@cyclonedx/cdxgen 10.9.1 → 10.9.2

package/bin/cdxgen.js

@@ -104,6 +104,11 @@ const args = yargs(hideBin(process.argv))
   .option("server-url", {
     description: "Dependency track url. Eg: https://deptrack.cyclonedx.io",
   })
+  .option("skip-dt-tls-check", {
+    type: "boolean",
+    default: false,
+    description: "Skip TLS certificate check when calling Dependency-Track. ",
+  })
   .option("api-key", {
     description: "Dependency track api key",
   })

package/binary.js

@@ -271,6 +271,9 @@ const OS_DISTRO_ALIAS = {
   "debian-1.3": "bo",
   "debian-1.2": "rex",
   "debian-1.1": "buzz",
+  "red hat enterprise linux": "rhel",
+  "red hat enterprise linux 8": "rhel-8",
+  "red hat enterprise linux 9": "rhel-9",
 };
 
 export function getGoBuildInfo(src) {
@@ -421,9 +424,13 @@ export function getOSPackages(src) {
       let distro_codename =
         osReleaseData["VERSION_CODENAME"] ||
         osReleaseData["CENTOS_MANTISBT_PROJECT"] ||
+        osReleaseData["REDHAT_BUGZILLA_PRODUCT"] ||
         osReleaseData["REDHAT_SUPPORT_PRODUCT"] ||
         "";
       distro_codename = distro_codename.toLowerCase();
+      if (distro_codename.includes(" ") && OS_DISTRO_ALIAS[distro_codename]) {
+        distro_codename = OS_DISTRO_ALIAS[distro_codename];
+      }
       let distro_id = osReleaseData["ID"] || "";
       const distro_id_like = osReleaseData["ID_LIKE"] || "";
       let purl_type = "rpm";

package/index.js

@@ -1943,6 +1943,7 @@ export async function createJavaBom(path, options) {
 
   // Bazel
   // Look for the BUILD file only in the root directory
+  // NOTE: This can match BUILD files used by perl, so could lead to errors in some projects
   const bazelFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}BUILD*`,
@@ -1950,6 +1951,7 @@ export async function createJavaBom(path, options) {
   );
   if (
     bazelFiles?.length &&
+    !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
     !options.projectType?.includes("maven") &&
     !options.projectType?.includes("gradle") &&
     !options.projectType?.includes("scala") &&
@@ -2837,7 +2839,7 @@ export async function createPythonBom(path, options) {
       const parentDependsOn = [];
       // Complete the dependency tree by making parent component depend on the first level
       for (const p of retMap.rootList) {
-        parentDependsOn.push(`pkg:pypi/${p.name}@${p.version}`);
+        parentDependsOn.push(`pkg:pypi/${p.name.toLowerCase()}@${p.version}`);
       }
       const pdependencies = {
         ref: parentComponent["bom-ref"],
@@ -2985,50 +2987,63 @@ export async function createPythonBom(path, options) {
       } else {
         pkgMap = getPipFrozenTree(path, undefined, tempDir, parentComponent);
       }
+
       // Get the imported modules and a dedupe list of packages
       const parentDependsOn = new Set();
-      const retMap = await getPyModules(path, pkgList, options);
-      // We need to patch the existing package list to add ImportedModules for evinse to work
-      if (retMap.modList?.length) {
-        const iSymbolsMap = {};
-        retMap.modList.forEach((v) => {
-          iSymbolsMap[v.name] = v.importedSymbols;
-          iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
-        });
-        for (const apkg of pkgList) {
-          if (iSymbolsMap[apkg.name]) {
-            apkg.properties = apkg.properties || [];
-            apkg.properties.push({
-              name: "ImportedModules",
-              value: iSymbolsMap[apkg.name],
-            });
+
+      // ATOM parsedeps block
+      // Atom parsedeps slices can be used to identify packages that are not declared in manifests
+      // Since it is a slow operation, we only use it as a fallback or in deep mode
+      // This change was made in 10.9.2 release onwards
+      if (options.deep || !pkgList.length) {
+        const retMap = await getPyModules(path, pkgList, options);
+        // We need to patch the existing package list to add ImportedModules for evinse to work
+        if (retMap.modList?.length) {
+          const iSymbolsMap = {};
+          retMap.modList.forEach((v) => {
+            iSymbolsMap[v.name] = v.importedSymbols;
+            iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
+          });
+          for (const apkg of pkgList) {
+            if (iSymbolsMap[apkg.name]) {
+              apkg.properties = apkg.properties || [];
+              apkg.properties.push({
+                name: "ImportedModules",
+                value: iSymbolsMap[apkg.name],
+              });
+            }
           }
         }
-      }
-      if (retMap.pkgList?.length) {
-        pkgList = pkgList.concat(retMap.pkgList);
-        for (const p of retMap.pkgList) {
-          if (
-            !p.version ||
-            (parentComponent &&
-              p.name === parentComponent.name &&
-              (p.version === parentComponent.version || p.version === "latest"))
-          ) {
-            continue;
+        if (retMap.pkgList?.length) {
+          pkgList = pkgList.concat(retMap.pkgList);
+          for (const p of retMap.pkgList) {
+            if (
+              !p.version ||
+              (parentComponent &&
+                p.name === parentComponent.name &&
+                (p.version === parentComponent.version ||
+                  p.version === "latest"))
+            ) {
+              continue;
+            }
+            parentDependsOn.add(
+              `pkg:pypi/${p.name.toLowerCase()}@${p.version}`,
+            );
           }
-          parentDependsOn.add(`pkg:pypi/${p.name}@${p.version}`);
+        }
+        if (retMap.dependenciesList) {
+          dependencies = mergeDependencies(
+            dependencies,
+            retMap.dependenciesList,
+            parentComponent,
+          );
+        }
+        if (retMap.allImports) {
+          allImports = { ...allImports, ...retMap.allImports };
         }
       }
-      if (retMap.dependenciesList) {
-        dependencies = mergeDependencies(
-          dependencies,
-          retMap.dependenciesList,
-          parentComponent,
-        );
-      }
-      if (retMap.allImports) {
-        allImports = { ...allImports, ...retMap.allImports };
-      }
+      // ATOM parsedeps block
+
       // Complete the dependency tree by making parent component depend on the first level
       for (const p of pkgMap.rootList) {
         if (
@@ -3038,7 +3053,7 @@ export async function createPythonBom(path, options) {
         ) {
           continue;
         }
-        parentDependsOn.add(`pkg:pypi/${p.name}@${p.version}`);
+        parentDependsOn.add(`pkg:pypi/${p.name.toLowerCase()}@${p.version}`);
       }
       if (pkgMap.pkgList?.length) {
         pkgList = pkgList.concat(pkgMap.pkgList);
@@ -6543,8 +6558,18 @@ export async function submitBom(args, bomContents) {
     );
   }
   try {
+    if (DEBUG_MODE && args.skipDtTlsCheck) {
+      console.log(
+        "Calling ",
+        serverUrl,
+        "with --skip-dt-tls-check argument: Skip DT TLS check.",
+      );
+    }
     return await got(serverUrl, {
       method: "PUT",
+      https: {
+        rejectUnauthorized: !args.skipDtTlsCheck,
+      },
       headers: {
         "X-Api-Key": args.apiKey,
         "Content-Type": "application/json",
@@ -6560,10 +6585,16 @@ export async function submitBom(args, bomContents) {
         "Received Unauthorized error. Check the API key used is valid and has necessary permissions to create projects and upload bom.",
       );
     } else if (error.response && error.response.statusCode === 405) {
+      console.log(
+        "Method PUT not allowed on Dependency-Track server. Trying with POST ...",
+      );
       // Method not allowed errors
       try {
         return await got(serverUrl, {
           method: "POST",
+          https: {
+            rejectUnauthorized: !args.skipDtTlsCheck,
+          },
           headers: {
             "X-Api-Key": args.apiKey,
             "Content-Type": "application/json",
@@ -6573,14 +6604,27 @@ export async function submitBom(args, bomContents) {
           responseType: "json",
         }).json();
       } catch (error) {
+        if (DEBUG_MODE) {
+          console.log(
+            "Unable to submit the SBOM to the Dependency-Track server using POST method",
+            error,
+          );
+        } else {
+          console.log(
+            "Unable to submit the SBOM to the Dependency-Track server using POST method",
+          );
+        }
+      }
+    } else {
+      if (DEBUG_MODE) {
         console.log(
           "Unable to submit the SBOM to the Dependency-Track server using POST method",
+          error,
         );
+      } else {
+        console.log("Unable to submit the SBOM to the Dependency-Track server");
       }
-    } else {
-      console.log("Unable to submit the SBOM to the Dependency-Track server");
     }
-    console.log(error.response?.body);
     return error.response?.body;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.9.1",
+  "version": "10.9.2",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/types/binary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../binary.js"],"names":[],"mappings":"AAmRA,iDA8BC;AAED,wDAmBC;AAED;;;;;;;EAiXC;AAkCD,gDAoDC;AAED;;;;;;GAMG;AACH,qCAJW,MAAM,cACN,MAAM,WA2BhB;AAED;;;;;;;;GAQG;AACH,kCANW,MAAM,iBACN,MAAM,YACN,OAAO,GAEN,OAAO,CA8BlB"}
+{"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../binary.js"],"names":[],"mappings":"AAsRA,iDA8BC;AAED,wDAmBC;AAED;;;;;;;EAqXC;AAkCD,gDAoDC;AAED;;;;;;GAMG;AACH,qCAJW,MAAM,cACN,MAAM,WA2BhB;AAED;;;;;;;;GAQG;AACH,kCANW,MAAM,iBACN,MAAM,YACN,OAAO,GAEN,OAAO,CA8BlB"}

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AAyvBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAyUD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAwgChB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA2chB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAkahB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAkUhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAiUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA6XhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDA2CC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BAmclB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAiUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAsOhB;AAED;;;;;;GAMG;AACH,wDAFY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAAC,CA2FxE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AAyvBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAyUD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BA0gChB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA2chB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA+ahB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAkUhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAiUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA6XhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDA2CC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BAmclB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAiUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAsOhB;AAED;;;;;;GAMG;AACH,wDAFY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAAC,CAwHxE"}