@cdxgen/cdxgen 13.5.0 → 13.7.0

package/lib/inventory/nodeBuildInfo.js

@@ -0,0 +1,218 @@
+// Bounded Node.js build-version reader for unpackaged `node` binaries.
+//
+// The Node.js the Docker Official images, the release tarballs, nvm, fnm and
+// volta install is not owned by any package manager, so a BOM sees it only as
+// a file. Its version decides whether the runtime is affected by advisories
+// such as CVE-2026-111497 (fixed in 22.23.4, 24.22.1 and 26.12.1).
+//
+// Two markers are compiled into the binary:
+// - the release URLs, `https://nodejs.org/download/<channel>/v<version>/`,
+//   which a build configured with release URLs (every nodejs.org build)
+//   carries for process.release.sourceUrl and headersUrl
+//   https://github.com/nodejs/node/blob/v24.22.0/src/node_metadata.cc#L191-L197
+// - `node.js/v<version>`, NUL-terminated, the inspector's /json/version
+//   Browser string, which every build with the inspector carries; it is the
+//   fallback for a build without release URLs.
+//   https://github.com/nodejs/node/blob/v24.22.0/src/inspector_socket_server.cc#L117
+//
+// process.versions.brotli is not a usable signal: Node.js backports the
+// decoder fix without changing it (24.22.1 still reports 1.2.0). The decoder
+// state is read separately, by brotliDecoder.js.
+
+import { basename } from "node:path";
+
+import { scanFileMarkers } from "../core/boundedFile.js";
+import { applyPurl, tryBuildPurl } from "./purl.js";
+
+const RELEASE_URL_MARKER = Buffer.from("https://nodejs.org/download/");
+const USER_AGENT_MARKER = Buffer.from("node.js/v");
+const MAX_VERSION_LENGTH = 64;
+const VERSION_RE = /^(\d+\.\d+\.\d+)(?:-([0-9A-Za-z][0-9A-Za-z.]*))?$/;
+const CHANNELS = new Set(["release", "rc", "nightly", "test", "v8-canary"]);
+
+/**
+ * The most node-named files one scan opens in search of a build version.
+ *
+ * @type {number}
+ */
+export const MAX_NODE_PROBES = 64;
+
+/**
+ * Whether a file name is one the Node.js runtime is installed under.
+ *
+ * @param {string} fileName basename or path of the candidate
+ * @returns {boolean} true for `node`, `nodejs` and `node.exe`
+ */
+export function isNodeBinaryName(fileName) {
+  if (typeof fileName !== "string" || !fileName) {
+    return false;
+  }
+  const name = basename(fileName.replaceAll("\\", "/"));
+  return name === "node" || name === "nodejs" || name === "node.exe";
+}
+
+/**
+ * Parse a Node.js version in the grammar the release tooling produces:
+ * `24.22.1`, `25.0.0-rc.1`, `26.0.0-nightly20260301abcdef`.
+ *
+ * @param {string} text candidate version, without the leading `v`
+ * @returns {string|undefined} the version, or undefined
+ */
+export function parseNodeVersion(text) {
+  if (typeof text !== "string" || !text || text.length > MAX_VERSION_LENGTH) {
+    return undefined;
+  }
+  return VERSION_RE.test(text) ? text : undefined;
+}
+
+function versionFromReleaseUrl(after) {
+  // <channel>/v<version>/...
+  const text = after.toString("latin1");
+  const slash = text.indexOf("/");
+  if (slash <= 0) {
+    return undefined;
+  }
+  const channel = text.slice(0, slash);
+  if (!CHANNELS.has(channel) || text[slash + 1] !== "v") {
+    return undefined;
+  }
+  const end = text.indexOf("/", slash + 2);
+  if (end === -1) {
+    return undefined;
+  }
+  const version = parseNodeVersion(text.slice(slash + 2, end));
+  return version ? { version, channel } : undefined;
+}
+
+function versionFromUserAgent(after) {
+  const end = after.indexOf(0);
+  if (end <= 0) {
+    return undefined;
+  }
+  return parseNodeVersion(after.toString("latin1", 0, end));
+}
+
+/**
+ * Read the Node.js version a `node` binary was built as.
+ *
+ * @param {string} absPath absolute path of the binary
+ * @param {string|undefined} rootDir extracted root, when the file came from one
+ * @returns {{version: string, source: string, channel?: string}|undefined}
+ *   source is `release-url` or `binary`
+ */
+export function readNodeBuildVersion(absPath, rootDir) {
+  const scan = scanFileMarkers(
+    absPath,
+    rootDir,
+    [RELEASE_URL_MARKER, USER_AGENT_MARKER],
+    { contextBytes: MAX_VERSION_LENGTH + 32, maxHits: 8 },
+  );
+  if (!scan || scan.skipped) {
+    return undefined;
+  }
+  const [releaseHits, userAgentHits] = scan.hits;
+  const fromBinary = userAgentHits
+    .map((hit) => versionFromUserAgent(hit.after))
+    .find(Boolean);
+  for (const hit of releaseHits) {
+    const release = versionFromReleaseUrl(hit.after);
+    // The headers URL names the release a binary was published as. A binary
+    // whose own version string disagrees is not that release, so the URL is
+    // used only when the two agree or the version string is missing.
+    if (release && (!fromBinary || fromBinary === release.version)) {
+      return {
+        version: release.version,
+        source: "release-url",
+        channel: release.channel,
+      };
+    }
+  }
+  return fromBinary ? { version: fromBinary, source: "binary" } : undefined;
+}
+
+/**
+ * The CPE that lets a downstream scanner match a Node.js version. NVD names the
+ * product node.js and keeps a pre-release in the update field.
+ *
+ * @param {string} version Node.js version
+ * @returns {string} CPE 2.3 string
+ */
+export function nodeCpe(version) {
+  const match = VERSION_RE.exec(version || "");
+  if (!match) {
+    return `cpe:2.3:a:nodejs:node.js:${version}:*:*:*:*:*:*:*`;
+  }
+  const update = match[2] ? match[2].replaceAll(".", "").toLowerCase() : "*";
+  return `cpe:2.3:a:nodejs:node.js:${match[1]}:${update}:*:*:*:*:*:*`;
+}
+
+/**
+ * A Node.js runtime is one `platform` component per distinct version, like the
+ * PHP and Go stdlib components. Its identity is `pkg:generic/node`: it is only
+ * used where no package manager owns the runtime.
+ *
+ * @param {string} version Node.js version
+ * @returns {Object} component with `purl`, `bom-ref` and `cpe`
+ */
+export function createNodeRuntimeComponent(version) {
+  return applyPurl(
+    { type: "platform", name: "node", version, cpe: nodeCpe(version) },
+    tryBuildPurl({ type: "generic", name: "node", version }),
+  );
+}
+
+/**
+ * The properties a node file component carries once its build is known.
+ *
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ * @returns {{name: string, value: string}[]} properties to append
+ */
+export function nodeBuildProperties(build) {
+  const properties = [
+    { name: "cdx:node:buildVersion", value: build.version },
+    { name: "cdx:node:buildVersionSource", value: build.source },
+  ];
+  if (build.channel) {
+    properties.push({ name: "cdx:node:releaseChannel", value: build.channel });
+  }
+  return properties;
+}
+
+/**
+ * Start collecting the runtime components and edges of one scan.
+ *
+ * @returns {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}}
+ */
+export function createNodeRuntimeInventory() {
+  return { runtimeComponents: [], dependencies: [], runtimeRefs: new Set() };
+}
+
+/**
+ * Tag a node file component with its build facts and link it to the runtime
+ * component of its version, creating that component on first use. Mutates the
+ * component in place.
+ *
+ * @param {{runtimeComponents: Object[], dependencies: Object[], runtimeRefs: Set<string>}} inventory
+ *   accumulator from createNodeRuntimeInventory
+ * @param {Object} component file component, with a `properties` array
+ * @param {{version: string, source: string, channel?: string}} build result of readNodeBuildVersion
+ */
+export function attachNodeBuild(inventory, component, build) {
+  component.properties.push(...nodeBuildProperties(build));
+  const runtime = createNodeRuntimeComponent(build.version);
+  const runtimeRef = runtime["bom-ref"];
+  if (!runtimeRef) {
+    return;
+  }
+  if (!inventory.runtimeRefs.has(runtimeRef)) {
+    inventory.runtimeRefs.add(runtimeRef);
+    inventory.runtimeComponents.push(runtime);
+    inventory.dependencies.push({ ref: runtimeRef, dependsOn: [] });
+  }
+  if (component["bom-ref"]) {
+    inventory.dependencies.push({
+      ref: component["bom-ref"],
+      dependsOn: [runtimeRef],
+    });
+  }
+}

package/lib/inventory/nodeHostProbe.js

@@ -0,0 +1,202 @@
+// Bounded, read-only probe for the Node.js no package manager owns on a live
+// host, for `-t os` / obom. The release tarballs, the nodejs.org installer and
+// the version managers (nvm, fnm, volta, asdf, mise, n) put Node.js where no
+// package database records it, so an OBOM sees neither the runtime nor the
+// Brotli decoder compiled into it.
+//
+// Candidates come from fixed directories and from each version manager's
+// tree under the home directories, one wildcard level at a time, never from a
+// walk of the file system. The ownership rules, caps and degradations are the
+// shared host-runtime probe's.
+
+import { join } from "node:path";
+
+import {
+  isDryRun,
+  readEnvironmentVariable,
+  recordActivity,
+} from "../core/activity.js";
+import { recordDegradation } from "../core/buildLedger.js";
+import {
+  attachBrotliDecoder,
+  createBrotliInventory,
+  finishBrotliInventory,
+  readBrotliDecoder,
+} from "./brotliDecoder.js";
+import {
+  isDirectory,
+  listDirectory,
+  probeHostRuntime,
+} from "./hostRuntimeProbe.js";
+import {
+  attachNodeBuild,
+  createNodeRuntimeInventory,
+  isNodeBinaryName,
+  MAX_NODE_PROBES,
+  readNodeBuildVersion,
+} from "./nodeBuildInfo.js";
+
+// The most directories one wildcard pattern may expand to.
+const MAX_EXPANDED_DIRECTORIES = 256;
+
+// Relative to the root.
+const POSIX_DIRECTORIES = {
+  linux: ["usr/local/bin", "opt/*/bin", "usr/local/n/versions/node/*/bin"],
+  darwin: ["usr/local/bin", "opt/homebrew/bin", "opt/*/bin"],
+};
+
+// Relative to a home directory.
+const VERSION_MANAGER_DIRECTORIES = [
+  ".nvm/versions/node/*/bin",
+  ".local/share/fnm/node-versions/*/installation/bin",
+  ".fnm/node-versions/*/installation/bin",
+  "Library/Application Support/fnm/node-versions/*/installation/bin",
+  ".volta/tools/image/node/*/bin",
+  ".asdf/installs/nodejs/*/bin",
+  ".local/share/mise/installs/node/*/bin",
+];
+
+const HOME_PARENTS = {
+  linux: ["home"],
+  darwin: ["Users"],
+};
+
+/**
+ * Expand a relative directory pattern whose `*` segments match one directory
+ * name each.
+ *
+ * @param {string} base absolute directory the pattern hangs off
+ * @param {string} pattern `/`-separated relative pattern
+ * @returns {string[]} existing directories, at most MAX_EXPANDED_DIRECTORIES
+ */
+function expandDirectories(base, pattern) {
+  let current = [base];
+  for (const segment of pattern.split("/")) {
+    const next = [];
+    for (const directory of current) {
+      if (segment !== "*") {
+        next.push(join(directory, segment));
+        continue;
+      }
+      for (const name of listDirectory(directory)) {
+        const child = join(directory, name);
+        if (isDirectory(child)) {
+          next.push(child);
+        }
+        if (next.length >= MAX_EXPANDED_DIRECTORIES) {
+          break;
+        }
+      }
+    }
+    current = next.slice(0, MAX_EXPANDED_DIRECTORIES);
+  }
+  return current.filter(isDirectory);
+}
+
+function homeDirectories(context) {
+  const { rootPath, platform } = context;
+  const homes = [];
+  if (platform === "linux") {
+    homes.push(join(rootPath, "root"));
+  }
+  for (const parent of HOME_PARENTS[platform] || []) {
+    for (const name of listDirectory(join(rootPath, parent))) {
+      const home = join(rootPath, parent, name);
+      if (isDirectory(home)) {
+        homes.push(home);
+      }
+    }
+  }
+  return homes.slice(0, MAX_EXPANDED_DIRECTORIES);
+}
+
+// Where the Node.js MSI installs, by itself or for Chocolatey's nodejs.install.
+function windowsInstallDirectory(context) {
+  const programFiles =
+    context.readEnv("ProgramFiles") || join(context.rootPath, "Program Files");
+  return join(programFiles, "nodejs");
+}
+
+function candidateDirectories(context) {
+  const { rootPath, platform } = context;
+  const directories = [];
+  if (platform === "win32") {
+    directories.push({ directory: windowsInstallDirectory(context) });
+    const appData = context.readEnv("APPDATA");
+    if (appData) {
+      for (const directory of expandDirectories(appData, "nvm/*")) {
+        directories.push({ directory });
+      }
+    }
+    return directories;
+  }
+  for (const pattern of POSIX_DIRECTORIES[platform] || []) {
+    for (const directory of expandDirectories(rootPath, pattern)) {
+      directories.push({ directory });
+    }
+  }
+  for (const home of homeDirectories(context)) {
+    for (const pattern of VERSION_MANAGER_DIRECTORIES) {
+      for (const directory of expandDirectories(home, pattern)) {
+        directories.push({ directory });
+      }
+    }
+  }
+  return directories;
+}
+
+function readBuild(context, candidate) {
+  const node = readNodeBuildVersion(candidate.real, context.realRoot);
+  if (!node) {
+    return undefined;
+  }
+  return { node, brotli: readBrotliDecoder(candidate.real, context.realRoot) };
+}
+
+/**
+ * Look for Node.js no package manager owns on the host. Components come back
+ * only for the files nothing owns: a `file` component for each `node` binary
+ * with the cdx:node and cdx:brotli properties, one `platform` component per
+ * Node.js version with its CPE, and the brotli component when a binary embeds
+ * a decoder.
+ *
+ * @param {Object} [options] probe options, as probeHostPhp takes them
+ * @returns {{components: Object[], dependencies: Object[]}}
+ */
+export function probeHostNode(options = {}) {
+  return probeHostRuntime(options, {
+    label: "Node.js",
+    ecosystem: "npm",
+    capability: "node-host-probe",
+    remediationId: "npm.host-probe.package-db-unreadable",
+    maxProbes: MAX_NODE_PROBES,
+    chocolateyPackages: ["nodejs", "nodejs-lts", "nodejs.install"],
+    chocolateyDirectories: (context) => [windowsInstallDirectory(context)],
+    directories: candidateDirectories,
+    classify: (name) => (isNodeBinaryName(name) ? "node" : undefined),
+    readBuild,
+    createInventory: () => ({
+      node: createNodeRuntimeInventory(),
+      brotli: createBrotliInventory(),
+    }),
+    attach: (inventory, component, build) => {
+      attachNodeBuild(inventory.node, component, build.node);
+      if (build.brotli) {
+        attachBrotliDecoder(inventory.brotli, component, build.brotli);
+      }
+    },
+    finish: (inventory) => {
+      const brotli = finishBrotliInventory(inventory.brotli);
+      return {
+        components: [...inventory.node.runtimeComponents, ...brotli.components],
+        dependencies: [...inventory.node.dependencies, ...brotli.dependencies],
+      };
+    },
+    hooks: {
+      isDryRun,
+      readEnvironmentVariable,
+      recordActivity,
+      recordDegradation,
+    },
+  });
+}

package/lib/inventory/occurrenceKey.js

@@ -0,0 +1,90 @@
+/**
+ * The key of a place in a purl's occurrence set (`purlLocationMap`).
+ *
+ * Every location that enters an occurrence set is keyed by this function,
+ * whatever evidence source added it: the seeding from the input BOM
+ * (`initFromSbom`), the atom `usages` and `callsites` slices, the golem, rusi,
+ * kosi, dosai and scalasem reports, the C include attribution and the Swift
+ * semantics slices. Backslashes become `/`, so a place spelled with `\` in the
+ * input BOM (Windows cdxgen output) and `/` in a slice is one occurrence, not
+ * two (issue 4726). The path is otherwise left as spelled: no resolving, no
+ * case folding, no stripping of a leading `./`.
+ *
+ * A place a line already names is keyed `file#line`; a place a callsites
+ * record names down to its column (counted from 0, as atom writes it) is keyed
+ * `file:line:offset`, so two use
+ * sites on one line are two occurrences. An occurrence with only `location`
+ * and `line` names the line as a whole: it is the same place as any use site
+ * that line carries, and it is kept as an occurrence of its own only while no
+ * `file:line:offset` key of that line exists (the writer drops the line-only
+ * key then, see `dropSubsumedOccurrenceKeys`). That rule is what keeps a
+ * re-run of evinse over its own output at the same occurrences: the first run
+ * writes the `file:line:offset` keys, and the second run seeds and re-adds
+ * exactly those.
+ *
+ * @param {string} location File path or other location text
+ * @param {number} [line] Line number; not a positive number means the location names no line
+ * @param {number} [offset] Column within the line, counted from 0 as atom writes it; a value that is not an integer of 0 or more (atom writes -1 for an unknown column) means the place is the line
+ * @returns {string|undefined} Key in the `file:line:offset`, `file#line` or plain `file` shape; undefined when the location is empty
+ */
+export function occurrenceLocationKey(location, line, offset) {
+  const normalized = `${location ?? ""}`.trim().replaceAll("\\", "/");
+  if (!normalized) {
+    return undefined;
+  }
+  if (!(line > 0)) {
+    return normalized;
+  }
+  return Number.isInteger(offset) && offset >= 0
+    ? `${normalized}:${line}:${offset}`
+    : `${normalized}#${line}`;
+}
+
+/**
+ * Drop the occurrence keys a use-site key subsumes.
+ *
+ * A `file:line:offset` key names a use site on a line; the line-only
+ * `file#line` key of the same line names no place of its own any more, so it
+ * is removed rather than counted beside the use sites (issue 4726: an
+ * occurrence seeded from an input BOM with only `location` and `line` is the
+ * same place as a callsites occurrence at that line).
+ *
+ * @param {string[]} keys Occurrence-set keys
+ * @returns {string[]} The keys without the subsumed line-only entries
+ */
+export function dropSubsumedOccurrenceKeys(keys) {
+  const linesWithOffset = new Set();
+  for (const key of keys) {
+    const withOffset = /^(.*):(\d+):(\d+)$/.exec(key);
+    if (withOffset) {
+      linesWithOffset.add(`${withOffset[1]}#${withOffset[2]}`);
+    }
+  }
+  if (!linesWithOffset.size) {
+    return keys;
+  }
+  return keys.filter((key) => {
+    const lineOnly = /^(.*)#(\d+)$/.exec(key);
+    return !(lineOnly && linesWithOffset.has(`${lineOnly[1]}#${lineOnly[2]}`));
+  });
+}
+
+/**
+ * The location part of an occurrence-set key: `src/a.js` for `src/a.js#3`,
+ * `src/a.js:3:14` and `src/a.js` alike.
+ *
+ * @param {string} key Key made by `occurrenceLocationKey`
+ * @returns {string} The location the key names
+ */
+export function occurrenceKeyLocation(key) {
+  const text = `${key ?? ""}`;
+  const withOffset = /^(.*):(\d+):(\d+)$/.exec(text);
+  if (withOffset) {
+    return withOffset[1];
+  }
+  const hash = text.lastIndexOf("#");
+  if (hash > 0 && /^\d+$/.test(text.slice(hash + 1))) {
+    return text.slice(0, hash);
+  }
+  return text;
+}

package/lib/inventory/osPackageResolver.js

@@ -493,3 +493,185 @@ function collectAllLdConfs(basePath, ldConf, allLdConfDirs, libPaths) {
     }
   }
 }
+
+// Native modules that language package managers install outside the library
+// directories the loader searches: CPython and PyPy extension modules, PHP
+// extensions, Ruby gem extensions, Node.js addons, and the native half of a
+// .NET runtime. A Brotli decoder compiled into one of them is invisible unless
+// the file is read.
+const NATIVE_EXTENSION_GLOBS = [
+  "**/site-packages/**/*.{so,pyd}",
+  "**/dist-packages/**/*.so",
+  "**/lib/php/**/*.so",
+  "**/lib/php*/modules/*.so",
+  "**/php*/ext/php_*.dll",
+  "**/gems/*/lib/**/*.{so,bundle}",
+  "**/gems/*/extensions/**/*.{so,bundle}",
+  "**/bundle/extensions/**/*.{so,bundle}",
+  "**/node_modules/**/*.node",
+  "**/dotnet/shared/*/*/*.so",
+  "**/.dotnet/shared/*/*/*.so",
+  // Of a Windows runtime's many DLLs, only this one is native and holds the
+  // decoder.
+  "**/dotnet/shared/*/*/System.IO.Compression.Native.dll",
+];
+const NATIVE_EXTENSION_IGNORES = ["proc/**", "sys/**", "dev/**"];
+
+/**
+ * The most native extension candidates one scan returns.
+ *
+ * @type {number}
+ */
+export const MAX_NATIVE_EXTENSIONS = 4096;
+
+/**
+ * Collect native extension modules under a root file system that the library
+ * collector does not see, leaving out paths a package database owns and paths
+ * already collected. Symlinks are not followed, so a link pointing out of the
+ * root is never listed.
+ *
+ * @param {string} basePath extracted root file system
+ * @param {string[]} [excludePaths] root-relative paths to leave out
+ * @returns {string[]} root-relative paths, sorted, capped at MAX_NATIVE_EXTENSIONS
+ */
+export function collectNativeExtensions(basePath, excludePaths = []) {
+  if (!basePath) {
+    return [];
+  }
+  const excluded = new Set(
+    (excludePaths || []).map((f) => f.replace(/^\/+/, "").replace(/\\/g, "/")),
+  );
+  let files = [];
+  try {
+    files = globSync(NATIVE_EXTENSION_GLOBS, {
+      cwd: basePath,
+      absolute: false,
+      nodir: true,
+      dot: true,
+      follow: false,
+      ignore: NATIVE_EXTENSION_IGNORES,
+    });
+  } catch (_err) {
+    return [];
+  }
+  const result = new Set();
+  for (const file of files) {
+    const normalized = file.replace(/\\/g, "/").replace(/^\/+/, "");
+    if (!excluded.has(normalized)) {
+      result.add(normalized);
+    }
+  }
+  return Array.from(result).sort().slice(0, MAX_NATIVE_EXTENSIONS);
+}
+
+const OS_PACKAGE_PURL_PREFIXES = [
+  "pkg:deb/",
+  "pkg:apk/",
+  "pkg:rpm/",
+  "pkg:alpm/",
+  "pkg:qpkg/",
+  "pkg:generic/",
+];
+
+/**
+ * Whether a source file is the installation record of a language package,
+ * the file a package manager writes when it installs the package: dist-info
+ * or egg-info metadata, an installed gemspec, a package.json inside
+ * node_modules, or a jar. A lock file or manifest only names packages, so an
+ * OS package owning one says nothing about who installed them.
+ *
+ * @param {string} filePath root-relative path with forward slashes
+ * @returns {boolean}
+ */
+function isInstallRecord(filePath) {
+  const parts = filePath.split("/");
+  const name = parts.at(-1) || "";
+  const parent = parts.at(-2) || "";
+  if (parent.endsWith(".dist-info") || parent.endsWith(".egg-info")) {
+    return true;
+  }
+  if (name.endsWith(".egg-info") || name.endsWith(".jar")) {
+    return true;
+  }
+  if (name.endsWith(".gemspec") && parts.includes("specifications")) {
+    return true;
+  }
+  return name === "package.json" && parts.includes("node_modules");
+}
+
+/**
+ * Mark language packages that an OS package installed. Alpine's py3-brotli
+ * ships a Brotli-1.1.0.dist-info that a Python scan reports as
+ * pkg:pypi/brotli@1.1.0, but a distro fixes it by backporting under the same
+ * upstream version, so a PyPI advisory range keeps matching after the fix. The
+ * `cdx:os:installedBy` property names the OS package that owns the
+ * installation record, so a consumer can judge the component by that package
+ * instead.
+ *
+ * A component is marked only when every installation record it was read from
+ * belongs to an OS package: a copy that pip put in a virtual environment
+ * beside the distro's is not the distro's to fix. Run it after duplicates
+ * merge, so that a merged component carries all of its records.
+ *
+ * @param {Object[]} components BOM components, mutated in place
+ * @param {Map<string, string>|undefined} ownerByPath root-relative file path to
+ *   owning OS package bom-ref
+ * @param {string} [rootDir] extracted root, stripped from absolute source paths
+ * @returns {number} how many components were marked
+ */
+export function markOsInstalledLanguagePackages(
+  components,
+  ownerByPath,
+  rootDir,
+) {
+  if (!ownerByPath?.size || !Array.isArray(components)) {
+    return 0;
+  }
+  const rootPrefix = rootDir
+    ? rootDir.replaceAll("\\", "/").replace(/\/+$/, "")
+    : undefined;
+  let marked = 0;
+  for (const component of components) {
+    const purl = component?.purl;
+    if (
+      typeof purl !== "string" ||
+      !purl.startsWith("pkg:") ||
+      OS_PACKAGE_PURL_PREFIXES.some((prefix) => purl.startsWith(prefix)) ||
+      !Array.isArray(component.properties) ||
+      component.properties.some((prop) => prop.name === "cdx:os:installedBy")
+    ) {
+      continue;
+    }
+    const owners = new Set();
+    let records = 0;
+    let unowned = 0;
+    for (const prop of component.properties) {
+      if (prop.name !== "internal:SrcFile" || typeof prop.value !== "string") {
+        continue;
+      }
+      let filePath = prop.value.replaceAll("\\", "/");
+      if (rootPrefix && filePath.startsWith(`${rootPrefix}/`)) {
+        filePath = filePath.slice(rootPrefix.length);
+      }
+      filePath = filePath.replace(/^\/+/, "");
+      if (!isInstallRecord(filePath)) {
+        continue;
+      }
+      records += 1;
+      const owner = ownerByPath.get(filePath);
+      if (owner) {
+        owners.add(owner);
+      } else {
+        unowned += 1;
+      }
+    }
+    if (!records || unowned) {
+      continue;
+    }
+    for (const owner of Array.from(owners).sort()) {
+      component.properties.push({ name: "cdx:os:installedBy", value: owner });
+    }
+    marked += 1;
+  }
+  return marked;
+}