@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/ecosystems/gradleutils.js

@@ -1,7 +1,7 @@
 import { Buffer } from "node:buffer";
 import { chmodSync, readdirSync, readFileSync } from "node:fs";
 import { homedir, platform } from "node:os";
-import { basename, join, resolve } from "node:path";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
@@ -12,6 +12,7 @@ import {
   readEnvironmentVariable,
   recordDecisionActivity,
 } from "../core/activity.js";
+import { readRegularTextFile } from "../core/boundedFile.js";
 import {
   commandOutputText,
   isLedgerEnabled,
@@ -30,9 +31,13 @@ import {
   noteBuildToolRateLimit,
 } from "../inventory/buildToolRateLimit.js";
 import { collectJarNS } from "../inventory/deps.js";
+import { splitArtifactFileName } from "../inventory/jvmLocalRepos.js";
 import { minimumGradleVersionForJava } from "../inventory/jvmToolEnv.js";
-import { applyPurl, tryBuildPurl } from "../inventory/purl.js";
+import { gradleMirrorInitScriptArgs } from "../inventory/mavenCentralMirror.js";
+import { applyPurl, mavenPurl, tryBuildPurl } from "../inventory/purl.js";
+import { xml2js } from "../parsers/xml.js";
 import { parsePkgJson } from "./parsers-js.js";
+import { isInVendoredDir } from "./vendoredCode.js";
 
 /**
  * True when the pre-generation stage pinned an exact JVM build tool version
@@ -218,6 +223,50 @@ function gradleEvaluationOverrides(gradleArguments) {
   return overrides;
 }
 
+/**
+ * Keep Gradle's task headers in the output. cdxgen splits the `properties`
+ * and `dependencies` reports by the `> Task :path` headers, which Gradle
+ * prints at the lifecycle log level, so a project that sets
+ * `org.gradle.logging.level=quiet` or `warn` in `gradle.properties` would
+ * leave nothing to split. A command-line `-D` property beats
+ * `gradle.properties`, and a log-level option such as `--info` beats the
+ * property. A log level the user chose in `GRADLE_ARGS` is left alone.
+ *
+ * @param {string[]} gradleArguments User-supplied general gradle arguments
+ * @returns {string[]} The `-D` flag to inject, or nothing
+ */
+function gradleLogLevelOverride(gradleArguments) {
+  const logLevelOptions = [
+    "-q",
+    "--quiet",
+    "-w",
+    "--warn",
+    "-i",
+    "--info",
+    "-d",
+    "--debug",
+  ];
+  const userChose = gradleArguments.some(
+    (arg) =>
+      logLevelOptions.includes(arg) ||
+      arg.startsWith("-Dorg.gradle.logging.level="),
+  );
+  return userChose ? [] : ["-Dorg.gradle.logging.level=lifecycle"];
+}
+
+/**
+ * Read a whitespace-separated list of Gradle arguments from an environment
+ * variable such as `GRADLE_ARGS`. Repeated, leading or trailing whitespace
+ * adds no empty argument, which Gradle would read as a task path.
+ *
+ * @param {string} name Name of the environment variable
+ * @returns {string[]} The arguments, empty when the variable is unset
+ */
+export function gradleArgsFromEnv(name) {
+  const value = readEnvironmentVariable(name);
+  return value ? value.split(/\s+/).filter(Boolean) : [];
+}
+
 /**
  * Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
  *
@@ -242,6 +291,8 @@ export function buildGradleCommandArguments(
   ]
     .concat(getGradleDaemonParameter())
     .concat(gradleEvaluationOverrides(gradleArguments))
+    .concat(gradleLogLevelOverride(gradleArguments))
+    .concat(gradleMirrorInitScriptArgs())
     .concat(gradleArguments);
   const maxCliArgsLength = isWin
     ? 7500 - gradleCommandLength - mainGradleArguments.join(" ").length - 2
@@ -257,7 +308,13 @@ export function buildGradleCommandArguments(
   for (const gradleSubCommand of gradleSubCommands) {
     const subCommandLength =
       [gradleSubCommand, ...gradleSubCommandArguments].join(" ").length + 1;
-    if (maxCliArgsLength !== -1 && remainingLength - subCommandLength < 0) {
+    // An invocation always carries at least one task: without one Gradle
+    // runs the project's default tasks.
+    if (
+      maxCliArgsLength !== -1 &&
+      remainingLength - subCommandLength < 0 &&
+      allGradleArguments.length > mainGradleArguments.length
+    ) {
       splitArgs.push(allGradleArguments);
       allGradleArguments = [].concat(mainGradleArguments);
       remainingLength = maxCliArgsLength;
@@ -297,16 +354,52 @@ function parseGradleTaskHeader(line) {
   if (!line.startsWith("> Task :")) {
     return undefined;
   }
-  // The path is the first token: a status such as UP-TO-DATE or FAILED may
-  // follow it, and a CRLF line keeps its carriage return.
-  const taskPath = line.slice("> Task ".length).trim().split(/\s+/)[0];
+  // A project path may contain spaces (`:my lib`), and a status such as
+  // UP-TO-DATE or FAILED may follow the task name, so the task name is the
+  // first token after the last colon. A status never contains a colon, and a
+  // CRLF line keeps its carriage return.
+  const taskPath = line.slice("> Task ".length).trim();
   const lastColon = taskPath.lastIndexOf(":");
   return {
     projectPath: taskPath.slice(0, lastColon),
-    taskName: taskPath.slice(lastColon + 1),
+    taskName: taskPath.slice(lastColon + 1).split(/\s+/)[0],
   };
 }
 
+/**
+ * List the dependency tasks to run for the root project and every module read
+ * from `gradle properties`.
+ *
+ * The root project is recognised by identity, never by purl. A module named
+ * after the root project that inherits its group and version has the root's
+ * purl (issue 4695), and it still needs its own `:module:dependencies` task.
+ * `root` in `modulesToSkip` drops the root task; any other entry is a module
+ * path.
+ *
+ * @param {Map<string, Object>} gradleModules Modules keyed by project path, and the root project by its name
+ * @param {Object} rootComponent The component built for the root project
+ * @param {string} gradleDepTask Name of the dependency task, usually `dependencies`
+ * @param {string[]} modulesToSkip Module paths, or `root`, to leave out
+ * @returns {string[]} Task paths in the order Gradle should run them
+ */
+export function gradleDependencyTasks(
+  gradleModules,
+  rootComponent,
+  gradleDepTask,
+  modulesToSkip = [],
+) {
+  const tasks = [];
+  if (!modulesToSkip.includes("root")) {
+    tasks.push(gradleDepTask);
+  }
+  for (const [key, module] of gradleModules) {
+    if (module !== rootComponent && !modulesToSkip.includes(key)) {
+      tasks.push(`${key}:${gradleDepTask}`);
+    }
+  }
+  return tasks;
+}
+
 /**
  * Method to split the output produced by Gradle using parallel processing by project
  *
@@ -398,27 +491,19 @@ export function parseGradleProjects(rawOutput) {
             }
           }
         }
-      } else if (l.includes("--- project ")) {
-        const tmpB = l.split("--- project ");
-        if (tmpB && tmpB.length > 1) {
-          const projName = tmpB[1];
-          if (projName.startsWith(":")) {
-            const tmpName = projName.split(" ")[0];
-            if (tmpName.length > 1) {
-              projects.add(tmpName);
-            }
+      } else {
+        for (const marker of ["--- project ", "-> project "]) {
+          const markerIndex = l.indexOf(marker);
+          if (markerIndex === -1) {
+            continue;
           }
-        }
-      } else if (l.includes("-> project ")) {
-        const tmpB = l.split("-> project ");
-        if (tmpB && tmpB.length > 1) {
-          const projName = tmpB[1];
-          if (projName.startsWith(":")) {
-            const tmpName = projName.split(" ")[0];
-            if (tmpName.length > 1) {
-              projects.add(tmpName);
-            }
+          const projName = gradleProjectPath(
+            l.slice(markerIndex + marker.length),
+          );
+          if (projName?.startsWith(":") && projName.length > 1) {
+            projects.add(projName);
           }
+          break;
         }
       }
     });
@@ -432,11 +517,17 @@ export function parseGradleProjects(rawOutput) {
 /**
  * Parse gradle properties output
  *
+ * `gradlePlugin` is true when the project has the `gradlePlugin` extension,
+ * which `java-gradle-plugin`, `kotlin-dsl` and `groovy-gradle-plugin` add: the
+ * project builds Gradle plugins, as a `build-logic` build does.
+ *
  * @param {string} rawOutput Raw string output
  * @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
+ * @returns {{rootProject: string, projects: string[], metadata: Object, gradlePlugin: boolean}} The parsed properties
  */
 export function parseGradleProperties(rawOutput, gradleModuleName = null) {
   let rootProject = "root";
+  let gradlePlugin = false;
   const projects = new Set();
   const metadata = { group: "", version: "latest", properties: [] };
   if (gradleModuleName) {
@@ -472,6 +563,8 @@ export function parseGradleProperties(rawOutput, gradleModuleName = null) {
           metadata[tmpB[0]] = tmpB[1].trim().replace("unspecified", "latest");
         } else if (["buildFile", "projectDir", "rootDir"].includes(tmpB[0])) {
           metadata.properties.push({ name: tmpB[0], value: tmpB[1].trim() });
+        } else if (tmpB[0] === "gradlePlugin") {
+          gradlePlugin = true;
         } else if (tmpB[0] === "subprojects") {
           const spStrs = tmpB[1].replace(/[[\]']/g, "").split(", ");
           const tmpprojects = spStrs
@@ -486,6 +579,7 @@ export function parseGradleProperties(rawOutput, gradleModuleName = null) {
     rootProject,
     projects: Array.from(projects),
     metadata,
+    gradlePlugin,
   };
 }
 
@@ -511,17 +605,11 @@ export function executeParallelGradleProperties(
   }
   const gradleCmd = getGradleCommand(dir, null, options);
   const gradleArgs = buildGradleCommandArguments(
-    extraArgs.concat(
-      readEnvironmentVariable("GRADLE_ARGS")
-        ? readEnvironmentVariable("GRADLE_ARGS").split(" ")
-        : [],
-    ),
+    extraArgs.concat(gradleArgsFromEnv("GRADLE_ARGS")),
     allProjectsStr.map((project) =>
       project ? `${project}:properties` : "properties",
     ),
-    readEnvironmentVariable("GRADLE_ARGS_PROPERTIES")
-      ? readEnvironmentVariable("GRADLE_ARGS_PROPERTIES").split(" ")
-      : [],
+    gradleArgsFromEnv("GRADLE_ARGS_PROPERTIES"),
     gradleCmd.length,
   );
   const allOutputs = [];
@@ -880,19 +968,539 @@ export function recordGradleInvocationFailure(result, context = {}) {
   });
 }
 
+/**
+ * Configurations whose dependencies never reach the packaged application:
+ * code-quality tools, coverage agents and Spring Boot's development-only
+ * dependencies.
+ */
+const GRADLE_TOOL_CONFIGURATIONS = new Set([
+  "checkstyle",
+  "codenarc",
+  "detekt",
+  "developmentOnly",
+  "errorprone",
+  "jacocoAgent",
+  "jacocoAnt",
+  "ktlint",
+  "lintChecks",
+  "lintClassPath",
+  "pmd",
+  "spotbugs",
+  "spotbugsPlugins",
+]);
+
+/**
+ * Parts of a configuration name that mark it as feeding the compiler or a
+ * build tool, such as `annotationProcessor`, Android's
+ * `debugAnnotationProcessorClasspath` or `kotlinCompilerPluginClasspathMain`.
+ */
+const GRADLE_TOOL_CONFIGURATION_PARTS = [
+  "annotationprocessor",
+  "buildtoolsapiclasspath",
+  "commonizer",
+  "compilerclasspath",
+  "compilerpluginclasspath",
+];
+
+/**
+ * Properties that describe a dependency Gradle could not resolve.
+ */
+const GRADLE_FAILURE_PROPERTIES = [
+  "cdx:gradle:resolutionFailed",
+  "cdx:gradle:requestedVersion",
+];
+
+/**
+ * Markers Gradle appends to a dependency tree line, with the flag each sets.
+ */
+const GRADLE_TREE_LINE_MARKERS = [
+  ["(*)", "omitted"],
+  ["(c)", "constraint"],
+  ["(n)", "unresolvable"],
+  ["FAILED", "failed"],
+];
+
+/**
+ * Read the name of the configuration a `gradle dependencies` header line
+ * introduces, such as `runtimeClasspath - Runtime classpath of source set
+ * 'main'.`, `api (n)`, a bare `classpath`, a Groovy name such as
+ * `integration-test` or an internal one such as
+ * `_internal-unified-test-platform-android-device-provider-ddmlib`.
+ *
+ * @param {string} line One line of the report
+ * @returns {string|undefined} The configuration name, or undefined when the
+ *   line is not a configuration header
+ */
+function parseGradleConfigurationHeader(line) {
+  let name = line.split(" - ")[0];
+  if (name.endsWith(" (n)")) {
+    name = name.slice(0, -" (n)".length);
+  }
+  return /^[A-Za-z_][A-Za-z0-9_.-]*$/.test(name) ? name : undefined;
+}
+
+/**
+ * Configurations, other than runtime classpaths, whose dependencies ship
+ * with the application: `compile` and `default` in Gradle 6 and older, which
+ * the runtime classpath extended, and the Shadow plugin's `shadow`, whose
+ * dependencies the published artifact declares as runtime dependencies.
+ */
+const GRADLE_SHIPPED_CONFIGURATIONS = new Set(["compile", "default", "shadow"]);
+
+/**
+ * Map a Gradle configuration to the CycloneDX scope of the dependencies it
+ * resolves, so that only what ships with the application reads as required.
+ *
+ * Configurations whose name starts with `_`, such as the Android Gradle
+ * plugin's `_internal-unified-test-platform-*` ones, are the plugin's own
+ * tooling and `excluded`. Test configurations are `optional`. Runtime
+ * classpaths, including Android
+ * variants such as `debugRuntimeClasspath` and Kotlin targets such as
+ * `jvmRuntimeClasspath`, are `required`, and so are Kotlin/Native klibraries,
+ * which are linked into the binary, and the configurations in
+ * `GRADLE_SHIPPED_CONFIGURATIONS`. Everything else is `excluded`: annotation
+ * processors, compiler, code-quality and other build-tool classpaths, and
+ * compile classpaths, whose dependencies a runtime classpath also lists unless
+ * they are compile-only, as Maven's `provided` scope is. A dependency seen in
+ * several configurations keeps the strongest scope among them. Test and
+ * runtime are matched as whole words of the camel-case name, so
+ * `latestRuntimeClasspath` is a runtime classpath, not a test one.
+ *
+ * @param {string} configurationName Name of the configuration
+ * @returns {string} The CycloneDX scope
+ */
+function gradleConfigurationScope(configurationName) {
+  const lowerName = configurationName.toLowerCase();
+  const words = configurationName
+    .split(/[-_.]|(?=[A-Z])/)
+    .map((word) => word.toLowerCase());
+  if (
+    GRADLE_TOOL_CONFIGURATIONS.has(configurationName) ||
+    configurationName.startsWith("_") ||
+    ["kapt", "ksp"].includes(words[0]) ||
+    GRADLE_TOOL_CONFIGURATION_PARTS.some((part) => lowerName.includes(part))
+  ) {
+    return "excluded";
+  }
+  if (words.includes("test") || words.includes("tests")) {
+    return "optional";
+  }
+  if (
+    words.includes("runtime") ||
+    words.includes("klibraries") ||
+    GRADLE_SHIPPED_CONFIGURATIONS.has(configurationName)
+  ) {
+    return "required";
+  }
+  return "excluded";
+}
+
+/**
+ * Rank a scope so that a dependency seen in several configurations keeps the
+ * strongest one: `required` or no scope (which CycloneDX reads as required),
+ * then `optional`, then `excluded`.
+ *
+ * @param {string|undefined} scope CycloneDX scope
+ * @returns {number} The rank, higher being stronger
+ */
+function gradleScopeRank(scope) {
+  if (scope === "required" || scope === undefined) {
+    return 2;
+  }
+  return scope === "optional" ? 1 : 0;
+}
+
+/**
+ * Read a project path from the text that follows `project ` in a dependency
+ * tree line. Gradle 9 quotes the path (`project ':lib'`), Gradle 8 does not
+ * (`project :lib`).
+ *
+ * @param {string} text The text after `project `
+ * @returns {string|undefined} The project path, such as `:lib`
+ */
+function gradleProjectPath(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("'")) {
+    const end = trimmed.indexOf("'", 1);
+    return end > 1 ? trimmed.slice(1, end) : undefined;
+  }
+  return trimmed.split(" ")[0] || undefined;
+}
+
+/**
+ * Find the module a project path in a dependency tree names. Subprojects are
+ * keyed by their path (`:lib`) and the root project by its name, so the root
+ * path `:` resolves to the report's own project when that is the root, or else
+ * to the one module keyed by a name.
+ *
+ * @param {Map} gradleModules Modules keyed by project path or root name
+ * @param {string} projectPath Project path from the tree, such as `:lib` or `:`
+ * @param {string} reportProjectName Key of the project the report belongs to
+ * @returns {Object|undefined} The module component
+ */
+function gradleModuleForPath(gradleModules, projectPath, reportProjectName) {
+  if (projectPath !== ":") {
+    return gradleModules.get(projectPath);
+  }
+  if (!reportProjectName.startsWith(":")) {
+    return gradleModules.get(reportProjectName);
+  }
+  const rootKeys = [...gradleModules.keys()].filter((k) => !k.startsWith(":"));
+  return rootKeys.length === 1 ? gradleModules.get(rootKeys[0]) : undefined;
+}
+
+/**
+ * Pick a concrete version out of the version Gradle printed as requested. A
+ * rich version such as `{strictly 1.0}`, `{require 2.2; reject 2.0}` or
+ * `{prefer 2.0.9}` gives the version of its first strictly, require or prefer
+ * clause. A range or dynamic version gives none.
+ *
+ * @param {string|undefined} versionText The requested version
+ * @returns {string|undefined} The concrete version
+ */
+function gradleRequestedVersion(versionText) {
+  if (!versionText) {
+    return undefined;
+  }
+  // `1.+` and `latest.release` are dynamic and a bracketed range is a
+  // range, but `0.92.2+1.20.1` is a concrete version with build metadata.
+  const isConcrete = (v) =>
+    v &&
+    !v.endsWith("+") &&
+    !v.startsWith("latest.") &&
+    ![..."[](),"].some((ch) => v.includes(ch));
+  if (!versionText.startsWith("{")) {
+    return isConcrete(versionText) ? versionText : undefined;
+  }
+  const body = versionText.slice(1, versionText.lastIndexOf("}"));
+  for (const clause of body.split(";")) {
+    const [keyword, ...rest] = clause.trim().split(" ");
+    const value = rest.join(" ").trim();
+    if (
+      ["strictly", "require", "prefer"].includes(keyword) &&
+      isConcrete(value)
+    ) {
+      return value;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Split one line of a `gradle dependencies` tree into its depth and the
+ * dependency it names. The selected side of `->` wins over the requested
+ * side, whether it is a version, other coordinates or a project.
+ *
+ * @param {string} line One line of the report, without its line ending
+ * @returns {Object|undefined} `{ level, group, name, version,
+ *   requestedVersion, projectPath, omitted, constraint, unresolvable, failed }`,
+ *   `{ level, unknown: true }` for a tree line whose dependency cannot be
+ *   read, or undefined when the line is not a tree line
+ */
+function parseGradleTreeLine(line) {
+  const markerIndex = line.indexOf("--- ");
+  if (markerIndex < 1) {
+    return undefined;
+  }
+  for (const ch of line.slice(0, markerIndex)) {
+    if (!"|+\\ ".includes(ch)) {
+      return undefined;
+    }
+  }
+  const parsed = {
+    level: Math.floor(markerIndex / 5) + 1,
+    omitted: false,
+    constraint: false,
+    unresolvable: false,
+    failed: false,
+  };
+  let text = line.slice(markerIndex + "--- ".length).trim();
+  let stripped = true;
+  while (stripped) {
+    stripped = false;
+    for (const [marker, flag] of GRADLE_TREE_LINE_MARKERS) {
+      if (text.endsWith(` ${marker}`)) {
+        parsed[flag] = true;
+        text = text.slice(0, -marker.length - 1).trimEnd();
+        stripped = true;
+      }
+    }
+  }
+  const [requested, selected] = text.split(" -> ");
+  // Gradle 9.6 and later print the root project as `root project '<name>'`
+  // where earlier versions print `project :`. Either way it is the root
+  // project, whose path is `:`.
+  if (requested.startsWith("root project ")) {
+    parsed.projectPath = ":";
+  } else if (requested.startsWith("project ")) {
+    parsed.projectPath = gradleProjectPath(requested.slice("project ".length));
+  } else {
+    const [group, name, ...versionParts] = requested.split(":");
+    if (!group || !name || group.includes(" ") || name.includes(" ")) {
+      return { level: parsed.level, unknown: true };
+    }
+    parsed.group = group;
+    parsed.name = name;
+    parsed.requestedVersion = versionParts.join(":") || undefined;
+    parsed.version = gradleRequestedVersion(parsed.requestedVersion);
+  }
+  if (selected?.startsWith("root project ")) {
+    // A module substituted by the root project, as with
+    // `substitute module('org.ex:main') using project(':')`.
+    parsed.projectPath = ":";
+  } else if (selected?.startsWith("project ")) {
+    parsed.projectPath = gradleProjectPath(selected.slice("project ".length));
+  } else if (selected?.includes(":")) {
+    // The selected module replaces the requested one, version and all.
+    const [group, name, version] = selected.split(":");
+    parsed.group = group;
+    parsed.name = name;
+    parsed.version = version;
+    parsed.requestedVersion = undefined;
+  } else if (selected && !/\s/u.test(selected)) {
+    // A selected version has no whitespace. Anything else is a form of the
+    // report this parser does not know, and must not become a version.
+    parsed.version = selected;
+  } else if (selected) {
+    return { level: parsed.level, unknown: true };
+  }
+  if (parsed.projectPath === undefined && !parsed.group) {
+    return { level: parsed.level, unknown: true };
+  }
+  return parsed;
+}
+
+/**
+ * Read the properties of every project the dependency reports name that
+ * `gradleModules` does not have yet, such as a project of an included build,
+ * and add a module for each one whose properties task printed a report. One
+ * Gradle invocation covers all of them.
+ *
+ * @param {Iterable<string>} reports Text of the `gradle dependencies` reports
+ * @param {Map} gradleModules Modules keyed by project path, updated in place
+ * @param {string} gradleRootPath Directory to run Gradle in
+ * @param {Object} options CLI options
+ * @returns {Promise<string[]>} Paths of the projects added
+ */
+export async function loadGradleModulesForReports(
+  reports,
+  gradleModules,
+  gradleRootPath,
+  options = {},
+) {
+  const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
+    ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
+    : [];
+  const missing = new Set();
+  for (const report of reports) {
+    for (const projectPath of parseGradleProjects(report).projects) {
+      if (
+        !gradleModules.has(projectPath) &&
+        !modulesToSkip.includes(projectPath)
+      ) {
+        missing.add(projectPath);
+      }
+    }
+  }
+  if (!missing.size || !isProjectToolingAllowed(options)) {
+    return [];
+  }
+  const splitPropTaskOut = splitOutputByGradleProjects(
+    executeParallelGradleProperties(gradleRootPath, [...missing], [], options),
+    ["properties"],
+  );
+  const added = [];
+  for (const projectPath of missing) {
+    // A project whose properties task printed nothing has no metadata to
+    // build a module from.
+    if (!splitPropTaskOut.has(projectPath)) {
+      continue;
+    }
+    const propMap = parseGradleProperties(
+      splitPropTaskOut.get(projectPath),
+      projectPath,
+    );
+    gradleModules.set(
+      projectPath,
+      await buildObjectForGradleModule(
+        propMap.rootProject === "root"
+          ? projectPath.split(":").pop()
+          : propMap.rootProject,
+        propMap.metadata,
+      ),
+    );
+    added.push(projectPath);
+  }
+  return added;
+}
+
+/**
+ * Give the components of a build-tooling report, such as that of an included
+ * build that builds Gradle plugins, the `excluded` scope that build-tool
+ * configurations get. `reconcileGradleComponents` later keeps a stronger
+ * scope that another project's report gives the same component.
+ *
+ * @param {Object[]} pkgList Components from one project's report, updated in place
+ * @param {Map<string, Object>} gradleModules Modules, which keep their own scope
+ * @returns {Object[]} The same list
+ */
+export function excludeGradleBuildTooling(pkgList, gradleModules) {
+  const modules = new Set(gradleModules.values());
+  for (const pkg of pkgList) {
+    if (!modules.has(pkg)) {
+      pkg.scope = "excluded";
+    }
+  }
+  return pkgList;
+}
+
+/**
+ * Reconcile the copies of a component that several Gradle projects report.
+ * Every copy gets the strongest scope any project gave it, so a library one
+ * module only tests with stays required when another module compiles against
+ * it, and a dependency one project failed to resolve loses its failure
+ * properties when another project resolved it.
+ *
+ * @param {Object[]} pkgList Components from all the projects, updated in place
+ * @returns {Object[]} The same list
+ */
+export function reconcileGradleComponents(pkgList) {
+  const strongest = new Map();
+  const resolvedSomewhere = new Set();
+  const isFailed = (pkg) =>
+    pkg.properties?.some((p) => p.name === "cdx:gradle:resolutionFailed");
+  for (const pkg of pkgList) {
+    const key = pkg?.["bom-ref"];
+    if (!key) {
+      continue;
+    }
+    if (
+      !strongest.has(key) ||
+      gradleScopeRank(pkg.scope) > gradleScopeRank(strongest.get(key))
+    ) {
+      strongest.set(key, pkg.scope);
+    }
+    if (!isFailed(pkg)) {
+      resolvedSomewhere.add(key);
+    }
+  }
+  for (const pkg of pkgList) {
+    const key = pkg?.["bom-ref"];
+    if (!key) {
+      continue;
+    }
+    if (strongest.get(key) === undefined) {
+      delete pkg.scope;
+    } else {
+      pkg.scope = strongest.get(key);
+    }
+    if (resolvedSomewhere.has(key) && isFailed(pkg)) {
+      pkg.properties = pkg.properties.filter(
+        (p) => !GRADLE_FAILURE_PROPERTIES.includes(p.name),
+      );
+      if (!pkg.properties.length) {
+        delete pkg.properties;
+      }
+    }
+  }
+  return pkgList;
+}
+
+/**
+ * Whether a module name is one that platforms and BOMs use, such as
+ * `jackson-bom`, `spring-boot-dependencies`, `micronaut-platform` or the AWS
+ * SDK's `bom`.
+ *
+ * @param {string} name Module name
+ * @returns {boolean} True for a platform-style name
+ */
+function isGradlePlatformName(name) {
+  return (
+    name === "bom" ||
+    ["-bom", "-dependencies", "-platform"].some((suffix) =>
+      name.endsWith(suffix),
+    )
+  );
+}
+
+/**
+ * Give the platforms and BOMs in one report a `pom` type and the `excluded`
+ * scope. Gradle prints a platform like a library, with only constraints
+ * (`(c)`) under it, but a platform is a pom that never ships. A module counts
+ * as a platform when its name is one platforms use and the report gives it no
+ * dependency of its own, so a jar such as `jna-platform`, which depends on
+ * `jna`, stays a jar.
+ *
+ * @param {Map<string, {adep: Object, isModule: boolean}>} depsByRef Components of the report by bom-ref, updated in place
+ * @param {Object<string, string[]>} levelTrees Edges of the report by bom-ref
+ * @returns {Map<string, string>} The new bom-ref of each renamed component, keyed by its old one
+ */
+function markGradlePlatforms(depsByRef, levelTrees) {
+  const renamed = new Map();
+  for (const [bomRef, { adep, isModule }] of depsByRef) {
+    if (
+      isModule ||
+      adep.qualifiers?.type !== "jar" ||
+      !isGradlePlatformName(adep.name || "") ||
+      levelTrees[bomRef]?.length
+    ) {
+      continue;
+    }
+    const purl = tryBuildPurl({
+      type: "maven",
+      namespace: adep.group || null,
+      name: adep.name,
+      version: adep.version || null,
+      qualifiers: { type: "pom" },
+    });
+    if (!purl) {
+      continue;
+    }
+    adep.qualifiers = { type: "pom" };
+    adep.scope = "excluded";
+    applyPurl(adep, purl);
+    renamed.set(bomRef, adep["bom-ref"]);
+  }
+  return renamed;
+}
+
 /**
  * Method to resolve dependencies from a gradle output
  *
+ * A constraint line (`(c)`) adds neither a component nor an edge. Gradle
+ * prints a nested constraint under the platform or module that declares it,
+ * and only when the dependency it affects is resolved elsewhere in the tree,
+ * where that dependency gets its component and edges. A top-level
+ * `{strictly …}` constraint from consistent resolution can name a module the
+ * configuration never resolves. A dependency that failed to resolve carries
+ * `cdx:gradle:resolutionFailed`, keeps the version it was requested at when
+ * that is a concrete version, and otherwise records the request in
+ * `cdx:gradle:requestedVersion`. A dependency seen in several configurations
+ * keeps the strongest scope among them. Platforms and BOMs get a `pom` type
+ * and the `excluded` scope.
+ *
+ * The parser runs no Gradle task. A project the tree names but `gradleModules`
+ * lacks gets a component built from the root project's group and version; use
+ * `loadGradleModulesForReports` first to read such projects' properties.
+ *
+ * The lines Gradle prints under another project, such as `project ':lib'` in
+ * the report of `:app`, show that project's dependencies as `:app` resolved
+ * them, after conflict resolution. When `reportedProjects` names that project,
+ * its own report supplies its edges, so these lines add no edge from it.
+ *
  * @param {string} rawOutput Text output from gradle dependencies task
- * @param {string} rootProjectName Name of the root project
- * @param {map} gradleModules Cache with all gradle modules that have already been read
- * @param {string} gradleRootPath Root path where Gradle is to be run when getting module information
+ * @param {string} rootProjectName Key in `gradleModules` of the project the report belongs to
+ * @param {map} gradleModules Gradle modules keyed by project path, and the root project by its name
+ * @param {string} gradleRootPath Directory Gradle ran in, recorded as `cdx:gradle:GradleRootPath`
+ * @param {Set<string>} [reportedProjects] Keys in `gradleModules` of the projects whose own reports are parsed
+ * @returns {{pkgList: Object[], dependenciesList: Object[]}|{}} The components and dependency graph
  */
 export async function parseGradleDep(
   rawOutput,
   rootProjectName = "root",
   gradleModules = new Map(),
   gradleRootPath = "",
+  reportedProjects = new Set(),
 ) {
   if (typeof rawOutput === "string") {
     // Bug: 249. Get any sub-projects refered here
@@ -907,225 +1515,238 @@ export async function parseGradleDep(
     ) {
       rootProjectName = retMap.rootProject;
     }
-    let match = "";
     // To render dependency tree we need a root project
     const rootProject = gradleModules.get(rootProjectName);
+    if (!rootProject) {
+      thoughtLog(
+        `The Gradle report for ${rootProjectName} belongs to no module read from 'gradle properties', so it has no parent to hang its dependency tree from.`,
+      );
+      return {};
+    }
     const deps = [];
     const dependenciesList = [];
-    const keys_cache = {};
-    const deps_keys_cache = {};
-    let last_level = 0;
-    let last_bomref = rootProject["bom-ref"];
-    const first_bomref = last_bomref;
-    let last_project_bomref = first_bomref;
+    const depsByRef = new Map();
+    const firstBomRef = rootProject["bom-ref"];
     const level_trees = {};
-    level_trees[last_bomref] = [];
+    level_trees[firstBomRef] = [];
+    // Modules whose own report supplies their edges.
+    const reportedModuleRefs = new Set();
+    for (const key of reportedProjects) {
+      const reportedRef = gradleModules.get(key)?.["bom-ref"];
+      if (reportedRef && reportedRef !== firstBomRef) {
+        reportedModuleRefs.add(reportedRef);
+      }
+    }
     let scope;
     let profileName;
-    if (retMap?.projects) {
-      const modulesToSkip = readEnvironmentVariable("GRADLE_SKIP_MODULES")
-        ? readEnvironmentVariable("GRADLE_SKIP_MODULES").split(",")
-        : [];
-      const modulesToScan = retMap.projects.filter(
-        (module) => !gradleModules.has(module),
-      );
-      if (modulesToScan.length > 0) {
-        const parallelPropTaskOut = executeParallelGradleProperties(
-          gradleRootPath,
-          modulesToScan.filter((module) => !modulesToSkip.includes(module)),
-        );
-        const splitPropTaskOut = splitOutputByGradleProjects(
-          parallelPropTaskOut,
-          ["properties"],
-        );
-
-        for (const module of modulesToScan) {
-          const propMap = parseGradleProperties(
-            splitPropTaskOut.get(module),
-            module,
-          );
-          const rootSubProject = propMap.rootProject;
-          if (rootSubProject) {
-            const rootSubProjectObj = await buildObjectForGradleModule(
-              rootSubProject === "root" ? module : rootSubProject,
-              propMap.metadata,
-            );
-            gradleModules.set(module, rootSubProjectObj);
-          }
-        }
-      }
-      const subDependsOn = [];
-      for (const sd of retMap.projects) {
-        if (gradleModules.has(sd)) {
-          subDependsOn.push(gradleModules.get(sd)["bom-ref"]);
-        }
+    // ancestors[level] is the bom-ref of the line most recently seen at that
+    // depth; ancestors[0] is the project the report belongs to.
+    const ancestors = [firstBomRef];
+    const lines = rawOutput.split("\n").map((l) => l.replaceAll("\r", ""));
+    // Modules some configuration resolved to a version, so that a failed,
+    // versionless request for one of them adds nothing.
+    const resolvedModules = new Set();
+    for (const line of lines) {
+      const parsed = parseGradleTreeLine(line);
+      if (
+        parsed?.group &&
+        parsed.version !== undefined &&
+        !parsed.failed &&
+        !parsed.constraint &&
+        !parsed.unresolvable
+      ) {
+        resolvedModules.add(`${parsed.group}:${parsed.name}`);
       }
-      level_trees[last_bomref] = subDependsOn;
     }
-    let stack = [last_bomref];
-    const depRegex =
-      /^.*?--- +(?<groupspecified>[^\s:]+) ?:(?<namespecified>[^\s:]+)(?::(?:{strictly [[]?)?(?<versionspecified>[^,\s:}]+))?(?:})?(?:[^->]* +-> +(?:(?<groupoverride>[^\s:]+):(?<nameoverride>[^\s:]+):)?(?<versionoverride>[^\s:]+))?/gm;
-    for (let rline of rawOutput.split("\n")) {
-      if (!rline) {
+    for (const rline of lines) {
+      const configurationName = parseGradleConfigurationHeader(rline);
+      if (configurationName) {
+        ancestors.length = 1;
+        profileName = configurationName;
+        scope = gradleConfigurationScope(configurationName);
+      }
+      if (rline.trim() === "") {
+        ancestors.length = 1;
         continue;
       }
-      rline = rline.replaceAll("\r", "");
-      const trimmedLine = rline.trim();
-      if (
-        trimmedLine.endsWith("(n)") ||
-        ((rline.startsWith("+--- ") || rline.startsWith("\\--- ")) &&
-          rline.includes("{strictly") &&
-          rline.includes("(c)"))
-      ) {
+      const parsed = parseGradleTreeLine(rline);
+      if (!parsed) {
+        continue;
+      }
+      // A line that names nothing usable still takes its place in the tree,
+      // so the lines under it get no parent rather than a wrong one.
+      if (parsed.unknown || parsed.unresolvable) {
+        ancestors.length = Math.min(ancestors.length, parsed.level);
         continue;
       }
+      const { level } = parsed;
+      const isProject = parsed.projectPath !== undefined;
+      if (parsed.constraint) {
+        ancestors.length = Math.min(ancestors.length, level);
+        continue;
+      }
+      // Only a dependency that failed to resolve can lack a version: Gradle
+      // prints every resolved one with the version it selected.
       if (
-        trimmedLine === "" ||
-        rline.startsWith("+--- ") ||
-        rline.startsWith("\\--- ")
+        !isProject &&
+        parsed.version === undefined &&
+        (!parsed.failed ||
+          resolvedModules.has(`${parsed.group}:${parsed.name}`))
       ) {
-        last_level = 1;
-        last_project_bomref = first_bomref;
-        last_bomref = last_project_bomref;
-        stack = [first_bomref];
+        ancestors.length = Math.min(ancestors.length, level);
+        continue;
       }
-      if (rline.includes(" - ") && !rline.startsWith("Project ':")) {
-        profileName = rline.split(" - ")[0];
-        if (profileName.toLowerCase().includes("test")) {
-          scope = "optional";
-        } else if (profileName.toLowerCase().includes("runtime")) {
-          scope = "required";
-        } else {
-          scope = undefined;
+      // A project the modules lack is named as Gradle publishes it by
+      // default: the last segment of its path, with the root project's group
+      // and version.
+      const name = isProject
+        ? parsed.projectPath.split(":").pop()
+        : parsed.name;
+      const group = isProject ? rootProject.group : parsed.group;
+      const version = isProject ? rootProject.version : parsed.version;
+      const gradleModule = isProject
+        ? gradleModuleForPath(
+            gradleModules,
+            parsed.projectPath,
+            rootProjectName,
+          )
+        : undefined;
+      if (isProject && !gradleModule && name === "") {
+        ancestors.length = Math.min(ancestors.length, level);
+        continue;
+      }
+      let purl;
+      let bomRef;
+      if (gradleModule) {
+        purl = gradleModule["purl"];
+        bomRef = gradleModule["bom-ref"];
+      } else {
+        try {
+          purl = build({
+            type: "maven",
+            namespace: group || null,
+            name,
+            version: version || null,
+            qualifiers: { type: "jar" },
+          });
+          bomRef = decodeURIComponent(purl);
+        } catch {
+          // A purl that cannot be built keeps a name-only bom-ref so the
+          // component still lands in the graph.
+          purl = undefined;
+          bomRef = name;
         }
       }
-      while ((match = depRegex.exec(rline))) {
-        const [
-          _line,
-          groupspecified,
-          namespecified,
-          versionspecified,
-          groupoverride,
-          nameoverride,
-          versionoverride,
-        ] = match;
-        let group = groupoverride || groupspecified;
-        let name = nameoverride || namespecified;
-        let version = versionoverride || versionspecified;
-        const prefix = rline.split("---")[0];
-        const level = Math.floor(prefix.length / 5) + 1;
-        if (version !== undefined || group === "project") {
-          // Project line has no version
-          // For multi sub-module projects such as :module:dummy:starter the regex is producing incorrect values
-          if (rline.includes("project ")) {
-            const tmpA = rline.split("project ");
-            if (tmpA && tmpA.length > 1) {
-              group = rootProject.group;
-              name = tmpA[1].split(" ")[0];
-              version = undefined;
-            }
+      const existing = depsByRef.get(bomRef);
+      // The project the report belongs to is the parent, not a component.
+      if (!existing && bomRef !== firstBomRef) {
+        let adep;
+        if (gradleModule) {
+          adep = gradleModule;
+        } else {
+          adep = {
+            group,
+            name: name,
+            version,
+            qualifiers: { type: "jar" },
+          };
+          if (version === undefined) {
+            delete adep.version;
           }
-          let purl;
-          let bomRef;
-          if (gradleModules.has(name)) {
-            purl = gradleModules.get(name)["purl"];
-            bomRef = gradleModules.get(name)["bom-ref"];
-          } else {
-            try {
-              purl = build({
-                type: "maven",
-                namespace:
-                  group !== "project" ? group : rootProject.group || null,
-                name: name.replace(/^:/, ""),
-                version:
-                  version !== undefined ? version : rootProject.version || null,
-                qualifiers: { type: "jar" },
-              });
-              bomRef = decodeURIComponent(purl);
-            } catch {
-              // A purl that cannot be built keeps a name-only bom-ref so the
-              // component still lands in the graph.
-              purl = undefined;
-              bomRef = name.replace(/^:/, "");
-            }
+          adep["purl"] = purl;
+          adep["bom-ref"] = bomRef;
+          if (scope) {
+            adep["scope"] = scope;
           }
-          keys_cache[`${bomRef}_${last_bomref}`] = true;
-          // Filter duplicates
-          if (!deps_keys_cache[bomRef]) {
-            deps_keys_cache[bomRef] = true;
-            let adep;
-            if (gradleModules.has(name)) {
-              adep = gradleModules.get(name);
-            } else {
-              adep = {
-                group: group !== "project" ? group : rootProject.group,
-                name: name,
-                version: version !== undefined ? version : rootProject.version,
-                qualifiers: { type: "jar" },
-              };
-              adep["purl"] = purl;
-              adep["bom-ref"] = bomRef;
-              if (scope) {
-                adep["scope"] = scope;
-              }
-              adep.properties = [];
-              if (profileName) {
-                adep.properties.push({
-                  name: "internal:GradleProfileName",
-                  value: profileName,
-                });
-              }
-              if (gradleRootPath && gradleRootPath !== ".") {
-                adep.properties.push({
-                  name: "cdx:gradle:GradleRootPath",
-                  value: gradleRootPath,
-                });
-              }
-            }
-            if (adep?.properties?.length === 0) {
-              delete adep.properties;
-            }
-            deps.push(adep);
+          adep.properties = [];
+          if (profileName) {
+            adep.properties.push({
+              name: "internal:GradleProfileName",
+              value: profileName,
+            });
           }
-          if (!level_trees[bomRef]) {
-            level_trees[bomRef] = [];
+          if (gradleRootPath && gradleRootPath !== ".") {
+            adep.properties.push({
+              name: "cdx:gradle:GradleRootPath",
+              value: gradleRootPath,
+            });
           }
-          if (level === 0) {
-            stack = [first_bomref];
-            stack.push(bomRef);
-          } else if (last_bomref === "") {
-            stack.push(bomRef);
-          } else if (level > last_level) {
-            const cnodes = level_trees[last_bomref] || [];
-            if (!cnodes.includes(bomRef)) {
-              cnodes.push(bomRef);
-            }
-            level_trees[last_bomref] = cnodes;
-            if (stack[stack.length - 1] !== bomRef) {
-              stack.push(bomRef);
+          if (parsed.failed) {
+            adep.properties.push({
+              name: "cdx:gradle:resolutionFailed",
+              value: "true",
+            });
+            if (
+              parsed.requestedVersion &&
+              parsed.requestedVersion !== version
+            ) {
+              adep.properties.push({
+                name: "cdx:gradle:requestedVersion",
+                value: parsed.requestedVersion.slice(0, 256),
+              });
             }
+          }
+        }
+        if (adep?.properties?.length === 0) {
+          delete adep.properties;
+        }
+        depsByRef.set(bomRef, { adep, isModule: !!gradleModule });
+        deps.push(adep);
+      } else if (existing && !existing.isModule) {
+        const { adep } = existing;
+        if (gradleScopeRank(scope) > gradleScopeRank(adep.scope)) {
+          if (scope) {
+            adep.scope = scope;
           } else {
-            for (let i = level; i <= last_level; i++) {
-              stack.pop();
-            }
-            const last_stack =
-              stack.length > 0 ? stack[stack.length - 1] : last_project_bomref;
-            const cnodes = level_trees[last_stack] || [];
-            if (!cnodes.includes(bomRef)) {
-              cnodes.push(bomRef);
-            }
-            level_trees[last_stack] = cnodes;
-            stack.push(bomRef);
+            delete adep.scope;
+          }
+          const profileProp = adep.properties?.find(
+            (p) => p.name === "internal:GradleProfileName",
+          );
+          if (profileProp && profileName) {
+            profileProp.value = profileName;
+          }
+        }
+        // A dependency one configuration failed to resolve and another
+        // resolved is not a failed dependency.
+        if (!parsed.failed && adep.properties) {
+          adep.properties = adep.properties.filter(
+            (p) => !GRADLE_FAILURE_PROPERTIES.includes(p.name),
+          );
+          if (!adep.properties.length) {
+            delete adep.properties;
           }
-          last_level = level;
-          last_bomref = bomRef;
         }
       }
+      if (!level_trees[bomRef]) {
+        level_trees[bomRef] = [];
+      }
+      // A line whose parent was skipped has no known parent and gets no edge.
+      const parentRef =
+        ancestors.length >= level ? ancestors[level - 1] : undefined;
+      if (
+        parentRef &&
+        parentRef !== bomRef &&
+        !reportedModuleRefs.has(parentRef)
+      ) {
+        const cnodes = level_trees[parentRef] || [];
+        if (!cnodes.includes(bomRef)) {
+          cnodes.push(bomRef);
+        }
+        level_trees[parentRef] = cnodes;
+      }
+      ancestors.length = Math.min(ancestors.length, level);
+      if (ancestors.length === level) {
+        ancestors.push(bomRef);
+      }
     }
+    const renamedRefs = markGradlePlatforms(depsByRef, level_trees);
     for (const lk of Object.keys(level_trees)) {
       dependenciesList.push({
-        ref: lk,
-        dependsOn: [...new Set(level_trees[lk])].sort(),
+        ref: renamedRefs.get(lk) || lk,
+        dependsOn: [
+          ...new Set(level_trees[lk].map((ref) => renamedRefs.get(ref) || ref)),
+        ].sort(),
       });
     }
     return {
@@ -1830,8 +2451,16 @@ function catalogCoordinate(entry) {
 }
 
 /**
- * Resolve the version of one catalog entry.
- *
+ * Gradle rich-version syntax that names no single version: a bracketed range,
+ * an interval, a `!!` or `{strictly}` marker, a `->` transition, or a `..`
+ * separator. A version text matching this is a declaration about versions, not
+ * one version.
+ */
+const GRADLE_RICH_VERSION_PATTERN = /[[\](),!]|->|\.\./u;
+
+/**
+ * Resolve the version of one catalog entry.
+ *
  * An entry may pin `version = "1.2.3"` directly or reference the versions
  * table with `version.ref = "alias"`. Version references that are missing, or
  * that carry Gradle rich-version syntax (ranges, `!!`, separators), resolve
@@ -1851,8 +2480,1059 @@ function resolveCatalogVersion(entry, versions) {
   if (typeof raw !== "string" || !raw) {
     return undefined;
   }
-  if (/[[\](),!]|->|\.\./u.test(raw)) {
+  if (GRADLE_RICH_VERSION_PATTERN.test(raw)) {
     return undefined;
   }
   return raw;
 }
+
+/**
+ * The largest Gradle lockfile read. Real lockfiles of large multi-project
+ * builds stay well under a megabyte; the file is untrusted input, so a larger
+ * one is skipped whole rather than read in part.
+ */
+const GRADLE_LOCKFILE_MAX_BYTES = 8 * 1024 * 1024;
+
+/**
+ * The most lines read from one Gradle lockfile. Lines past the cap are
+ * ignored.
+ */
+const GRADLE_LOCKFILE_MAX_LINES = 100000;
+
+/**
+ * Gradle 6+ lockfiles that lock a buildscript classpath rather than the
+ * project's own configurations.
+ */
+const GRADLE_BUILD_TOOLING_LOCKFILES = new Set([
+  "buildscript-gradle.lockfile",
+  "settings-gradle.lockfile",
+]);
+
+const GRADLE_LOCKFILE_SUFFIX = ".lockfile";
+
+/**
+ * Work out which kind of Gradle lockfile a path names.
+ *
+ * Gradle 6 and later write one `gradle.lockfile` per project, plus
+ * `buildscript-gradle.lockfile` and `settings-gradle.lockfile` for the
+ * buildscript classpaths. Gradle 4.8 to 5.x wrote one
+ * `gradle/dependency-locks/<configuration>.lockfile` per configuration, with
+ * the buildscript configurations prefixed `buildscript-`.
+ *
+ * @param {string} lockFile Path to the lockfile
+ * @returns {{legacy: boolean, buildTooling: boolean, configuration: (string|undefined)}|undefined}
+ *   The kind, or undefined when the name is not a lockfile name
+ */
+function gradleLockfileKind(lockFile) {
+  const fileName = basename(lockFile);
+  if (!fileName.endsWith(GRADLE_LOCKFILE_SUFFIX)) {
+    return undefined;
+  }
+  const parentDir = dirname(lockFile);
+  if (
+    basename(parentDir) === "dependency-locks" &&
+    basename(dirname(parentDir)) === "gradle"
+  ) {
+    const configuration = fileName.slice(0, -GRADLE_LOCKFILE_SUFFIX.length);
+    if (!configuration) {
+      return undefined;
+    }
+    return {
+      legacy: true,
+      buildTooling: configuration.startsWith("buildscript-"),
+      configuration,
+    };
+  }
+  return {
+    legacy: false,
+    buildTooling: GRADLE_BUILD_TOOLING_LOCKFILES.has(fileName),
+    configuration: undefined,
+  };
+}
+
+/**
+ * Read a `group:name:version` coordinate from a lockfile entry.
+ *
+ * Gradle writes only resolved versions to a lockfile, so a version that is
+ * blank, a range, a dynamic selector (`1.+`, `latest.release`) or any other
+ * rich-version syntax means the line was not written by Gradle and is
+ * skipped.
+ *
+ * @param {string} text Coordinate text, already trimmed
+ * @returns {{group: string, name: string, version: string}|undefined}
+ *   The coordinate, or undefined for anything else
+ */
+function parseGradleLockCoordinate(text) {
+  if (!text || /[\s=]/u.test(text)) {
+    return undefined;
+  }
+  const parts = text.split(":");
+  if (parts.length !== 3 || parts.some((part) => !part)) {
+    return undefined;
+  }
+  const [group, name, version] = parts;
+  // Gradle writes only resolved versions to a lockfile, so a rich version or
+  // a dynamic selector (`1.+`, `2.*`, `latest.release`) means the line was
+  // not written by Gradle. The rich-version rejection is the one
+  // `resolveCatalogVersion` applies; a trailing `+` and a `*` are the
+  // dynamic selectors.
+  if (
+    version.startsWith("latest.") ||
+    version.endsWith("+") ||
+    version.includes("*") ||
+    GRADLE_RICH_VERSION_PATTERN.test(version)
+  ) {
+    return undefined;
+  }
+  return { group, name, version };
+}
+
+/**
+ * Parse one Gradle dependency lockfile.
+ *
+ * Both layouts are read. A Gradle 6+ `gradle.lockfile` has one
+ * `group:name:version=configuration,configuration` line per module and an
+ * `empty=` line naming the configurations that resolved nothing. A legacy
+ * `gradle/dependency-locks/<configuration>.lockfile` has one
+ * `group:name:version` line per module, and the file name is the
+ * configuration.
+ *
+ * The scope of a module is the strongest that `gradleConfigurationScope`
+ * gives any of its configurations, so a module locked for both
+ * `testRuntimeClasspath` and `runtimeClasspath` is `required`. Everything in
+ * a buildscript or settings lockfile is build tooling and `excluded`.
+ *
+ * A lockfile records resolved versions, so components carry a purl identity
+ * with confidence 1 and the lockfile path as the evidence value. The purl and
+ * bom-ref match what `parseGradleDep` builds for the same coordinate, so a
+ * component reads the same whether Gradle ran or not. A lockfile is flat: it
+ * says nothing about which module depends on which, so no dependency graph is
+ * returned.
+ *
+ * The file is untrusted input. It is read only when it is a regular file no
+ * larger than 8 MiB, at most 100000 lines are read, and a malformed line
+ * costs only itself. Line content never reaches a property.
+ *
+ * @param {string} lockFile Path to the lockfile
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the lockfile must resolve inside
+ * @returns {Object[]} Components, one per locked module
+ */
+export function parseGradleLockfile(lockFile, options = {}) {
+  const kind = gradleLockfileKind(lockFile);
+  if (!kind) {
+    return [];
+  }
+  const text = readRegularTextFile(
+    lockFile,
+    GRADLE_LOCKFILE_MAX_BYTES,
+    options?.rootDir,
+  );
+  if (text === undefined) {
+    if (safeExistsSync(lockFile)) {
+      console.warn(
+        `Skipping ${lockFile}: it is not a regular file inside the project, or is larger than ${GRADLE_LOCKFILE_MAX_BYTES} bytes.`,
+      );
+    }
+    return [];
+  }
+  const body = text.startsWith("\uFEFF") ? text.slice(1) : text;
+  const pkgsByRef = new Map();
+  let skippedLines = 0;
+  let lineStart = 0;
+  let lineCount = 0;
+  while (lineStart <= body.length) {
+    if (lineCount === GRADLE_LOCKFILE_MAX_LINES) {
+      if (lineStart < body.length) {
+        thoughtLog(
+          `${lockFile} has more than ${GRADLE_LOCKFILE_MAX_LINES} lines; only the first ${GRADLE_LOCKFILE_MAX_LINES} are read.`,
+        );
+      }
+      break;
+    }
+    let lineEnd = body.indexOf("\n", lineStart);
+    if (lineEnd === -1) {
+      lineEnd = body.length;
+    }
+    const line = body.slice(lineStart, lineEnd).trim();
+    lineStart = lineEnd + 1;
+    lineCount++;
+    if (!line || line.startsWith("#")) {
+      continue;
+    }
+    let coordinateText = line;
+    let configurations = [kind.configuration];
+    if (!kind.legacy) {
+      const separator = line.indexOf("=");
+      if (separator === -1) {
+        skippedLines++;
+        continue;
+      }
+      coordinateText = line.slice(0, separator).trim();
+      if (coordinateText === "empty") {
+        continue;
+      }
+      configurations = line
+        .slice(separator + 1)
+        .split(",")
+        .map((configuration) => configuration.trim())
+        .filter(Boolean);
+    }
+    const coordinate = parseGradleLockCoordinate(coordinateText);
+    if (!coordinate || !configurations.length) {
+      skippedLines++;
+      continue;
+    }
+    const { group, name, version } = coordinate;
+    const purl = mavenPurl(group, name, version, { type: "jar" });
+    if (!purl) {
+      skippedLines++;
+      continue;
+    }
+    let scope = "excluded";
+    if (!kind.buildTooling) {
+      for (const configuration of configurations) {
+        const configurationScope = gradleConfigurationScope(configuration);
+        if (gradleScopeRank(configurationScope) > gradleScopeRank(scope)) {
+          scope = configurationScope;
+        }
+      }
+    }
+    const bomRef = decodeURIComponent(purl);
+    const existing = pkgsByRef.get(bomRef);
+    if (existing) {
+      if (gradleScopeRank(scope) > gradleScopeRank(existing.scope)) {
+        existing.scope = scope;
+      }
+      continue;
+    }
+    pkgsByRef.set(bomRef, {
+      group,
+      name,
+      version,
+      qualifiers: { type: "jar" },
+      type: "library",
+      scope,
+      purl,
+      "bom-ref": bomRef,
+      properties: [{ name: "internal:SrcFile", value: lockFile }],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 1,
+          concludedValue: purl,
+          methods: [
+            {
+              technique: "manifest-analysis",
+              confidence: 1,
+              value: lockFile,
+            },
+          ],
+        },
+      },
+    });
+  }
+  if (skippedLines) {
+    thoughtLog(
+      `Skipped ${skippedLines} malformed or unresolved line(s) in ${lockFile}.`,
+    );
+  }
+  return [...pkgsByRef.values()];
+}
+
+/**
+ * Parse several Gradle lockfiles of one build and merge the result.
+ *
+ * Every project of a multi-project build has its own lockfile, so the same
+ * module often appears in several of them with different configurations. The
+ * copies collapse into one component with the strongest scope any lockfile
+ * gave it (see `reconcileGradleComponents`), and its evidence lists every
+ * lockfile that locked it. The first lockfile that locked a module stays its
+ * `internal:SrcFile`.
+ *
+ * @param {string[]} lockFiles Paths to the lockfiles
+ * @param {Object} [options] Parse options, as for `parseGradleLockfile`
+ * @returns {Object[]} Components, one per locked module
+ */
+export function parseGradleLockfiles(lockFiles, options = {}) {
+  const allPkgs = [];
+  for (const lockFile of lockFiles || []) {
+    allPkgs.push(...parseGradleLockfile(lockFile, options));
+  }
+  reconcileGradleComponents(allPkgs);
+  const pkgsByRef = new Map();
+  for (const pkg of allPkgs) {
+    const existing = pkgsByRef.get(pkg["bom-ref"]);
+    if (!existing) {
+      pkgsByRef.set(pkg["bom-ref"], pkg);
+      continue;
+    }
+    const methods = existing.evidence.identity.methods;
+    for (const method of pkg.evidence.identity.methods) {
+      if (!methods.some((m) => m.value === method.value)) {
+        methods.push(method);
+      }
+    }
+  }
+  return [...pkgsByRef.values()];
+}
+
+/**
+ * The build files that mark a directory as a Gradle project of its own. A
+ * lockfile is accepted only beside one of these, so a lockfile copied into a
+ * notes folder or a build's output is not read as an inventory source.
+ */
+const GRADLE_PROJECT_MARKERS = [
+  "build.gradle",
+  "build.gradle.kts",
+  "settings.gradle",
+  "settings.gradle.kts",
+];
+
+/**
+ * Find the Gradle dependency lockfiles of one build.
+ *
+ * Both layouts are searched below `rootPath`, recursively even when
+ * `options.multiProject` is off: every subproject of a Gradle build locks its
+ * own configurations, and the subprojects belong to the same build. The
+ * Gradle 6+ names are `gradle.lockfile`, `buildscript-gradle.lockfile` and
+ * `settings-gradle.lockfile`; the Gradle 4.8 to 5.x layout is
+ * `gradle/dependency-locks/<configuration>.lockfile`.
+ *
+ * A lockfile is accepted only when the project directory that owns it holds a
+ * Gradle build file, and never when it sits under `build/`, `.gradle/`,
+ * `node_modules/` or a vendored directory. `getAllFiles` already leaves
+ * `.git`, `.hg`, `.chen` and `node_modules` out; `build/` and `.gradle/` are
+ * Gradle's own output and cache directories, which a lockfile in them cannot
+ * belong to the project's source of truth.
+ *
+ * Custom `dependencyLocking.lockFile` paths, the Nebula `dependencies.lock`
+ * and Palantir `versions.lock` formats are not looked for.
+ *
+ * @param {string} rootPath Directory to search
+ * @param {Object} [options] CLI options
+ * @returns {string[]} Lockfile paths, in a stable order
+ */
+export function findGradleLockfiles(rootPath, options = {}) {
+  const lockFiles = new Set();
+  for (const pattern of [
+    "**/{gradle,buildscript-gradle,settings-gradle}.lockfile",
+    "**/gradle/dependency-locks/*.lockfile",
+  ]) {
+    for (const lockFile of getAllFiles(rootPath, pattern, options)) {
+      // Only the segments below the scan root count: a scan root that sits
+      // under a directory named `build` still has lockfiles of its own.
+      const segments = relative(rootPath, lockFile).split(/[\\/]/);
+      if (
+        segments.some((segment) =>
+          ["build", ".gradle", "node_modules"].includes(segment),
+        )
+      ) {
+        continue;
+      }
+      if (isInVendoredDir(rootPath, lockFile)) {
+        continue;
+      }
+      const kind = gradleLockfileKind(lockFile);
+      if (!kind) {
+        continue;
+      }
+      // The project directory is the lockfile's own directory, and the
+      // directory above `gradle` for a legacy dependency-locks file.
+      const projectDir = kind.legacy
+        ? dirname(dirname(dirname(lockFile)))
+        : dirname(lockFile);
+      if (
+        !GRADLE_PROJECT_MARKERS.some((marker) =>
+          safeExistsSync(join(projectDir, marker)),
+        )
+      ) {
+        continue;
+      }
+      lockFiles.add(lockFile);
+    }
+  }
+  return [...lockFiles].sort();
+}
+
+/**
+ * The most bytes read from a settings script when looking for the root
+ * project name.
+ */
+const GRADLE_SETTINGS_MAX_BYTES = 1024 * 1024;
+
+/**
+ * Read the root project name a Gradle settings script assigns with
+ * `rootProject.name = '<name>'` or `rootProject.name = "<name>"`, without
+ * running Gradle.
+ *
+ * `settings.gradle` is read before `settings.gradle.kts`, and the last
+ * assignment in the file wins, as it does in Gradle. Only a plain string
+ * literal is accepted: a value built from a variable, a template
+ * (`"${x}"`) or a method call is not something a static read can resolve.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The root project name, or undefined when no
+ *   settings script assigns one as a plain literal
+ */
+export function readGradleRootProjectName(gradleRootPath) {
+  for (const settingsName of ["settings.gradle", "settings.gradle.kts"]) {
+    const settingsFile = join(gradleRootPath, settingsName);
+    if (!safeExistsSync(settingsFile)) {
+      continue;
+    }
+    const text = readRegularTextFile(
+      settingsFile,
+      GRADLE_SETTINGS_MAX_BYTES,
+      gradleRootPath,
+    );
+    if (!text) {
+      continue;
+    }
+    let rootName;
+    for (const rawLine of text.split("\n")) {
+      const line = rawLine.trim();
+      if (!line.startsWith("rootProject.name")) {
+        continue;
+      }
+      let rest = line.slice("rootProject.name".length).trim();
+      if (!rest.startsWith("=")) {
+        continue;
+      }
+      rest = rest.slice(1).trim();
+      const commentIndex = rest.indexOf("//");
+      if (commentIndex !== -1) {
+        rest = rest.slice(0, commentIndex).trim();
+      }
+      if (rest.endsWith(";")) {
+        rest = rest.slice(0, -1).trim();
+      }
+      const quote = rest.charAt(0);
+      if (
+        rest.length < 3 ||
+        !["'", '"'].includes(quote) ||
+        !rest.endsWith(quote)
+      ) {
+        continue;
+      }
+      const value = rest.slice(1, -1).trim();
+      if (
+        !value ||
+        [..."'\"$\\"].some((ch) => value.includes(ch)) ||
+        value.includes("/")
+      ) {
+        continue;
+      }
+      rootName = value;
+    }
+    if (rootName) {
+      return rootName;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The largest gradle/verification-metadata.xml read. Real files of large
+ * builds stay around half a megabyte; the file is untrusted input, so a
+ * larger one is skipped whole rather than read in part.
+ */
+const GRADLE_VERIFICATION_METADATA_MAX_BYTES = 32 * 1024 * 1024;
+
+/**
+ * The most components read from one verification-metadata.xml. Components
+ * past the cap are ignored.
+ */
+const GRADLE_VERIFICATION_METADATA_MAX_COMPONENTS = 200000;
+
+/**
+ * The most artifacts read for one component. A real entry names the jar, the
+ * pom and the module metadata; a coordinate listing many more artifacts was
+ * not written by Gradle.
+ */
+const GRADLE_VERIFICATION_METADATA_MAX_ARTIFACTS = 64;
+
+/**
+ * Checksum element of the verification schema, the CycloneDX hash algorithm
+ * it maps to, and the exact hex digest length that algorithm produces. A
+ * digest of any other length was not written by Gradle.
+ */
+const VERIFICATION_HASH_ALGORITHMS = [
+  { element: "sha512", alg: "SHA-512", length: 128 },
+  { element: "sha256", alg: "SHA-256", length: 64 },
+  { element: "sha1", alg: "SHA-1", length: 40 },
+  { element: "md5", alg: "MD5", length: 32 },
+];
+
+const HEX_DIGEST_PATTERN = /^[0-9a-f]+$/iu;
+
+/**
+ * A `pgp value` is either a 16-character long key id or a 40-character v4
+ * fingerprint. Anything else is not a key id.
+ */
+const PGP_KEY_ID_LENGTHS = new Set([16, 40]);
+
+/**
+ * The build stamp a timestamped SNAPSHOT file carries in place of
+ * `-SNAPSHOT`, for example `-20240401.123456-1`.
+ */
+const SNAPSHOT_STAMP_PATTERN = /^-\d{8}\.\d{6}-\d+/u;
+
+/**
+ * Children of one element in the compact XML form. A child that occurs once
+ * parses as an object and a repeated child as an array; this accepts both.
+ *
+ * @param {object|object[]|undefined} value Compact-form child or children
+ * @returns {object[]} The children as a list
+ */
+function verificationElementList(value) {
+  if (value === undefined || value === null) {
+    return [];
+  }
+  return Array.isArray(value) ? value : [value];
+}
+
+/**
+ * One named child of an element in the compact XML form.
+ *
+ * A document whose root element carries a namespace prefix keeps that prefix
+ * on the name of every element below it, so the child name is looked up with
+ * the root's prefix in front of it. Attributes are never prefixed: the
+ * schema's attributes are unqualified even when the elements are not.
+ *
+ * @param {object|undefined} element Compact-form element
+ * @param {string} name Child element name without a prefix
+ * @param {string} [prefix] Namespace prefix of the root element, with its
+ *   colon
+ * @returns {object[]} The children as a list
+ */
+function verificationChildList(element, name, prefix = "") {
+  return verificationElementList(element?.[`${prefix}${name}`]);
+}
+
+/**
+ * Read the `true` or `false` text of a configuration flag. A flag that is
+ * absent, or whose text is neither, reads as undefined so the caller cannot
+ * tell a written `false` from an unreadable one.
+ *
+ * @param {object|undefined} element Compact-form flag element
+ * @returns {boolean|undefined} The flag value, or undefined
+ */
+function verificationBoolean(element) {
+  const value = typeof element?._ === "string" ? element._.trim() : "";
+  if (value === "true") {
+    return true;
+  }
+  if (value === "false") {
+    return false;
+  }
+  return undefined;
+}
+
+/**
+ * Split an artifact file name into its classifier and extension, accepting
+ * the timestamped file names Gradle writes for SNAPSHOT versions, for which
+ * the build stamp replaces `-SNAPSHOT` in the file name only.
+ *
+ * @param {string} fileName File name from the verification metadata
+ * @param {string} name Artifact ID of the coordinate
+ * @param {string} version Version of the coordinate
+ * @returns {{classifier: string, extension: string}|undefined} Undefined when
+ *   the name does not belong to the coordinate
+ */
+function splitVerificationArtifactName(fileName, name, version) {
+  const split = splitArtifactFileName(fileName, name, version);
+  if (split) {
+    return split;
+  }
+  if (!version.endsWith("-SNAPSHOT")) {
+    return undefined;
+  }
+  const base = version.slice(0, -"-SNAPSHOT".length);
+  if (!fileName.startsWith(`${name}-${base}`)) {
+    return undefined;
+  }
+  const stamp = SNAPSHOT_STAMP_PATTERN.exec(
+    fileName.substring(`${name}-${base}`.length),
+  );
+  if (!stamp) {
+    return undefined;
+  }
+  return splitArtifactFileName(fileName, name, `${base}${stamp[0]}`);
+}
+
+/**
+ * Keep a checksum value only when it is a hex digest of the exact length its
+ * algorithm produces. The `origin` and `reason` attributes, and the
+ * `also-trust` alternates, are never read.
+ *
+ * @param {string} alg CycloneDX hash algorithm name
+ * @param {number} length Expected hex digest length
+ * @param {object|undefined} element Compact-form checksum element
+ * @returns {{alg: string, content: string}|undefined} The hash, or undefined
+ */
+function verificationHash(alg, length, element) {
+  const value = element?.$?.value;
+  if (typeof value !== "string" || value.length !== length) {
+    return undefined;
+  }
+  if (!HEX_DIGEST_PATTERN.test(value)) {
+    return undefined;
+  }
+  return { alg, content: value.toLowerCase() };
+}
+
+/**
+ * Keep a `pgp value` only when it is a long key id or a v4 fingerprint, in
+ * the upper-case form the verification schema itself uses.
+ *
+ * @param {object|undefined} element Compact-form pgp element
+ * @returns {string|undefined} The key id, or undefined
+ */
+function verificationPgpKeyId(element) {
+  const value = element?.$?.value;
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const keyId = value.trim();
+  if (
+    !PGP_KEY_ID_LENGTHS.has(keyId.length) ||
+    !HEX_DIGEST_PATTERN.test(keyId)
+  ) {
+    return undefined;
+  }
+  return keyId.toUpperCase();
+}
+
+/**
+ * Parse a `gradle/verification-metadata.xml` file.
+ *
+ * The file is untrusted input. It records what Gradle verified when
+ * `gradle --write-verification-metadata` last ran, which does not prove that
+ * the artifacts in this BOM match: the file travels with the source, and
+ * nothing here re-checks the digests. Trust rules (`trusted-artifacts`,
+ * `trusted-keys`, `ignored-keys`) may be regular expressions, so they are
+ * only counted, never evaluated, and no free text of the file (an `origin`, a
+ * `reason`, a key-server URI) reaches the result. Only checksum digests,
+ * PGP key ids and the configuration flags survive.
+ *
+ * The read is bounded: the file must be a regular file no larger than
+ * 32 MiB inside `options.rootDir`, at most 200000 components and 64
+ * artifacts per component are read, and a malformed file yields undefined
+ * rather than an error.
+ *
+ * @param {string} metadataFile Path to verification-metadata.xml
+ * @param {Object} [options] Parse options
+ * @param {string} [options.rootDir] Directory the file must resolve inside
+ * @returns {{configuration: {verifyMetadata: (boolean|undefined), verifySignatures: (boolean|undefined), trustedKeyCount: number, trustedArtifactRuleCount: number, ignoredKeyCount: number, keyServerCount: number}, components: Map<string, {group: string, name: string, version: string, artifacts: {fileName: string, classifier: string, extension: string, hashes: {alg: string, content: string}[], pgpKeyIds: string[]}[]}>}|undefined}
+ *   The parsed metadata, or undefined when the file could not be read
+ */
+export function parseGradleVerificationMetadata(metadataFile, options = {}) {
+  const text = readRegularTextFile(
+    metadataFile,
+    GRADLE_VERIFICATION_METADATA_MAX_BYTES,
+    options?.rootDir,
+  );
+  if (text === undefined) {
+    if (safeExistsSync(metadataFile)) {
+      console.warn(
+        `Skipping ${metadataFile}: it is not a regular file inside the project, or is larger than ${GRADLE_VERIFICATION_METADATA_MAX_BYTES} bytes.`,
+      );
+    }
+    return undefined;
+  }
+  const body = text.startsWith("\uFEFF") ? text.slice(1) : text;
+  let parsed;
+  try {
+    parsed = xml2js(body, {
+      compact: true,
+      ignoreComment: true,
+      ignoreDoctype: true,
+      ignoreDeclaration: true,
+      textKey: "_",
+      attributesKey: "$",
+    });
+  } catch (err) {
+    thoughtLog(
+      `${metadataFile} is not well-formed XML, so it was skipped: ${
+        err?.message || err
+      }`,
+    );
+    return undefined;
+  }
+  // Gradle writes the root element in its own namespace, which a default
+  // namespace leaves off element names and a prefix keeps; both are accepted.
+  // A prefixed document keeps the prefix on the name of every element below
+  // the root, so the prefix is carried into every child lookup below.
+  const rootKey = Object.keys(parsed).find(
+    (key) =>
+      key === "verification-metadata" || key.endsWith(":verification-metadata"),
+  );
+  const root = verificationElementList(
+    rootKey ? parsed[rootKey] : undefined,
+  )[0];
+  if (!root) {
+    thoughtLog(
+      `${metadataFile} has no verification-metadata root element, so it was skipped.`,
+    );
+    return undefined;
+  }
+  const prefix = rootKey?.includes(":")
+    ? rootKey.slice(0, rootKey.indexOf(":") + 1)
+    : "";
+  const configurationElement = verificationChildList(
+    root,
+    "configuration",
+    prefix,
+  )[0];
+  const componentsElement = verificationChildList(
+    root,
+    "components",
+    prefix,
+  )[0];
+  const trustedKeysElement = verificationChildList(
+    configurationElement,
+    "trusted-keys",
+    prefix,
+  )[0];
+  const trustedArtifactsElement = verificationChildList(
+    configurationElement,
+    "trusted-artifacts",
+    prefix,
+  )[0];
+  const ignoredKeysElement = verificationChildList(
+    configurationElement,
+    "ignored-keys",
+    prefix,
+  )[0];
+  const keyServersElement = verificationChildList(
+    configurationElement,
+    "key-servers",
+    prefix,
+  )[0];
+  const components = new Map();
+  let skippedArtifacts = 0;
+  const componentList = verificationChildList(
+    componentsElement,
+    "component",
+    prefix,
+  );
+  for (const componentElement of componentList) {
+    if (components.size === GRADLE_VERIFICATION_METADATA_MAX_COMPONENTS) {
+      thoughtLog(
+        `${metadataFile} lists more than ${GRADLE_VERIFICATION_METADATA_MAX_COMPONENTS} components; only the first ${GRADLE_VERIFICATION_METADATA_MAX_COMPONENTS} are read.`,
+      );
+      break;
+    }
+    const attributes = componentElement?.$ || {};
+    const group =
+      typeof attributes.group === "string" ? attributes.group.trim() : "";
+    const name =
+      typeof attributes.name === "string" ? attributes.name.trim() : "";
+    const version =
+      typeof attributes.version === "string" ? attributes.version.trim() : "";
+    // A coordinate without all three parts, or one no valid purl can be
+    // built for, can never match a component of this BOM.
+    if (!group || !name || !version) {
+      continue;
+    }
+    if (!mavenPurl(group, name, version)) {
+      continue;
+    }
+    const artifacts = [];
+    const artifactList = verificationChildList(
+      componentElement,
+      "artifact",
+      prefix,
+    );
+    if (artifactList.length > GRADLE_VERIFICATION_METADATA_MAX_ARTIFACTS) {
+      skippedArtifacts +=
+        artifactList.length - GRADLE_VERIFICATION_METADATA_MAX_ARTIFACTS;
+    }
+    for (const artifactElement of artifactList.slice(
+      0,
+      GRADLE_VERIFICATION_METADATA_MAX_ARTIFACTS,
+    )) {
+      const fileName =
+        typeof artifactElement?.$?.name === "string"
+          ? artifactElement.$.name.trim()
+          : "";
+      const split = fileName
+        ? splitVerificationArtifactName(fileName, name, version)
+        : undefined;
+      if (!split) {
+        skippedArtifacts++;
+        continue;
+      }
+      const hashes = [];
+      for (const { element, alg, length } of VERIFICATION_HASH_ALGORITHMS) {
+        const hash = verificationHash(
+          alg,
+          length,
+          verificationChildList(artifactElement, element, prefix)[0],
+        );
+        if (hash) {
+          hashes.push(hash);
+        }
+      }
+      const pgpKeyIds = [];
+      for (const pgpElement of verificationChildList(
+        artifactElement,
+        "pgp",
+        prefix,
+      )) {
+        const keyId = verificationPgpKeyId(pgpElement);
+        if (keyId && !pgpKeyIds.includes(keyId)) {
+          pgpKeyIds.push(keyId);
+        }
+      }
+      pgpKeyIds.sort();
+      artifacts.push({
+        fileName,
+        classifier: split.classifier,
+        extension: split.extension,
+        hashes,
+        pgpKeyIds,
+      });
+    }
+    const key = `${group}:${name}:${version}`;
+    if (!components.has(key)) {
+      components.set(key, { group, name, version, artifacts });
+    }
+  }
+  if (skippedArtifacts) {
+    thoughtLog(
+      `Skipped ${skippedArtifacts} artifact element(s) whose file name does not belong to their coordinate in ${metadataFile}.`,
+    );
+  }
+  return {
+    configuration: {
+      verifyMetadata: verificationBoolean(
+        verificationChildList(
+          configurationElement,
+          "verify-metadata",
+          prefix,
+        )[0],
+      ),
+      verifySignatures: verificationBoolean(
+        verificationChildList(
+          configurationElement,
+          "verify-signatures",
+          prefix,
+        )[0],
+      ),
+      trustedKeyCount: verificationChildList(
+        trustedKeysElement,
+        "trusted-key",
+        prefix,
+      ).length,
+      trustedArtifactRuleCount: verificationChildList(
+        trustedArtifactsElement,
+        "trust",
+        prefix,
+      ).length,
+      ignoredKeyCount: verificationChildList(
+        ignoredKeysElement,
+        "ignored-key",
+        prefix,
+      ).length,
+      keyServerCount: verificationChildList(
+        keyServersElement,
+        "key-server",
+        prefix,
+      ).length,
+    },
+    components,
+  };
+}
+
+/**
+ * Find the gradle/verification-metadata.xml of one Gradle build.
+ *
+ * Gradle reads one verification file per build, from the root build's
+ * `gradle` directory; included builds' copies are ignored, so nothing is
+ * searched below the root. The file is accepted only when the directory is a
+ * Gradle project of its own, so a file copied into a nested folder is not
+ * read as an inventory source.
+ *
+ * @param {string} gradleRootPath Root directory of the Gradle build
+ * @returns {string|undefined} The metadata file path, or undefined
+ */
+export function findGradleVerificationMetadata(gradleRootPath) {
+  const metadataFile = join(
+    gradleRootPath,
+    "gradle",
+    "verification-metadata.xml",
+  );
+  if (!safeExistsSync(metadataFile)) {
+    return undefined;
+  }
+  if (
+    !GRADLE_PROJECT_MARKERS.some((marker) =>
+      safeExistsSync(join(gradleRootPath, marker)),
+    )
+  ) {
+    return undefined;
+  }
+  return metadataFile;
+}
+
+/**
+ * The artifact of a coordinate whose hashes describe the component itself:
+ * the `.pom` artifact for a platform or BOM component, else the main jar,
+ * else the main aar. Sources, javadoc and other classifiers, and the
+ * `.module` and `.pom` hashes of a jar component, are never used.
+ *
+ * @param {object} component Parsed verification metadata component
+ * @param {boolean} wantsPom True for a component with purl qualifier type=pom
+ * @returns {object|undefined} The artifact, or undefined
+ */
+export function gradleVerificationMainArtifact(component, wantsPom) {
+  const wanted = wantsPom ? "pom" : "jar";
+  const main = component.artifacts.find(
+    (artifact) => !artifact.classifier && artifact.extension === wanted,
+  );
+  if (main || wantsPom) {
+    return main;
+  }
+  return component.artifacts.find(
+    (artifact) => !artifact.classifier && artifact.extension === "aar",
+  );
+}
+
+/**
+ * Merge the checksums and PGP key ids a verification-metadata.xml records
+ * into the components of a package list.
+ *
+ * A digest of the artifact itself, computed from the jar in the local cache
+ * or found by another collector, is the stronger claim, so the recorded
+ * digests only fill the algorithms a component still lacks. Where the file
+ * records a different digest for an algorithm the component already has,
+ * the recorded digest never wins: the component keeps its own, and the
+ * component gains the cdx:gradle:verificationMismatch=true property so the
+ * disagreement is visible. A released Maven version does not change after
+ * publishing, so a stale file cannot explain a mismatch: a stale file names
+ * old versions, which match nothing. The likely causes are an artifact
+ * republished on a mirror or internal repository, or a corrupted or
+ * tampered cache. SNAPSHOT versions and digests that are not hex are not
+ * compared.
+ *
+ * Every matched component also gains two properties naming the verification
+ * methods and the PGP key ids of its artifact. The evidence of the
+ * component is left alone: a component found by a Gradle run or a lockfile
+ * keeps the identity evidence of that source, and only the components the
+ * verification-metadata fallback built carry the file as their evidence.
+ *
+ * @param {Object[]} pkgList Components to enrich in place
+ * @param {Object} metadata Parsed metadata, as parseGradleVerificationMetadata
+ *   returns
+ * @param {string} metadataFile Path to the verification-metadata.xml, named
+ *   in the debug reasoning
+ * @returns {number} The number of components this call changed
+ */
+export function applyGradleVerificationMetadata(
+  pkgList,
+  metadata,
+  metadataFile,
+) {
+  if (!metadata?.components?.size) {
+    return 0;
+  }
+  let changedCount = 0;
+  for (const pkg of pkgList || []) {
+    if (!pkg?.purl?.startsWith("pkg:maven/")) {
+      continue;
+    }
+    const component = metadata.components.get(
+      `${pkg.group}:${pkg.name}:${pkg.version}`,
+    );
+    if (!component) {
+      continue;
+    }
+    const artifact = gradleVerificationMainArtifact(
+      component,
+      pkg.qualifiers?.type === "pom",
+    );
+    if (!artifact) {
+      continue;
+    }
+    const hashesBefore = pkg.hashes;
+    const propertiesBefore = pkg.properties;
+    // A SNAPSHOT version names a moving artifact: the file can record
+    // several timestamped builds of it while the cache holds the newest, so
+    // a differing digest there says nothing about tampering.
+    const comparable = !String(pkg.version || "").endsWith("-SNAPSHOT");
+    // The merged list keeps the order the component's own hashes came in
+    // and appends the recorded ones in the schema's algorithm order.
+    const hashes = Array.isArray(pkg.hashes) ? [...pkg.hashes] : [];
+    let mismatch = false;
+    for (const recorded of artifact.hashes) {
+      const existing = hashes.find((hash) => hash.alg === recorded.alg);
+      if (existing) {
+        // Other collectors may carry an upper-case or base64 digest; only a
+        // hex digest can be compared with the recorded one.
+        const existingContent =
+          typeof existing.content === "string" ? existing.content : "";
+        if (
+          comparable &&
+          HEX_DIGEST_PATTERN.test(existingContent) &&
+          existingContent.toLowerCase() !== recorded.content
+        ) {
+          mismatch = true;
+          thoughtLog(
+            `${metadataFile} records a different ${recorded.alg} digest for ${pkg.group}:${pkg.name}:${pkg.version} than the artifact carries; the recorded digest is flagged, not applied.`,
+          );
+        }
+        continue;
+      }
+      hashes.push({ alg: recorded.alg, content: recorded.content });
+    }
+    if (hashes.length && hashes.length !== (pkg.hashes?.length || 0)) {
+      pkg.hashes = hashes;
+    }
+    const methods = new Set();
+    for (const { element, alg } of VERIFICATION_HASH_ALGORITHMS) {
+      if (artifact.hashes.some((hash) => hash.alg === alg)) {
+        methods.add(element);
+      }
+    }
+    if (artifact.pgpKeyIds.length) {
+      methods.add("pgp");
+    }
+    const properties = pkg.properties || [];
+    if (
+      methods.size &&
+      !properties.some((p) => p.name === "cdx:gradle:verificationMethods")
+    ) {
+      properties.push({
+        name: "cdx:gradle:verificationMethods",
+        value: [...methods].sort().join(","),
+      });
+    }
+    if (
+      artifact.pgpKeyIds.length &&
+      !properties.some((p) => p.name === "cdx:gradle:pgpKeyIds")
+    ) {
+      properties.push({
+        name: "cdx:gradle:pgpKeyIds",
+        value: [...new Set(artifact.pgpKeyIds)].sort().slice(0, 10).join(","),
+      });
+    }
+    if (
+      mismatch &&
+      !properties.some((p) => p.name === "cdx:gradle:verificationMismatch")
+    ) {
+      properties.push({
+        name: "cdx:gradle:verificationMismatch",
+        value: "true",
+      });
+    }
+    if (properties.length !== (pkg.properties?.length || 0)) {
+      pkg.properties = properties;
+    }
+    if (pkg.hashes !== hashesBefore || pkg.properties !== propertiesBefore) {
+      changedCount++;
+    }
+  }
+  return changedCount;
+}