@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/envcontext.js

@@ -1,6 +1,6 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync, statSync } from "node:fs";
 import { arch, homedir } from "node:os";
-import { basename, delimiter, dirname, join } from "node:path";
+import { basename, delimiter, dirname, isAbsolute, join } from "node:path";
 import process from "node:process";
 
 import { compareLoose } from "semver";
@@ -19,10 +19,12 @@ import {
   recordLedgerEvent,
 } from "../core/buildLedger.js";
 import {
+  BUNDLE_CMD,
   CARGO_CMD,
   COMPOSER_CMD,
   DOTNET_CMD,
   GCC_CMD,
+  GEM_CMD,
   GO_CMD,
   getJavaCommand,
   getPythonCommand,
@@ -44,12 +46,23 @@ import {
 import { diagnosticStream } from "../core/logger.js";
 import { dirNameStr, isMac, isWin } from "../core/paths.js";
 import { isProjectToolingAllowed } from "../core/projectTooling.js";
+import { brotliDecoderProperties, readBrotliDecoder } from "./brotliDecoder.js";
+import {
+  createHostDotnetRuntimeComponent,
+  parseDotnetListRuntimes,
+} from "./dotnetRuntime.js";
 import { isValidSdkmanVersion } from "./jvmToolEnv.js";
+import { createNodeRuntimeComponent } from "./nodeBuildInfo.js";
 import {
   createPhpRuntimeComponent,
+  packageStoreOf,
   parsePhpReportedVersion,
 } from "./phpBuildInfo.js";
 import { applyPurl, tryBuildPurl } from "./purl.js";
+import {
+  createRubyRuntimeComponent,
+  parseRubyDescription,
+} from "./rubyBuildInfo.js";
 import {
   classifySpawnRestriction,
   describeSpawnRestriction,
@@ -137,6 +150,11 @@ export const SDKMAN_JAVA_TOOL_ALIASES = {
   java24: readEnvironmentVariable("JAVA24_TOOL") || "24.0.2-tem",
   java25: readEnvironmentVariable("JAVA25_TOOL") || "25.0.4-tem",
   java26: readEnvironmentVariable("JAVA26_TOOL") || "26.0.2-tem",
+  // The broker serves no Java 27 build yet (every vendor id 404s), so java27
+  // has an alias only when JAVA27_TOOL names one that is downloadable.
+  ...(readEnvironmentVariable("JAVA27_TOOL")
+    ? { java27: readEnvironmentVariable("JAVA27_TOOL") }
+    : {}),
 };
 
 /**
@@ -165,7 +183,8 @@ export function getOriginUrl(dir) {
  * @param {string} configKey Git config key
  * @param {string} dir repo directory
  *
- * @returns Output from git config or undefined
+ * @returns {string|undefined} The branch name, or undefined when git fails,
+ * for example when the directory is not a git working tree or has no commit
  */
 export function getBranch(_configKey, dir) {
   return execGitCommand(dir, ["rev-parse", "--abbrev-ref", "HEAD"]);
@@ -198,20 +217,20 @@ export function gitTreeHashes(dir) {
 }
 
 /**
- * Retrieves the files list from git
- * @param {string} dir repo directory
+ * Retrieves the files git tracks under a directory at HEAD. Only the
+ * directory's own subtree is listed, with names relative to it, so a scan of
+ * one directory of a larger repository does not record the rest of that
+ * repository.
  *
- * @returns Output from git config or undefined
+ * @param {string} dir directory inside a git working tree
+ *
+ * @returns {Object[]} files with their blob hash, name, OmniBOR id and SWHID;
+ * empty when git fails, for example when the directory is not a git working
+ * tree or has no commit
  */
 export function listFiles(dir) {
   const filesList = [];
-  const output = execGitCommand(dir, [
-    "ls-tree",
-    "-l",
-    "-r",
-    "--full-tree",
-    "HEAD",
-  ]);
+  const output = execGitCommand(dir, ["ls-tree", "-l", "-r", "HEAD"]);
   if (output) {
     output.split("\n").forEach((l) => {
       l = l.replaceAll("\r", "");
@@ -239,7 +258,10 @@ export function listFiles(dir) {
  * @param {string} dir Repo directory
  * @param {Array} args arguments to git command
  *
- * @returns Output from the git command
+ * @returns {string|undefined} git's standard output, or undefined when git
+ * could not run or exited with a non-zero status. Text git writes to standard
+ * error, including warnings of a successful command, is never part of the
+ * result.
  */
 export function execGitCommand(dir, args) {
   // Prepend hardening `-c` overrides before the subcommand and run git with a
@@ -256,6 +278,8 @@ export function execGitCommand(dir, args) {
     {
       env: hardenedGitEnv(),
       shell: false,
+      requireSuccess: true,
+      includeStderr: false,
     },
   );
 }
@@ -393,6 +417,22 @@ function recordToolProbeFailure(tool, ecosystem, command, detail) {
   }
 }
 
+/**
+ * Collapse command output to one line. The `\r` of a Windows line ending goes
+ * with the break it belongs to, and the empty lines of trailing output are
+ * dropped.
+ *
+ * @param {string} output command output
+ * @param {string} separator what to join the lines with
+ * @returns {string} the non-empty lines joined into one line
+ */
+function collapseOutputLines(output, separator) {
+  return `${output || ""}`
+    .split(/\r?\n/)
+    .filter((line) => line !== "")
+    .join(separator);
+}
+
 /**
  * Collect Java version and installed modules
  *
@@ -400,9 +440,9 @@ function recordToolProbeFailure(tool, ecosystem, command, detail) {
  * @returns Object containing the java details
  */
 export function collectJavaInfo(dir) {
-  const versionDesc = getCommandOutput(getJavaCommand(), dir, ["--version"]);
+  const versionDesc = probeCommandOutput(getJavaCommand(), dir, ["--version"]);
   const moduleDesc =
-    getCommandOutput(getJavaCommand(), dir, ["--list-modules"]) || "";
+    probeCommandOutput(getJavaCommand(), dir, ["--list-modules"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -412,7 +452,7 @@ export function collectJavaInfo(dir) {
       properties: [
         {
           name: "java:modules",
-          value: moduleDesc.replaceAll("\n", ", "),
+          value: collapseOutputLines(moduleDesc, ", "),
         },
       ],
     };
@@ -426,20 +466,41 @@ export function collectJavaInfo(dir) {
 /**
  * Collect dotnet version
  *
+ * `version` is the version `dotnet --version` prints, which is the SDK's. .NET
+ * advisories name runtime versions, so the component itself carries no purl
+ * and no CPE. Each shared framework `dotnet --list-runtimes` reports is a
+ * nested component built by createHostDotnetRuntimeComponent, without a
+ * bom-ref like the other toolchains.
+ *
  * @param {string} dir Working directory
  * @returns Object containing dotnet details
  */
 export function collectDotnetInfo(dir) {
-  const versionDesc = getCommandOutput(DOTNET_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(DOTNET_CMD, dir, ["--version"]);
   const moduleDesc =
-    getCommandOutput(DOTNET_CMD, dir, ["--list-runtimes"]) || "";
+    probeCommandOutput(DOTNET_CMD, dir, ["--list-runtimes"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "dotnet",
       version: versionDesc.trim(),
-      description: moduleDesc.replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
+    const components = [];
+    const seen = new Set();
+    for (const entry of parseDotnetListRuntimes(moduleDesc)) {
+      const key = `${entry.framework} ${entry.version}`;
+      if (seen.has(key)) {
+        continue;
+      }
+      seen.add(key);
+      components.push(
+        formulationToolchain(createHostDotnetRuntimeComponent(entry)),
+      );
+    }
+    if (components.length) {
+      info.components = components;
+    }
     recordToolProbeResolved("dotnet", "csharp", info.version);
     return info;
   }
@@ -455,15 +516,15 @@ export function collectDotnetInfo(dir) {
  */
 export function collectPythonInfo(dir) {
   const pythonCmd = getPythonCommand();
-  const versionDesc = getCommandOutput(pythonCmd, dir, ["-S", "--version"]);
+  const versionDesc = probeCommandOutput(pythonCmd, dir, ["-S", "--version"]);
   const moduleDesc =
-    getCommandOutput(pythonCmd, dir, ["-I", "-m", "pip", "--version"]) || "";
+    probeCommandOutput(pythonCmd, dir, ["-I", "-m", "pip", "--version"]) || "";
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "python",
       version: versionDesc.replace("Python ", ""),
-      description: moduleDesc.replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
     recordToolProbeResolved("python", "python", info.version);
     return info;
@@ -486,7 +547,17 @@ export function collectNodeInfo(dir) {
     version: runtimeInfo.version,
     components: runtimeInfo.components,
   };
-  const moduleDesc = getCommandOutput(NPM_CMD, dir, ["--version"]);
+  if (runtimeInfo.runtime === "Node.js" && runtimeInfo.version) {
+    // The same identity a scanned image's Node.js gets, without a bom-ref, as
+    // for the other toolchains.
+    const runtime = formulationToolchain(
+      createNodeRuntimeComponent(runtimeInfo.version),
+    );
+    nodeInfo.purl = runtime.purl;
+    nodeInfo.cpe = runtime.cpe;
+    annotateNodeBrotli(nodeInfo.components);
+  }
+  const moduleDesc = probeCommandOutput(NPM_CMD, dir, ["--version"]);
   if (moduleDesc) {
     nodeInfo.description = `npm: ${moduleDesc}`;
     recordToolProbeResolved("npm", "npm", moduleDesc);
@@ -496,6 +567,36 @@ export function collectNodeInfo(dir) {
   return nodeInfo;
 }
 
+/**
+ * Record whether the Brotli decoder the running Node.js uses carries the
+ * CVE-2026-111497 fix. process.versions.brotli cannot say: Node.js backports
+ * the fix without changing it. The decoder is read where it lives, in the node
+ * binary or in the shared libbrotlidec a `--shared-brotli` build loads.
+ *
+ * @param {Object[]|undefined} components bundled components of the runtime
+ */
+function annotateNodeBrotli(components) {
+  const brotli = (components || []).find(
+    (component) => component.name === "brotli",
+  );
+  if (!brotli) {
+    return;
+  }
+  let decoderFile = globalThis.process?.execPath;
+  if (nodeComponentLinkage("brotli") === "shared") {
+    decoderFile = (
+      globalThis.process?.report?.getReport?.()?.sharedObjects || []
+    ).find((path) => basename(path).startsWith("libbrotlidec"));
+  }
+  const decoder = decoderFile ? readBrotliDecoder(decoderFile) : undefined;
+  if (decoder) {
+    brotli.properties = [
+      ...(brotli.properties || []),
+      ...brotliDecoderProperties(decoder),
+    ];
+  }
+}
+
 /**
  * Collect gcc version
  *
@@ -503,14 +604,14 @@ export function collectNodeInfo(dir) {
  * @returns Object containing gcc details
  */
 export function collectGccInfo(dir) {
-  const versionDesc = getCommandOutput(GCC_CMD, dir, ["--version"]);
-  const moduleDesc = getCommandOutput(GCC_CMD, dir, ["-print-search-dirs"]);
+  const versionDesc = probeCommandOutput(GCC_CMD, dir, ["--version"]);
+  const moduleDesc = probeCommandOutput(GCC_CMD, dir, ["-print-search-dirs"]);
   if (versionDesc) {
     const info = {
       type: "platform",
       name: "gcc",
       version: versionDesc.split("\n")[0],
-      description: (moduleDesc || "").replaceAll("\n", "\\n"),
+      description: collapseOutputLines(moduleDesc, "\\n"),
     };
     recordToolProbeResolved("gcc", "c", info.version);
     return info;
@@ -526,8 +627,8 @@ export function collectGccInfo(dir) {
  * @returns Object containing rust details
  */
 export function collectRustInfo(dir) {
-  const versionDesc = getCommandOutput(RUSTC_CMD, dir, ["--version"]);
-  const moduleDesc = getCommandOutput(CARGO_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(RUSTC_CMD, dir, ["--version"]);
+  const moduleDesc = probeCommandOutput(CARGO_CMD, dir, ["--version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -549,7 +650,7 @@ export function collectRustInfo(dir) {
  * @returns Object containing go details
  */
 export function collectGoInfo(dir) {
-  const versionDesc = getCommandOutput(GO_CMD, dir, ["version"]);
+  const versionDesc = probeCommandOutput(GO_CMD, dir, ["version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -570,7 +671,7 @@ export function collectGoInfo(dir) {
  * @returns Object containing swift details
  */
 export function collectSwiftInfo(dir) {
-  const versionDesc = getCommandOutput(SWIFT_CMD, dir, ["--version"]);
+  const versionDesc = probeCommandOutput(SWIFT_CMD, dir, ["--version"]);
   if (versionDesc) {
     const info = {
       type: "platform",
@@ -585,23 +686,217 @@ export function collectSwiftInfo(dir) {
 }
 
 /**
- * Collect Ruby version
+ * The real path of the executable a command name runs, looked up on PATH as
+ * the shell would, or undefined when it cannot be found.
+ *
+ * @param {string} command command name or path
+ * @returns {string|undefined}
+ */
+function resolveExecutable(command) {
+  const name = `${command || ""}`.trim().split(" ")[0];
+  if (!name) {
+    return undefined;
+  }
+  const extensions = isWin
+    ? ["", ...`${process.env.PATHEXT || ".EXE;.CMD;.BAT"}`.split(";")]
+    : [""];
+  const directories = isAbsolute(name)
+    ? [dirname(name)]
+    : `${process.env.PATH || ""}`.split(delimiter).filter(Boolean);
+  const base = isAbsolute(name) ? basename(name) : name;
+  for (const directory of directories) {
+    for (const extension of extensions) {
+      const candidate = join(directory, `${base}${extension}`);
+      try {
+        if (statSync(candidate).isFile()) {
+          return realpathSync(candidate);
+        }
+      } catch {
+        // not here
+      }
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Whether a Ruby executable is one the operating system or a package manager
+ * that patches it owns. Distros backport fixes under the old upstream version,
+ * so its version must not be matched against upstream advisories by CPE.
+ *
+ * @param {string|undefined} realPath real path of the executable
+ * @returns {boolean}
+ */
+export function isPackagedRubyPath(realPath) {
+  if (!realPath || isWin) {
+    return false;
+  }
+  // Homebrew builds the upstream release, so it keeps the CPE, as it does in
+  // an OBOM; Nix and Guix patch theirs.
+  const store = packageStoreOf(realPath);
+  if (store) {
+    return store !== "homebrew";
+  }
+  return ["/usr/bin/", "/bin/", "/usr/lib/", "/usr/libexec/", "/System/"].some(
+    (prefix) => realPath.startsWith(prefix),
+  );
+}
+
+// The shims of rbenv, asdf and mise run whichever Ruby is selected, which can
+// be the distro's (`rbenv global system`).
+function isVersionManagerShim(realPath) {
+  return `${realPath}`.split(/[\\/]/).includes("shims");
+}
+
+// Whether the Ruby `ruby --version` described may carry its release's CPE.
+// A shim is followed to the interpreter it runs; one that cannot be followed
+// keeps no CPE, since it may be the distro's.
+function rubyKeepsCpe(dir) {
+  let executable = resolveExecutable(RUBY_CMD);
+  if (executable && isVersionManagerShim(executable)) {
+    const target = isWin
+      ? ""
+      : firstOutputLine(
+          probeCommandOutput(RUBY_CMD, dir, ["-e", "print RbConfig.ruby"]),
+        );
+    if (!isAbsolute(target)) {
+      return false;
+    }
+    try {
+      executable = realpathSync(target);
+    } catch {
+      executable = target;
+    }
+  }
+  return !isPackagedRubyPath(executable);
+}
+
+/**
+ * Collect the Ruby on the PATH.
+ *
+ * `ruby --version` prints the interpreter's description, such as
+ * `ruby 3.3.6 (2024-11-05 revision 75015d4c1f) [x86_64-linux]`, which is kept
+ * as the component description. The identity is `pkg:generic/ruby@3.3.6`
+ * (or jruby, truffleruby), with the CPE of the release unless a package
+ * manager owns the executable: a distro backports fixes under the old upstream
+ * version.
  *
  * @param {string} dir Working directory
  * @returns Object containing Ruby details
  */
 export function collectRubyInfo(dir) {
-  const versionDesc = getCommandOutput(RUBY_CMD, dir, ["--version"]);
-  if (versionDesc) {
-    const info = {
-      type: "platform",
-      name: "ruby",
-      version: versionDesc.trim(),
-    };
-    recordToolProbeResolved("ruby", "ruby", info.version);
+  const versionDesc = probeCommandOutput(RUBY_CMD, dir, ["--version"]);
+  const banner = firstOutputLine(versionDesc);
+  const parsed = parseRubyDescription(banner);
+  if (parsed) {
+    const info = formulationToolchain(
+      createRubyRuntimeComponent(parsed.version, {
+        engine: parsed.engine,
+        withCpe: rubyKeepsCpe(dir),
+      }),
+    );
+    info.description = banner;
+    const properties = [];
+    if (parsed.patchlevel !== undefined) {
+      properties.push({
+        name: "cdx:ruby:patchlevel",
+        value: parsed.patchlevel,
+      });
+    }
+    if (parsed.rubyVersion) {
+      properties.push({
+        name: "cdx:ruby:languageVersion",
+        value: parsed.rubyVersion,
+      });
+    }
+    if (parsed.platform) {
+      properties.push({ name: "cdx:ruby:platform", value: parsed.platform });
+    }
+    if (properties.length) {
+      info.properties = properties;
+    }
+    recordToolProbeResolved("ruby", "ruby", banner);
     return info;
   }
-  recordToolProbeFailure("ruby", "ruby", RUBY_CMD);
+  recordToolProbeFailure(
+    "ruby",
+    "ruby",
+    RUBY_CMD,
+    versionDesc
+      ? "The ruby version probe did not print a Ruby version banner."
+      : undefined,
+  );
+  return undefined;
+}
+
+/**
+ * Whether the Ruby collectRubyInfo found is the MRI release a project needs.
+ *
+ * @param {Object|undefined} info result of collectRubyInfo
+ * @param {string} version wanted MRI version
+ * @returns {boolean}
+ */
+export function isRubyVersionActive(info, version) {
+  return Boolean(info && info.name === "ruby" && info.version === version);
+}
+
+/**
+ * Collect the RubyGems version. `gem --version` prints the bare version.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the RubyGems component
+ */
+export function collectRubyGemsInfo(dir) {
+  const token = firstOutputLine(
+    probeCommandOutput(GEM_CMD, dir, ["--version"]),
+  );
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("gem", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "rubygems",
+          version: token,
+          cpe: `cpe:2.3:a:rubygems:rubygems:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "generic", name: "rubygems", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("gem", "ruby", GEM_CMD);
+  return undefined;
+}
+
+/**
+ * Collect the Bundler version. `bundle --version` prints `Bundler version
+ * 2.5.22`, or the bare version from Bundler 2.6 on.
+ *
+ * @param {string} dir Working directory
+ * @returns {Object|undefined} the Bundler component
+ */
+export function collectBundlerInfo(dir) {
+  const line = firstOutputLine(
+    probeCommandOutput(BUNDLE_CMD, dir, ["--version"]),
+  );
+  const token = line.startsWith("Bundler version ")
+    ? line.slice("Bundler version ".length).trim()
+    : line;
+  if (/^\d+\.\d+\.\d+$/.test(token)) {
+    recordToolProbeResolved("bundler", "ruby", token);
+    return formulationToolchain(
+      applyPurl(
+        {
+          type: "platform",
+          name: "bundler",
+          version: token,
+          cpe: `cpe:2.3:a:bundler:bundler:${token}:*:*:*:*:*:*:*`,
+        },
+        tryBuildPurl({ type: "gem", name: "bundler", version: token }),
+      ),
+    );
+  }
+  recordToolProbeFailure("bundler", "ruby", BUNDLE_CMD);
   return undefined;
 }
 
@@ -646,7 +941,7 @@ function formulationToolchain(component) {
  * @returns Object containing the PHP details
  */
 export function collectPhpInfo(dir) {
-  const output = getCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
+  const output = probeCommandOutput(PHP_CMD, dir, ["-n", "-v"]);
   const banner = firstOutputLine(output);
   const reported = banner.startsWith("PHP ")
     ? parsePhpReportedVersion(banner.slice("PHP ".length))
@@ -688,7 +983,7 @@ export function collectPhpInfo(dir) {
  * @returns Object containing the Composer details
  */
 export function collectComposerInfo(dir) {
-  const output = getCommandOutput(COMPOSER_CMD, dir, [
+  const output = probeCommandOutput(COMPOSER_CMD, dir, [
     "--version",
     "--no-plugins",
     "--no-scripts",
@@ -787,6 +1082,14 @@ export function collectEnvInfo(dir, options = undefined) {
   cmp = collectRubyInfo(dir);
   if (cmp) {
     infoComponents.push(cmp);
+    cmp = collectRubyGemsInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
+    cmp = collectBundlerInfo(dir);
+    if (cmp) {
+      infoComponents.push(cmp);
+    }
   }
   cmp = collectPhpInfo(dir);
   if (cmp) {
@@ -799,16 +1102,55 @@ export function collectEnvInfo(dir, options = undefined) {
   return infoComponents;
 }
 
+/**
+ * Longest a toolchain version probe may run. A `--version` call answers in
+ * well under a second; a tool that sets itself up on first use, such as
+ * dotnet or gem in a fresh home directory, or one that waits on a prompt,
+ * must not hold up a scan for the general spawn timeout.
+ */
+const VERSION_PROBE_TIMEOUT_MS = 60000;
+
+/**
+ * Run a toolchain version probe with VERSION_PROBE_TIMEOUT_MS as its limit.
+ *
+ * A probe that fails gives no output. Its text is then an error message, not
+ * a version: `dotnet --version` under a global.json that pins an SDK the host
+ * lacks exits with an error and lists every installed SDK, which would
+ * otherwise become the version of the dotnet component in the formulation.
+ *
+ * @param {string} cmd Command to execute
+ * @param {string} dir Working directory
+ * @param {string[]} args Arguments
+ * @returns {string|undefined} Output of the command, or undefined when it
+ * could not run or exited with a non-zero status
+ */
+const probeCommandOutput = (cmd, dir, args) =>
+  getCommandOutput(cmd, dir, args, {
+    requireSuccess: true,
+    timeout: VERSION_PROBE_TIMEOUT_MS,
+  });
+
 /**
  * Execute any command to retrieve the output
  *
  * @param {*} cmd Command to execute
  * @param {*} dir working directory
  * @param {*} args arguments
- * @param {Object} [spawnOverrides] extra options merged into spawnSync (e.g. env)
- * @returns String output from the command or undefined in case of error
+ * @param {Object} [options] extra options merged into spawnSync (e.g. env),
+ * plus `requireSuccess`, which gives undefined for a command that exits with
+ * a non-zero status, and `includeStderr`, which joins the command's standard
+ * error into the result (the default). With `includeStderr` false only the
+ * standard output is returned, so text a command writes to standard error
+ * cannot reach a parser of its output.
+ * @returns {string|undefined} Output of the command, or undefined when it
+ * could not run or printed nothing
  */
-const getCommandOutput = (cmd, dir, args, spawnOverrides = {}) => {
+const getCommandOutput = (cmd, dir, args, options = {}) => {
+  const {
+    requireSuccess = false,
+    includeStderr = true,
+    ...spawnOverrides
+  } = options;
   let commandToUse = cmd;
   // If the command includes space, automatically move it to the front of the args.
   if (cmd?.trim().includes(" ")) {
@@ -837,7 +1179,13 @@ const getCommandOutput = (cmd, dir, args, spawnOverrides = {}) => {
     maxBuffer: MAX_BUFFER * 2,
     ...spawnOverrides,
   });
+  if (requireSuccess && (result.error || result.status !== 0)) {
+    return undefined;
+  }
   const stdout = result.stdout ? result.stdout.toString() : "";
+  if (!includeStderr) {
+    return stdout.trim() || undefined;
+  }
   const stderr = result.stderr ? result.stderr.toString() : "";
   return `${stdout}\n${stderr}`.trim() || undefined;
 };
@@ -1218,7 +1566,7 @@ export function installRubyVersion(rubyVersion, filePath) {
     return { fullToolBinDir: undefined, status: false };
   }
   const existingRuby = collectRubyInfo(filePath);
-  if (existingRuby?.version?.startsWith(`ruby ${rubyVersion} `)) {
+  if (isRubyVersionActive(existingRuby, rubyVersion)) {
     return { fullToolBinDir: undefined, status: true };
   }
   const fullToolBinDir = rubyVersionDir(rubyVersion);
@@ -1984,6 +2332,36 @@ export function gitRevertsAndHotfixes(dir, maxCount = 20) {
   return entries;
 }
 
+// process.versions keys whose configure flag is named differently.
+const NODE_SHARED_FLAG_NAMES = {
+  ares: "cares",
+  libffi: "ffi",
+  llhttp: "http_parser",
+  uv: "libuv",
+};
+
+/**
+ * Whether the running Node.js links a bundled dependency as a shared library,
+ * from the `node_shared_<name>` configure variables it reports.
+ *
+ * @param {string} name key of process.versions
+ * @param {Object} [variables] configure variables, process.config.variables
+ *   by default
+ * @returns {string|undefined} `shared`, `bundled`, or undefined when the build
+ *   does not say
+ */
+export function nodeComponentLinkage(
+  name,
+  variables = globalThis.process?.config?.variables,
+) {
+  const flag = `node_shared_${NODE_SHARED_FLAG_NAMES[name] || name}`;
+  if (!variables || !(flag in variables)) {
+    return undefined;
+  }
+  const value = variables[flag];
+  return value === true || value === "true" ? "shared" : "bundled";
+}
+
 /**
  * Get information about the runtime.
  *
@@ -2016,12 +2394,22 @@ export function getRuntimeInformation() {
           name,
           version: version || null,
         });
+        // A distro or Homebrew build links some of these as shared libraries
+        // (`configure --shared-brotli`); the version is then the shared
+        // library's, and updating Node.js alone does not update it.
+        const linkage = nodeComponentLinkage(name);
         const apkg = {
           name,
           version,
-          description: `Bundled with Node.js ${runtimeInfo.version}`,
+          description:
+            linkage === "shared"
+              ? `Linked by Node.js ${runtimeInfo.version} as a shared library`
+              : `Bundled with Node.js ${runtimeInfo.version}`,
           type: "library",
           scope: "excluded",
+          ...(linkage
+            ? { properties: [{ name: "cdx:node:linkage", value: linkage }] }
+            : {}),
         };
         applyPurl(apkg, bundledPurl);
         if (nodeSourceUrl) {