@cdxgen/cdxgen 13.6.0 → 13.7.0

package/lib/ecosystems/parsers-python.js

@@ -8,6 +8,7 @@ import { parse as _load } from "yaml";
 import { DEBUG_MODE } from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { getAllFiles, safeExistsSync, safeSpawnSync } from "../core/fs.js";
+import { sanitizeBomUrl } from "../core/propertySanitizer.js";
 import { PYTHON_STD_MODULES } from "../core/state.js";
 import { parseToml } from "../core/toml.js";
 import { tryBuildPurl } from "../inventory/purl.js";
@@ -1137,10 +1138,22 @@ export async function parsePyLockData(
       hasWorkspaces = true;
     }
     for (const amember of workspaceMembers) {
-      if (amember === parentComponent.name) {
+      if (amember === parentComponent?.name) {
+        continue;
+      }
+      // a lock file read without its pyproject.toml has no parent to hold
+      // the members, which is said once for the whole lock file
+      if (!parentComponent) {
+        if (!workspaceWarningShown) {
+          console.log(
+            `The workspace members in ${lockFile || "the lock file"} are read without a pyproject.toml, so there is no project to list them under.`,
+          );
+          workspaceWarningShown = true;
+        }
         continue;
       }
       if (workspaceComponentMap[amember]) {
+        parentComponent.components = parentComponent.components || [];
         parentComponent.components.push(workspaceComponentMap[amember]);
       } else {
         if (!workspaceWarningShown) {
@@ -1629,14 +1642,40 @@ export async function parsePyLockData(
 }
 
 /**
- * First version clause of a PEP 508 requirement: an operator and the version
- * that follows it.
+ * An exact PEP 440 version clause: `==` or `===` and a version with no
+ * wildcard.
  *
- * `===` (arbitrary equality) is tried before `==`, whitespace may separate the
- * operator from the version, and a version may carry a PEP 440 epoch (`1!2.0`)
- * or a local version label (`2.1.0+cpu`).
+ * Whitespace may separate the operator from the version, and a version may
+ * carry a PEP 440 epoch (`1!2.0`) or a local version label (`2.1.0+cpu`).
  */
-const PEP440_VERSION_CLAUSE = /(===|==|!=|<=|>=|~=|<|>)\s*([0-9A-Za-z.*_+!-]*)/;
+const PEP440_EXACT_CLAUSE = /^(===?)\s*([0-9A-Za-z._+!-]+)$/;
+
+/**
+ * Version a PEP 508 requirement pins: the version of its only exact clause.
+ *
+ * A requirement with no exact clause, a wildcard (`==1.2.*`) or more than one
+ * exact clause pins no version, so a range such as `>=1.0,<2` gives null
+ * rather than one of its bounds. Per-requirement options such as
+ * `--config-settings` are not clauses.
+ *
+ * @param {String} versionSpecifiers Version specifiers of the requirement
+ * @returns {String|null} The pinned version, or null
+ */
+function pinnedRequirementVersion(versionSpecifiers) {
+  const specifiers = versionSpecifiers || "";
+  const optionsIndex = specifiers.indexOf(" --");
+  const clausesSource =
+    optionsIndex === -1 ? specifiers : specifiers.substring(0, optionsIndex);
+  let trimmed = clausesSource.trim();
+  if (trimmed.startsWith("(") && trimmed.endsWith(")")) {
+    trimmed = trimmed.substring(1, trimmed.length - 1);
+  }
+  const exactClauses = trimmed
+    .split(",")
+    .map((clause) => clause.trim().match(PEP440_EXACT_CLAUSE))
+    .filter(Boolean);
+  return exactClauses.length === 1 ? exactClauses[0][2] : null;
+}
 
 /**
  * Method to parse requirements.txt file. This must be replaced with atom parsedeps.
@@ -1825,7 +1864,7 @@ async function parseReqData(
 
     // Handle extras (e.g., package[extra1,extra2])
     let extras = null;
-    const extrasMatch = l.match(/^([a-zA-Z0-9_\-.]+)(\[([^\]]+)])?(.*)$/);
+    const extrasMatch = l.match(/^([a-zA-Z0-9_\-.]+)(\s*\[([^\]]+)])?(.*)$/);
     if (extrasMatch) {
       const [, packageName, , extrasStr, versionSpecifiers] = extrasMatch;
       const name = packageName;
@@ -1836,14 +1875,7 @@ async function parseReqData(
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
-      let version = null;
-      if (versionMatch) {
-        version = versionMatch[2].replaceAll("*", "0") || null;
-        if (version === "0") {
-          version = null;
-        }
-      }
+      const version = pinnedRequirementVersion(versionSpecifiers);
       const apkg = {
         name,
         version,
@@ -1863,7 +1895,10 @@ async function parseReqData(
           value: extras.join(","),
         });
       }
-      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
+      if (
+        versionSpecifiers?.trim() &&
+        (!version || !versionSpecifiers.trim().startsWith("=="))
+      ) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -1900,12 +1935,7 @@ async function parseReqData(
       if (PYTHON_STD_MODULES.includes(name)) {
         continue;
       }
-      const versionMatch = versionSpecifiers.match(PEP440_VERSION_CLAUSE);
-      let version = null;
-      if (versionMatch) {
-        version = versionMatch[2].replaceAll("*", "0") || null;
-        if (version === "0") version = null;
-      }
+      const version = pinnedRequirementVersion(versionSpecifiers);
       const apkg = {
         name,
         version,
@@ -1916,7 +1946,10 @@ async function parseReqData(
       if (licenses) {
         apkg.licenses = licenses;
       }
-      if (versionSpecifiers && !versionSpecifiers.trim().startsWith("==")) {
+      if (
+        versionSpecifiers?.trim() &&
+        (!version || !versionSpecifiers.trim().startsWith("=="))
+      ) {
         properties.push({
           name: "cdx:pypi:versionSpecifiers",
           value: versionSpecifiers.trim(),
@@ -2064,6 +2097,33 @@ function createPixiBomRef(packageData) {
   return `library:${packageData["name"]}:${packageData["version"] || ""}`;
 }
 
+/**
+ * Return the download url of a pixi.lock package, without credentials, query
+ * or fragment. A private conda channel can carry its access token in a
+ * `/t/<token>/` path segment, so such a url is left out.
+ *
+ * @param {unknown} url Package url from pixi.lock
+ * @returns {string|undefined} Distribution url
+ */
+function pixiDistributionUrl(url) {
+  if (typeof url !== "string" || !url.trim()) {
+    return undefined;
+  }
+  const sanitized = sanitizeBomUrl(url);
+  try {
+    const parsed = new URL(sanitized);
+    if (
+      !["http:", "https:"].includes(parsed.protocol) ||
+      parsed.pathname.split("/").includes("t")
+    ) {
+      return undefined;
+    }
+  } catch {
+    return undefined;
+  }
+  return sanitized;
+}
+
 /**
  * Method to parse pixi.lock data
  *
@@ -2153,10 +2213,13 @@ export function parsePixiLockFile(pixiLockFileName, path) {
      *
      */
     const purlTemplate = createPurlTemplate(packageData);
+    const distributionUrl = pixiDistributionUrl(packageData["url"]);
     return {
       name: packageData["name"],
       version: packageData["version"],
       ...(purlTemplate ? { purl: purlTemplate } : {}),
+      // The package download url becomes a distribution external reference.
+      ...(distributionUrl ? { distribution: { url: distributionUrl } } : {}),
       type: "library",
       "bom-ref": createPixiBomRef(packageData),
       // "licenses": [
@@ -2164,10 +2227,8 @@ export function parsePixiLockFile(pixiLockFileName, path) {
       //       "id": packageData["license"]
       //   }]
       // ],
-      supplier: {
-        name: packageData["build"],
-        url: packageData["url"],
-      },
+      // The conda build string is not a supplier, so it stays in
+      // cdx:pixi:build below.
       // "hashes": [
       //   {"md5": packageData["md5"]},
       //   {"sha256": packageData["sha256"]}

package/lib/ecosystems/parsers-rust.js

@@ -506,27 +506,55 @@ function resolveCargoWorkspaceDependencyTarget(
   ) {
     return workspaceMemberMap.get(resolvedDependencyName);
   }
-  const dependencyPath =
-    dependencyNode &&
-    typeof dependencyNode === "object" &&
-    typeof dependencyNode.path === "string" &&
-    dependencyNode.path
-      ? resolve(dirname(cargoTomlFile), dependencyNode.path, "Cargo.toml")
-      : undefined;
-  if (!dependencyPath || !safeExistsSync(dependencyPath)) {
+  if (
+    !dependencyNode ||
+    typeof dependencyNode !== "object" ||
+    typeof dependencyNode.path !== "string" ||
+    !dependencyNode.path
+  ) {
+    return undefined;
+  }
+  // A member cannot combine `workspace = true` with its own `path`, so a path
+  // on such an entry came from [workspace.dependencies], and Cargo reads it
+  // relative to the workspace root rather than to the member.
+  const pathBaseFile =
+    dependencyNode.workspace === true && workspaceContext?.workspaceRootFile
+      ? workspaceContext.workspaceRootFile
+      : cargoTomlFile;
+  const dependencyPath = resolve(
+    dirname(pathBaseFile),
+    dependencyNode.path,
+    "Cargo.toml",
+  );
+  if (!safeExistsSync(dependencyPath)) {
     return undefined;
   }
   const dependencyCargoData = readCargoTomlData(dependencyPath);
-  if (!dependencyCargoData) {
+  // A path dependency names a package; a virtual workspace root has none.
+  if (!dependencyCargoData?.package) {
     return undefined;
   }
+  // A path crate outside the current workspace inherits `*.workspace = true`
+  // fields from its own workspace, which resolveCargoWorkspaceContext finds by
+  // walking up from the crate. Handing it the current workspace would give
+  // the crate this workspace's version.
+  const workspaceRootDir = workspaceContext?.workspaceRootFile
+    ? resolve(dirname(workspaceContext.workspaceRootFile))
+    : undefined;
+  const dependencyDir = dirname(dependencyPath);
+  const isInsideWorkspace =
+    workspaceRootDir &&
+    (dependencyDir === workspaceRootDir ||
+      dependencyDir.startsWith(`${workspaceRootDir}${_sep}`));
   const dependencyIdentity = resolveCargoManifestPackageIdentity(
     dependencyPath,
     dependencyCargoData,
-    {
-      workspaceRootData: workspaceContext?.workspaceRootData,
-      workspaceRootFile: workspaceContext?.workspaceRootFile,
-    },
+    isInsideWorkspace
+      ? {
+          workspaceRootData: workspaceContext.workspaceRootData,
+          workspaceRootFile: workspaceContext.workspaceRootFile,
+        }
+      : {},
   );
   if (!dependencyIdentity?.name || !dependencyIdentity?.version) {
     return undefined;
@@ -656,6 +684,68 @@ function applyCargoDependencySpecMetadata(
   );
 }
 
+/**
+ * Version to record for a Cargo.toml dependency whose requirement is the only
+ * thing known about it.
+ *
+ * A Cargo requirement is not a version: `serde = "1.0"` means `^1.0`, and even
+ * `"1.0.94"` means `^1.0.94`. The component version is therefore left out
+ * unless the whole requirement is an exact `=X.Y.Z` pin (with an optional
+ * prerelease and build label), which is the one requirement Cargo resolves to
+ * a single version. `=1.0` is not exact, because Cargo reads it as
+ * `>=1.0.0,<1.1.0`.
+ *
+ * When the requirement is not the node's `version` key, it is a `git+`, `path+`
+ * or `workspace` fallback from normalizeCargoDependencyVersion, and it is kept
+ * as it stands so the dependency stays traceable to its source.
+ *
+ * @param {Object|String} dependencyNode Dependency entry from the manifest
+ * @param {String} requirement Requirement string from normalizeCargoDependencyVersion
+ * @returns {String|undefined} The pinned version, or undefined
+ */
+function cargoManifestComponentVersion(dependencyNode, requirement) {
+  if (
+    typeof dependencyNode === "object" &&
+    dependencyNode?.version !== requirement
+  ) {
+    return requirement;
+  }
+  const pin = requirement
+    .trim()
+    .match(/^=\s*(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?)$/);
+  return pin ? pin[1] : undefined;
+}
+
+/**
+ * Version to record for a Cargo.toml dependency component once the dependency
+ * has been resolved to a crate on disk.
+ *
+ * A path dependency or a workspace dependency always builds against the
+ * version in the target crate's own `[package]` section; the requirement next
+ * to it (`local = { path = "local", version = "0.2" }`) matters only when the
+ * crate is published to a registry. Recording the resolved version keeps one
+ * component per crate: the manifest entry and the target's own manifest, which
+ * a recursive scan parses as well, then describe the same cargo purl and
+ * merge, instead of listing the crate once version-less and once resolved
+ * (issue #4719). The `cdx:cargo:path` property keeps the dependency
+ * traceable to its source.
+ *
+ * @param {Object|String} dependencyNode Dependency entry from the manifest
+ * @param {String} requirement Requirement string from normalizeCargoDependencyVersion
+ * @param {Object|undefined} resolvedTarget Identity of the resolved local crate
+ * @returns {String|undefined} The resolved version, or cargoManifestComponentVersion's answer
+ */
+function cargoManifestDependencyComponentVersion(
+  dependencyNode,
+  requirement,
+  resolvedTarget,
+) {
+  if (resolvedTarget?.version) {
+    return resolvedTarget.version;
+  }
+  return cargoManifestComponentVersion(dependencyNode, requirement);
+}
+
 function collectCargoManifestDependencyComponents(
   dependencyEntries,
   addPackageToList,
@@ -689,9 +779,21 @@ function collectCargoManifestDependencyComponents(
       continue;
     }
     const pkg = {
-      name: dependencyName,
-      version,
+      // A renamed local dependency (`alias = { path = "…", package = "real" }`)
+      // is the crate `real`; the alias only names it inside this manifest and
+      // stays on cdx:cargo:package. Keeping the alias with the resolved version
+      // would describe a crate that does not exist, or a different one on
+      // crates.io.
+      name: resolvedWorkspaceTarget?.name || dependencyName,
+      version: cargoManifestDependencyComponentVersion(
+        dependencyNode,
+        version,
+        resolvedWorkspaceTarget,
+      ),
     };
+    if (resolvedWorkspaceTarget?.group) {
+      pkg.group = resolvedWorkspaceTarget.group;
+    }
     applyCargoDependencySpecMetadata(
       pkg,
       dependencyNode,

package/lib/ecosystems/remote/huggingface.js

@@ -10,6 +10,10 @@ import {
   detectAiModelVariants,
   normalizeDetectedVariants,
 } from "../../inventory/aiModelVariants.js";
+import {
+  modelCreatorEntity,
+  modelCreatorFromOrganization,
+} from "../../inventory/aiProviders.js";
 import { getLicenses } from "../../inventory/spdx.js";
 import {
   createHuggingFaceComponentReference,
@@ -26,6 +30,7 @@ import {
   toHuggingFaceAssetPath,
   toHuggingFaceAssetUrl,
   toHuggingFacePurl,
+  toHuggingFaceSupplier,
 } from "../../parsers/huggingfaceUtils.js";
 
 const CACHE_MISS = Symbol("huggingface-cache-miss");
@@ -1191,6 +1196,23 @@ export async function fetchHuggingFaceAssetInventory(
         payload?.sha ||
         (revision !== "HEAD" ? revision : payload?.lastModified),
       purl,
+      // The repository namespace published the asset, so it is the
+      // supplier. Its url is the organisation or user page, not the
+      // repository. A model is credited to a creator as manufacturer only
+      // when the namespace is that creator's own organisation, since
+      // re-packagers publish models other organisations made.
+      supplier:
+        slashIndex > 0
+          ? toHuggingFaceSupplier(normalizedRepoId.slice(0, slashIndex))
+          : undefined,
+      manufacturer:
+        normalizedAssetType === "model" && slashIndex > 0
+          ? modelCreatorEntity(
+              modelCreatorFromOrganization(
+                normalizedRepoId.slice(0, slashIndex),
+              ),
+            )
+          : undefined,
       description:
         normalizedAssetType === "dataset"
           ? datasetDescriptionFromStats(payload)

package/lib/ecosystems/rusi.js

@@ -16,6 +16,7 @@ import {
 } from "../core/pluginRun.js";
 import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
+import { occurrenceLocationKey } from "../inventory/occurrenceKey.js";
 import { resolvePluginBinary } from "../inventory/plugins.js";
 
 const RUST_LANGUAGES = new Set(["rust", "rs", "rust-lang"]);
@@ -67,10 +68,7 @@ function positionLocation(position) {
   if (!position?.filename) {
     return undefined;
   }
-  if (position.line && position.line > 0) {
-    return `${position.filename}#${position.line}`;
-  }
-  return position.filename;
+  return occurrenceLocationKey(position.filename, position.line);
 }
 
 function purlWithoutVersion(purl) {

package/lib/ecosystems/scalasem.js

@@ -30,6 +30,7 @@ import { isProjectToolingAllowed } from "../core/projectTooling.js";
 import { parsetoolsFile } from "../inventory/atomUtils.js";
 import { applyAlgorithmProperties } from "../inventory/cryptoAlgorithmFamily.js";
 import { getJarClasses } from "../inventory/deps.js";
+import { occurrenceLocationKey } from "../inventory/occurrenceKey.js";
 import {
   parseScalaArtifact,
   scalaCoordinateKey,
@@ -1984,7 +1985,7 @@ function addUsageEvidence(
       let added = false;
       for (const [file, lines] of files) {
         if (depth < lines.length && locations.size < cap) {
-          locations.add(`${file}#${lines[depth]}`);
+          locations.add(occurrenceLocationKey(file, lines[depth]));
           added = true;
         }
       }