@cdxgen/cdxgen 13.5.0 → 13.7.0

package/bin/convert.js

@@ -20,9 +20,16 @@ import {
 } from "../lib/helpers/exportUtils.js";
 import {
   getNonCycloneDxErrorMessage,
+  isCycloneDx20SpecVersion,
   isCycloneDxBom,
   toCycloneDxSpecVersionString,
 } from "../lib/inventory/bomUtils.js";
+import {
+  CDX20_INTERNAL_SECTIONS_KEY,
+  loadBomForAnalysis,
+  renderCycloneDx20WithReport,
+} from "../lib/inventory/cyclonedx20.js";
+import { hardwareRenderContext } from "../lib/inventory/hbomLoader.js";
 import {
   importProtobomModule,
   isProtoBomPath,
@@ -31,13 +38,19 @@ import { sortBomCollections } from "../lib/stages/postgen/sortBom.js";
 import { convertCycloneDxToSpdx } from "../lib/stages/postgen/spdxConverter.js";
 import {
   applySpecVersionCompatibility,
-  collectFieldPaths,
+  diffMissingLeafValues,
+  diffRemovedFieldPaths,
 } from "../lib/stages/postgen/specVersionCompat.js";
 import { validateBom, validateSpdx } from "../lib/validator/bomValidator.js";
 
 // cdxgen bundles CycloneDX JSON schemas for these versions only, so a
 // conversion to any other version is written without a schema check.
 const VALIDATABLE_SPEC_VERSIONS = new Set(["1.6", "1.7", "2.0"]);
+// The 2.0 renderer reads the 1.x model of these versions; older input has
+// shapes it does not convert (a 1.5 tools array, a single identity object).
+const CDX20_SOURCE_SPEC_VERSIONS = new Set(["1.6", "1.7", "2.0"]);
+// Longest value printed for a missing 2.0 leaf; the comparison uses all of it.
+const MAX_PRINTED_LEAF_LENGTH = 160;
 
 const _yargs = yargs(hideBin(process.argv));
 
@@ -55,7 +68,7 @@ const args = _yargs
   .option("to", {
     default: "spdx",
     description:
-      "Conversion target. 'spdx' exports SPDX 3.0.1 JSON-LD. A CycloneDX spec version (1.5, 1.6, 1.7) cross-converts the BOM to that version instead.",
+      "Conversion target. 'spdx' exports SPDX 3.0.1 JSON-LD. A CycloneDX spec version (1.5, 1.6, 1.7, 2.0) cross-converts the BOM to that version instead.",
   })
   .option("validate", {
     type: "boolean",
@@ -63,6 +76,12 @@ const args = _yargs
     description:
       "Validate the converted output against its schema. Pass --no-validate to skip.",
   })
+  .option("fail-on-loss", {
+    type: "boolean",
+    default: false,
+    description:
+      "Exit 2, without writing the output, when the conversion loses data: a CycloneDX 2.0 input's read losses for a 1.x or SPDX target, values the 2.0 render drops, or field paths the target version does not define.",
+  })
   .option("json-pretty", {
     type: "boolean",
     default: false,
@@ -116,10 +135,11 @@ const targetSpecVersion = toCycloneDxSpecVersionString(args.to);
 const isSpdxTarget = `${args.to}`.trim().toLowerCase() === "spdx";
 if (!isSpdxTarget && !targetSpecVersion) {
   console.error(
-    `Unsupported conversion target '${args.to}'. Pass --to spdx for an SPDX 3.0.1 export, or a CycloneDX spec version such as 1.5, 1.6, or 1.7.`,
+    `Unsupported conversion target '${args.to}'. Pass --to spdx for an SPDX 3.0.1 export, or a CycloneDX spec version such as 1.5, 1.6, 1.7 or 2.0.`,
   );
   process.exit(1);
 }
+const isCdx20Target = !isSpdxTarget && targetSpecVersion === "2.0";
 
 const bomJson = await loadCycloneDxBom(args.input);
 
@@ -127,17 +147,66 @@ if (!isCycloneDxBom(bomJson)) {
   console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-convert"));
   process.exit(1);
 }
-const cdxSpecVersion = toCycloneDxSpecVersionString(bomJson?.specVersion);
+// A 2.0 input reads into the 1.x-shaped internal model first; the losses say
+// what of the input that model (and so any 1.x or SPDX output) cannot hold.
+let analysis;
+try {
+  analysis = loadBomForAnalysis(bomJson);
+} catch (err) {
+  console.error(`cdx-convert: ${args.input}: ${err.message}`);
+  process.exit(1);
+}
+const { internalBom, losses } = analysis;
+const isCdx20Input =
+  isCycloneDx20SpecVersion(bomJson?.specVersion) || !!bomJson?.specFormat;
+const cdxSpecVersion = isCdx20Input
+  ? "2.0"
+  : toCycloneDxSpecVersionString(bomJson?.specVersion);
+if (isCdx20Target && !CDX20_SOURCE_SPEC_VERSIONS.has(cdxSpecVersion)) {
+  console.error(
+    `cdx-convert --to 2.0 reads CycloneDX 1.6, 1.7 or 2.0 input, and '${args.input}' is CycloneDX ${bomJson?.specVersion ?? "(no specVersion)"}. Convert it with --to 1.7 first, then convert that file to 2.0.`,
+  );
+  process.exit(1);
+}
+
+// Every loss is printed, whatever the target; --fail-on-loss counts the ones
+// the output really lacks.
+let lostCount = 0;
+if (losses.length) {
+  const targetLabel = isSpdxTarget
+    ? "the SPDX 3.0.1 export lacks what they name"
+    : isCdx20Target
+      ? "the 2.0 output keeps what the read model carries for 2.0, and any difference is reported below"
+      : `the CycloneDX ${targetSpecVersion} output lacks what they name`;
+  console.warn(
+    `Reading the CycloneDX 2.0 input into cdxgen's 1.x model reported ${losses.length} loss(es); ${targetLabel}:`,
+  );
+  for (const loss of losses) {
+    console.warn(`  - ${loss.pointer || "(root)"}: ${loss.reason}`);
+  }
+  if (!isCdx20Target) {
+    lostCount += losses.length;
+  }
+}
+const failIfLost = () => {
+  if (args.failOnLoss && lostCount > 0) {
+    console.error(
+      `--fail-on-loss is set and the conversion lost data (${lostCount} loss(es) above).`,
+    );
+    process.exit(2);
+  }
+};
 
 if (isSpdxTarget) {
-  if (!["1.6", "1.7"].includes(cdxSpecVersion)) {
+  if (!["1.6", "1.7", "2.0"].includes(cdxSpecVersion)) {
     console.error(
-      `Unsupported CycloneDX specVersion '${bomJson?.specVersion}'. cdx-convert currently supports CycloneDX 1.6 or 1.7 input and exports SPDX 3.0.1.`,
+      `Unsupported CycloneDX specVersion '${bomJson?.specVersion}'. cdx-convert supports CycloneDX 1.6, 1.7 and 2.0 input and exports SPDX 3.0.1.`,
     );
     process.exit(1);
   }
+  failIfLost();
 
-  const spdxJson = convertCycloneDxToSpdx(bomJson, args);
+  const spdxJson = convertCycloneDxToSpdx(internalBom, args);
   if (!spdxJson) {
     console.error("Conversion failed: unable to generate SPDX output.");
     process.exit(1);
@@ -167,24 +236,79 @@ if (isSpdxTarget) {
 
   // The same normalizer the postgen stage applies to freshly generated BOMs, so
   // `cdx-convert --to 1.6` and `cdxgen --spec-version 1.6` agree on the result.
-  const sourceFieldPaths = collectFieldPaths(bomJson);
-  const convertedBomJson = applySpecVersionCompatibility(bomJson, {
-    specVersion: targetSpecVersion,
-  });
-  sortBomCollections(convertedBomJson);
-
-  const retainedFieldPaths = collectFieldPaths(convertedBomJson);
-  const removedFieldPaths = [...sourceFieldPaths]
-    .filter((fieldPath) => !retainedFieldPaths.has(fieldPath))
-    .sort();
-  if (removedFieldPaths.length) {
-    console.warn(
-      `Converting to CycloneDX ${targetSpecVersion} dropped ${removedFieldPaths.length} field path(s) that version does not define:`,
+  const convertedModel = applySpecVersionCompatibility(
+    structuredClone(internalBom),
+    { specVersion: targetSpecVersion },
+  );
+  let convertedBomJson = convertedModel;
+  if (isCdx20Target) {
+    // A 1.6/1.7 input is sorted, as postProcess sorts before its render, so
+    // `cdx-convert --to 2.0` and `cdxgen --spec-version 2.0` agree on the
+    // order. A 2.0 input keeps its own order: sorting would reorder the
+    // objects the read model keeps as 2.0 originals, and they would no
+    // longer render back unchanged.
+    if (!isCdx20Input) {
+      sortBomCollections(convertedModel);
+    }
+    // The optional cdx-hbom hardware mapper, as cdxgen --spec-version 2.0
+    // uses it, so both render an HBOM the same way.
+    const { bomJson: rendered, report } = renderCycloneDx20WithReport(
+      convertedModel,
+      await hardwareRenderContext(convertedModel),
+    );
+    convertedBomJson = rendered;
+    const dropLabels = Object.keys(report.drops);
+    const dropCount = dropLabels.reduce(
+      (sum, label) => sum + report.drops[label],
+      0,
     );
-    for (const fieldPath of removedFieldPaths) {
-      console.warn(`  - ${fieldPath}`);
+    if (dropCount) {
+      console.warn(
+        `Rendering CycloneDX 2.0 dropped ${dropCount} value(s) the 2.0 format has no place for:`,
+      );
+      for (const label of dropLabels) {
+        console.warn(`  - ${label} ×${report.drops[label]}`);
+      }
+      lostCount += dropCount;
+    }
+    if (isCdx20Input) {
+      // The read model carries 2.0-only content for 2.0 output, so a 2.0 to
+      // 2.0 conversion loses only what is missing from the output.
+      const missing = diffMissingLeafValues(bomJson, convertedBomJson);
+      if (missing.length) {
+        console.warn(
+          `The CycloneDX 2.0 output lacks ${missing.length} value(s) of the input (member order ignored):`,
+        );
+        for (const leaf of missing) {
+          console.warn(
+            `  - ${leaf.length > MAX_PRINTED_LEAF_LENGTH ? `${leaf.slice(0, MAX_PRINTED_LEAF_LENGTH)}…` : leaf}`,
+          );
+        }
+        lostCount += missing.length;
+      }
+    }
+  } else {
+    sortBomCollections(convertedBomJson);
+    const removedFieldPaths = diffRemovedFieldPaths(
+      internalBom,
+      convertedBomJson,
+    )
+      // The internal sections key is a transport detail of the 1.x model,
+      // not a document field, so it never counts as dropped data.
+      .filter(
+        (fieldPath) => !fieldPath.startsWith(CDX20_INTERNAL_SECTIONS_KEY),
+      );
+    if (removedFieldPaths.length) {
+      console.warn(
+        `Converting to CycloneDX ${targetSpecVersion} dropped ${removedFieldPaths.length} field path(s) that version does not define:`,
+      );
+      for (const fieldPath of removedFieldPaths) {
+        console.warn(`  - ${fieldPath}`);
+      }
+      lostCount += removedFieldPaths.length;
     }
   }
+  failIfLost();
 
   if (args.validate) {
     if (VALIDATABLE_SPEC_VERSIONS.has(targetSpecVersion)) {

package/bin/evinse.js

@@ -12,12 +12,16 @@ import { safeExistsSync } from "../lib/ecosystems/utils.js";
 import {
   analyzeProject,
   createEvinseFile,
+  loadEvinseInputBom,
   prepareDB,
+  reportEvinseInputLosses,
 } from "../lib/evinser/evinser.js";
 import {
   getNonCycloneDxErrorMessage,
+  isCycloneDx20SpecVersion,
   isCycloneDxBom,
 } from "../lib/inventory/bomUtils.js";
+import { loadBomForAnalysis } from "../lib/inventory/cyclonedx20.js";
 import {
   printCallStack,
   printOccurrences,
@@ -269,6 +273,9 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("callsites-slices-file", {
+    description: "Use an existing callsites slices file (JS/TS).",
+  })
   .option("scalasem-command", {
     description:
       "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",
@@ -360,6 +367,22 @@ function ensureCycloneDxInput(inputFile) {
   }
 }
 ensureCycloneDxInput(args.input);
+// A CycloneDX 2.0 input is read into the 1.x internal model once, here. The
+// model goes to prepareDB, analyzeProject and createEvinseFile as
+// `inputBomJson`, so the analysis works on the 1.x shape, and the evinser's
+// postProcess pass writes the result back at 2.0.
+if (safeExistsSync(args.input)) {
+  try {
+    const { bomJson: inputBom, losses } = loadEvinseInputBom(args);
+    if (isCycloneDx20SpecVersion(inputBom?.specVersion)) {
+      args.specVersion = "2.0";
+      args.inputBomJson = inputBom;
+      reportEvinseInputLosses(losses);
+    }
+  } catch {
+    // ensureCycloneDxInput already reported the parse failure.
+  }
+}
 (async () => {
   // First, prepare the database by cataloging jars and other libraries
   const dbObjMap = await prepareDB(args);
@@ -373,10 +396,12 @@ ensureCycloneDxInput(args.input);
       process.exit(1);
     }
     if (args.print) {
-      printOccurrences(bomJson);
-      printCallStack(bomJson);
+      // The print helpers walk the 1.x shape; a 2.0 result is read back.
+      const printBom = loadBomForAnalysis(bomJson).internalBom;
+      printOccurrences(printBom);
+      printCallStack(printBom);
       printReachables(sliceArtefacts);
-      printServices(bomJson);
+      printServices(printBom);
     }
   }
 })();

package/bin/repl.js

@@ -10,6 +10,7 @@ import jsonata from "jsonata";
 
 import { createBom } from "../lib/cli/index.js";
 import { readEnvironmentVariable } from "../lib/core/activity.js";
+import { thoughtLog } from "../lib/core/logger.js";
 import {
   getTmpDir,
   isDryRun,
@@ -19,6 +20,11 @@ import {
   safeWriteSync,
 } from "../lib/ecosystems/utils.js";
 import { isSpdxJsonLd } from "../lib/inventory/bomUtils.js";
+import {
+  formatReadLossNotice,
+  loadBomForAnalysis,
+  renderCycloneDx20,
+} from "../lib/inventory/cyclonedx20.js";
 import {
   printAiBomDatasets,
   printAiBomInsights,
@@ -89,6 +95,20 @@ if (readEnvironmentVariable("CDXGEN_NODE_OPTIONS")) {
 
 // The current sbom is stored here
 let sbom;
+// For an imported CycloneDX 2.0 document, `sbom` holds the 1.x-shaped model
+// the pivots read. `sbomIs20` says the BOM is a 2.0 one, so .validate and
+// .save work with 2.0 documents; `importedBom20` keeps the document as read
+// until .update changes the model.
+let sbomIs20 = false;
+let importedBom20;
+
+/** The current BOM as a document: the 2.0 one for a 2.0 import. */
+const getBomDocument = () => {
+  if (!sbomIs20) {
+    return sbom;
+  }
+  return importedBom20 ?? renderCycloneDx20(sbom);
+};
 const getInteractiveBom = () => toCycloneDxLikeBom(sbom);
 
 function getContainerRegistryHost(reference) {
@@ -427,7 +447,20 @@ export const importSbom = async (sbomOrPath) => {
   }
   if (importTarget.endsWith(".json") && safeExistsSync(importTarget)) {
     try {
-      sbom = JSON.parse(readFileSync(importTarget, "utf-8"));
+      const importedBom = JSON.parse(readFileSync(importTarget, "utf-8"));
+      // A CycloneDX 2.0 document is read into the 1.x internal model so the
+      // pivots below keep working; the number of read losses is noted once.
+      const { internalBom, losses, specVersion } =
+        loadBomForAnalysis(importedBom);
+      sbom = internalBom;
+      sbomIs20 = specVersion === "2.0" && internalBom !== importedBom;
+      importedBom20 = sbomIs20 ? importedBom : undefined;
+      if (losses.length) {
+        console.log(`ℹ ${formatReadLossNotice(losses)}`);
+        for (const loss of losses) {
+          thoughtLog(`cdxi 2.0 loss at ${loss.pointer}: ${loss.reason}`);
+        }
+      }
       let bomType = "SBOM";
       if (isSpdxJsonLd(sbom)) {
         bomType = "SPDX";
@@ -473,10 +506,14 @@ export const importSbom = async (sbomOrPath) => {
       "protobuf BOM input",
     );
     sbom = readBinary(importTarget, true);
+    sbomIs20 = false;
+    importedBom20 = undefined;
     printSummary(sbom);
   } else if (isSupportedSbomRegistryReference(importTarget)) {
     try {
       sbom = await getBomWithOras(importTarget);
+      sbomIs20 = false;
+      importedBom20 = undefined;
       if (sbom) {
         printSummary(sbom);
       } else {
@@ -557,6 +594,8 @@ cdxgenRepl.defineCommand("create", {
     });
     if (bomNSData) {
       sbom = bomNSData.bomJson;
+      sbomIs20 = false;
+      importedBom20 = undefined;
       console.log("✅ BOM imported successfully.");
       console.log("💭 Type .print to view the BOM as a table");
       console.log(
@@ -1381,7 +1420,8 @@ cdxgenRepl.defineCommand("validate", {
   help: "validate the bom using jsonschema",
   action() {
     if (sbom) {
-      validateBom(sbom).then((result) => {
+      // A 2.0 import is validated as the 2.0 document, not as the model.
+      validateBom(getBomDocument()).then((result) => {
         if (result) {
           console.log("BOM is valid!");
         }
@@ -1408,7 +1448,9 @@ cdxgenRepl.defineCommand("save", {
         this.displayPrompt();
         return;
       }
-      safeWriteSync(saveToFile, JSON.stringify(sbom, null, 2));
+      // A 2.0 import is saved as a 2.0 document rendered from the model.
+      const document = sbomIs20 ? renderCycloneDx20(sbom) : sbom;
+      safeWriteSync(saveToFile, JSON.stringify(document, null, 2));
       console.log(`BOM saved successfully to ${saveToFile}`);
     } else {
       console.log(
@@ -1436,6 +1478,8 @@ cdxgenRepl.defineCommand("update", {
       const newSbom = await expression.evaluate(sbom);
       if (newSbom && newSbom.components.length <= sbom.components.length) {
         sbom = newSbom;
+        // The model changed, so a 2.0 import is rendered again on use.
+        importedBom20 = undefined;
       }
       console.log("BOM updated successfully.");
     } else {