@conterra/vuln-scan 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +238 -1
- package/dist/vuln-scan.js +7 -7
- package/package.json +11 -12
package/README.md
CHANGED
|
@@ -1,3 +1,240 @@
|
|
|
1
1
|
# ct-vuln-scan
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
The project is a utility to scan sbom files in CycloneDX json format for CVEs.
|
|
4
|
+
The utility is a wrapper around [grype](https://github.com/anchore/grype) and [trivy](https://github.com/aquasecurity/trivy) and [oss index](https://ossindex.sonatype.org/).
|
|
5
|
+
It also supports the [OpenVex](https://github.com/openvex) specification for vulnerability status and justification.
|
|
6
|
+
|
|
7
|
+
## Pre-Requisites
|
|
8
|
+
|
|
9
|
+
You need to have `docker` and `node/npm` installed on your machine.
|
|
10
|
+
|
|
11
|
+
## Installation
|
|
12
|
+
|
|
13
|
+
The utility is available as an npm package it can be installed globally or locally.
|
|
14
|
+
|
|
15
|
+
For global installation use:
|
|
16
|
+
|
|
17
|
+
```sh
|
|
18
|
+
$ npm install -g @conterra/vuln-scan
|
|
19
|
+
```
|
|
20
|
+
|
|
21
|
+
For local installation use:
|
|
22
|
+
|
|
23
|
+
```sh
|
|
24
|
+
$ npm install @conterra/vuln-scan
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
or reference it in your `package.json` file:
|
|
28
|
+
|
|
29
|
+
```json
|
|
30
|
+
{
|
|
31
|
+
"dependencies": {
|
|
32
|
+
"@conterra/vuln-scan": "<current version>"
|
|
33
|
+
}
|
|
34
|
+
}
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
After that you have two commands available:
|
|
38
|
+
|
|
39
|
+
- `ct-vuln-scan`
|
|
40
|
+
- Triggers the vulnerability scan
|
|
41
|
+
- `ct-vuln-add-vex`
|
|
42
|
+
- Triggers a process to add a new vex statement to a file
|
|
43
|
+
|
|
44
|
+
## Configuration
|
|
45
|
+
|
|
46
|
+
You need to create a `vuln-scan-conf.json` file in the root of your project.
|
|
47
|
+
|
|
48
|
+
A minimal configuration file specifies only the project to scan:
|
|
49
|
+
|
|
50
|
+
```json
|
|
51
|
+
{
|
|
52
|
+
"$schema": "./node_modules/@conterra/vuln-scan/dist/schema/conf-schema.json",
|
|
53
|
+
"projects": [
|
|
54
|
+
{
|
|
55
|
+
"name": "mapapps",
|
|
56
|
+
"version": "4.18.2",
|
|
57
|
+
"purl": "pkg:maven/de.conterra.mapapps/ct-mapapps@4.18.2",
|
|
58
|
+
"sbomFile": "./input/sboms/mapapps-4.18.2.cdx.json"
|
|
59
|
+
}
|
|
60
|
+
]
|
|
61
|
+
}
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
The following sample lists all available options with their default values:
|
|
65
|
+
|
|
66
|
+
```json
|
|
67
|
+
{
|
|
68
|
+
"$schema": "./node_modules/@conterra/vuln-scan/dist/schema/conf-schema.json",
|
|
69
|
+
|
|
70
|
+
/* Defines if the process should fail or only log a warning.
|
|
71
|
+
If true the process ends with exit code 1 if a vulnerability is detected without a vex information.
|
|
72
|
+
Otherwise only the log statement "##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED" is issued.
|
|
73
|
+
*/
|
|
74
|
+
"failOnNewVulnerabilities": false,
|
|
75
|
+
/* The maven repository to fetch sboms from.
|
|
76
|
+
If the maven repository requires authentication, the environment variables MAVEN_REPO_USER and MAVEN_REPO_PW must be set.
|
|
77
|
+
*/
|
|
78
|
+
"mavenRepo": "https://repository.conterra.de/repository/maven-mirror-ct",
|
|
79
|
+
/* The list of scanners to use. Possible values are "grype", "trivy" and "ossindex". */
|
|
80
|
+
"scanners": ["grype", "trivy", "ossindex"],
|
|
81
|
+
/* The directory where the vex files are stored. */
|
|
82
|
+
"vexDir": "./input/vex",
|
|
83
|
+
/* The directory where the scan results are written to. */
|
|
84
|
+
"outDir": "./output",
|
|
85
|
+
/* The directory where the cache of the grype and trivy is stored. Both tools maintain databases, which are downloaded and stored in the cache directory. */
|
|
86
|
+
"cacheDir": "./cache",
|
|
87
|
+
/* Flag if true then for each project a sub directory is created in the output directory.
|
|
88
|
+
If false all files are directly stored in the output dir without a subfolder structure.
|
|
89
|
+
*/
|
|
90
|
+
"createSubDirsForProject": true,
|
|
91
|
+
/* The list of projects to scan. */
|
|
92
|
+
"projects": [
|
|
93
|
+
{
|
|
94
|
+
"name": "mapapps",
|
|
95
|
+
"version": "4.18.3",
|
|
96
|
+
/* identifier of the project in the vex files, used to filter the vex statements. */
|
|
97
|
+
"purl": "pkg:maven/de.conterra.mapapps/ct-mapapps@4.18.3",
|
|
98
|
+
/* The maven coordinates of the sbom file, used to download the file from the maven remote repository. */
|
|
99
|
+
"sbomMavenCoordinates": "de.conterra.mapapps:ct-mapapps-rollout:4.18.3:sbom"
|
|
100
|
+
},
|
|
101
|
+
{
|
|
102
|
+
"name": "mapapps",
|
|
103
|
+
"version": "4.18.2",
|
|
104
|
+
"purl": "pkg:maven/de.conterra.mapapps/ct-mapapps@4.18.2",
|
|
105
|
+
/* The location of the sbom file. */
|
|
106
|
+
"sbomFile": "./input/sboms/mapapps-4.18.2.cdx.json"
|
|
107
|
+
}
|
|
108
|
+
]
|
|
109
|
+
}
|
|
110
|
+
```
|
|
111
|
+
|
|
112
|
+
## Usage - Scan
|
|
113
|
+
|
|
114
|
+
To scan all projects run following command in the directory where the configuration file is located:
|
|
115
|
+
|
|
116
|
+
```sh
|
|
117
|
+
$ ct-vuln-scan
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
To scan a specific project run following command:
|
|
121
|
+
|
|
122
|
+
```sh
|
|
123
|
+
$ ct-vuln-scan mapapps 4.18.2
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
You may need following environment variables for a successful scan:
|
|
127
|
+
|
|
128
|
+
```bash
|
|
129
|
+
# (optional) to fetch sboms from maven repository
|
|
130
|
+
MAVEN_REPO_USER=[username]
|
|
131
|
+
MAVEN_REPO_PW=[password]
|
|
132
|
+
|
|
133
|
+
# (optional) for oss index authenticated api
|
|
134
|
+
OSS_INDEX_API_USER=[username]
|
|
135
|
+
OSS_INDEX_API_TOKEN=[token]
|
|
136
|
+
```
|
|
137
|
+
|
|
138
|
+
For each project following files are created in the `output` folder:
|
|
139
|
+
|
|
140
|
+
- `<project-name>-<project-version>-sbom.cdx.json`
|
|
141
|
+
- Copy of the sbom file.
|
|
142
|
+
- `<project-name>-<project-version>-scan-grype-results.json`
|
|
143
|
+
- Result of the grype scanner in the grype json format.
|
|
144
|
+
- `<project-name>-<project-version>-scan-trivy-results.json`
|
|
145
|
+
- Result of the trivy scanner in the trivy json format.
|
|
146
|
+
- `<project-name>-<project-version>-scan-ossindex-results.json`
|
|
147
|
+
- Result of the sonatype oss index api requests in json format.
|
|
148
|
+
- `<project-name>-<project-version>-scan-aggregated-results.json`
|
|
149
|
+
- Aggregations of the results of all scanners in an own `@conterra/vuln-scan` json format.
|
|
150
|
+
- `<project-name>-<project-version>-scan-aggregated-results.sarif.json`
|
|
151
|
+
- Aggregations of the results of all scanners in an own [sarif json](https://sarifweb.azurewebsites.net/) format.
|
|
152
|
+
- `<project-name>-<project-version>-openvex.vex.json`
|
|
153
|
+
- Aggregation of all vex statements available for the project.
|
|
154
|
+
|
|
155
|
+
If the `createSubDirsForProject` flag is set to `true`, the scanner will create for each project a sub directory in the `output` folder named `<project-name>-<project-version>`.
|
|
156
|
+
|
|
157
|
+
### Azure DevOps Pipelines Integration
|
|
158
|
+
|
|
159
|
+
Attach the output directory as build artifact `CodeAnalysisLogs`.
|
|
160
|
+
|
|
161
|
+
```yaml
|
|
162
|
+
- task: PublishBuildArtifacts@1
|
|
163
|
+
inputs:
|
|
164
|
+
PathtoPublish: "output"
|
|
165
|
+
ArtifactName: "CodeAnalysisLogs"
|
|
166
|
+
```
|
|
167
|
+
|
|
168
|
+
Make sure that your Azure DevOps organization has the extension [SARIF SAST Scans Tab](https://marketplace.visualstudio.com/items?itemName=sariftools.scans) installed.
|
|
169
|
+
This extension visualizes the `.sarif.json` files which are part of the `CodeAnalysisLogs`.
|
|
170
|
+
|
|
171
|
+
If the configuration option `failOnNewVulnerabilities` flag is set to `false`, the pipeline will be set to `SucceededWithIssues` if vulnerabilities are found with no matching vex statement.
|
|
172
|
+
Otherwise the pipeline will be set to `Failed` (because of exit code 1).
|
|
173
|
+
|
|
174
|
+
## Usage - Add Vex
|
|
175
|
+
|
|
176
|
+
This is a currently experimental maintenance workflow, where you want to make a decision if a vulnerability is affecting your project or not or if you currently investigating a vulnerability.
|
|
177
|
+
|
|
178
|
+
To add a new `CVE-<>.json` file in the `vexDir`, run:
|
|
179
|
+
|
|
180
|
+
```sh
|
|
181
|
+
$ ct-vuln-add-vex
|
|
182
|
+
```
|
|
183
|
+
|
|
184
|
+
And follow the instructions.
|
|
185
|
+
|
|
186
|
+
This will create a new `CVE-[id].json` file in the `vexDir` folder.
|
|
187
|
+
|
|
188
|
+
A `CVE-2023-52070.json` file may look like this:
|
|
189
|
+
|
|
190
|
+
```json
|
|
191
|
+
{
|
|
192
|
+
"@context": "https://openvex.dev/ns/v0.2.0",
|
|
193
|
+
"@id": "https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",
|
|
194
|
+
"author": "conterra",
|
|
195
|
+
"timestamp": "2024-10-01T18:54:23.3233227+02:00",
|
|
196
|
+
"last_updated": "2024-10-01T19:58:13.2159221+02:00",
|
|
197
|
+
"version": 2,
|
|
198
|
+
"statements": [
|
|
199
|
+
{
|
|
200
|
+
"vulnerability": {
|
|
201
|
+
"name": "CVE-2023-52070"
|
|
202
|
+
},
|
|
203
|
+
"timestamp": "2024-10-01T19:58:13.2159221+02:00",
|
|
204
|
+
"products": [
|
|
205
|
+
{
|
|
206
|
+
"@id": "pkg:maven/de.conterra.mapapps/ct-mapapps@4.18.2"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"@id": "pkg:maven/de.conterra.mapapps/ct-mapapps@4.18.3"
|
|
210
|
+
}
|
|
211
|
+
],
|
|
212
|
+
"status": "not_affected",
|
|
213
|
+
"impact_statement": "Reported to JFreeChart library. The CVE was created by an LLM and valued by the JFreeChart team as invalid and bogus. See https://github.com/jfree/jfreechart/issues/396 for more information."
|
|
214
|
+
}
|
|
215
|
+
]
|
|
216
|
+
}
|
|
217
|
+
```
|
|
218
|
+
|
|
219
|
+
For more information about the OpenVex specification, please refer to the [OpenVex Spec](https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md).
|
|
220
|
+
|
|
221
|
+
Here some valid values for the `status` field:
|
|
222
|
+
|
|
223
|
+
| Status | Description |
|
|
224
|
+
| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- |
|
|
225
|
+
| not_affected | This product is known to be not affected by this vulnerability. |
|
|
226
|
+
| affected | This product is known to be affected by this vulnerability. |
|
|
227
|
+
| fixed | This product contains a fix for this vulnerability. |
|
|
228
|
+
| under_investigation | It is not known yet whether these versions are or are not affected by the vulnerability. However, it is still under investigation. |
|
|
229
|
+
|
|
230
|
+
Here some valid values for the `justification` field (if status is `not_affected`):
|
|
231
|
+
|
|
232
|
+
[VEX Status Justification PDF](https://www.cisa.gov/sites/default/files/publications/VEX_Status_Justification_Jun22.pdf)
|
|
233
|
+
|
|
234
|
+
| Justification | Description |
|
|
235
|
+
| ------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
236
|
+
| component_not_present | The vulnerable component is not present in the product. |
|
|
237
|
+
| vulnerable_code_not_present | The vulnerable code is not present. Typically this case occurs when source code is configured or built in a way that excludes the vulnerable code. |
|
|
238
|
+
| vulnerable_code_not_in_execute_path | The vulnerable code can not be executed. Typically this case occurs when the product includes the vulnerable code but does not call or use the vulnerable code. |
|
|
239
|
+
| vulnerable_code_cannot_be_controlled_by_adversary | The vulnerable code cannot be controlled by an attacker to exploit the vulnerability. |
|
|
240
|
+
| inline_mitigations_already_exist | The product includes built-in protections or features that prevent exploitation of the vulnerability. These built-in protections cannot be subverted by the attacker and cannot be configured or disabled by the user. These mitigations completely prevent exploitation based on known attack vectors. |
|
package/dist/vuln-scan.js
CHANGED
|
@@ -1,11 +1,11 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
"use strict";var qi=Object.create;var gt=Object.defineProperty;var Vi=Object.getOwnPropertyDescriptor;var Xi=Object.getOwnPropertyNames;var $i=Object.getPrototypeOf,Bi=Object.prototype.hasOwnProperty;var h=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Gi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Xi(e))!Bi.call(t,n)&&n!==r&>(t,n,{get:()=>e[n],enumerable:!(i=Vi(e,n))||i.enumerable});return t};var vt=(t,e,r)=>(r=t!=null?qi($i(t)):{},Gi(e||!t||!t.__esModule?gt(r,"default",{value:t,enumerable:!0}):r,t));var E=h(Qe=>{"use strict";Qe.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};Qe.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Mt=h((
|
|
3
|
-
GFS4: `),console.error(t)});k[C]||(At=global[C]||[],Rt(k,At),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Nt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Oe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Nt()}return Object.defineProperty(e,Oe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){ee(k[C]),require("assert").equal(k[C].length,0)}));var At;global[C]||Rt(global,k[C]);Ze.exports=Ke(mn(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(Ze.exports=Ke(k),k.__patched=!0);function Ke(t){un(t),t.gracefulify=Ke,t.createReadStream=ht,t.createWriteStream=St;var e=t.readFile;t.readFile=r;function r(y,v,g){return typeof v=="function"&&(g=v,v=null),D(y,v,g);function D(j,F,P,O){return e(j,F,function(b){b&&(b.code==="EMFILE"||b.code==="ENFILE")?oe([D,[j,F,P],b,O||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return i(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return o(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,v,g,D){return typeof g=="function"&&(D=g,g=0),j(y,v,g,D);function j(F,P,O,b,T){return c(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var f=t.readdir;t.readdir=m;var a=/^v[0-5]\./;function m(y,v,g){typeof v=="function"&&(g=v,v=null);var D=a.test(process.version)?function(P,O,b,T){return f(P,j(P,O,b,T))}:function(P,O,b,T){return f(P,O,j(P,O,b,T))};return D(y,v,g);function j(F,P,O,b){return function(T,x){T&&(T.code==="EMFILE"||T.code==="ENFILE")?oe([D,[F,P,O],T,b||Date.now(),Date.now()]):(x&&x.sort&&x.sort(),typeof O=="function"&&O.call(this,T,x))}}}if(process.version.substr(0,4)==="v0.8"){var p=fn(t);L=p.ReadStream,A=p.WriteStream}var l=t.ReadStream;l&&(L.prototype=Object.create(l.prototype),L.prototype.open=V);var d=t.WriteStream;d&&(A.prototype=Object.create(d.prototype),A.prototype.open=ue),Object.defineProperty(t,"ReadStream",{get:function(){return L},set:function(y){L=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return A},set:function(y){A=y},enumerable:!0,configurable:!0});var S=L;Object.defineProperty(t,"FileReadStream",{get:function(){return S},set:function(y){S=y},enumerable:!0,configurable:!0});var w=A;Object.defineProperty(t,"FileWriteStream",{get:function(){return w},set:function(y){w=y},enumerable:!0,configurable:!0});function L(y,v){return this instanceof L?(l.apply(this,arguments),this):L.apply(Object.create(L.prototype),arguments)}function V(){var y=this;Ge(y.path,y.flags,y.mode,function(v,g){v?(y.autoClose&&y.destroy(),y.emit("error",v)):(y.fd=g,y.emit("open",g),y.read())})}function A(y,v){return this instanceof A?(d.apply(this,arguments),this):A.apply(Object.create(A.prototype),arguments)}function ue(){var y=this;Ge(y.path,y.flags,y.mode,function(v,g){v?(y.destroy(),y.emit("error",v)):(y.fd=g,y.emit("open",g))})}function ht(y,v){return new t.ReadStream(y,v)}function St(y,v){return new t.WriteStream(y,v)}var _i=t.open;t.open=Ge;function Ge(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return _i(F,P,O,function(x,Es){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}return t}function oe(t){ee("ENQUEUE",t[0].name,t[1]),k[C].push(t),Ye()}var ke;function Nt(){for(var t=Date.now(),e=0;e<k[C].length;++e)k[C][e].length>2&&(k[C][e][3]=t,k[C][e][4]=t);Ye()}function Ye(){if(clearTimeout(ke),ke=void 0,k[C].length!==0){var t=k[C].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)ee("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){ee("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),f=Math.min(u*1.2,100);c>=f?(ee("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[C].push(t)}ke===void 0&&(ke=setTimeout(Ye,0))}}});var R=h(U=>{"use strict";var _t=E().fromCallback,N=se(),dn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof N[t]=="function");Object.assign(U,N);dn.forEach(t=>{U[t]=_t(N[t])});U.exists=function(t,e){return typeof e=="function"?N.exists(t,e):new Promise(r=>N.exists(t,r))};U.read=function(t,e,r,i,n,o){return typeof o=="function"?N.read(t,e,r,i,n,o):new Promise((s,c)=>{N.read(t,e,r,i,n,(u,f,a)=>{if(u)return c(u);s({bytesRead:f,buffer:a})})})};U.write=function(t,e,...r){return typeof r[r.length-1]=="function"?N.write(t,e,...r):new Promise((i,n)=>{N.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};U.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?N.readv(t,e,...r):new Promise((i,n)=>{N.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};U.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?N.writev(t,e,...r):new Promise((i,n)=>{N.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof N.realpath.native=="function"?U.realpath.native=_t(N.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Vt=h((Qs,qt)=>{"use strict";var yn=require("path");qt.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(yn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Gt=h((zs,et)=>{"use strict";var Xt=R(),{checkPath:$t}=Vt(),Bt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};et.exports.makeDir=async(t,e)=>($t(t),Xt.mkdir(t,{mode:Bt(e),recursive:!0}));et.exports.makeDirSync=(t,e)=>($t(t),Xt.mkdirSync(t,{mode:Bt(e),recursive:!0}))});var $=h((Ks,Jt)=>{"use strict";var hn=E().fromPromise,{makeDir:Sn,makeDirSync:tt}=Gt(),rt=hn(Sn);Jt.exports={mkdirs:rt,mkdirsSync:tt,mkdirp:rt,mkdirpSync:tt,ensureDir:rt,ensureDirSync:tt}});var z=h((Ys,Ut)=>{"use strict";var gn=E().fromPromise,Wt=R();function vn(t){return Wt.access(t).then(()=>!0).catch(()=>!1)}Ut.exports={pathExists:gn(vn),pathExistsSync:Wt.existsSync}});var it=h((Zs,Ht)=>{"use strict";var ae=R(),wn=E().fromPromise;async function bn(t,e,r){let i=await ae.open(t,"r+"),n=null;try{await ae.futimes(i,e,r)}finally{try{await ae.close(i)}catch(o){n=o}}if(n)throw n}function xn(t,e,r){let i=ae.openSync(t,"r+");return ae.futimesSync(i,e,r),ae.closeSync(i)}Ht.exports={utimesMillis:wn(bn),utimesMillisSync:xn}});var te=h((ea,Yt)=>{"use strict";var ce=R(),M=require("path"),Qt=E().fromPromise;function Ln(t,e,r){let i=r.dereference?n=>ce.stat(n,{bigint:!0}):n=>ce.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function Pn(t,e,r){let i,n=r.dereference?s=>ce.statSync(s,{bigint:!0}):s=>ce.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function kn(t,e,r,i){let{srcStat:n,destStat:o}=await Ln(t,e,i);if(o){if(fe(n,o)){let s=M.basename(t),c=M.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&nt(t,e))throw new Error(Fe(t,e,r));return{srcStat:n,destStat:o}}function On(t,e,r,i){let{srcStat:n,destStat:o}=Pn(t,e,i);if(o){if(fe(n,o)){let s=M.basename(t),c=M.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&nt(t,e))throw new Error(Fe(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=M.resolve(M.dirname(t)),o=M.resolve(M.dirname(r));if(o===n||o===M.parse(o).root)return;let s;try{s=await ce.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(fe(e,s))throw new Error(Fe(t,r,i));return zt(t,e,o,i)}function Kt(t,e,r,i){let n=M.resolve(M.dirname(t)),o=M.resolve(M.dirname(r));if(o===n||o===M.parse(o).root)return;let s;try{s=ce.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(fe(e,s))throw new Error(Fe(t,r,i));return Kt(t,e,o,i)}function fe(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function nt(t,e){let r=M.resolve(t).split(M.sep).filter(n=>n),i=M.resolve(e).split(M.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function Fe(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}Yt.exports={checkPaths:Qt(kn),checkPathsSync:On,checkParentPaths:Qt(zt),checkParentPathsSync:Kt,isSrcSubdir:nt,areIdentical:fe}});var ir=h((ta,rr)=>{"use strict";var I=R(),me=require("path"),{mkdirs:Fn}=$(),{pathExists:En}=z(),{utimesMillis:Mn}=it(),pe=te();async function Dn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
|
|
2
|
+
"use strict";var qi=Object.create;var gt=Object.defineProperty;var Vi=Object.getOwnPropertyDescriptor;var Xi=Object.getOwnPropertyNames;var $i=Object.getPrototypeOf,Bi=Object.prototype.hasOwnProperty;var h=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var Gi=(t,e,r,i)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of Xi(e))!Bi.call(t,n)&&n!==r&>(t,n,{get:()=>e[n],enumerable:!(i=Vi(e,n))||i.enumerable});return t};var vt=(t,e,r)=>(r=t!=null?qi($i(t)):{},Gi(e||!t||!t.__esModule?gt(r,"default",{value:t,enumerable:!0}):r,t));var E=h(Qe=>{"use strict";Qe.fromCallback=function(t){return Object.defineProperty(function(...e){if(typeof e[e.length-1]=="function")t.apply(this,e);else return new Promise((r,i)=>{e.push((n,o)=>n!=null?i(n):r(o)),t.apply(this,e)})},"name",{value:t.name})};Qe.fromPromise=function(t){return Object.defineProperty(function(...e){let r=e[e.length-1];if(typeof r!="function")return t.apply(this,e);e.pop(),t.apply(this,e).then(i=>r(null,i),r)},"name",{value:t.name})}});var Mt=h((Js,Et)=>{var Q=require("constants"),on=process.cwd,Le=null,sn=process.env.GRACEFUL_FS_PLATFORM||process.platform;process.cwd=function(){return Le||(Le=on.call(process)),Le};try{process.cwd()}catch{}typeof process.chdir=="function"&&(ze=process.chdir,process.chdir=function(t){Le=null,ze.call(process,t)},Object.setPrototypeOf&&Object.setPrototypeOf(process.chdir,ze));var ze;Et.exports=an;function an(t){Q.hasOwnProperty("O_SYMLINK")&&process.version.match(/^v0\.6\.[0-2]|^v0\.5\./)&&e(t),t.lutimes||r(t),t.chown=o(t.chown),t.fchown=o(t.fchown),t.lchown=o(t.lchown),t.chmod=i(t.chmod),t.fchmod=i(t.fchmod),t.lchmod=i(t.lchmod),t.chownSync=s(t.chownSync),t.fchownSync=s(t.fchownSync),t.lchownSync=s(t.lchownSync),t.chmodSync=n(t.chmodSync),t.fchmodSync=n(t.fchmodSync),t.lchmodSync=n(t.lchmodSync),t.stat=c(t.stat),t.fstat=c(t.fstat),t.lstat=c(t.lstat),t.statSync=u(t.statSync),t.fstatSync=u(t.fstatSync),t.lstatSync=u(t.lstatSync),t.chmod&&!t.lchmod&&(t.lchmod=function(a,l,p){p&&process.nextTick(p)},t.lchmodSync=function(){}),t.chown&&!t.lchown&&(t.lchown=function(a,l,p,f){f&&process.nextTick(f)},t.lchownSync=function(){}),sn==="win32"&&(t.rename=typeof t.rename!="function"?t.rename:function(a){function l(p,f,d){var S=Date.now(),w=0;a(p,f,function L(V){if(V&&(V.code==="EACCES"||V.code==="EPERM"||V.code==="EBUSY")&&Date.now()-S<6e4){setTimeout(function(){t.stat(f,function(A,ue){A&&A.code==="ENOENT"?a(p,f,L):d(V)})},w),w<100&&(w+=10);return}d&&d(V)})}return Object.setPrototypeOf&&Object.setPrototypeOf(l,a),l}(t.rename)),t.read=typeof t.read!="function"?t.read:function(a){function l(p,f,d,S,w,L){var V;if(L&&typeof L=="function"){var A=0;V=function(ue,ht,St){if(ue&&ue.code==="EAGAIN"&&A<10)return A++,a.call(t,p,f,d,S,w,V);L.apply(this,arguments)}}return a.call(t,p,f,d,S,w,V)}return Object.setPrototypeOf&&Object.setPrototypeOf(l,a),l}(t.read),t.readSync=typeof t.readSync!="function"?t.readSync:function(a){return function(l,p,f,d,S){for(var w=0;;)try{return a.call(t,l,p,f,d,S)}catch(L){if(L.code==="EAGAIN"&&w<10){w++;continue}throw L}}}(t.readSync);function e(a){a.lchmod=function(l,p,f){a.open(l,Q.O_WRONLY|Q.O_SYMLINK,p,function(d,S){if(d){f&&f(d);return}a.fchmod(S,p,function(w){a.close(S,function(L){f&&f(w||L)})})})},a.lchmodSync=function(l,p){var f=a.openSync(l,Q.O_WRONLY|Q.O_SYMLINK,p),d=!0,S;try{S=a.fchmodSync(f,p),d=!1}finally{if(d)try{a.closeSync(f)}catch{}else a.closeSync(f)}return S}}function r(a){Q.hasOwnProperty("O_SYMLINK")&&a.futimes?(a.lutimes=function(l,p,f,d){a.open(l,Q.O_SYMLINK,function(S,w){if(S){d&&d(S);return}a.futimes(w,p,f,function(L){a.close(w,function(V){d&&d(L||V)})})})},a.lutimesSync=function(l,p,f){var d=a.openSync(l,Q.O_SYMLINK),S,w=!0;try{S=a.futimesSync(d,p,f),w=!1}finally{if(w)try{a.closeSync(d)}catch{}else a.closeSync(d)}return S}):a.futimes&&(a.lutimes=function(l,p,f,d){d&&process.nextTick(d)},a.lutimesSync=function(){})}function i(a){return a&&function(l,p,f){return a.call(t,l,p,function(d){m(d)&&(d=null),f&&f.apply(this,arguments)})}}function n(a){return a&&function(l,p){try{return a.call(t,l,p)}catch(f){if(!m(f))throw f}}}function o(a){return a&&function(l,p,f,d){return a.call(t,l,p,f,function(S){m(S)&&(S=null),d&&d.apply(this,arguments)})}}function s(a){return a&&function(l,p,f){try{return a.call(t,l,p,f)}catch(d){if(!m(d))throw d}}}function c(a){return a&&function(l,p,f){typeof p=="function"&&(f=p,p=null);function d(S,w){w&&(w.uid<0&&(w.uid+=4294967296),w.gid<0&&(w.gid+=4294967296)),f&&f.apply(this,arguments)}return p?a.call(t,l,p,d):a.call(t,l,d)}}function u(a){return a&&function(l,p){var f=p?a.call(t,l,p):a.call(t,l);return f&&(f.uid<0&&(f.uid+=4294967296),f.gid<0&&(f.gid+=4294967296)),f}}function m(a){if(!a||a.code==="ENOSYS")return!0;var l=!process.getuid||process.getuid()!==0;return!!(l&&(a.code==="EINVAL"||a.code==="EPERM"))}}});var Tt=h((Ws,jt)=>{var Dt=require("stream").Stream;jt.exports=cn;function cn(t){return{ReadStream:e,WriteStream:r};function e(i,n){if(!(this instanceof e))return new e(i,n);Dt.call(this);var o=this;this.path=i,this.fd=null,this.readable=!0,this.paused=!1,this.flags="r",this.mode=438,this.bufferSize=64*1024,n=n||{};for(var s=Object.keys(n),c=0,u=s.length;c<u;c++){var m=s[c];this[m]=n[m]}if(this.encoding&&this.setEncoding(this.encoding),this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.end===void 0)this.end=1/0;else if(typeof this.end!="number")throw TypeError("end must be a Number");if(this.start>this.end)throw new Error("start must be <= end");this.pos=this.start}if(this.fd!==null){process.nextTick(function(){o._read()});return}t.open(this.path,this.flags,this.mode,function(a,l){if(a){o.emit("error",a),o.readable=!1;return}o.fd=l,o.emit("open",l),o._read()})}function r(i,n){if(!(this instanceof r))return new r(i,n);Dt.call(this),this.path=i,this.fd=null,this.writable=!0,this.flags="w",this.encoding="binary",this.mode=438,this.bytesWritten=0,n=n||{};for(var o=Object.keys(n),s=0,c=o.length;s<c;s++){var u=o[s];this[u]=n[u]}if(this.start!==void 0){if(typeof this.start!="number")throw TypeError("start must be a Number");if(this.start<0)throw new Error("start must be >= zero");this.pos=this.start}this.busy=!1,this._queue=[],this.fd===null&&(this._open=t.open,this._queue.push([this._open,this.path,this.flags,this.mode,void 0]),this.flush())}}});var It=h((Us,Ct)=>{"use strict";Ct.exports=un;var ln=Object.getPrototypeOf||function(t){return t.__proto__};function un(t){if(t===null||typeof t!="object")return t;if(t instanceof Object)var e={__proto__:ln(t)};else var e=Object.create(null);return Object.getOwnPropertyNames(t).forEach(function(r){Object.defineProperty(e,r,Object.getOwnPropertyDescriptor(t,r))}),e}});var se=h((Hs,Ze)=>{var k=require("fs"),fn=Mt(),mn=Tt(),pn=It(),Pe=require("util"),C,Oe;typeof Symbol=="function"&&typeof Symbol.for=="function"?(C=Symbol.for("graceful-fs.queue"),Oe=Symbol.for("graceful-fs.previous")):(C="___graceful-fs.queue",Oe="___graceful-fs.previous");function dn(){}function Rt(t,e){Object.defineProperty(t,C,{get:function(){return e}})}var ee=dn;Pe.debuglog?ee=Pe.debuglog("gfs4"):/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&(ee=function(){var t=Pe.format.apply(Pe,arguments);t="GFS4: "+t.split(/\n/).join(`
|
|
3
|
+
GFS4: `),console.error(t)});k[C]||(At=global[C]||[],Rt(k,At),k.close=function(t){function e(r,i){return t.call(k,r,function(n){n||Nt(),typeof i=="function"&&i.apply(this,arguments)})}return Object.defineProperty(e,Oe,{value:t}),e}(k.close),k.closeSync=function(t){function e(r){t.apply(k,arguments),Nt()}return Object.defineProperty(e,Oe,{value:t}),e}(k.closeSync),/\bgfs4\b/i.test(process.env.NODE_DEBUG||"")&&process.on("exit",function(){ee(k[C]),require("assert").equal(k[C].length,0)}));var At;global[C]||Rt(global,k[C]);Ze.exports=Ke(pn(k));process.env.TEST_GRACEFUL_FS_GLOBAL_PATCH&&!k.__patched&&(Ze.exports=Ke(k),k.__patched=!0);function Ke(t){fn(t),t.gracefulify=Ke,t.createReadStream=ht,t.createWriteStream=St;var e=t.readFile;t.readFile=r;function r(y,v,g){return typeof v=="function"&&(g=v,v=null),D(y,v,g);function D(j,F,P,O){return e(j,F,function(b){b&&(b.code==="EMFILE"||b.code==="ENFILE")?oe([D,[j,F,P],b,O||Date.now(),Date.now()]):typeof P=="function"&&P.apply(this,arguments)})}}var i=t.writeFile;t.writeFile=n;function n(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return i(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var o=t.appendFile;o&&(t.appendFile=s);function s(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return o(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var c=t.copyFile;c&&(t.copyFile=u);function u(y,v,g,D){return typeof g=="function"&&(D=g,g=0),j(y,v,g,D);function j(F,P,O,b,T){return c(F,P,O,function(x){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}var m=t.readdir;t.readdir=l;var a=/^v[0-5]\./;function l(y,v,g){typeof v=="function"&&(g=v,v=null);var D=a.test(process.version)?function(P,O,b,T){return m(P,j(P,O,b,T))}:function(P,O,b,T){return m(P,O,j(P,O,b,T))};return D(y,v,g);function j(F,P,O,b){return function(T,x){T&&(T.code==="EMFILE"||T.code==="ENFILE")?oe([D,[F,P,O],T,b||Date.now(),Date.now()]):(x&&x.sort&&x.sort(),typeof O=="function"&&O.call(this,T,x))}}}if(process.version.substr(0,4)==="v0.8"){var p=mn(t);L=p.ReadStream,A=p.WriteStream}var f=t.ReadStream;f&&(L.prototype=Object.create(f.prototype),L.prototype.open=V);var d=t.WriteStream;d&&(A.prototype=Object.create(d.prototype),A.prototype.open=ue),Object.defineProperty(t,"ReadStream",{get:function(){return L},set:function(y){L=y},enumerable:!0,configurable:!0}),Object.defineProperty(t,"WriteStream",{get:function(){return A},set:function(y){A=y},enumerable:!0,configurable:!0});var S=L;Object.defineProperty(t,"FileReadStream",{get:function(){return S},set:function(y){S=y},enumerable:!0,configurable:!0});var w=A;Object.defineProperty(t,"FileWriteStream",{get:function(){return w},set:function(y){w=y},enumerable:!0,configurable:!0});function L(y,v){return this instanceof L?(f.apply(this,arguments),this):L.apply(Object.create(L.prototype),arguments)}function V(){var y=this;Ge(y.path,y.flags,y.mode,function(v,g){v?(y.autoClose&&y.destroy(),y.emit("error",v)):(y.fd=g,y.emit("open",g),y.read())})}function A(y,v){return this instanceof A?(d.apply(this,arguments),this):A.apply(Object.create(A.prototype),arguments)}function ue(){var y=this;Ge(y.path,y.flags,y.mode,function(v,g){v?(y.destroy(),y.emit("error",v)):(y.fd=g,y.emit("open",g))})}function ht(y,v){return new t.ReadStream(y,v)}function St(y,v){return new t.WriteStream(y,v)}var _i=t.open;t.open=Ge;function Ge(y,v,g,D){return typeof g=="function"&&(D=g,g=null),j(y,v,g,D);function j(F,P,O,b,T){return _i(F,P,O,function(x,Ms){x&&(x.code==="EMFILE"||x.code==="ENFILE")?oe([j,[F,P,O,b],x,T||Date.now(),Date.now()]):typeof b=="function"&&b.apply(this,arguments)})}}return t}function oe(t){ee("ENQUEUE",t[0].name,t[1]),k[C].push(t),Ye()}var ke;function Nt(){for(var t=Date.now(),e=0;e<k[C].length;++e)k[C][e].length>2&&(k[C][e][3]=t,k[C][e][4]=t);Ye()}function Ye(){if(clearTimeout(ke),ke=void 0,k[C].length!==0){var t=k[C].shift(),e=t[0],r=t[1],i=t[2],n=t[3],o=t[4];if(n===void 0)ee("RETRY",e.name,r),e.apply(null,r);else if(Date.now()-n>=6e4){ee("TIMEOUT",e.name,r);var s=r.pop();typeof s=="function"&&s.call(null,i)}else{var c=Date.now()-o,u=Math.max(o-n,1),m=Math.min(u*1.2,100);c>=m?(ee("RETRY",e.name,r),e.apply(null,r.concat([n]))):k[C].push(t)}ke===void 0&&(ke=setTimeout(Ye,0))}}});var R=h(U=>{"use strict";var _t=E().fromCallback,N=se(),yn=["access","appendFile","chmod","chown","close","copyFile","fchmod","fchown","fdatasync","fstat","fsync","ftruncate","futimes","lchmod","lchown","link","lstat","mkdir","mkdtemp","open","opendir","readdir","readFile","readlink","realpath","rename","rm","rmdir","stat","symlink","truncate","unlink","utimes","writeFile"].filter(t=>typeof N[t]=="function");Object.assign(U,N);yn.forEach(t=>{U[t]=_t(N[t])});U.exists=function(t,e){return typeof e=="function"?N.exists(t,e):new Promise(r=>N.exists(t,r))};U.read=function(t,e,r,i,n,o){return typeof o=="function"?N.read(t,e,r,i,n,o):new Promise((s,c)=>{N.read(t,e,r,i,n,(u,m,a)=>{if(u)return c(u);s({bytesRead:m,buffer:a})})})};U.write=function(t,e,...r){return typeof r[r.length-1]=="function"?N.write(t,e,...r):new Promise((i,n)=>{N.write(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffer:c})})})};U.readv=function(t,e,...r){return typeof r[r.length-1]=="function"?N.readv(t,e,...r):new Promise((i,n)=>{N.readv(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesRead:s,buffers:c})})})};U.writev=function(t,e,...r){return typeof r[r.length-1]=="function"?N.writev(t,e,...r):new Promise((i,n)=>{N.writev(t,e,...r,(o,s,c)=>{if(o)return n(o);i({bytesWritten:s,buffers:c})})})};typeof N.realpath.native=="function"?U.realpath.native=_t(N.realpath.native):process.emitWarning("fs.realpath.native is not a function. Is fs being monkey-patched?","Warning","fs-extra-WARN0003")});var Vt=h((zs,qt)=>{"use strict";var hn=require("path");qt.exports.checkPath=function(e){if(process.platform==="win32"&&/[<>:"|?*]/.test(e.replace(hn.parse(e).root,""))){let i=new Error(`Path contains invalid characters: ${e}`);throw i.code="EINVAL",i}}});var Gt=h((Ks,et)=>{"use strict";var Xt=R(),{checkPath:$t}=Vt(),Bt=t=>{let e={mode:511};return typeof t=="number"?t:{...e,...t}.mode};et.exports.makeDir=async(t,e)=>($t(t),Xt.mkdir(t,{mode:Bt(e),recursive:!0}));et.exports.makeDirSync=(t,e)=>($t(t),Xt.mkdirSync(t,{mode:Bt(e),recursive:!0}))});var $=h((Ys,Jt)=>{"use strict";var Sn=E().fromPromise,{makeDir:gn,makeDirSync:tt}=Gt(),rt=Sn(gn);Jt.exports={mkdirs:rt,mkdirsSync:tt,mkdirp:rt,mkdirpSync:tt,ensureDir:rt,ensureDirSync:tt}});var z=h((Zs,Ut)=>{"use strict";var vn=E().fromPromise,Wt=R();function wn(t){return Wt.access(t).then(()=>!0).catch(()=>!1)}Ut.exports={pathExists:vn(wn),pathExistsSync:Wt.existsSync}});var it=h((ea,Ht)=>{"use strict";var ae=R(),bn=E().fromPromise;async function xn(t,e,r){let i=await ae.open(t,"r+"),n=null;try{await ae.futimes(i,e,r)}finally{try{await ae.close(i)}catch(o){n=o}}if(n)throw n}function Ln(t,e,r){let i=ae.openSync(t,"r+");return ae.futimesSync(i,e,r),ae.closeSync(i)}Ht.exports={utimesMillis:bn(xn),utimesMillisSync:Ln}});var te=h((ta,Yt)=>{"use strict";var ce=R(),M=require("path"),Qt=E().fromPromise;function Pn(t,e,r){let i=r.dereference?n=>ce.stat(n,{bigint:!0}):n=>ce.lstat(n,{bigint:!0});return Promise.all([i(t),i(e).catch(n=>{if(n.code==="ENOENT")return null;throw n})]).then(([n,o])=>({srcStat:n,destStat:o}))}function kn(t,e,r){let i,n=r.dereference?s=>ce.statSync(s,{bigint:!0}):s=>ce.lstatSync(s,{bigint:!0}),o=n(t);try{i=n(e)}catch(s){if(s.code==="ENOENT")return{srcStat:o,destStat:null};throw s}return{srcStat:o,destStat:i}}async function On(t,e,r,i){let{srcStat:n,destStat:o}=await Pn(t,e,i);if(o){if(fe(n,o)){let s=M.basename(t),c=M.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&nt(t,e))throw new Error(Fe(t,e,r));return{srcStat:n,destStat:o}}function Fn(t,e,r,i){let{srcStat:n,destStat:o}=kn(t,e,i);if(o){if(fe(n,o)){let s=M.basename(t),c=M.basename(e);if(r==="move"&&s!==c&&s.toLowerCase()===c.toLowerCase())return{srcStat:n,destStat:o,isChangingCase:!0};throw new Error("Source and destination must not be the same.")}if(n.isDirectory()&&!o.isDirectory())throw new Error(`Cannot overwrite non-directory '${e}' with directory '${t}'.`);if(!n.isDirectory()&&o.isDirectory())throw new Error(`Cannot overwrite directory '${e}' with non-directory '${t}'.`)}if(n.isDirectory()&&nt(t,e))throw new Error(Fe(t,e,r));return{srcStat:n,destStat:o}}async function zt(t,e,r,i){let n=M.resolve(M.dirname(t)),o=M.resolve(M.dirname(r));if(o===n||o===M.parse(o).root)return;let s;try{s=await ce.stat(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(fe(e,s))throw new Error(Fe(t,r,i));return zt(t,e,o,i)}function Kt(t,e,r,i){let n=M.resolve(M.dirname(t)),o=M.resolve(M.dirname(r));if(o===n||o===M.parse(o).root)return;let s;try{s=ce.statSync(o,{bigint:!0})}catch(c){if(c.code==="ENOENT")return;throw c}if(fe(e,s))throw new Error(Fe(t,r,i));return Kt(t,e,o,i)}function fe(t,e){return e.ino&&e.dev&&e.ino===t.ino&&e.dev===t.dev}function nt(t,e){let r=M.resolve(t).split(M.sep).filter(n=>n),i=M.resolve(e).split(M.sep).filter(n=>n);return r.every((n,o)=>i[o]===n)}function Fe(t,e,r){return`Cannot ${r} '${t}' to a subdirectory of itself, '${e}'.`}Yt.exports={checkPaths:Qt(On),checkPathsSync:Fn,checkParentPaths:Qt(zt),checkParentPathsSync:Kt,isSrcSubdir:nt,areIdentical:fe}});var ir=h((ra,rr)=>{"use strict";var I=R(),me=require("path"),{mkdirs:En}=$(),{pathExists:Mn}=z(),{utimesMillis:Dn}=it(),pe=te();async function jn(t,e,r={}){typeof r=="function"&&(r={filter:r}),r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
|
|
4
4
|
|
|
5
|
-
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await pe.checkPaths(t,e,"copy",r);if(await pe.checkParentPaths(t,i,e,"copy"),!await er(t,e,r))return;let s=me.dirname(e);await
|
|
5
|
+
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0001");let{srcStat:i,destStat:n}=await pe.checkPaths(t,e,"copy",r);if(await pe.checkParentPaths(t,i,e,"copy"),!await er(t,e,r))return;let s=me.dirname(e);await Mn(s)||await En(s),await tr(n,t,e,r)}async function er(t,e,r){return r.filter?r.filter(t,e):!0}async function tr(t,e,r,i){let o=await(i.dereference?I.stat:I.lstat)(e);if(o.isDirectory())return An(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Tn(o,t,e,r,i);if(o.isSymbolicLink())return Nn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}async function Tn(t,e,r,i,n){if(!e)return Zt(t,r,i,n);if(n.overwrite)return await I.unlink(i),Zt(t,r,i,n);if(n.errorOnExist)throw new Error(`'${i}' already exists`)}async function Zt(t,e,r,i){if(await I.copyFile(e,r),i.preserveTimestamps){Cn(t.mode)&&await In(r,t.mode);let n=await I.stat(e);await Dn(r,n.atime,n.mtime)}return I.chmod(r,t.mode)}function Cn(t){return(t&128)===0}function In(t,e){return I.chmod(t,e|128)}async function An(t,e,r,i,n){e||await I.mkdir(i);let o=await I.readdir(r);await Promise.all(o.map(async s=>{let c=me.join(r,s),u=me.join(i,s);if(!await er(c,u,n))return;let{destStat:a}=await pe.checkPaths(c,u,"copy",n);return tr(a,c,u,n)})),e||await I.chmod(i,t.mode)}async function Nn(t,e,r,i){let n=await I.readlink(e);if(i.dereference&&(n=me.resolve(process.cwd(),n)),!t)return I.symlink(n,r);let o=null;try{o=await I.readlink(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return I.symlink(n,r);throw s}if(i.dereference&&(o=me.resolve(process.cwd(),o)),pe.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(pe.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return await I.unlink(r),I.symlink(n,r)}rr.exports=jn});var cr=h((ia,ar)=>{"use strict";var _=se(),de=require("path"),Rn=$().mkdirsSync,_n=it().utimesMillisSync,ye=te();function qn(t,e,r){typeof r=="function"&&(r={filter:r}),r=r||{},r.clobber="clobber"in r?!!r.clobber:!0,r.overwrite="overwrite"in r?!!r.overwrite:r.clobber,r.preserveTimestamps&&process.arch==="ia32"&&process.emitWarning(`Using the preserveTimestamps option in 32-bit node is not recommended;
|
|
6
6
|
|
|
7
|
-
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ye.checkPathsSync(t,e,"copy",r);if(ye.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=de.dirname(e);return _.existsSync(o)||
|
|
8
|
-
`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function Fo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Wr.exports={stringify:Oo,stripBom:Fo}});var zr=h((pa,Qr)=>{var le;try{le=se()}catch{le=require("fs")}var De=E(),{stringify:Ur,stripBom:Hr}=Me();async function Eo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||le,i="throws"in e?e.throws:!0,n=await De.fromCallback(r.readFile)(t,e);n=Hr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Mo=De.fromPromise(Eo);function Do(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||le,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Hr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function jo(t,e,r={}){let i=r.fs||le,n=Ur(e,r);await De.fromCallback(i.writeFile)(t,n,r)}var To=De.fromPromise(jo);function Co(t,e,r={}){let i=r.fs||le,n=Ur(e,r);return i.writeFileSync(t,n,r)}var Io={readFile:Mo,readFileSync:Do,writeFile:To,writeFileSync:Co};Qr.exports=Io});var Yr=h((da,Kr)=>{"use strict";var je=zr();Kr.exports={readJson:je.readFile,readJsonSync:je.readFileSync,writeJson:je.writeFile,writeJsonSync:je.writeFileSync}});var Te=h((ya,ti)=>{"use strict";var Ao=E().fromPromise,st=R(),Zr=require("path"),ei=$(),No=z().pathExists;async function Ro(t,e,r="utf-8"){let i=Zr.dirname(t);return await No(i)||await ei.mkdirs(i),st.writeFile(t,e,r)}function _o(t,...e){let r=Zr.dirname(t);st.existsSync(r)||ei.mkdirsSync(r),st.writeFileSync(t,...e)}ti.exports={outputFile:Ao(Ro),outputFileSync:_o}});var ii=h((ha,ri)=>{"use strict";var{stringify:qo}=Me(),{outputFile:Vo}=Te();async function Xo(t,e,r={}){let i=qo(e,r);await Vo(t,i,r)}ri.exports=Xo});var oi=h((Sa,ni)=>{"use strict";var{stringify:$o}=Me(),{outputFileSync:Bo}=Te();function Go(t,e,r){let i=$o(e,r);Bo(t,i,r)}ni.exports=Go});var ai=h((ga,si)=>{"use strict";var Jo=E().fromPromise,q=Yr();q.outputJson=Jo(ii());q.outputJsonSync=oi();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;si.exports=q});var mi=h((va,fi)=>{"use strict";var Wo=R(),ci=require("path"),{copy:Uo}=Ee(),{remove:ui}=he(),{mkdirp:Ho}=$(),{pathExists:Qo}=z(),li=te();async function zo(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await li.checkPaths(t,e,"move",r);await li.checkParentPaths(t,n,e,"move");let s=ci.dirname(e);return ci.parse(s).root!==s&&await Ho(s),Ko(t,e,i,o)}async function Ko(t,e,r,i){if(!i){if(r)await ui(e);else if(await Qo(e))throw new Error("dest already exists.")}try{await Wo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Yo(t,e,r)}}async function Yo(t,e,r){return await Uo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),ui(t)}fi.exports=zo});var Si=h((wa,hi)=>{"use strict";var di=se(),ct=require("path"),Zo=Ee().copySync,yi=he().removeSync,es=$().mkdirpSync,pi=te();function ts(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=pi.checkPathsSync(t,e,"move",r);return pi.checkParentPathsSync(t,n,e,"move"),rs(e)||es(ct.dirname(e)),is(t,e,i,o)}function rs(t){let e=ct.dirname(t);return ct.parse(e).root===e}function is(t,e,r,i){if(i)return at(t,e,r);if(r)return yi(e),at(t,e,r);if(di.existsSync(e))throw new Error("dest already exists.");return at(t,e,r)}function at(t,e,r){try{di.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return ns(t,e,r)}}function ns(t,e,r){return Zo(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),yi(t)}hi.exports=ts});var vi=h((ba,gi)=>{"use strict";var os=E().fromPromise;gi.exports={move:os(mi()),moveSync:Si()}});var bi=h((xa,wi)=>{"use strict";wi.exports={...R(),...Ee(),...vr(),...Jr(),...ai(),...$(),...vi(),...Te(),...z(),...he()}});var xi=h(Ce=>{"use strict";Object.defineProperty(Ce,"__esModule",{value:!0});Ce.EXTENSIONS_LANGUAGES=void 0;Ce.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var ge=h(lt=>{"use strict";Object.defineProperty(lt,"__esModule",{value:!0});lt.setOptionValues=ss;function ss(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Pi=h(Ie=>{"use strict";Object.defineProperty(Ie,"__esModule",{value:!0});Ie.SarifBuilder=void 0;var as=require("path"),Li=bi(),cs=xi(),ls=ge(),ut=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,ls.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Li.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Li.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let f of u.locations||[])if(!((i=(r=f?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var m;return((m=a?.location)===null||m===void 0?void 0:m.uri)===f.physicalLocation.artifactLocation.uri}).length===0){let a=as.extname(f.physicalLocation.artifactLocation.uri).replace(".",""),m=cs.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:m,location:{uri:f.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var f;return(f=u?.location)===null||f===void 0?void 0:f.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(f=>{var a,m;let p=(m=(a=f?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||m===void 0?void 0:m.uri;return p&&s.indexOf(p)>-1&&(f.physicalLocation.artifactLocation.index=s.indexOf(p)),f})),u)),e}};Ie.SarifBuilder=ut});var ki=h(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.SarifResultBuilder=void 0;var us=ge(),ft=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,us.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ae.SarifResultBuilder=ft});var Oi=h(Ne=>{"use strict";Object.defineProperty(Ne,"__esModule",{value:!0});Ne.SarifRuleBuilder=void 0;var fs=ge(),mt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,fs.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Ne.SarifRuleBuilder=mt});var Fi=h(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifRunBuilder=void 0;var ms=ge(),pt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ms.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};Re.SarifRunBuilder=pt});var Ei=h(J=>{"use strict";Object.defineProperty(J,"__esModule",{value:!0});J.SarifResultBuilder=J.SarifRuleBuilder=J.SarifRunBuilder=J.SarifBuilder=void 0;var ps=Pi();Object.defineProperty(J,"SarifBuilder",{enumerable:!0,get:function(){return ps.SarifBuilder}});var ds=ki();Object.defineProperty(J,"SarifResultBuilder",{enumerable:!0,get:function(){return ds.SarifResultBuilder}});var ys=Oi();Object.defineProperty(J,"SarifRuleBuilder",{enumerable:!0,get:function(){return ys.SarifRuleBuilder}});var hs=Fi();Object.defineProperty(J,"SarifRunBuilder",{enumerable:!0,get:function(){return hs.SarifRunBuilder}})});var Di=h((Da,Mi)=>{"use strict";var Ss=/["'&<>]/;Mi.exports=gs;function gs(t){var e=""+t,r=Ss.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i=""";break;case 38:i="&";break;case 39:i="'";break;case 60:i="<";break;case 62:i=">";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Be=require("zx"),re=require("fs/promises");var Je={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var we=class{allById=new Map;getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=wt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=Ji(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=We(o.detectedBy,r),o.components=We(o.components,e.components[0]),o.refs=We(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push(i.id);continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function Ji(t,e){return wt(t,e)>0?t:e}function wt(t,e){return Je[t]-Je[e]}function We(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ne=require("path");var X=require("fs/promises"),Ue=require("path");async function B(t){if(await ie(t))return JSON.parse(await(0,X.readFile)(t,{encoding:"utf-8"}))}function W(t){return t&&t.replace(/\?.*$/,"")}async function ie(t){try{return await(0,X.access)(t,X.constants.F_OK),!0}catch{return!1}}async function He(t){let e=(0,Ue.resolve)(t),r=await(0,X.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ue.resolve)(i.parentPath,i.name);i.isDirectory()?await He(n):await(0,X.rm)(n)}await(0,X.rmdir)(e)}async function bt(){let t="https://repository.conterra.de/repository/maven-mirror-ct",e="./input/vex",r="./output",i="./.cache",n=["grype","trivy","ossindex"],o=(0,ne.resolve)("./vuln-scan-conf.json"),s=await B(o);if(!s)throw new Error(`Missing project configuration file '${o}'`);return{failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??t,vexDir:(0,ne.resolve)(s.vexDir??e),outDir:(0,ne.resolve)(s.outDir??r),cacheDir:(0,ne.resolve)(s.cacheDir??i),scanners:s.scanners??n,projects:(s.projects??[]).map(c=>{let u=c;return u.sbomFile?{...u,sbomFile:(0,ne.resolve)(u.sbomFile)}:c})}}var xt=require("zx");var be=require("path");async function Lt(t,e,r,i){console.log(" with Grype ...");let n=(0,be.dirname)(e),o=(0,be.basename)(e),s=await xt.$`docker run --rm -v '${t}:/.cache' -v '${n}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' anchore/grype:latest sbom:/tmp/input.json -o json --file '/tmp/output/${o}' --by-cve --quiet`;s.stdout&&console.log(` Scan log: ${s.stdout}`),s.stderr&&console.log(` Scan error: ${s.stderr}`),console.log(` Grype output file: ${e}`);let c=await B(e);Wi(i,c)}function Wi(t,e){if(e)for(let r of e.matches){let i=Ui(r);t.addVulnerability(i,"grype")}}function Ui(t){let e=t.vulnerability,r=e.id,i=W(t.artifact.purl),n=W(e.dataSource),o=Hi(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function Hi(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var Pt=require("zx");var xe=require("path");async function kt(t,e,r,i){console.log(" with Trivy ...");let n=(0,xe.dirname)(e),o=(0,xe.basename)(e),s=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${n}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' aquasec/trivy:latest sbom /tmp/input.json --cache-dir '/.cache' --format json --output /tmp/output/${o} --quiet`;s.stdout&&console.log(` Scan log: ${s.stdout}`),s.stderr&&console.log(` Scan error: ${s.stderr}`),console.log(` Trivy output file: ${e}`);let c=await B(e);Qi(i,c)}function Qi(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=zi(i);t.addVulnerability(n,"trivy")}}}function zi(t){let e=t.VulnerabilityID,r=W(t.PkgIdentifier.PURL),i=W(t.PrimaryURL),n=Ki(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Ki(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Ot=require("fs/promises");async function Ft(t,e,r,i){console.log(" with Sonatype OSS Index ...");let n={},o="";r.user&&r.token&&(n.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,o="/authorized");let s=`https://ossindex.sonatype.org/api/v3${o}/component-report`,u=(await Yi(e.sbomFile)).map(a=>a.purl.replace(/\?.*$/,"")),f=[];for(let a=0;a<u.length;a+=128){let m=JSON.stringify({coordinates:u.slice(a,a+128)}),l=await(await fetch(s,{method:"POST",headers:{...n,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:m})).json();Array.isArray(l)?f.push(...l.filter(d=>d.vulnerabilities.length>0)):console.log(` Sonatype OssIndex Error: ${l.code} - ${l.message}`)}await(0,Ot.writeFile)(t,JSON.stringify(f,null,2)),console.log(` Sonatype OssIndex output file: ${t}`),en(i,f)}async function Yi(t){return(await B(t)).components.filter(r=>!Zi(r))}function Zi(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function en(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=tn(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function tn(t,e){let r=t.cve||t.id,i=W(e),n=W(t.reference),o=rn(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function rn(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}var Z=vt(Ei()),ji=vt(Di());function Ti(t,e){let r=new Z.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=ws(o.severity),c=o.id,u=vs(o.refs),f=new Z.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,m,p="new",l="";a&&(s="none",p="updated",l=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(l="--- UNDER INVESTIGATION --- ")),Object.assign(f.rule,{name:`${l}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:bs(o,u,l)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(f);for(let d of o.components){let S=new Z.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});S.result.message.id="default",S.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],S.result.baselineState=p,S.result.suppressions=m,r.addResult(S)}}let n=new Z.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function vs(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function ws(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function bs(t,e,r){let i=t.vexStatement,n=i?`
|
|
7
|
+
see https://github.com/jprichardson/node-fs-extra/issues/269`,"Warning","fs-extra-WARN0002");let{srcStat:i,destStat:n}=ye.checkPathsSync(t,e,"copy",r);if(ye.checkParentPathsSync(t,i,e,"copy"),r.filter&&!r.filter(t,e))return;let o=de.dirname(e);return _.existsSync(o)||Rn(o),nr(n,t,e,r)}function nr(t,e,r,i){let o=(i.dereference?_.statSync:_.lstatSync)(e);if(o.isDirectory())return Wn(o,t,e,r,i);if(o.isFile()||o.isCharacterDevice()||o.isBlockDevice())return Vn(o,t,e,r,i);if(o.isSymbolicLink())return Qn(t,e,r,i);throw o.isSocket()?new Error(`Cannot copy a socket file: ${e}`):o.isFIFO()?new Error(`Cannot copy a FIFO pipe: ${e}`):new Error(`Unknown file: ${e}`)}function Vn(t,e,r,i,n){return e?Xn(t,r,i,n):or(t,r,i,n)}function Xn(t,e,r,i){if(i.overwrite)return _.unlinkSync(r),or(t,e,r,i);if(i.errorOnExist)throw new Error(`'${r}' already exists`)}function or(t,e,r,i){return _.copyFileSync(e,r),i.preserveTimestamps&&$n(t.mode,e,r),ot(r,t.mode)}function $n(t,e,r){return Bn(t)&&Gn(r,t),Jn(e,r)}function Bn(t){return(t&128)===0}function Gn(t,e){return ot(t,e|128)}function ot(t,e){return _.chmodSync(t,e)}function Jn(t,e){let r=_.statSync(t);return _n(e,r.atime,r.mtime)}function Wn(t,e,r,i,n){return e?sr(r,i,n):Un(t.mode,r,i,n)}function Un(t,e,r,i){return _.mkdirSync(r),sr(e,r,i),ot(r,t)}function sr(t,e,r){_.readdirSync(t).forEach(i=>Hn(i,t,e,r))}function Hn(t,e,r,i){let n=de.join(e,t),o=de.join(r,t);if(i.filter&&!i.filter(n,o))return;let{destStat:s}=ye.checkPathsSync(n,o,"copy",i);return nr(s,n,o,i)}function Qn(t,e,r,i){let n=_.readlinkSync(e);if(i.dereference&&(n=de.resolve(process.cwd(),n)),t){let o;try{o=_.readlinkSync(r)}catch(s){if(s.code==="EINVAL"||s.code==="UNKNOWN")return _.symlinkSync(n,r);throw s}if(i.dereference&&(o=de.resolve(process.cwd(),o)),ye.isSrcSubdir(n,o))throw new Error(`Cannot copy '${n}' to a subdirectory of itself, '${o}'.`);if(ye.isSrcSubdir(o,n))throw new Error(`Cannot overwrite '${o}' with '${n}'.`);return zn(n,r)}else return _.symlinkSync(n,r)}function zn(t,e){return _.unlinkSync(e),_.symlinkSync(t,e)}ar.exports=qn});var Ee=h((na,lr)=>{"use strict";var Kn=E().fromPromise;lr.exports={copy:Kn(ir()),copySync:cr()}});var he=h((oa,fr)=>{"use strict";var ur=se(),Yn=E().fromCallback;function Zn(t,e){ur.rm(t,{recursive:!0,force:!0},e)}function eo(t){ur.rmSync(t,{recursive:!0,force:!0})}fr.exports={remove:Yn(Zn),removeSync:eo}});var vr=h((sa,gr)=>{"use strict";var to=E().fromPromise,dr=R(),yr=require("path"),hr=$(),Sr=he(),mr=to(async function(e){let r;try{r=await dr.readdir(e)}catch{return hr.mkdirs(e)}return Promise.all(r.map(i=>Sr.remove(yr.join(e,i))))});function pr(t){let e;try{e=dr.readdirSync(t)}catch{return hr.mkdirsSync(t)}e.forEach(r=>{r=yr.join(t,r),Sr.removeSync(r)})}gr.exports={emptyDirSync:pr,emptydirSync:pr,emptyDir:mr,emptydir:mr}});var Lr=h((aa,xr)=>{"use strict";var ro=E().fromPromise,wr=require("path"),H=R(),br=$();async function io(t){let e;try{e=await H.stat(t)}catch{}if(e&&e.isFile())return;let r=wr.dirname(t),i=null;try{i=await H.stat(r)}catch(n){if(n.code==="ENOENT"){await br.mkdirs(r),await H.writeFile(t,"");return}else throw n}i.isDirectory()?await H.writeFile(t,""):await H.readdir(r)}function no(t){let e;try{e=H.statSync(t)}catch{}if(e&&e.isFile())return;let r=wr.dirname(t);try{H.statSync(r).isDirectory()||H.readdirSync(r)}catch(i){if(i&&i.code==="ENOENT")br.mkdirsSync(r);else throw i}H.writeFileSync(t,"")}xr.exports={createFile:ro(io),createFileSync:no}});var Er=h((ca,Fr)=>{"use strict";var oo=E().fromPromise,Pr=require("path"),K=R(),kr=$(),{pathExists:so}=z(),{areIdentical:Or}=te();async function ao(t,e){let r;try{r=await K.lstat(e)}catch{}let i;try{i=await K.lstat(t)}catch(s){throw s.message=s.message.replace("lstat","ensureLink"),s}if(r&&Or(i,r))return;let n=Pr.dirname(e);await so(n)||await kr.mkdirs(n),await K.link(t,e)}function co(t,e){let r;try{r=K.lstatSync(e)}catch{}try{let o=K.lstatSync(t);if(r&&Or(o,r))return}catch(o){throw o.message=o.message.replace("lstat","ensureLink"),o}let i=Pr.dirname(e);return K.existsSync(i)||kr.mkdirsSync(i),K.linkSync(t,e)}Fr.exports={createLink:oo(ao),createLinkSync:co}});var Dr=h((la,Mr)=>{"use strict";var Y=require("path"),Se=R(),{pathExists:lo}=z(),uo=E().fromPromise;async function fo(t,e){if(Y.isAbsolute(t)){try{await Se.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:t}}let r=Y.dirname(e),i=Y.join(r,t);if(await lo(i))return{toCwd:i,toDst:t};try{await Se.lstat(t)}catch(o){throw o.message=o.message.replace("lstat","ensureSymlink"),o}return{toCwd:t,toDst:Y.relative(r,t)}}function mo(t,e){if(Y.isAbsolute(t)){if(!Se.existsSync(t))throw new Error("absolute srcpath does not exist");return{toCwd:t,toDst:t}}let r=Y.dirname(e),i=Y.join(r,t);if(Se.existsSync(i))return{toCwd:i,toDst:t};if(!Se.existsSync(t))throw new Error("relative srcpath does not exist");return{toCwd:t,toDst:Y.relative(r,t)}}Mr.exports={symlinkPaths:uo(fo),symlinkPathsSync:mo}});var Cr=h((ua,Tr)=>{"use strict";var jr=R(),po=E().fromPromise;async function yo(t,e){if(e)return e;let r;try{r=await jr.lstat(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}function ho(t,e){if(e)return e;let r;try{r=jr.lstatSync(t)}catch{return"file"}return r&&r.isDirectory()?"dir":"file"}Tr.exports={symlinkType:po(yo),symlinkTypeSync:ho}});var Rr=h((fa,Nr)=>{"use strict";var So=E().fromPromise,Ir=require("path"),G=R(),{mkdirs:go,mkdirsSync:vo}=$(),{symlinkPaths:wo,symlinkPathsSync:bo}=Dr(),{symlinkType:xo,symlinkTypeSync:Lo}=Cr(),{pathExists:Po}=z(),{areIdentical:Ar}=te();async function ko(t,e,r){let i;try{i=await G.lstat(e)}catch{}if(i&&i.isSymbolicLink()){let[c,u]=await Promise.all([G.stat(t),G.stat(e)]);if(Ar(c,u))return}let n=await wo(t,e);t=n.toDst;let o=await xo(n.toCwd,r),s=Ir.dirname(e);return await Po(s)||await go(s),G.symlink(t,e,o)}function Oo(t,e,r){let i;try{i=G.lstatSync(e)}catch{}if(i&&i.isSymbolicLink()){let c=G.statSync(t),u=G.statSync(e);if(Ar(c,u))return}let n=bo(t,e);t=n.toDst,r=Lo(n.toCwd,r);let o=Ir.dirname(e);return G.existsSync(o)||vo(o),G.symlinkSync(t,e,r)}Nr.exports={createSymlink:So(ko),createSymlinkSync:Oo}});var Jr=h((ma,Gr)=>{"use strict";var{createFile:_r,createFileSync:qr}=Lr(),{createLink:Vr,createLinkSync:Xr}=Er(),{createSymlink:$r,createSymlinkSync:Br}=Rr();Gr.exports={createFile:_r,createFileSync:qr,ensureFile:_r,ensureFileSync:qr,createLink:Vr,createLinkSync:Xr,ensureLink:Vr,ensureLinkSync:Xr,createSymlink:$r,createSymlinkSync:Br,ensureSymlink:$r,ensureSymlinkSync:Br}});var Me=h((pa,Wr)=>{function Fo(t,{EOL:e=`
|
|
8
|
+
`,finalEOL:r=!0,replacer:i=null,spaces:n}={}){let o=r?e:"";return JSON.stringify(t,i,n).replace(/\n/g,e)+o}function Eo(t){return Buffer.isBuffer(t)&&(t=t.toString("utf8")),t.replace(/^\uFEFF/,"")}Wr.exports={stringify:Fo,stripBom:Eo}});var zr=h((da,Qr)=>{var le;try{le=se()}catch{le=require("fs")}var De=E(),{stringify:Ur,stripBom:Hr}=Me();async function Mo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||le,i="throws"in e?e.throws:!0,n=await De.fromCallback(r.readFile)(t,e);n=Hr(n);let o;try{o=JSON.parse(n,e?e.reviver:null)}catch(s){if(i)throw s.message=`${t}: ${s.message}`,s;return null}return o}var Do=De.fromPromise(Mo);function jo(t,e={}){typeof e=="string"&&(e={encoding:e});let r=e.fs||le,i="throws"in e?e.throws:!0;try{let n=r.readFileSync(t,e);return n=Hr(n),JSON.parse(n,e.reviver)}catch(n){if(i)throw n.message=`${t}: ${n.message}`,n;return null}}async function To(t,e,r={}){let i=r.fs||le,n=Ur(e,r);await De.fromCallback(i.writeFile)(t,n,r)}var Co=De.fromPromise(To);function Io(t,e,r={}){let i=r.fs||le,n=Ur(e,r);return i.writeFileSync(t,n,r)}var Ao={readFile:Do,readFileSync:jo,writeFile:Co,writeFileSync:Io};Qr.exports=Ao});var Yr=h((ya,Kr)=>{"use strict";var je=zr();Kr.exports={readJson:je.readFile,readJsonSync:je.readFileSync,writeJson:je.writeFile,writeJsonSync:je.writeFileSync}});var Te=h((ha,ti)=>{"use strict";var No=E().fromPromise,st=R(),Zr=require("path"),ei=$(),Ro=z().pathExists;async function _o(t,e,r="utf-8"){let i=Zr.dirname(t);return await Ro(i)||await ei.mkdirs(i),st.writeFile(t,e,r)}function qo(t,...e){let r=Zr.dirname(t);st.existsSync(r)||ei.mkdirsSync(r),st.writeFileSync(t,...e)}ti.exports={outputFile:No(_o),outputFileSync:qo}});var ii=h((Sa,ri)=>{"use strict";var{stringify:Vo}=Me(),{outputFile:Xo}=Te();async function $o(t,e,r={}){let i=Vo(e,r);await Xo(t,i,r)}ri.exports=$o});var oi=h((ga,ni)=>{"use strict";var{stringify:Bo}=Me(),{outputFileSync:Go}=Te();function Jo(t,e,r){let i=Bo(e,r);Go(t,i,r)}ni.exports=Jo});var ai=h((va,si)=>{"use strict";var Wo=E().fromPromise,q=Yr();q.outputJson=Wo(ii());q.outputJsonSync=oi();q.outputJSON=q.outputJson;q.outputJSONSync=q.outputJsonSync;q.writeJSON=q.writeJson;q.writeJSONSync=q.writeJsonSync;q.readJSON=q.readJson;q.readJSONSync=q.readJsonSync;si.exports=q});var mi=h((wa,fi)=>{"use strict";var Uo=R(),ci=require("path"),{copy:Ho}=Ee(),{remove:ui}=he(),{mkdirp:Qo}=$(),{pathExists:zo}=z(),li=te();async function Ko(t,e,r={}){let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=await li.checkPaths(t,e,"move",r);await li.checkParentPaths(t,n,e,"move");let s=ci.dirname(e);return ci.parse(s).root!==s&&await Qo(s),Yo(t,e,i,o)}async function Yo(t,e,r,i){if(!i){if(r)await ui(e);else if(await zo(e))throw new Error("dest already exists.")}try{await Uo.rename(t,e)}catch(n){if(n.code!=="EXDEV")throw n;await Zo(t,e,r)}}async function Zo(t,e,r){return await Ho(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),ui(t)}fi.exports=Ko});var Si=h((ba,hi)=>{"use strict";var di=se(),ct=require("path"),es=Ee().copySync,yi=he().removeSync,ts=$().mkdirpSync,pi=te();function rs(t,e,r){r=r||{};let i=r.overwrite||r.clobber||!1,{srcStat:n,isChangingCase:o=!1}=pi.checkPathsSync(t,e,"move",r);return pi.checkParentPathsSync(t,n,e,"move"),is(e)||ts(ct.dirname(e)),ns(t,e,i,o)}function is(t){let e=ct.dirname(t);return ct.parse(e).root===e}function ns(t,e,r,i){if(i)return at(t,e,r);if(r)return yi(e),at(t,e,r);if(di.existsSync(e))throw new Error("dest already exists.");return at(t,e,r)}function at(t,e,r){try{di.renameSync(t,e)}catch(i){if(i.code!=="EXDEV")throw i;return os(t,e,r)}}function os(t,e,r){return es(t,e,{overwrite:r,errorOnExist:!0,preserveTimestamps:!0}),yi(t)}hi.exports=rs});var vi=h((xa,gi)=>{"use strict";var ss=E().fromPromise;gi.exports={move:ss(mi()),moveSync:Si()}});var bi=h((La,wi)=>{"use strict";wi.exports={...R(),...Ee(),...vr(),...Jr(),...ai(),...$(),...vi(),...Te(),...z(),...he()}});var xi=h(Ce=>{"use strict";Object.defineProperty(Ce,"__esModule",{value:!0});Ce.EXTENSIONS_LANGUAGES=void 0;Ce.EXTENSIONS_LANGUAGES={1:"Groff",2:"Groff",3:"Groff",4:"Groff",5:"Groff",6:"Groff",7:"Groff",8:"Groff",9:"Groff",abap:"ABAP",asc:"Public Key",ash:"AGS Script",ampl:"AMPL",mod:"XML",g4:"ANTLR",apib:"API Blueprint",apl:"APL",dyalog:"APL",asp:"ASP",asax:"ASP",ascx:"ASP",ashx:"ASP",asmx:"ASP",aspx:"ASP",axd:"ASP",dats:"ATS",hats:"ATS",sats:"ATS",as:"ActionScript",adb:"Ada",ada:"Ada",ads:"Ada",agda:"Agda",als:"Alloy",apacheconf:"ApacheConf",vhost:"Nginx",cls:"Visual Basic",applescript:"AppleScript",scpt:"AppleScript",arc:"Arc",ino:"Arduino",asciidoc:"AsciiDoc",adoc:"AsciiDoc",aj:"AspectJ",asm:"Assembly",a51:"Assembly",inc:"SourcePawn",nasm:"Assembly",aug:"Augeas",ahk:"AutoHotkey",ahkl:"AutoHotkey",au3:"AutoIt",awk:"Awk",auk:"Awk",gawk:"Awk",mawk:"Awk",nawk:"Awk",bat:"Batchfile",cmd:"Batchfile",befunge:"Befunge",bison:"Bison",bb:"BlitzBasic",decls:"BlitzBasic",bmx:"BlitzMax",bsv:"Bluespec",boo:"Boo",b:"Limbo",bf:"HyPhy",brs:"Brightscript",bro:"Bro",c:"C",cats:"C",h:"Objective-C",idc:"C",w:"C",cs:"Smalltalk",cake:"CoffeeScript",cshtml:"C#",csx:"C#",cpp:"C++","c++":"C++",cc:"C++",cp:"Component Pascal",cxx:"C++","h++":"C++",hh:"Hack",hpp:"C++",hxx:"C++",inl:"C++",ipp:"C++",tcc:"C++",tpp:"C++","c-objdump":"C-ObjDump",chs:"C2hs Haskell",clp:"CLIPS",cmake:"CMake","cmake.in":"CMake",cob:"COBOL",cbl:"COBOL",ccp:"COBOL",cobol:"COBOL",cpy:"COBOL",css:"CSS",csv:"CSV",capnp:"Cap'n Proto",mss:"CartoCSS",ceylon:"Ceylon",chpl:"Chapel",ch:"xBase",ck:"ChucK",cirru:"Cirru",clw:"Clarion",icl:"Clean",dcl:"Clean",click:"Click",clj:"Clojure",boot:"Clojure",cl2:"Clojure",cljc:"Clojure",cljs:"Clojure","cljs.hl":"Clojure",cljscm:"Clojure",cljx:"Clojure",hic:"Clojure",coffee:"CoffeeScript",_coffee:"CoffeeScript",cjsx:"CoffeeScript",cson:"CoffeeScript",iced:"CoffeeScript",cfm:"ColdFusion",cfml:"ColdFusion",cfc:"ColdFusion CFC",lisp:"NewLisp",asd:"Common Lisp",cl:"OpenCL",l:"PicoLisp",lsp:"NewLisp",ny:"Common Lisp",podsl:"Common Lisp",sexp:"Common Lisp",cps:"Component Pascal",coq:"Coq",v:"Verilog",cppobjdump:"Cpp-ObjDump","c++-objdump":"Cpp-ObjDump","c++objdump":"Cpp-ObjDump","cpp-objdump":"Cpp-ObjDump","cxx-objdump":"Cpp-ObjDump",creole:"Creole",cr:"Crystal",feature:"Cucumber",cu:"Cuda",cuh:"Cuda",cy:"Cycript",pyx:"Cython",pxd:"Cython",pxi:"Cython",d:"Makefile",di:"D","d-objdump":"D-ObjDump",com:"DIGITAL Command Language",dm:"DM",zone:"DNS Zone",arpa:"DNS Zone",darcspatch:"Darcs Patch",dpatch:"Darcs Patch",dart:"Dart",diff:"Diff",patch:"Diff",dockerfile:"Dockerfile",djs:"Dogescript",dylan:"Dylan",dyl:"Dylan",intr:"Dylan",lid:"Dylan",E:"E",ecl:"ECLiPSe",eclxml:"ECL",sch:"KiCad",brd:"KiCad",epj:"Ecere Projects",e:"Eiffel",ex:"Elixir",exs:"Elixir",elm:"Elm",el:"Emacs Lisp",emacs:"Emacs Lisp","emacs.desktop":"Emacs Lisp",em:"EmberScript",emberscript:"EmberScript",erl:"Erlang",es:"JavaScript",escript:"Erlang",hrl:"Erlang",xrl:"Erlang",yrl:"Erlang",fs:"GLSL",fsi:"F#",fsx:"F#",fx:"HLSL",flux:"FLUX",f90:"FORTRAN",f:"Forth",f03:"FORTRAN",f08:"FORTRAN",f77:"FORTRAN",f95:"FORTRAN",for:"Forth",fpp:"FORTRAN",factor:"Factor",fy:"Fancy",fancypack:"Fancy",fan:"Fantom","eam.fs":"Formatted",fth:"Forth","4th":"Forth",forth:"Forth",fr:"Text",frt:"Forth",ftl:"FreeMarker",g:"GAP",gco:"G-code",gcode:"G-code",gms:"GAMS",gap:"GAP",gd:"GDScript",gi:"GAP",tst:"Scilab",s:"GAS",ms:"MAXScript",glsl:"GLSL",fp:"GLSL",frag:"JavaScript",frg:"GLSL",fsh:"GLSL",fshader:"GLSL",geo:"GLSL",geom:"GLSL",glslv:"GLSL",gshader:"GLSL",shader:"GLSL",vert:"GLSL",vrx:"GLSL",vsh:"GLSL",vshader:"GLSL",gml:"XML",kid:"Genshi",ebuild:"Gentoo Ebuild",eclass:"Gentoo Eclass",po:"Gettext Catalog",pot:"Gettext Catalog",glf:"Glyph",gp:"Gnuplot",gnu:"Gnuplot",gnuplot:"Gnuplot",plot:"Gnuplot",plt:"Gnuplot",go:"Go",golo:"Golo",gs:"JavaScript",gst:"Gosu",gsx:"Gosu",vark:"Gosu",grace:"Grace",gradle:"Gradle",gf:"Grammatical Framework",graphql:"GraphQL",dot:"Graphviz (DOT)",gv:"Graphviz (DOT)",man:"Groff","1in":"Groff","1m":"Groff","1x":"Groff","3in":"Groff","3m":"Groff","3qt":"Groff","3x":"Groff",me:"Groff",n:"Nemerle",rno:"Groff",roff:"Groff",groovy:"Groovy",grt:"Groovy",gtpl:"Groovy",gvy:"Groovy",gsp:"Groovy Server Pages",hcl:"HCL",tf:"HCL",hlsl:"HLSL",fxh:"HLSL",hlsli:"HLSL",html:"HTML",htm:"HTML","html.hl":"HTML",st:"Smalltalk",xht:"HTML",xhtml:"HTML",mustache:"HTML+Django",jinja:"HTML+Django",eex:"HTML+EEX",erb:"HTML+ERB","erb.deface":"HTML+ERB",phtml:"HTML+PHP",http:"HTTP",php:"PHP",haml:"Haml","haml.deface":"Haml",handlebars:"Handlebars",hbs:"Handlebars",hb:"Harbour",hs:"Haskell",hsc:"Haskell",hx:"Haxe",hxsl:"Haxe",hy:"Hy",pro:"QMake",dlm:"IDL",ipf:"IGOR Pro",ini:"INI",cfg:"INI",prefs:"INI",properties:"INI",irclog:"IRC log",weechatlog:"IRC log",idr:"Idris",lidr:"Idris",ni:"Inform 7",i7x:"Inform 7",iss:"Inno Setup",io:"Io",ik:"Ioke",thy:"Isabelle",ijs:"J",flex:"JFlex",jflex:"JFlex",json:"JSON",geojson:"JSON",lock:"JSON",topojson:"JSON",json5:"JSON5",jsonld:"JSONLD",jq:"JSONiq",jsx:"JSX",jade:"Jade",j:"Objective-J",java:"Java",jsp:"Java Server Pages",js:"JavaScript",_js:"JavaScript",bones:"JavaScript",es6:"JavaScript",jake:"JavaScript",jsb:"JavaScript",jscad:"JavaScript",jsfl:"JavaScript",jsm:"JavaScript",jss:"JavaScript",njs:"JavaScript",pac:"JavaScript",sjs:"JavaScript",ssjs:"JavaScript","sublime-build":"JavaScript","sublime-commands":"JavaScript","sublime-completions":"JavaScript","sublime-keymap":"JavaScript","sublime-macro":"JavaScript","sublime-menu":"JavaScript","sublime-mousemap":"JavaScript","sublime-project":"JavaScript","sublime-settings":"JavaScript","sublime-theme":"JavaScript","sublime-workspace":"JavaScript",sublime_metrics:"JavaScript",sublime_session:"JavaScript",xsjs:"JavaScript",xsjslib:"JavaScript",jl:"Julia",ipynb:"Jupyter Notebook",krl:"KRL",kicad_pcb:"KiCad",kit:"Kit",kt:"Kotlin",ktm:"Kotlin",kts:"Kotlin",lfe:"LFE",ll:"LLVM",lol:"LOLCODE",lsl:"LSL",lslp:"LSL",lvproj:"LabVIEW",lasso:"Lasso",las:"Lasso",lasso8:"Lasso",lasso9:"Lasso",ldml:"Lasso",latte:"Latte",lean:"Lean",hlean:"Lean",less:"Less",lex:"Lex",ly:"LilyPond",ily:"LilyPond",m:"Objective-C",ld:"Linker Script",lds:"Linker Script",liquid:"Liquid",lagda:"Literate Agda",litcoffee:"Literate CoffeeScript",lhs:"Literate Haskell",ls:"LoomScript",_ls:"LiveScript",xm:"Logos",x:"Logos",xi:"Logos",lgt:"Logtalk",logtalk:"Logtalk",lookml:"LookML",lua:"Lua",fcgi:"Shell",nse:"Lua",pd_lua:"Lua",rbxs:"Lua",wlua:"Lua",mumps:"M",m4:"M4Sugar",mcr:"MAXScript",mtml:"MTML",muf:"MUF",mak:"Makefile",mk:"Makefile",mkfile:"Makefile",mako:"Mako",mao:"Mako",md:"Markdown",markdown:"Markdown",mkd:"Markdown",mkdn:"Markdown",mkdown:"Markdown",ron:"Markdown",mask:"Mask",mathematica:"Mathematica",cdf:"Mathematica",ma:"Mathematica",mt:"Mathematica",nb:"Text",nbp:"Mathematica",wl:"Mathematica",wlt:"Mathematica",matlab:"Matlab",maxpat:"Max",maxhelp:"Max",maxproj:"Max",mxt:"Max",pat:"Max",mediawiki:"MediaWiki",wiki:"MediaWiki",moo:"Moocode",metal:"Metal",minid:"MiniD",druby:"Mirah",duby:"Mirah",mir:"Mirah",mirah:"Mirah",mo:"Modelica",mms:"Module Management System",mmk:"Module Management System",monkey:"Monkey",moon:"MoonScript",myt:"Myghty",ncl:"Text",nl:"NewLisp",nsi:"NSIS",nsh:"NSIS",axs:"NetLinx",axi:"NetLinx","axs.erb":"NetLinx+ERB","axi.erb":"NetLinx+ERB",nlogo:"NetLogo",nginxconf:"Nginx",nim:"Nimrod",nimrod:"Nimrod",ninja:"Ninja",nit:"Nit",nix:"Nix",nu:"Nu",numpy:"NumPy",numpyw:"NumPy",numsc:"NumPy",ml:"OCaml",eliom:"OCaml",eliomi:"OCaml",ml4:"OCaml",mli:"OCaml",mll:"OCaml",mly:"OCaml",objdump:"ObjDump",mm:"XML",sj:"Objective-J",omgrofl:"Omgrofl",opa:"Opa",opal:"Opal",opencl:"OpenCL",p:"OpenEdge ABL",scad:"OpenSCAD",org:"Org",ox:"Ox",oxh:"Ox",oxo:"Ox",oxygene:"Oxygene",oz:"Oz",pwn:"PAWN",aw:"PHP",ctp:"PHP",php3:"PHP",php4:"PHP",php5:"PHP",phps:"PHP",phpt:"PHP",pls:"PLSQL",pck:"PLSQL",pkb:"PLSQL",pks:"PLSQL",plb:"PLSQL",plsql:"PLSQL",sql:"SQLPL",pov:"POV-Ray SDL",pan:"Pan",psc:"Papyrus",parrot:"Parrot",pasm:"Parrot Assembly",pir:"Parrot Internal Representation",pas:"Pascal",dfm:"Pascal",dpr:"Pascal",lpr:"Pascal",pp:"Puppet",pl:"Prolog",al:"Perl",cgi:"Shell",perl:"Perl",ph:"Perl",plx:"Perl",pm:"Perl6",pod:"Pod",psgi:"Perl",t:"Turing","6pl":"Perl6","6pm":"Perl6",nqp:"Perl6",p6:"Perl6",p6l:"Perl6",p6m:"Perl6",pl6:"Perl6",pm6:"Perl6",pkl:"Pickle",pig:"PigLatin",pike:"Pike",pmod:"Pike",pogo:"PogoScript",pony:"Pony",ps:"PostScript",eps:"PostScript",ps1:"PowerShell",psd1:"PowerShell",psm1:"PowerShell",pde:"Processing",prolog:"Prolog",yap:"Prolog",spin:"Propeller Spin",proto:"Protocol Buffer",pub:"Public Key",pd:"Pure Data",pb:"PureBasic",pbi:"PureBasic",purs:"PureScript",py:"Python",bzl:"Python",gyp:"Python",lmi:"Python",pyde:"Python",pyp:"Python",pyt:"Python",pyw:"Python",rpy:"Ren'Py",tac:"Python",wsgi:"Python",xpy:"Python",pytb:"Python traceback",qml:"QML",qbs:"QML",pri:"QMake",r:"Rebol",rd:"R",rsx:"R",raml:"RAML",rdoc:"RDoc",rbbas:"REALbasic",rbfrm:"REALbasic",rbmnu:"REALbasic",rbres:"REALbasic",rbtbar:"REALbasic",rbuistate:"REALbasic",rhtml:"RHTML",rmd:"RMarkdown",rkt:"Racket",rktd:"Racket",rktl:"Racket",scrbl:"Racket",rl:"Ragel in Ruby Host",raw:"Raw token data",reb:"Rebol",r2:"Rebol",r3:"Rebol",rebol:"Rebol",red:"Red",reds:"Red",cw:"Redcode",rs:"Rust",rsh:"RenderScript",robot:"RobotFramework",rg:"Rouge",rb:"Ruby",builder:"Ruby",gemspec:"Ruby",god:"Ruby",irbrc:"Ruby",jbuilder:"Ruby",mspec:"Ruby",pluginspec:"XML",podspec:"Ruby",rabl:"Ruby",rake:"Ruby",rbuild:"Ruby",rbw:"Ruby",rbx:"Ruby",ru:"Ruby",ruby:"Ruby",thor:"Ruby",watchr:"Ruby","rs.in":"Rust",sas:"SAS",scss:"SCSS",smt2:"SMT",smt:"SMT",sparql:"SPARQL",rq:"SPARQL",sqf:"SQF",hqf:"SQF",cql:"SQL",ddl:"SQL",prc:"SQL",tab:"SQL",udf:"SQL",viw:"SQL",db2:"SQLPL",ston:"STON",svg:"SVG",sage:"Sage",sagews:"Sage",sls:"Scheme",sass:"Sass",scala:"Scala",sbt:"Scala",sc:"SuperCollider",scaml:"Scaml",scm:"Scheme",sld:"Scheme",sps:"Scheme",ss:"Scheme",sci:"Scilab",sce:"Scilab",self:"Self",sh:"Shell",bash:"Shell",bats:"Shell",command:"Shell",ksh:"Shell","sh.in":"Shell",tmux:"Shell",tool:"Shell",zsh:"Shell","sh-session":"ShellSession",shen:"Shen",sl:"Slash",slim:"Slim",smali:"Smali",tpl:"Smarty",sp:"SourcePawn",sma:"SourcePawn",nut:"Squirrel",stan:"Stan",ML:"Standard ML",fun:"Standard ML",sig:"Standard ML",sml:"Standard ML",do:"Stata",ado:"Stata",doh:"Stata",ihlp:"Stata",mata:"Stata",matah:"Stata",sthlp:"Stata",styl:"Stylus",scd:"SuperCollider",swift:"Swift",sv:"SystemVerilog",svh:"SystemVerilog",vh:"SystemVerilog",toml:"TOML",txl:"TXL",tcl:"Tcl",adp:"Tcl",tm:"Tcl",tcsh:"Tcsh",csh:"Tcsh",tex:"TeX",aux:"TeX",bbx:"TeX",bib:"TeX",cbx:"TeX",dtx:"TeX",ins:"TeX",lbx:"TeX",ltx:"TeX",mkii:"TeX",mkiv:"TeX",mkvi:"TeX",sty:"TeX",toc:"TeX",tea:"Tea",txt:"Text",no:"Text",textile:"Textile",thrift:"Thrift",tu:"Turing",ttl:"Turtle",twig:"Twig",ts:"XML",tsx:"XML",upc:"Unified Parallel C",anim:"Unity3D Asset",asset:"Unity3D Asset",mat:"Unity3D Asset",meta:"Unity3D Asset",prefab:"Unity3D Asset",unity:"Unity3D Asset",uno:"Uno",uc:"UnrealScript",ur:"UrWeb",urs:"UrWeb",vcl:"VCL",vhdl:"VHDL",vhd:"VHDL",vhf:"VHDL",vhi:"VHDL",vho:"VHDL",vhs:"VHDL",vht:"VHDL",vhw:"VHDL",vala:"Vala",vapi:"Vala",veo:"Verilog",vim:"VimL",vb:"Visual Basic",bas:"Visual Basic",frm:"Visual Basic",frx:"Visual Basic",vba:"Visual Basic",vbhtml:"Visual Basic",vbs:"Visual Basic",volt:"Volt",vue:"Vue",owl:"Web Ontology Language",webidl:"WebIDL",x10:"X10",xc:"XC",xml:"XML",ant:"XML",axml:"XML",ccxml:"XML",clixml:"XML",cproject:"XML",csl:"XML",csproj:"XML",ct:"XML",dita:"XML",ditamap:"XML",ditaval:"XML","dll.config":"XML",dotsettings:"XML",filters:"XML",fsproj:"XML",fxml:"XML",glade:"XML",grxml:"XML",iml:"XML",ivy:"XML",jelly:"XML",jsproj:"XML",kml:"XML",launch:"XML",mdpolicy:"XML",mxml:"XML",nproj:"XML",nuspec:"XML",odd:"XML",osm:"XML",plist:"XML",props:"XML",ps1xml:"XML",psc1:"XML",pt:"XML",rdf:"XML",rss:"XML",scxml:"XML",srdf:"XML",storyboard:"XML",stTheme:"XML","sublime-snippet":"XML",targets:"XML",tmCommand:"XML",tml:"XML",tmLanguage:"XML",tmPreferences:"XML",tmSnippet:"XML",tmTheme:"XML",ui:"XML",urdf:"XML",ux:"XML",vbproj:"XML",vcxproj:"XML",vssettings:"XML",vxml:"XML",wsdl:"XML",wsf:"XML",wxi:"XML",wxl:"XML",wxs:"XML",x3d:"XML",xacro:"XML",xaml:"XML",xib:"XML",xlf:"XML",xliff:"XML",xmi:"XML","xml.dist":"XML",xproj:"XML",xsd:"XML",xul:"XML",zcml:"XML","xsp-config":"XPages","xsp.metadata":"XPages",xpl:"XProc",xproc:"XProc",xquery:"XQuery",xq:"XQuery",xql:"XQuery",xqm:"XQuery",xqy:"XQuery",xs:"XS",xslt:"XSLT",xsl:"XSLT",xojo_code:"Xojo",xojo_menu:"Xojo",xojo_report:"Xojo",xojo_script:"Xojo",xojo_toolbar:"Xojo",xojo_window:"Xojo",xtend:"Xtend",yml:"YAML",reek:"YAML",rviz:"YAML","sublime-syntax":"YAML",syntax:"YAML",yaml:"YAML","yaml-tmlanguage":"YAML",yang:"YANG",y:"Yacc",yacc:"Yacc",yy:"Yacc",zep:"Zephir",zimpl:"Zimpl",zmpl:"Zimpl",zpl:"Zimpl",desktop:"desktop","desktop.in":"desktop",ec:"eC",eh:"eC",edn:"edn",fish:"fish",mu:"mupad",nc:"nesC",ooc:"ooc",rst:"reStructuredText",rest:"reStructuredText","rest.txt":"reStructuredText","rst.txt":"reStructuredText",wisp:"wisp",prg:"xBase",prw:"xBase"}});var ge=h(lt=>{"use strict";Object.defineProperty(lt,"__esModule",{value:!0});lt.setOptionValues=as;function as(t,e){for(let r of Object.keys(e))t[r]!==void 0&&(e[r]=t[r]);return e}});var Pi=h(Ie=>{"use strict";Object.defineProperty(Ie,"__esModule",{value:!0});Ie.SarifBuilder=void 0;var cs=require("path"),Li=bi(),ls=xi(),us=ge(),ut=class{constructor(e={}){this.log={$schema:"http://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[]},(0,us.setOptionValues)(e,this.log)}addRun(e){this.log.runs.push(e.run)}generateSarifFileSync(e){let r=this.buildSarifJsonString();Li.writeFileSync(e,r,"utf8")}async generateSarifFile(e){let r=this.buildSarifJsonString();await Li.writeFile(e,r,"utf8")}buildSarifOutput(){return this.log.runs=this.log.runs.map(e=>this.completeRunFields(e)),this.log}buildSarifJsonString(e={indent:!1}){this.buildSarifOutput();let r=e.indent?JSON.stringify(this.log,null,2):JSON.stringify(this.log);if(r.includes("SARIF_BUILDER_INVALID"))throw new Error("Your SARIF log is invalid, please solve SARIF_BUILDER_INVALID messages");return r}completeRunFields(e){var r,i,n,o;e.artifacts=e.artifacts||[];for(let u of e.results)for(let m of u.locations||[])if(!((i=(r=m?.physicalLocation)===null||r===void 0?void 0:r.artifactLocation)===null||i===void 0)&&i.uri&&e.artifacts.filter(a=>{var l;return((l=a?.location)===null||l===void 0?void 0:l.uri)===m.physicalLocation.artifactLocation.uri}).length===0){let a=cs.extname(m.physicalLocation.artifactLocation.uri).replace(".",""),l=ls.EXTENSIONS_LANGUAGES[a]||"unknown";e.artifacts.push({sourceLanguage:l,location:{uri:m.physicalLocation.artifactLocation.uri}})}let s=e.artifacts.map(u=>{var m;return(m=u?.location)===null||m===void 0?void 0:m.uri}),c=(((o=(n=e?.tool)===null||n===void 0?void 0:n.driver)===null||o===void 0?void 0:o.rules)||[]).map(u=>u.id);return e.results=e.results.map(u=>(c.indexOf(u.ruleId)>-1&&(u.ruleIndex=c.indexOf(u.ruleId)),u.locations&&(u.locations=u.locations.map(m=>{var a,l;let p=(l=(a=m?.physicalLocation)===null||a===void 0?void 0:a.artifactLocation)===null||l===void 0?void 0:l.uri;return p&&s.indexOf(p)>-1&&(m.physicalLocation.artifactLocation.index=s.indexOf(p)),m})),u)),e}};Ie.SarifBuilder=ut});var ki=h(Ae=>{"use strict";Object.defineProperty(Ae,"__esModule",{value:!0});Ae.SarifResultBuilder=void 0;var fs=ge(),ft=class{constructor(e={}){this.result={level:"error",message:{},ruleId:"SARIF_BUILDER_INVALID: Please send the rule Id ruleId property, or call setRuleId(ruleId)"},(0,fs.setOptionValues)(e,this.result)}initSimple(e){if(this.setLevel(e.level),this.setMessageText(e.messageText),this.setRuleId(e.ruleId),e.fileUri&&this.setLocationArtifactUri({uri:e.fileUri}),e.startLine!==null&&e.startLine!==void 0){let r={startLine:e.startLine,startColumn:e.startColumn||1,endLine:e.endLine||e.startLine,endColumn:e.endColumn||1};if(e.startLine===0||e.startColumn===0||e.endLine===0||e.endColumn===0)throw new Error("Region limit can not be 0 (minimum line 1 or column 1) in "+JSON.stringify(e));this.setLocationRegion(r)}return this}setLevel(e){this.result.level=e}setMessageText(e){this.result.message.text=e}setRuleId(e){this.result.ruleId=e}setLocationRegion(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.region=e}setLocationArtifactUri(e){this.manageInitPhysicalLocation(),this.result.locations[0].physicalLocation.artifactLocation=e}manageInitLocation(){var e,r;!((r=(e=this.result)===null||e===void 0?void 0:e.locations)===null||r===void 0)&&r.length||(this.result.locations=[{}])}manageInitPhysicalLocation(){var e;this.manageInitLocation(),!(!((e=this.result)===null||e===void 0)&&e.locations[0].physicalLocation)&&(this.result.locations[0].physicalLocation={})}};Ae.SarifResultBuilder=ft});var Oi=h(Ne=>{"use strict";Object.defineProperty(Ne,"__esModule",{value:!0});Ne.SarifRuleBuilder=void 0;var ms=ge(),mt=class{constructor(e={}){this.rule={id:"SARIF_BUILDER_INVALID: Please send the rule identifier in id property, or call setRuleId(ruleId)",shortDescription:{text:"SARIF_BUILDER_INVALID: Please send the rule text in shortDescription.text property, or call setShortDescriptionText(text)"}},(0,ms.setOptionValues)(e,this.rule)}initSimple(e){return this.setRuleId(e.ruleId),e.shortDescriptionText&&this.setShortDescriptionText(e.shortDescriptionText),e.fullDescriptionText&&this.setFullDescriptionText(e.fullDescriptionText),e.helpUri&&this.setHelpUri(e.helpUri),this}setRuleId(e){this.rule.id=e}setShortDescriptionText(e){this.rule.shortDescription.text=e}setFullDescriptionText(e){this.rule.fullDescription=this.rule.fullDescription||{text:""},this.rule.fullDescription.text=e}setHelpUri(e){this.rule.helpUri=e}};Ne.SarifRuleBuilder=mt});var Fi=h(Re=>{"use strict";Object.defineProperty(Re,"__esModule",{value:!0});Re.SarifRunBuilder=void 0;var ps=ge(),pt=class{constructor(e={}){this.run={tool:{driver:{name:process.env.npm_package_name||"SARIF_BUILDER_INVALID: Please send the tool name in tool.driver.name property, or call setToolName(name)",rules:[]}},results:[]},(0,ps.setOptionValues)(e,this.run)}initSimple(e){return this.setToolDriverName(e.toolDriverName),this.setToolDriverVersion(e.toolDriverVersion),e.url&&this.setToolDriverUri(e.url),this}addRule(e){this.run.tool.driver.rules.push(e.rule)}addResult(e){this.run.results.push(e.result)}setToolDriverName(e){this.run.tool.driver.name=e}setToolDriverVersion(e){this.run.tool.driver.version=e}setToolDriverUri(e){this.run.tool.driver.informationUri=e}};Re.SarifRunBuilder=pt});var Ei=h(J=>{"use strict";Object.defineProperty(J,"__esModule",{value:!0});J.SarifResultBuilder=J.SarifRuleBuilder=J.SarifRunBuilder=J.SarifBuilder=void 0;var ds=Pi();Object.defineProperty(J,"SarifBuilder",{enumerable:!0,get:function(){return ds.SarifBuilder}});var ys=ki();Object.defineProperty(J,"SarifResultBuilder",{enumerable:!0,get:function(){return ys.SarifResultBuilder}});var hs=Oi();Object.defineProperty(J,"SarifRuleBuilder",{enumerable:!0,get:function(){return hs.SarifRuleBuilder}});var Ss=Fi();Object.defineProperty(J,"SarifRunBuilder",{enumerable:!0,get:function(){return Ss.SarifRunBuilder}})});var Di=h((ja,Mi)=>{"use strict";var gs=/["'&<>]/;Mi.exports=vs;function vs(t){var e=""+t,r=gs.exec(e);if(!r)return e;var i,n="",o=0,s=0;for(o=r.index;o<e.length;o++){switch(e.charCodeAt(o)){case 34:i=""";break;case 38:i="&";break;case 39:i="'";break;case 60:i="<";break;case 62:i=">";break;default:continue}s!==o&&(n+=e.substring(s,o)),s=o+1,n+=i}return s!==o?n+e.substring(s,o):n}});var Be=require("zx"),re=require("fs/promises");var Je={UNKNOWN:0,LOW:1,MEDIUM:2,HIGH:3,CRITICAL:4};var we=class{allById=new Map;getAllVulnerabilitiesSortedBySeverity(){let e=Array.from(this.allById.values());return e.sort((r,i)=>{let n=wt(r.severity,i.severity);return n===0?r.id.localeCompare(i.id):-n}),e}addVulnerability(e,r){let i=e.id,n=this.allById;if(!n.has(i))n.set(i,e);else{let o=n.get(i);o.title=o.title||e.title,o.severity=Ji(o.severity,e.severity),o.scannerSeverity[r]=e.severity,o.detectedBy=We(o.detectedBy,r),o.components=We(o.components,e.components[0]),o.refs=We(o.refs,e.refs[0])}}enhanceWithVexData(e){let r=[];for(let i of this.allById.values()){let n=e.newestVulnerabilityStatement(i.id);if(!n){r.push(i.id);continue}i.vexStatement=n}return{unmatchedVulnerabilities:r}}};function Ji(t,e){return wt(t,e)>0?t:e}function wt(t,e){return Je[t]-Je[e]}function We(t,e){return e?Array.from(new Set([...t,e]).values()):t}var ne=require("path");var X=require("fs/promises"),Ue=require("path");async function B(t){if(await ie(t))return JSON.parse(await(0,X.readFile)(t,{encoding:"utf-8"}))}function W(t){return t&&t.replace(/\?.*$/,"")}async function ie(t){try{return await(0,X.access)(t,X.constants.F_OK),!0}catch{return!1}}async function He(t){let e=(0,Ue.resolve)(t),r=await(0,X.readdir)(e,{withFileTypes:!0});for(let i of r){let n=(0,Ue.resolve)(i.parentPath,i.name);i.isDirectory()?await He(n):await(0,X.rm)(n)}await(0,X.rmdir)(e)}async function bt(){let t="https://repository.conterra.de/repository/maven-mirror-ct",e="./input/vex",r="./output",i="./.cache",n=["grype","trivy","ossindex"],o=(0,ne.resolve)("./vuln-scan-conf.json"),s=await B(o);if(!s)throw new Error(`Missing project configuration file '${o}'`);return{failOnNewVulnerabilities:!1,createSubDirsForProject:s.createSubDirsForProject??!0,mavenRepo:s.mavenRepo??t,vexDir:(0,ne.resolve)(s.vexDir??e),outDir:(0,ne.resolve)(s.outDir??r),cacheDir:(0,ne.resolve)(s.cacheDir??i),scanners:s.scanners??n,projects:(s.projects??[]).map(c=>{let u=c;return u.sbomFile?{...u,sbomFile:(0,ne.resolve)(u.sbomFile)}:c})}}var xt=require("zx");var be=require("path");async function Lt(t,e,r,i){console.log(" with Grype ...");let n=(0,be.dirname)(e),o=(0,be.basename)(e),s=await xt.$`docker run --rm -v '${t}:/.cache' -v '${n}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' anchore/grype:latest sbom:/tmp/input.json -o json --file '/tmp/output/${o}' --by-cve --quiet`;s.stdout&&console.log(` Scan log: ${s.stdout}`),s.stderr&&console.log(` Scan error: ${s.stderr}`),console.log(` Grype output file: ${e}`);let c=await B(e);Wi(i,c)}function Wi(t,e){if(e)for(let r of e.matches){let i=Ui(r);t.addVulnerability(i,"grype")}}function Ui(t){let e=t.vulnerability,r=e.id,i=W(t.artifact.purl),n=W(e.dataSource),o=Hi(e.severity);return{id:r,severity:o,scannerSeverity:{grype:o},title:"",description:e.description,components:[i],detectedBy:["grype"],refs:[n]}}function Hi(t){switch(t){case"Negligible":return"LOW";case"Low":return"LOW";case"Medium":return"MEDIUM";case"High":return"HIGH";case"Critical":return"CRITICAL";default:return"UNKNOWN"}}var Pt=require("zx");var xe=require("path");async function kt(t,e,r,i){console.log(" with Trivy ...");let n=(0,xe.dirname)(e),o=(0,xe.basename)(e),s=await Pt.$`docker run --rm -v '${t}:/.cache' -v '${n}:/tmp/output' -v '${r.sbomFile}:/tmp/input.json' aquasec/trivy:latest sbom /tmp/input.json --cache-dir '/.cache' --format json --output /tmp/output/${o} --quiet`;s.stdout&&console.log(` Scan log: ${s.stdout}`),s.stderr&&console.log(` Scan error: ${s.stderr}`),console.log(` Trivy output file: ${e}`);let c=await B(e);Qi(i,c)}function Qi(t,e){if(e){for(let r of e.Results)if(r.Vulnerabilities)for(let i of r.Vulnerabilities){let n=zi(i);t.addVulnerability(n,"trivy")}}}function zi(t){let e=t.VulnerabilityID,r=W(t.PkgIdentifier.PURL),i=W(t.PrimaryURL),n=Ki(t.Severity);return{id:e,severity:n,scannerSeverity:{trivy:n},title:t.Title,description:t.Description,components:[r],detectedBy:["trivy"],refs:[i]}}function Ki(t){switch(t){case"UNKNOWN":case"LOW":case"MEDIUM":case"HIGH":case"CRITICAL":return t;default:return"UNKNOWN"}}var Ot=require("fs/promises");async function Ft(t,e,r,i){console.log(" with Sonatype OSS Index ...");let n={},o="";r.user&&r.token&&(n.Authorization=`Basic ${Buffer.from(`${r.user}:${r.token}`).toString("base64")}`,o="/authorized");let s=`https://ossindex.sonatype.org/api/v3${o}/component-report`,c=await Yi(e.sbomFile),u=new Set(c.map(l=>l.purl.replace(/\?.*$/,"")));nn(u);let m=Array.from(u),a=[];for(let l=0;l<m.length;l+=128){let p=JSON.stringify({coordinates:m.slice(l,l+128)}),d=await(await fetch(s,{method:"POST",headers:{...n,"Content-Type":"application/vnd.ossindex.component-report-request.v1+json"},body:p})).json();Array.isArray(d)?a.push(...d.filter(S=>S.vulnerabilities.length>0)):console.log(` Sonatype OssIndex Error: ${d.code} - ${d.message}`)}await(0,Ot.writeFile)(t,JSON.stringify(a,null,2)),console.log(` Sonatype OssIndex output file: ${t}`),en(i,a)}async function Yi(t){return(await B(t)).components.filter(r=>!Zi(r))}function Zi(t){return t.group?t.group.startsWith("de.conterra")||t.group.startsWith("org.n52.security"):!1}function en(t,e){if(e)for(let r of e)for(let i of r.vulnerabilities){let n=tn(i,r.coordinates);t.addVulnerability(n,"ossindex")}}function tn(t,e){let r=t.cve||t.id,i=W(e),n=W(t.reference),o=rn(t.cvssScore);return{id:r,severity:o,scannerSeverity:{ossindex:o},title:t.title,description:t.description,components:[i],detectedBy:["ossindex"],refs:n?[n]:[]}}function rn(t){return t===0?"UNKNOWN":t<4?"LOW":t<7?"MEDIUM":t<9?"HIGH":"CRITICAL"}function nn(t){let e=Array.from(t);for(let r of e){let i=r.replace(/(@[^-]+)-.*$/g,"$1");t.add(i)}}var Z=vt(Ei()),ji=vt(Di());function Ti(t,e){let r=new Z.SarifRunBuilder().initSimple({toolDriverName:`${e.name} - ${e.version}`,toolDriverVersion:"0.0.1"}),i=new Date().toISOString().split("T")[0];r.run.tool.driver.fullDescription={text:`Security Scan from ${i}`},r.run.tool.driver.properties={"microsoft/qualityDomain":`Security Scan from ${i}`};for(let o of t){let s=bs(o.severity),c=o.id,u=ws(o.refs),m=new Z.SarifRuleBuilder().initSimple({ruleId:c,shortDescriptionText:o.title,fullDescriptionText:o.description,helpUri:u}),a=o.vexStatement,l,p="new",f="";a&&(s="none",p="updated",f=`--- INVESTIGATED (${a.status}) --- `,a.status==="under_investigation"&&(f="--- UNDER INVESTIGATION --- ")),Object.assign(m.rule,{name:`${f}[${o.severity}] - ${o.title.replace(`[${c}]`,"")}`,messageStrings:{default:{text:o.description,markdown:xs(o,u,f)}},properties:{severity:o.severity,scanners:o.scannerSeverity,links:o.refs,tags:["cve","vulnerability","security",`severity_${o.severity.toLowerCase()}`]}}),r.addRule(m);for(let d of o.components){let S=new Z.SarifResultBuilder().initSimple({ruleId:c,level:s,messageText:`${c} [${o.severity}] - ${d}`});S.result.message.id="default",S.result.locations=[{logicalLocations:[{fullyQualifiedName:d}]}],S.result.baselineState=p,S.result.suppressions=l,r.addResult(S)}}let n=new Z.SarifBuilder;return n.addRun(r),n.buildSarifOutput()}function ws(t){for(let e of t)if(e.startsWith("https://nvd.nist.gov"))return e;return t[0]}function bs(t){switch(t){case"CRITICAL":return"error";case"HIGH":return"error";case"MEDIUM":return"warning";case"LOW":return"note";default:return"note"}}function xs(t,e,r){let i=t.vexStatement,n=i?`
|
|
9
9
|
${r}
|
|
10
10
|
${i.justification??""}
|
|
11
11
|
${i.impact_statement??""}`:"";return`
|
|
@@ -20,8 +20,8 @@ ${(0,ji.default)(t.description)}
|
|
|
20
20
|
|
|
21
21
|
${t.refs.map(o=>`* <${o}>`).join(`
|
|
22
22
|
`)}
|
|
23
|
-
`}var qe=require("fs/promises");async function Ci(t,e,r){if("sbomFile"in t)return await(0,qe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,qe.writeFile)(e,i),{...t,sbomFile:e}}var _e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await this.fetchMavenArtifact(i);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await this.fetchMavenArtifact(r)).text(),o=n.match(/<timestamp>([^<]+)<\/timestamp>/),s=n.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!o||!s)throw new Error(`Failed to get timestamp and build number from ${r}`);return`${o[1]}-${s[1]}`}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}async fetchMavenArtifact(e){let r=this.authn,i=r.user&&r.pw?{Authorization:`Basic ${Buffer.from(`${r.user}:${r.pw}`).toString("base64")}`}:{},n=await fetch(e,{headers:i});if(!n.ok){let o="";try{o=await n.text()}catch(s){o=`${s}`}throw new Error(`Failed to download sbom: ${e}: ${n.status} - ${n.statusText}: ${o}`)}return n}};var Ii=require("fs/promises"),Ve=require("path");async function yt(t,e=new ve){let r=(0,Ve.resolve)(t);for(let i of await(0,Ii.readdir)(r,{withFileTypes:!0}))if(i.name.endsWith(".json")){let n=await B((0,Ve.resolve)(i.parentPath,i.name));e.add(n)}else i.isDirectory()&&await yt((0,Ve.resolve)(i.parentPath,i.name),e);return e}var ve=class t{statements=[];filteredToProduct;add(e){let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=new Set([o,...i.vulnerability.aliases??[]]),c=new Set(i.products?.map(
|
|
24
|
-
Detected new vulnerabilities for products:`);for(let[c,u]of s){console.log(` ${c}:`);for(let
|
|
23
|
+
`}var qe=require("fs/promises");async function Ci(t,e,r){if("sbomFile"in t)return await(0,qe.copyFile)(t.sbomFile,e),t.sbomFile=e,t;let i=await r.downloadArtifact(t.sbomMavenCoordinates);return await(0,qe.writeFile)(e,i),{...t,sbomFile:e}}var _e=class{constructor(e,r){this.repo=e;this.authn=r}async downloadArtifact(e){let r=this.toArtifactInfo(e);if(this.isSnapshotVersion(r.version)&&!r.timestamp){let o=await this.fetchLatestSnapshotTimestamp(r);r={...r,timestamp:o}}let i=this.toArtifactUrl(r),n=await this.fetchMavenArtifact(i);return Buffer.from(await n.arrayBuffer())}async fetchLatestSnapshotTimestamp(e){let r=`${this.toArtifactBaseUrl(e)}/maven-metadata.xml`,n=await(await this.fetchMavenArtifact(r)).text(),o=n.match(/<timestamp>([^<]+)<\/timestamp>/),s=n.match(/<buildNumber>([^<]+)<\/buildNumber>/);if(!o||!s)throw new Error(`Failed to get timestamp and build number from ${r}`);return`${o[1]}-${s[1]}`}toArtifactUrl(e){let r=this.toArtifactBaseUrl(e),i=this.isSnapshotVersion(e.version)&&e.timestamp?e.version.replace(/SNAPSHOT$/,e.timestamp):e.version;return`${r}/${e.artifactId}-${i}-${e.classifier}.${e.extension}`}toArtifactBaseUrl(e){return`${this.repo}/${e.groupId.replace(/\./g,"/")}/${e.artifactId}/${e.version}`}isSnapshotVersion(e){return e.endsWith("-SNAPSHOT")}toArtifactInfo(e){let r=e.split(":");return{groupId:r[0],artifactId:r[1],version:r[2],classifier:r[3],extension:"json"}}async fetchMavenArtifact(e){let r=this.authn,i=r.user&&r.pw?{Authorization:`Basic ${Buffer.from(`${r.user}:${r.pw}`).toString("base64")}`}:{},n=await fetch(e,{headers:i});if(!n.ok){let o="";try{o=await n.text()}catch(s){o=`${s}`}throw new Error(`Failed to download sbom: ${e}: ${n.status} - ${n.statusText}: ${o}`)}return n}};var Ii=require("fs/promises"),Ve=require("path");async function yt(t,e=new ve){let r=(0,Ve.resolve)(t);for(let i of await(0,Ii.readdir)(r,{withFileTypes:!0}))if(i.name.endsWith(".json")){let n=await B((0,Ve.resolve)(i.parentPath,i.name));e.add(n)}else i.isDirectory()&&await yt((0,Ve.resolve)(i.parentPath,i.name),e);return e}var ve=class t{statements=[];filteredToProduct;add(e){let r=e.timestamp;for(let i of e.statements){i.timestamp=i.timestamp??r;let n=Date.parse(i.timestamp),o=i.vulnerability.name,s=new Set([o,...i.vulnerability.aliases??[]]),c=new Set(i.products?.map(m=>m["@id"]).filter(m=>!!m)??[]),u=new dt(n,o,s,c,i);this.statements.push(u)}this.sortStatementsByTimestampNewestFirst()}filterByProduct(e){if(this.assertCorrectProductId(e),this.filteredToProduct)return this;let r=new t;return r.filteredToProduct=e,r.statements=this.statements.filter(i=>i.matchesProduct(e)),r}newestVulnerabilityStatement(e,r){let i=this.filterByProduct(r??this.filteredToProduct);for(let n of i.statements)if(n.matchesVulnerability(e))return this.reduceToProductInformation(n.statement,i.filteredToProduct)}toVexFileForProduct(e){let r=this.filterByProduct(e??this.filteredToProduct),i=r.statements[0]?.statement.timestamp??new Date().toISOString(),n=r.statements.map(o=>r.reduceToProductInformation(o.statement)).filter(o=>o.status!=="under_investigation");if(n.length!==0)return{"@context":"https://openvex.dev/ns/v0.2.0","@id":"https://openvex.dev/docs/public/vex-fc763e6eb63bfbcda20b7cbbddd4e9f8feaaa317fe8d8a6f51a5663a1180343e",author:"conterra",timestamp:i,last_updated:i,version:1,statements:n}}assertCorrectProductId(e){if(!e)throw new Error("Product ID must be provided");if(this.filteredToProduct&&this.filteredToProduct!==e)throw new Error("Cannot filter to a different product")}reduceToProductInformation(e,r){return r=r??this.filteredToProduct,{...e,products:e.products?.filter(i=>i["@id"]===r)}}sortStatementsByTimestampNewestFirst(){this.statements.sort((e,r)=>r.timestamp-e.timestamp)}},dt=class{constructor(e,r,i,n,o){this.timestamp=e;this.vulnName=r;this.vulnAliases=i;this.products=n;this.statement=o}matchesProduct(e){return this.products.has(e)}matchesVulnerability(e){return this.vulnAliases.has(e)}};var $e=require("path"),Ai=require("fs/promises");var Xe=class{constructor(e,r,i){this.project=e;this.outputDir=r;this.useSubDirForProject=i}async lookupOutputFileForWriting(e){let r=this.useSubDirForProject?`${this.project.name}-${this.project.version}`:"",i=`${this.project.name}-${this.project.version}-`,n=this.getFileSuffix(e),o=(0,$e.resolve)(this.outputDir,r,`${i}${n}`),s=(0,$e.dirname)(o);return await ie(s)||await(0,Ai.mkdir)(s,{recursive:!0}),o}getFileSuffix(e){switch(e){case"grype-results":return"scan-grype-results.json";case"trivy-results":return"scan-trivy-results.json";case"ossindex-results":return"scan-ossindex-results.json";case"aggregate-results":return"scan-aggregate-results.json";case"aggregated-sarif-results":return"scan-aggregated-results.sarif.json";case"project-cyclonedx-sbom-file":return"sbom.cdx.json";case"project-openvex-file":return"openvex.vex.json";default:throw new Error(`Unknown output file key: ${e}`)}}};Be.os.type().startsWith("Windows")&&(0,Be.usePowerShell)();var Ni=process.argv[2],Ri=process.argv[3],Ls=process.env.OSS_INDEX_API_TOKEN,Ps=process.env.OSS_INDEX_API_USER,ks=process.env.MAVEN_REPO_PW,Os=process.env.MAVEN_REPO_USER;(async()=>{let t=await bt(),e=t.cacheDir;await ie(e)||await(0,re.mkdir)(e);let r=t.outDir;await ie(r)&&await He(r),await(0,re.mkdir)(r);let i=t.vexDir?await yt(t.vexDir):new ve,n=new _e(t.mavenRepo,{user:Os,pw:ks}),o=t.projects,s=new Map;for(let c of o){if(Ni&&(c.name!==Ni||Ri&&c.version!==Ri))continue;let u=new Xe(c,r,t.createSubDirsForProject),m=await Ci(c,await u.lookupOutputFileForWriting("project-cyclonedx-sbom-file"),n);console.log(`Analyzing project: ${m.name} - ${m.version} - ${m.sbomFile}`);let a=new we;await Promise.all(t.scanners.map(f=>Fs(f,m,u,e,a)));let l=i.filterByProduct(m.purl),{unmatchedVulnerabilities:p}=a.enhanceWithVexData(l);p.length>0&&s.set(m.purl,p),await Es(u,m,a,l)}if(s.size>0){console.log(`
|
|
24
|
+
Detected new vulnerabilities for products:`);for(let[c,u]of s){console.log(` ${c}:`);for(let m of u)console.log(` ${m}`)}console.log("##vso[task.complete result=SucceededWithIssues;]NEW_VULNERABILITIES_DETECTED"),t.failOnNewVulnerabilities&&process.exit(1)}})();async function Fs(t,e,r,i,n){switch(t){case"grype":return Lt(i,await r.lookupOutputFileForWriting("grype-results"),e,n);case"trivy":return kt(i,await r.lookupOutputFileForWriting("trivy-results"),e,n);case"ossindex":return Ft(await r.lookupOutputFileForWriting("ossindex-results"),e,{user:Ps,token:Ls},n)}}async function Es(t,e,r,i){let n=r.getAllVulnerabilitiesSortedBySeverity(),o=await t.lookupOutputFileForWriting("aggregate-results");await(0,re.writeFile)(o,JSON.stringify(n,null,2)),console.log(` Vulnerabilities output file: ${o}`);let s=await t.lookupOutputFileForWriting("aggregated-sarif-results"),c=Ti(n,e);await(0,re.writeFile)(s,JSON.stringify(c,null,2)),console.log(` Vuln Sarif output file: ${s}`);let u=i.toVexFileForProduct();if(!u)return;let m=await t.lookupOutputFileForWriting("project-openvex-file");await(0,re.writeFile)(m,JSON.stringify(u,null,2)),console.log(` OpenVex file: ${m}`)}
|
|
25
25
|
/*! Bundled license information:
|
|
26
26
|
|
|
27
27
|
escape-html/index.js:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@conterra/vuln-scan",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.2",
|
|
4
4
|
"description": "con terra vulnerability scan process",
|
|
5
5
|
"author": "con terra GmbH",
|
|
6
6
|
"license": "Apache-2.0",
|
|
@@ -11,8 +11,8 @@
|
|
|
11
11
|
"README.md"
|
|
12
12
|
],
|
|
13
13
|
"bin": {
|
|
14
|
-
"ct-vuln-scan": "
|
|
15
|
-
"ct-vuln-add-vex": "
|
|
14
|
+
"ct-vuln-scan": "dist/vuln-scan.js",
|
|
15
|
+
"ct-vuln-add-vex": "dist/add-statement.js"
|
|
16
16
|
},
|
|
17
17
|
"engines": {
|
|
18
18
|
"node": ">= 20"
|
|
@@ -33,19 +33,18 @@
|
|
|
33
33
|
},
|
|
34
34
|
"devDependencies": {
|
|
35
35
|
"@types/escape-html": "^1.0.4",
|
|
36
|
-
"
|
|
37
|
-
"node-fetch": "^3.3.2",
|
|
38
|
-
"node-sarif-builder": "^3.2.0",
|
|
39
|
-
"esbuild": "^0.24.0",
|
|
36
|
+
"chai": "^5.1.1",
|
|
40
37
|
"copyfiles": "^2.4.1",
|
|
41
|
-
"
|
|
42
|
-
"
|
|
38
|
+
"esbuild": "^0.24.0",
|
|
39
|
+
"escape-html": "^1.0.3",
|
|
43
40
|
"eslint-plugin-headers": "^1.2.0",
|
|
41
|
+
"globals": "^15.11.0",
|
|
44
42
|
"json-schema-to-typescript": "^15.0.2",
|
|
45
43
|
"mocha": "^10.4.0",
|
|
46
|
-
"
|
|
47
|
-
"
|
|
44
|
+
"node-sarif-builder": "^3.2.0",
|
|
45
|
+
"rimraf": "^6.0.1",
|
|
48
46
|
"tiny-glob": "^0.2.9",
|
|
49
|
-
"
|
|
47
|
+
"typescript": "^5.6.3",
|
|
48
|
+
"typescript-eslint": "^8.11.0"
|
|
50
49
|
}
|
|
51
50
|
}
|