@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/ecosystems/parsers-bazel.js

@@ -79,12 +79,62 @@ export function parseModuleBazel(moduleFile) {
     });
   }
 
+  // Overrides replace where a bazel_dep comes from, and Bazel then ignores
+  // the version the bazel_dep names.
+  // https://bazel.build/external/module#overrides
+  const overrides = new Map();
+  for (const kind of [
+    "local_path_override",
+    "git_override",
+    "archive_override",
+    "single_version_override",
+  ]) {
+    for (const call of findAllCalls(src, kind)) {
+      const moduleName = scalarArg(call, "module_name");
+      if (moduleName && !overrides.has(moduleName)) {
+        overrides.set(moduleName, {
+          kind,
+          version: scalarArg(call, "version"),
+          remote: scalarArg(call, "remote"),
+          revision:
+            scalarArg(call, "commit") ||
+            scalarArg(call, "tag") ||
+            scalarArg(call, "branch"),
+          url: scalarArg(call, "urls") || scalarArg(call, "url"),
+        });
+      }
+    }
+  }
+
   for (const call of findAllCalls(src, "bazel_dep")) {
     const name = scalarArg(call, "name");
-    const version = scalarArg(call, "version");
+    let version = scalarArg(call, "version");
     const repoName = scalarArg(call, "repo_name");
     if (!name || !version) continue;
-    pkgList.push(buildBcrPackage(repoName || name, name, version, moduleFile));
+    const override = overrides.get(name);
+    // A module taken from a local directory is the project's own tree, not a
+    // BCR release, and the version it declares is not what gets built.
+    if (override?.kind === "local_path_override") continue;
+    if (override?.kind === "single_version_override" && override.version) {
+      version = override.version;
+    }
+    // A git or archive override fetches the module from elsewhere, so it is
+    // no BCR release: the purl names where it comes from instead of the BCR.
+    const source = overrideSource(override);
+    const pkg = buildBcrPackage(
+      repoName || name,
+      name,
+      source ? null : version,
+      moduleFile,
+      source,
+    );
+    if (override && override.kind !== "single_version_override") {
+      pkg.properties.push({
+        name: "cdx:bazel:override",
+        value: override.kind.replace(/_override$/, ""),
+      });
+    }
+    pkgList.push(pkg);
   }
 
   for (const call of findAllCalls(src, "maven.artifact")) {
@@ -425,6 +475,37 @@ function buildEcosystemPackage(coords, context) {
   return pkg;
 }
 
+/**
+ * Where a git_override or archive_override takes a module from, as purl
+ * qualifiers and an external reference.
+ *
+ * @param {Object|undefined} override override recorded for the module
+ * @returns {{qualifiers: Object, externalReferences: Object[]}|undefined}
+ *   undefined for no override, or one that keeps the module a BCR release
+ */
+function overrideSource(override) {
+  if (override?.kind === "git_override") {
+    if (!override.remote) {
+      return { qualifiers: {}, externalReferences: [] };
+    }
+    const vcsUrl = `git+${override.remote}${override.revision ? `@${override.revision}` : ""}`;
+    return {
+      qualifiers: { vcs_url: vcsUrl },
+      externalReferences: [{ type: "vcs", url: override.remote }],
+    };
+  }
+  if (override?.kind === "archive_override") {
+    if (!override.url) {
+      return { qualifiers: {}, externalReferences: [] };
+    }
+    return {
+      qualifiers: { download_url: override.url },
+      externalReferences: [{ type: "distribution", url: override.url }],
+    };
+  }
+  return undefined;
+}
+
 /**
  * Build a component record for a BCR (Bazel Central Registry) module.
  *
@@ -435,26 +516,46 @@ function buildEcosystemPackage(coords, context) {
  * @param {string} moduleName Canonical module name
  * @param {string} version Resolved version
  * @param {string} srcFile Source file for evidence
+ * @param {{qualifiers: Object, externalReferences: Object[]}} [source] where
+ *   an override takes the module from, in place of the BCR
  * @returns {object} Package record
  */
-function buildBcrPackage(displayRepoName, moduleName, version, srcFile) {
+function buildBcrPackage(
+  displayRepoName,
+  moduleName,
+  version,
+  srcFile,
+  source,
+) {
   const purl = tryBuildPurl({
     type: "bazel",
     name: moduleName,
     version,
-    qualifiers: { repository_url: BCR_DEFAULT_REPOSITORY_URL },
+    qualifiers: source
+      ? source.qualifiers
+      : { repository_url: BCR_DEFAULT_REPOSITORY_URL },
   });
   return {
     name: moduleName,
-    version,
+    ...(version ? { version } : {}),
     type: "library",
     scope: "required",
     purl,
     "bom-ref": decodeURIComponent(purl),
+    ...(source?.externalReferences.length
+      ? { externalReferences: source.externalReferences }
+      : {}),
     properties: [
       { name: "internal:SrcFile", value: srcFile },
       { name: "cdx:bazel:module", value: moduleName },
-      { name: "cdx:bazel:repository_url", value: BCR_DEFAULT_REPOSITORY_URL },
+      ...(source
+        ? []
+        : [
+            {
+              name: "cdx:bazel:repository_url",
+              value: BCR_DEFAULT_REPOSITORY_URL,
+            },
+          ]),
       ...(displayRepoName !== moduleName
         ? [{ name: "cdx:bazel:repo_name", value: displayRepoName }]
         : []),