findParentComponentArgs.join(" ")}`,
@@ -956,10 +1083,11 @@ export async function createJavaBom(path, options) {
                   "dependency:tree",
                   "-N",
                   `-DoutputFile=${tempMvnParentTreeText}`,
-                ].concat(addArgs, projectSettings.args);
+                ].concat(addArgs, mvnSettingsArgs);
                 result = safeSpawnSync(mavenCmd, findParentComponentArgs, {
                   cwd: basePath,
                   shell: isWin,
+                  env: mvnSpawnEnv,
                 });
               }
               if (result.status === 0) {
@@ -1004,6 +1132,7 @@ export async function createJavaBom(path, options) {
               result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
                 cwd: basePath,
                 shell: isWin,
+                env: mvnSpawnEnv,
               });
               noteBuildToolRateLimit("maven", commandOutputText(result), {
                 command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
@@ -1029,10 +1158,11 @@ export async function createJavaBom(path, options) {
                 mvnTreeArgs = [
                   "dependency:tree",
                   `-DoutputFile=${tempMvnTreeText}`,
-                ].concat(addArgs, projectSettings.args);
+                ].concat(addArgs, mvnSettingsArgs);
                 result = safeSpawnSync(mavenCmd, mvnTreeArgs, {
                   cwd: basePath,
                   shell: isWin,
+                  env: mvnSpawnEnv,
                 });
                 noteBuildToolRateLimit("maven", commandOutputText(result), {
                   command: `${basename(mavenCmd)} ${mvnTreeArgs.join(" ")}`,
@@ -1182,6 +1312,12 @@ export async function createJavaBom(path, options) {
                   parentComponent = tmpParentComponent;
                   parentComponent.components = [];
                 } else {
+                  separateDuplicateMavenProject(
+                    tmpParentComponent,
+                    parentComponent,
+                    path,
+                    parsedList.dependenciesList,
+                  );
                   parentComponent.components.push(tmpParentComponent);
                 }
                 if (parsedList?.dependenciesList?.length) {
@@ -1309,9 +1445,14 @@ export async function createJavaBom(path, options) {
       }
     }
     const allProjects = [];
-    const allProjectsAddedPurls = [];
+    // Modules keyed by bom-ref: a module without a purl still has a bom-ref
+    // of its own, while every such module shares an undefined purl.
+    const allProjectsAddedRefs = new Map();
     const rootDependsOn = new Set();
     const gradleModules = new Map();
+    // Included builds that build Gradle plugins, such as a build-logic build
+    // included from pluginManagement. Their classpath is build tooling.
+    const gradlePluginBuilds = new Set();
     // Determine the root path for gradle
     // Fixes gradle invocation for microservices-demo
     let gradleRootPath = path;
@@ -1329,15 +1470,51 @@ export async function createJavaBom(path, options) {
         "Hmm, there is a gradle.properties file. Do we need any private modules or custom JVM arguments for this project 🤔?",
       );
     }
-    // Execute gradle properties
-    if (
-      gradleFiles?.length &&
-      isPackageManagerAllowed(
-        "gradle",
-        ["maven", "bazel", "sbt", "mill"],
-        options,
-      )
-    ) {
+    // The package-manager gate the Gradle invocations below share: a scan
+    // that prefers another JVM build tool over Gradle reads no Gradle
+    // lockfiles either.
+    const gradleManagerAllowed = isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    );
+    // The committed Gradle dependency lockfiles record the resolved versions
+    // of every locked configuration, so they are an inventory source that
+    // needs no Gradle run. They are looked for only in a Gradle build: a
+    // Maven-rooted scan does not pick up a nested sample's lockfile.
+    const gradleLockFiles =
+      gradleFiles?.length && gradleManagerAllowed
+        ? findGradleLockfiles(gradleRootPath, options)
+        : [];
+    // The committed gradle/verification-metadata.xml records the checksums
+    // and PGP key ids Gradle verified when `gradle
+    // --write-verification-metadata` last ran. Like the lockfiles, it is an
+    // inventory source that needs no Gradle run, and it is looked for only in
+    // a Gradle build.
+    gradleVerificationFile =
+      gradleFiles?.length && gradleManagerAllowed
+        ? findGradleVerificationMetadata(gradleRootPath)
+        : undefined;
+    gradleVerificationRootDir = gradleRootPath;
+    // `gradle properties` evaluates the project's build scripts and `gradle
+    // dependencies` resolves the graph, so both belong to the
+    // dependency-tooling surface. The properties task runs whenever
+    // `isProjectToolingAllowed` lets it, as it names the root project and
+    // the subprojects; only the gradle-prefer-lockfile preference holds it
+    // back. The dependencies task also needs `options.installDeps`. When
+    // either check would stop the dependencies task, or when the preference
+    // asks for it, the lockfiles supply the components instead.
+    const gradleToolingAllowed = isProjectToolingAllowed(options);
+    const gradlePreferLockfile = isFeatureEnabled(
+      options,
+      "gradle-prefer-lockfile",
+    );
+    const gradleSkipProperties =
+      gradlePreferLockfile && gradleLockFiles.length > 0;
+    const gradleUseLockfiles =
+      gradleLockFiles.length > 0 &&
+      (gradlePreferLockfile || !gradleToolingAllowed || !options.installDeps);
+    if (gradleFiles?.length && gradleManagerAllowed) {
       const wrapperInfo = readGradleWrapperVersion(gradleRootPath);
       if (wrapperInfo) {
         try {
@@ -1399,6 +1576,177 @@ export async function createJavaBom(path, options) {
           // ignore
         }
       }
+    }
+    // A module of this build that another one consumes by its coordinates is
+    // a project, not a dependency, so the fallback sources below drop it.
+    const dropGradleModuleComponents = (pkgs) => {
+      const moduleRefs = new Set(
+        [parentComponent, ...(parentComponent?.components || [])]
+          .map((c) => c?.["bom-ref"])
+          .filter(Boolean),
+      );
+      return pkgs.filter((pkg) => !moduleRefs.has(pkg["bom-ref"]));
+    };
+    // Without `gradle properties` nothing named the root project. The
+    // settings script names it, and the directory name stands in when it
+    // does not, so the BOM still has a primary component.
+    const ensureGradleParentComponent = () => {
+      if (!parentComponent || !Object.keys(parentComponent).length) {
+        const rootProjectName = readGradleRootProjectName(gradleRootPath);
+        parentComponent = createDefaultParentComponent(
+          gradleRootPath,
+          "maven",
+          rootProjectName && !("project-name" in options)
+            ? {
+                ...options,
+                "project-name": rootProjectName,
+                projectName: rootProjectName,
+              }
+            : options,
+        );
+      }
+    };
+    // The lockfiles stand in for the Gradle dependency resolution this scan
+    // is not making, prefers not to make, or that produced nothing. They
+    // record resolved versions but no graph, so the components carry no
+    // dependency edges and the scan records what that costs. Returns the
+    // number of components added.
+    const addGradleLockfileComponents = () => {
+      const lockfilePkgs = dropGradleModuleComponents(
+        parseGradleLockfiles(gradleLockFiles, {
+          rootDir: gradleRootPath,
+        }),
+      );
+      if (!lockfilePkgs.length) {
+        return 0;
+      }
+      pkgList = pkgList.concat(lockfilePkgs);
+      recordDegradation("jvm.gradle.lockfile-only", {
+        ecosystem: "java",
+        tool: "gradle",
+        impact: "transitive-deps",
+        detail:
+          "The components came from Gradle dependency lockfiles, which record no dependency graph between them.",
+      });
+      ensureGradleParentComponent();
+      return lockfilePkgs.length;
+    };
+    // The version catalog and, on request, the verification file declare
+    // coordinates without resolving them, so both are used only when Gradle
+    // and the lockfiles produced no dependency information at all. The call
+    // inside the Gradle run block happens before its failure paths, so a
+    // build whose static sources resolved it is not degraded twice and not
+    // failed with --fail-on-error over a BOM that has components. The
+    // verification fallback stays off unless the
+    // gradle-verification-fallback feature flag asks for it: the file
+    // records what the build resolved when --write-verification-metadata
+    // ran, which may be stale, and its components can only be optional.
+    // Both belong to a Gradle build, so a scan without Gradle build files,
+    // or one that prefers another JVM build tool, reads neither.
+    const addGradleStaticFallbackComponents = () => {
+      if (!gradleFiles?.length || !gradleManagerAllowed || pkgList.length) {
+        return;
+      }
+      const catalogFiles = getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
+        options,
+      );
+      for (const catalogFile of catalogFiles) {
+        if (DEBUG_MODE) {
+          console.log(`Parsing ${catalogFile}`);
+        }
+        const dlist = parseGradleVersionCatalog(catalogFile);
+        if (dlist?.length) {
+          pkgList = pkgList.concat(dlist);
+        }
+      }
+      if (
+        pkgList.length ||
+        !gradleVerificationFile ||
+        !isFeatureEnabled(options, "gradle-verification-fallback")
+      ) {
+        return;
+      }
+      const verificationMetadata = gradleVerification();
+      if (!verificationMetadata) {
+        return;
+      }
+      const verificationPkgs = [];
+      for (const component of verificationMetadata.components.values()) {
+        // A Gradle plugin marker coordinate publishes only a POM that
+        // points at the real plugin, so it is not a dependency of the
+        // build, and a coordinate without a main artifact is a parent or a
+        // BOM rather than a component of this BOM.
+        if (component.name.endsWith(".gradle.plugin")) {
+          continue;
+        }
+        if (!gradleVerificationMainArtifact(component, false)) {
+          continue;
+        }
+        const purl = mavenPurl(
+          component.group,
+          component.name,
+          component.version,
+          {
+            type: "jar",
+          },
+        );
+        if (!purl) {
+          continue;
+        }
+        verificationPkgs.push({
+          group: component.group,
+          name: component.name,
+          version: component.version,
+          qualifiers: { type: "jar" },
+          type: "library",
+          // A component with no scope counts as required, and the file
+          // cannot tell a runtime dependency from build tooling, so the
+          // components are optional.
+          scope: "optional",
+          purl,
+          "bom-ref": decodeURIComponent(purl),
+          // The digests are merged in at the end of the scan, from the file
+          // or from the artifact itself when the local cache holds it.
+          properties: [
+            { name: "internal:SrcFile", value: gradleVerificationFile },
+            { name: "cdx:gradle:verificationMetadata", value: "true" },
+          ],
+          evidence: {
+            identity: {
+              field: "purl",
+              confidence: 1,
+              concludedValue: purl,
+              methods: [
+                {
+                  technique: "manifest-analysis",
+                  confidence: 1,
+                  value: gradleVerificationFile,
+                },
+              ],
+            },
+          },
+        });
+      }
+      const addedPkgs = dropGradleModuleComponents(verificationPkgs);
+      if (addedPkgs.length) {
+        pkgList = pkgList.concat(addedPkgs);
+        recordDegradation("jvm.gradle.verification-metadata-only", {
+          ecosystem: "java",
+          tool: "gradle",
+          impact: "transitive-deps",
+          detail:
+            "The components came from gradle/verification-metadata.xml, which records no dependency graph between them.",
+        });
+        ensureGradleParentComponent();
+        thoughtLog(
+          `Obtained ${addedPkgs.length} components from ${gradleVerificationFile}. It says nothing about which module depends on which, and nothing about scopes.`,
+        );
+      }
+    };
+    // Execute gradle properties
+    if (gradleFiles?.length && gradleManagerAllowed && !gradleSkipProperties) {
       let includedBuilds = [];
       let allProjectsStr = [];
       if (readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")) {
@@ -1413,13 +1761,15 @@ export async function createJavaBom(path, options) {
       const gradleInitArgs = readEnvironmentVariable("GRADLE_INCLUDED_BUILDS")
         ? []
         : ["--init-script", GRADLE_INIT_SCRIPT];
+      // The mirror init script joins cdxgen's own helper script; Gradle
+      // applies every init script it is given.
+      const gradleMirrorArgs = gradleMirrorInitScriptArgs();
+      if (gradleMirrorArgs.length) {
+        gradleInitArgs.push(...gradleMirrorArgs);
+      }
       if (resolveGradleDistribution && gradleInitArgs.length) {
         gradleInitArgs.push("-PcdxgenResolveDistribution=true");
       }
-      // `gradle properties` evaluates the project's build scripts, so it is
-      // part of the dependency-tooling surface gated by --no-install-deps
-      // (and the pre-build lifecycle).
-      const gradleToolingAllowed = isProjectToolingAllowed(options);
       if (gradleToolingAllowed) {
         parallelPropTaskOut = executeParallelGradleProperties(
           gradleRootPath,
@@ -1484,12 +1834,19 @@ export async function createJavaBom(path, options) {
           );
           if (!includedBuilds.includes(key)) {
             parentComponent = rootComponent;
+          } else if (retMap.gradlePlugin) {
+            gradlePluginBuilds.add(key);
           }
           gradleModules.set(key, rootComponent);
-          if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
+          if (
+            !allProjectsAddedRefs.has(rootComponent["bom-ref"] ?? rootComponent)
+          ) {
             allProjects.push(rootComponent);
             rootDependsOn.add(rootComponent["bom-ref"]);
-            allProjectsAddedPurls.push(rootComponent["purl"]);
+            allProjectsAddedRefs.set(
+              rootComponent["bom-ref"] ?? rootComponent,
+              rootComponent,
+            );
           }
           allProjectsStr = allProjectsStr.concat(retMap.projects);
         }
@@ -1522,14 +1879,60 @@ export async function createJavaBom(path, options) {
           );
           const rootSubProject = retMap.rootProject;
           if (rootSubProject) {
+            // A subproject whose properties task printed nothing is named as
+            // Gradle publishes it by default: the last segment of its path,
+            // with the root project's group and version.
+            if (!splitPropTaskOut.has(subProject)) {
+              retMap.metadata.group ||= parentComponent?.group || "";
+              if (
+                retMap.metadata.version === "latest" &&
+                parentComponent?.version
+              ) {
+                retMap.metadata.version = parentComponent.version;
+              }
+            }
             const rootSubProjectObj = await buildObjectForGradleModule(
-              rootSubProject === "root" ? subProject : rootSubProject,
+              rootSubProject === "root"
+                ? subProject.split(":").pop()
+                : rootSubProject,
               retMap.metadata,
             );
-            if (!allProjectsAddedPurls.includes(rootSubProjectObj["purl"])) {
+            // Two subprojects that Gradle would publish under the same
+            // coordinates, such as `:a:util` and `:b:util` with a shared group
+            // and version, stay apart: the later one gets its project path as
+            // the purl subpath. A module that shares the root project's
+            // coordinates is the root's own artifact and merges with it.
+            const holder = allProjectsAddedRefs.get(
+              rootSubProjectObj["bom-ref"],
+            );
+            if (
+              holder &&
+              holder !== parentComponent &&
+              holder !== gradleModules.get(subProject)
+            ) {
+              const subpath = subProject.split(":").filter(Boolean).join("/");
+              const distinctPurl = rootSubProjectObj.purl
+                ? tryBuildPurl({
+                    type: "maven",
+                    namespace: rootSubProjectObj.group || null,
+                    name: rootSubProjectObj.name,
+                    version: rootSubProjectObj.version || null,
+                    qualifiers: { type: "jar" },
+                    subpath,
+                  })
+                : null;
+              if (distinctPurl) {
+                applyPurl(rootSubProjectObj, distinctPurl);
+              } else {
+                rootSubProjectObj["bom-ref"] =
+                  `${rootSubProjectObj["bom-ref"]}#${subpath}`;
+              }
+            }
+            const moduleKey = rootSubProjectObj["bom-ref"] ?? rootSubProjectObj;
+            if (!allProjectsAddedRefs.has(moduleKey)) {
               allProjects.push(rootSubProjectObj);
               rootDependsOn.add(rootSubProjectObj["bom-ref"]);
-              allProjectsAddedPurls.push(rootSubProjectObj["purl"]);
+              allProjectsAddedRefs.set(moduleKey, rootSubProjectObj);
             }
             gradleModules.set(subProject, rootSubProjectObj);
           }
@@ -1546,14 +1949,39 @@ export async function createJavaBom(path, options) {
         });
       }
     }
+    if (gradleUseLockfiles) {
+      const lockfileCount = addGradleLockfileComponents();
+      if (lockfileCount) {
+        console.log(
+          `Using the dependencies locked by ${gradleLockFiles.length} Gradle lockfile(s) instead of executing 'gradle dependencies'.`,
+        );
+        thoughtLog(
+          `Obtained ${lockfileCount} components from ${gradleLockFiles.length} Gradle lockfile(s). A lockfile is flat, so it says nothing about which module depends on which.`,
+        );
+        // --deep reads the jar namespaces of the versions the local Gradle
+        // cache holds, as it does after a Gradle run; a cold cache yields
+        // nothing.
+        if (options.resolveClass || options.deep) {
+          const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
+          if (tmpjarNSMapping && Object.keys(tmpjarNSMapping).length) {
+            jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
+          }
+        }
+      } else {
+        thoughtLog(
+          "The Gradle lockfiles yielded no components, so the remaining static sources are tried.",
+        );
+      }
+    }
+    // Components that came from somewhere other than this Gradle run, such
+    // as a Maven build in the same root, so the decisions below look only at
+    // what Gradle itself produced.
+    const pkgCountBeforeGradleRun = pkgList.length;
     if (
       gradleFiles?.length &&
       options.installDeps &&
-      isPackageManagerAllowed(
-        "gradle",
-        ["maven", "bazel", "sbt", "mill"],
-        options,
-      )
+      gradleManagerAllowed &&
+      !gradleUseLockfiles
     ) {
       allProjects.push(parentComponent);
       const gradleCmd = getGradleCommand(gradleRootPath, null, options);
@@ -1561,7 +1989,6 @@ export async function createJavaBom(path, options) {
         ? readEnvironmentVariable("GRADLE_DEPENDENCY_TASK")
         : "dependencies";
 
-      const gradleSubCommands = [];
       let modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
         ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
         : [];
@@ -1570,23 +1997,16 @@ export async function createJavaBom(path, options) {
           readEnvironmentVariable("GRADLE_SKIP_MODULE_DEPENDENCIES").split(","),
         );
       }
-      if (!modulesToSkip.includes("root")) {
-        gradleSubCommands.push(gradleDepTask);
-      }
-      for (const [key, sp] of gradleModules) {
-        //create single command for dependencies tasks on all subprojects
-        if (sp.purl !== parentComponent.purl && !modulesToSkip.includes(key)) {
-          gradleSubCommands.push(`${key}:${gradleDepTask}`);
-        }
-      }
+      const gradleSubCommands = gradleDependencyTasks(
+        gradleModules,
+        parentComponent,
+        gradleDepTask,
+        modulesToSkip,
+      );
       const gradleArguments = buildGradleCommandArguments(
-        readEnvironmentVariable("GRADLE_ARGS")
-          ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
-          : [],
+        gradleArgsFromEnv("GRADLE_ARGS"),
         gradleSubCommands,
-        readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES")
-          ? readEnvironmentVariable("GRADLE_ARGS_DEPENDENCIES").split(" ")
-          : [],
+        gradleArgsFromEnv("GRADLE_ARGS_DEPENDENCIES"),
         gradleCmd.length,
       );
       const allOutputs = [];
@@ -1647,14 +2067,30 @@ export async function createJavaBom(path, options) {
         const perProjectOutput = splitOutputByGradleProjects(cmdOutput, [
           gradleDepTask,
         ]);
+        await loadGradleModulesForReports(
+          perProjectOutput.values(),
+          gradleModules,
+          gradleRootPath,
+          options,
+        );
+        const reportedProjects = new Set(perProjectOutput.keys());
         for (const key of gradleModules.keys()) {
           const parsedList = await parseGradleDep(
             perProjectOutput.has(key) ? perProjectOutput.get(key) : "",
             key,
             gradleModules,
             gradleRootPath,
+            reportedProjects,
           );
           const dlist = parsedList.pkgList;
+          if (
+            dlist?.length &&
+            [...gradlePluginBuilds].some(
+              (build) => key === build || key.startsWith(`${build}:`),
+            )
+          ) {
+            excludeGradleBuildTooling(dlist, gradleModules);
+          }
           if (parsedList?.dependenciesList?.length) {
             dependencies = mergeDependencies(
               dependencies,
@@ -1672,7 +2108,25 @@ export async function createJavaBom(path, options) {
             pkgList = pkgList.concat(dlist);
           }
         }
+        reconcileGradleComponents(pkgList);
       }
+      const gradleRunPkgCount = pkgList.length - pkgCountBeforeGradleRun;
+      if (!gradleRunPkgCount && gradleLockFiles.length) {
+        // Gradle produced no components of its own. The lockfiles are the
+        // next source before the failure paths below: Gradle may have run
+        // fine over configurations the project never locked, or failed
+        // outright while the committed lockfiles still describe the build.
+        const lockfileCount = addGradleLockfileComponents();
+        if (lockfileCount) {
+          thoughtLog(
+            `Gradle produced no components, so the ${lockfileCount} components of ${gradleLockFiles.length} Gradle lockfile(s) were used instead.`,
+          );
+        }
+      }
+      // A catalog or verification fallback can supply these components when
+      // Gradle produced none, so they pass through the same distribution and
+      // subproject handling below.
+      addGradleStaticFallbackComponents();
       if (pkgList.length) {
         const fileToUrlMap = parseGradleInfoLogsForUrls(sstdout);
         // When the `resolve-gradle-distribution` feature flag is enabled, the init script
@@ -1685,9 +2139,15 @@ export async function createJavaBom(path, options) {
           if (!p.externalReferences) {
             p.externalReferences = [];
           }
-          if (!p.externalReferences.find((r) => r.type === "distribution")) {
+          // The repository URLs name jar files, which a platform does not
+          // have. The leading slash keeps group `foo` from matching a URL
+          // under `org/foo/`.
+          if (
+            p.qualifiers?.type !== "pom" &&
+            !p.externalReferences.find((r) => r.type === "distribution")
+          ) {
             const groupPath = p.group.replace(/\./g, "/");
-            const matchPath = `${groupPath}/${p.name}/${p.version}/`;
+            const matchPath = `/${groupPath}/${p.name}/${p.version}/`;
             let matchedUrl = Object.values(fileToUrlMap).find((url) =>
               url.includes(matchPath),
             );
@@ -1713,11 +2173,21 @@ export async function createJavaBom(path, options) {
           }
         }
         thoughtLog(
-          `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`,
+          gradleRunPkgCount
+            ? `Obtained ${pkgList.length} components by executing the '${basename(gradleCmd)}' command.`
+            : `Obtained ${pkgList.length} components from the static Gradle sources after '${basename(gradleCmd)}' produced none.`,
         );
         if (DEBUG_MODE) {
           console.log("Obtained", pkgList.length, "from this gradle project.");
         }
+        if (gradleRunPkgCount && gradleLockFiles.length) {
+          // Gradle resolved against the lockfiles itself, so the versions it
+          // reports already are the locked ones and parsing the files again
+          // would add nothing.
+          thoughtLog(
+            `Gradle enforced the ${gradleLockFiles.length} Gradle lockfile(s) of this build, so they are not parsed separately.`,
+          );
+        }
       } else if (hasGradleInvocationFailure()) {
         // The invocation failure is already ranked, and an empty
         // configuration is what that failure looks like from here: reporting
@@ -1783,37 +2253,25 @@ export async function createJavaBom(path, options) {
           jarNSMapping = { ...jarNSMapping, ...tmpjarNSMapping };
         }
       }
-
-      // A version catalog declares coordinates without resolving them, so it
-      // is used only when Gradle produced no dependency information at all.
-      // The emitted components carry cdx:gradle:catalog=true to mark them as
-      // declared rather than resolved.
-      if (!pkgList.length) {
-        const catalogFiles = getAllFiles(
-          path,
-          `${options.multiProject ? "**/" : ""}gradle/libs.versions.toml`,
-          options,
-        );
-        for (const catalogFile of catalogFiles) {
-          if (DEBUG_MODE) {
-            console.log(`Parsing ${catalogFile}`);
-          }
-          const dlist = parseGradleVersionCatalog(catalogFile);
-          if (dlist?.length) {
-            pkgList = pkgList.concat(dlist);
-          }
-        }
-      }
     }
 
+    // Outside the installDeps block on purpose: a scan with dependency
+    // installation disabled reaches the static sources through the lockfile
+    // path instead of the Gradle run, and a scan whose Gradle run was
+    // skipped entirely needs them here.
+    addGradleStaticFallbackComponents();
+
     // Bazel
     // Look for the BUILD file only in the root directory
     // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
+    // A workspace under third_party/ or vendor/ is a copied project's: its
+    // bazel_dep entries are that project's build tooling, and building it
+    // would run its build.
     const bazelFiles = getAllFiles(
       path,
       `${options.multiProject ? "**/" : ""}{WORKSPACE{,.bazel},MODULE.bazel}`,
       options,
-    );
+    ).filter((f) => !isInVendoredDir(path, f));
     if (
       bazelFiles?.length &&
       !hasAnyProjectType(
@@ -1886,6 +2344,9 @@ export async function createJavaBom(path, options) {
         ) {
           bArgs = ["--bazelrc=.bazelrc", "build", bazelTarget];
         }
+        // Repository rules see the mirror through their own environment,
+        // which only a --repo_env flag reaches.
+        bArgs = bArgs.concat(bazelMirrorArgs());
         console.log("Executing", BAZEL_CMD, "in", basePath);
         let result = safeSpawnSync(BAZEL_CMD, bArgs, {
           cwd: basePath,
@@ -2099,7 +2560,7 @@ export async function createJavaBom(path, options) {
         // sbt resolves into the user's own caches, so a project that has been
         // built resolves without the network. The dependency trees download
         // the jar of every dependency they list, which is all --deep reads.
-        const env = { ...process.env };
+        const env = { ...process.env, ...sbtMirrorEnv() };
         for (const i in sbtProjects) {
           if (isBuildToolRateLimited("sbt")) {
             // Every remaining sbt build in this scan resolves from the same
@@ -2450,19 +2911,13 @@ export async function createJavaBom(path, options) {
         const jarNSData = await createJarBom(path, options);
         if (jarNSData?.bomJson?.components) {
           pkgList = pkgList.concat(jarNSData?.bomJson?.components);
-          const targetJarNSMapping = {};
-          for (const p of jarNSData.bomJson.components) {
-            if (!p?.purl || !p?.properties?.length) {
-              continue;
-            }
-            const nsProp = p.properties.filter(
-              (prop) => prop.name === "internal:Namespaces",
-            );
-            if (nsProp.length) {
-              targetJarNSMapping[p.purl] = nsProp[0].value;
-            }
-          }
-          jarNSMapping = { ...jarNSMapping, ...targetJarNSMapping };
+          jarNSMapping = {
+            ...jarNSMapping,
+            ...namespaceMappingOfComponents(
+              jarNSData.bomJson.components,
+              jarNSMapping,
+            ),
+          };
         }
       }
     }
@@ -2504,10 +2959,12 @@ export async function createJavaBom(path, options) {
       if (DEBUG_MODE) {
         console.log("Executing", millCmd, "in", millRootPath);
       }
+      const millSpawnEnv = { ...process.env, ...coursierMirrorEnv() };
       let sresult = safeSpawnSync(millCmd, millArgs, {
         cwd: millRootPath,
         shell: isWin,
         maxBuffer: MAX_BUFFER * 10,
+        env: millSpawnEnv,
       });
       noteBuildToolRateLimit("mill", commandOutputText(sresult), {
         command: `${basename(millCmd)} ${millArgs.join(" ")}`,
@@ -2546,6 +3003,7 @@ export async function createJavaBom(path, options) {
       sresult = safeSpawnSync(millCmd, millResolveArgs, {
         cwd: millRootPath,
         shell: isWin,
+        env: millSpawnEnv,
       });
       if (sresult.status !== 0 || sresult.error) {
         if (options.failOnError || DEBUG_MODE) {
@@ -2710,12 +3168,70 @@ export async function createJavaBom(path, options) {
   // Deduplication and metadata belong to whatever was collected, so they run
   // on the deferred path too.
   pkgList = trimComponents(pkgList);
+  // A library the build tool reported and a jar on disk named again is one
+  // component, wherever the jar scan spelled it differently. The jar
+  // namespace map follows the purls the merge settled on.
+  const scalaMerge = mergeScalaDuplicateComponents(pkgList, dependencies);
+  pkgList = scalaMerge.components;
+  dependencies = scalaMerge.dependencies;
+  jarNSMapping = rekeyNamespaceMapping(jarNSMapping, scalaMerge.purlMap);
   // --deep collects namespaces; it does not opt in to remote licence lookups,
   // which FETCH_LICENSE controls. The project's own modules are never looked
   // up remotely: they are not published.
   pkgList = await getMvnMetadata(pkgList, jarNSMapping, false, {
     skipPurls: ownComponentRefs(parentComponent),
   });
+  // The verification file is the last enrichment, after getMvnMetadata has
+  // hashed the jars of the local cache: a digest of the artifact itself is
+  // the stronger claim, so the recorded digests only fill the algorithms a
+  // component still lacks, and a differing digest of the same algorithm is
+  // flagged, never applied. Whatever source found the component keeps the
+  // identity evidence of that source.
+  if (gradleVerificationFile) {
+    const verificationMetadata = gradleVerification();
+    if (verificationMetadata) {
+      const enrichedCount = applyGradleVerificationMetadata(
+        pkgList,
+        verificationMetadata,
+        gradleVerificationFile,
+      );
+      if (enrichedCount) {
+        thoughtLog(
+          `Enriched ${enrichedCount} component(s) with the checksums that ${gradleVerificationFile} records.`,
+        );
+      }
+      // Whether Gradle verified metadata and signatures is a fact about the
+      // whole build, so it lands on the primary component. Only the flags
+      // the file actually writes are emitted.
+      const { configuration } = verificationMetadata;
+      if (parentComponent && Object.keys(parentComponent).length) {
+        const parentProperties = parentComponent.properties || [];
+        if (
+          configuration.verifyMetadata !== undefined &&
+          !parentProperties.some((p) => p.name === "cdx:gradle:verifyMetadata")
+        ) {
+          parentProperties.push({
+            name: "cdx:gradle:verifyMetadata",
+            value: String(configuration.verifyMetadata),
+          });
+        }
+        if (
+          configuration.verifySignatures !== undefined &&
+          !parentProperties.some(
+            (p) => p.name === "cdx:gradle:verifySignatures",
+          )
+        ) {
+          parentProperties.push({
+            name: "cdx:gradle:verifySignatures",
+            value: String(configuration.verifySignatures),
+          });
+        }
+        if (parentProperties.length) {
+          parentComponent.properties = parentProperties;
+        }
+      }
+    }
+  }
   return buildBomNSData(options, pkgList, "maven", {
     src: path,
     nsMapping: jarNSMapping,