@cyclonedx/cdxgen 10.9.4 → 10.9.6

package/README.md

@@ -232,19 +232,7 @@ Use curl or your favorite tool to pass arguments to the `/sbom` route.
 
 ### Server arguments
 
-Arguments can be passed either via the query string or as a JSON body. The following arguments are supported.
-
-| Argument       | Description                                                                                                                                 |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
-| type           | Project type. Please refer to [Supported Project Types][docs-project-types].                                                                |
-| multiProject   | [boolean]                                                                                                                                   |
-| requiredOnly   | Include only the packages with required scope on the SBOM. [boolean]                                                                        |
-| noBabel        | Do not use babel to perform usage analysis for JavaScript/TypeScript projects. [boolean]                                                    |
-| installDeps    | Install dependencies automatically for some projects. Defaults to true but disabled for containers and oci scans. [boolean] [default: true] |
-| project        |                                                                                                                                             |
-| projectName    | Dependency track project name. Default use the directory name                                                                               |
-| projectGroup   | Dependency track project group                                                                                                              |
-| projectVersion | Dependency track project version [default: ""]                                                                                              |
+Arguments can be passed either via the query string or as a JSON body. Please refer to [Server Usage][docs-server]
 
 ### Health endpoint
 

package/data/README.md

@@ -22,3 +22,4 @@ Contents of data directory and their purpose.
 | wrapdb-releases.json  | Database of all available meson wraps. Generated using contrib/wrapdb.py.                                |
 | frameworks-list.json  | List of string fragments to categorize components into frameworks                                        |
 | crypto-oid.json       | Peter Gutmann's crypto oid [mapping](https://www.cs.auckland.ac.nz/~pgut001). GPL, BSD, or CC BY license |
+| glibc-stdlib.json     | Standard libraries that can be filtered out in C++ |

package/data/glibc-stdlib.json

@@ -0,0 +1,117 @@
+[
+  "algorithm",
+  "iomanip",
+  "list",
+  "ostream",
+  "streambuf",
+  "bitset",
+  "ios",
+  "locale",
+  "queue",
+  "string",
+  "complex",
+  "iosfwd",
+  "map",
+  "set",
+  "typeinfo",
+  "deque",
+  "iostream",
+  "memory",
+  "sstream",
+  "utility",
+  "exception",
+  "istream",
+  "new",
+  "stack",
+  "valarray",
+  "fstream",
+  "iterator",
+  "numeric",
+  "stdexcept",
+  "vector",
+  "functional",
+  "limits",
+  "debugging",
+  "inplace_vector",
+  "linalg",
+  "rcu",
+  "text_encoding",
+  "hazard_pointer",
+  "expected",
+  "flat_set",
+  "mdspan",
+  "spanstream",
+  "stdfloat",
+  "flat_map",
+  "generator",
+  "print",
+  "stacktrace",
+  "barrier",
+  "concepts",
+  "latch",
+  "semaphore",
+  "stop_token",
+  "bit",
+  "coroutine",
+  "numbers",
+  "source_location",
+  "syncstream",
+  "compare",
+  "format",
+  "ranges",
+  "span",
+  "version",
+  "any",
+  "execution",
+  "memory_resource",
+  "string_view",
+  "variant",
+  "charconv",
+  "filesystem",
+  "optional",
+  "shared_mutex",
+  "array",
+  "condition_variable",
+  "mutex",
+  "scoped_allocator",
+  "type_traits",
+  "atomic",
+  "forward_list",
+  "random",
+  "system_error",
+  "typeindex",
+  "chrono",
+  "future",
+  "ratio",
+  "thread",
+  "unordered_map",
+  "codecvt",
+  "initializer_list",
+  "regex",
+  "tuple",
+  "unordered_set",
+  "cassert",
+  "cctype",
+  "cerrno",
+  "cfenv",
+  "cfloat",
+  "cinttypes",
+  "ciso646",
+  "climits",
+  "clocale",
+  "cmath",
+  "csetjmp",
+  "csignal",
+  "cstdarg",
+  "cstdbool",
+  "cstddef",
+  "cstdint",
+  "cstdio",
+  "cstdlib",
+  "cstring",
+  "ctgmath",
+  "ctime",
+  "cuchar",
+  "cwchar",
+  "cwctype"
+]

package/index.js

@@ -119,6 +119,8 @@ import {
   parsePackageJsonName,
   parsePaketLockData,
   parsePiplockData,
+  parsePixiLockFile,
+  parsePixiTomlFile,
   parsePkgJson,
   parsePkgLock,
   parsePnpmLock,
@@ -1686,11 +1688,11 @@ export async function createJavaBom(path, options) {
               null,
             ).toString();
             rootSubProjectObj["purl"] = rootSubProjectPurl;
-            rootSubProjectObj["bom-ref"] =
-              decodeURIComponent(rootSubProjectPurl);
+            const rootSubProjectBomRef = decodeURIComponent(rootSubProjectPurl);
+            rootSubProjectObj["bom-ref"] = rootSubProjectBomRef;
             if (!allProjectsAddedPurls.includes(rootSubProjectPurl)) {
               allProjects.push(rootSubProjectObj);
-              rootDependsOn.push(rootSubProjectPurl);
+              rootDependsOn.push(rootSubProjectBomRef);
               allProjectsAddedPurls.push(rootSubProjectPurl);
             }
           }
@@ -1720,11 +1722,11 @@ export async function createJavaBom(path, options) {
               null,
             ).toString();
             rootSubProjectObj["purl"] = rootSubProjectPurl;
-            rootSubProjectObj["bom-ref"] =
-              decodeURIComponent(rootSubProjectPurl);
+            const rootSubProjectBomRef = decodeURIComponent(rootSubProjectPurl);
+            rootSubProjectObj["bom-ref"] = rootSubProjectBomRef;
             if (!allProjectsAddedPurls.includes(rootSubProjectPurl)) {
               allProjects.push(rootSubProjectObj);
-              rootDependsOn.push(rootSubProjectPurl);
+              rootDependsOn.push(rootSubProjectBomRef);
               allProjectsAddedPurls.push(rootSubProjectPurl);
             }
           }
@@ -2703,6 +2705,92 @@ export async function createNodejsBom(path, options) {
   });
 }
 
+/**
+ * Function to create bom string for Projects that use Pixi package manager.
+ * createPixiBom is based on createPythonBom.
+ * Pixi package manager utilizes many languages like python, rust, C/C++, ruby, etc.
+ * It produces a Lockfile which help produce reproducible envs across operating systems.
+ * This code will look at the operating system of our machine and create a BOM specific to that machine.
+ *
+ *
+ * @param {String} path
+ * @param {Object} options
+ */
+export async function createPixiBom(path, options) {
+  const allImports = {};
+  let metadataFilename = "";
+  let dependencies = [];
+  let pkgList = [];
+  let formulationList = [];
+  let frozen = true;
+  let parentComponent = createDefaultParentComponent(path, "pypi", options);
+  let PixiLockData = {};
+
+  const pixiToml = join(path, "pixi.toml");
+
+  // if pixi.toml file found then we
+  // Add parentComponent Details
+  const pixiTomlMode = existsSync(pixiToml);
+  if (pixiTomlMode) {
+    const tmpParentComponent = parsePixiTomlFile(pixiToml);
+    parentComponent = tmpParentComponent;
+    parentComponent.type = "application";
+    const ppurl = new PackageURL(
+      "pixi",
+      parentComponent.group || "",
+      parentComponent.name,
+      parentComponent.version || "latest",
+      null,
+      null,
+    ).toString();
+    parentComponent["bom-ref"] = decodeURIComponent(ppurl);
+    parentComponent["purl"] = ppurl;
+  }
+
+  const pixiLockFile = join(path, "pixi.lock");
+  const pixiFilesMode = existsSync(pixiLockFile);
+  if (pixiFilesMode) {
+    // Instead of what we do in createPythonBOM
+    // where we install packages and run `getPipFrozenTree`
+    // here I assume `pixi.lock` file to contain the accuracte version information
+    // across all platforms
+    PixiLockData = parsePixiLockFile(pixiLockFile, path);
+    metadataFilename = "pixi.lock";
+  } else {
+    if (options.installDeps) {
+      generatePixiLockFile(path);
+
+      const pixiLockFile = join(path, "pixi.lock");
+      if (!existsSync(pixiLockFile) && DEBUG_MODE) {
+        console.log(
+          "Unexpected Error tried to generate pixi.lock file but failed.",
+        );
+        console.log("This will result in creations of empty BOM.");
+      }
+      PixiLockData = parsePixiLockFile(pixiLockFile);
+      metadataFilename = "pixi.lock";
+    } else {
+      // If no pixi.lock and installDeps is false
+      // then return None and let `createPythonBOM()` handle generation of BOM.
+      return null;
+    }
+  }
+
+  pkgList = PixiLockData.pkgList;
+  frozen = PixiLockData.frozen;
+  formulationList = PixiLockData.formulationList;
+  dependencies = PixiLockData.dependencies;
+
+  return buildBomNSData(options, pkgList, "pypi", {
+    allImports,
+    src: path,
+    filename: metadataFilename,
+    dependencies,
+    parentComponent,
+    formulationList,
+  });
+}
+
 /**
  * Function to create bom string for Python projects
  *
@@ -2718,6 +2806,19 @@ export async function createPythonBom(path, options) {
   const tempDir = mkdtempSync(join(tmpdir(), "cdxgen-venv-"));
   let parentComponent = createDefaultParentComponent(path, "pypi", options);
   const pipenvMode = existsSync(join(path, "Pipfile"));
+
+  // If pixi is used then just return that as output instead
+  const pixiLockFile = join(path, "pixi.lock");
+  const pixiFilesMode = existsSync(pixiLockFile);
+  const pixiToml = join(path, "pixi.toml");
+  const pixiTomlMode = existsSync(pixiToml);
+  if (pixiTomlMode || pixiFilesMode) {
+    const BomNSData = createPixiBom(path, options);
+    if (BomNSData) {
+      return BomNSData;
+    }
+  }
+
   let poetryFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}poetry.lock`,
@@ -2759,7 +2860,7 @@ export async function createPythonBom(path, options) {
     `${options.multiProject ? "**/" : ""}*.egg-info`,
     options,
   );
-  const setupPy = join(path, "setup.py");
+
   const pyProjectFile = join(path, "pyproject.toml");
   const pyProjectMode = existsSync(pyProjectFile);
   if (pyProjectMode) {
@@ -2787,6 +2888,7 @@ export async function createPythonBom(path, options) {
   }
   const requirementsMode = reqFiles?.length || reqDirFiles?.length;
   const poetryMode = poetryFiles?.length;
+  const setupPy = join(path, "setup.py");
   const setupPyMode = existsSync(setupPy);
   // Poetry sets up its own virtual env containing site-packages so
   // we give preference to poetry lock file. Issue# 129
@@ -3069,6 +3171,7 @@ export async function createPythonBom(path, options) {
       }
     }
   }
+
   // Final fallback is to manually parse setup.py if we still
   // have an empty list
   if (!pkgList.length && setupPyMode) {
@@ -3319,6 +3422,8 @@ export async function createGoBom(path, options) {
           },
         );
         if (result.status !== 0 || result.error) {
+          // go list -deps command may not work when private packages are involved
+          // So we support a fallback to only operate with go mod graph command output in such instances
           console.log("go list -deps command has failed.");
           shouldManuallyParse = true;
           if (DEBUG_MODE && result.stdout) {
@@ -3392,17 +3497,50 @@ export async function createGoBom(path, options) {
             }
           }
         } else {
-          shouldManuallyParse = true;
-          console.log(
-            "1. Check if the correct version of golang is installed. Try building the application using go build or make command to troubleshoot.",
-          );
-          console.log(
-            "2. If the application uses private go modules, ensure the environment variable GOPRIVATE is set with the comma-separated repo names.\nEnsure $HOME/.netrc file contains a valid username and password for the private repos.",
-          );
-          console.log(
-            "3. Alternatively, consider generating a post-build SBOM from the built binary using blint. Use the official container image and invoke cdxgen with the arguments `-t binary --lifecycle post-build`.",
-          );
-          options.failOnError && process.exit(1);
+          if (DEBUG_MODE) {
+            console.log("Executing go mod graph in", basePath);
+          }
+          // Next we use the go mod graph command to construct the dependency tree
+          result = spawnSync("go", ["mod", "graph"], {
+            cwd: basePath,
+            encoding: "utf-8",
+            timeout: TIMEOUT_MS,
+            maxBuffer: MAX_BUFFER,
+          });
+          if (result.stdout) {
+            const cmdOutput = Buffer.from(result.stdout).toString();
+            // The arguments to parseGoModGraph are slightly different to force inclusion of all packages
+            const retMap = await parseGoModGraph(
+              cmdOutput,
+              f,
+              gosumMap,
+              [],
+              {},
+            );
+            if (retMap.pkgList?.length) {
+              pkgList = pkgList.concat(retMap.pkgList);
+              pkgList = trimComponents(pkgList);
+            }
+            if (retMap.dependenciesList?.length) {
+              dependencies = mergeDependencies(
+                dependencies,
+                retMap.dependenciesList,
+                parentComponent,
+              );
+            }
+          } else {
+            shouldManuallyParse = true;
+            console.log(
+              "1. Check if the correct version of golang is installed. Try building the application using go build or make command to troubleshoot.",
+            );
+            console.log(
+              "2. If the application uses private go modules, ensure the environment variable GOPRIVATE is set with the comma-separated repo names.\nEnsure $HOME/.netrc file contains a valid username and password for the private repos.",
+            );
+            console.log(
+              "3. Alternatively, consider generating a post-build SBOM from the built binary using blint. Use the official container image and invoke cdxgen with the arguments `-t binary --lifecycle post-build`.",
+            );
+            options.failOnError && process.exit(1);
+          }
         }
       }
       if (pkgList.length && !shouldManuallyParse) {
@@ -5843,7 +5981,7 @@ export async function createMultiXBom(pathList, options) {
     }
     // Jar scanning is enabled by default
     // See #330
-    bomData = createJarBom(path, options);
+    bomData = await createJarBom(path, options);
     if (bomData?.bomJson?.components?.length) {
       if (DEBUG_MODE) {
         console.log(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "10.9.4",
+  "version": "10.9.6",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -83,10 +83,11 @@
     "ssri": "^10.0.6",
     "table": "^6.8.2",
     "tar": "^6.2.1",
+    "toml": "^3.0.0",
     "uuid": "^10.0.0",
+    "validate-iri": "^1.0.1",
     "xml-js": "^1.6.11",
-    "yargs": "^17.7.2",
-    "validate-iri": "^1.0.1"
+    "yargs": "^17.7.2"
   },
   "optionalDependencies": {
     "@appthreat/atom": "2.0.17",

package/postgen.js

@@ -241,7 +241,6 @@ export function filterBom(bomJson, options) {
     }
   }
   if (!anyFiltered && DEBUG_MODE) {
-    console.log("No components got filtered with the given criteria.");
     if (
       options.requiredOnly &&
       !options.deep &&

package/types/index.d.ts

@@ -53,6 +53,18 @@ export function createJavaBom(path: string, options: any): Promise<any>;
  * @param {Object} options Parse options from the cli
  */
 export function createNodejsBom(path: string, options: any): Promise<any>;
+/**
+ * Function to create bom string for Projects that use Pixi package manager.
+ * createPixiBom is based on createPythonBom.
+ * Pixi package manager utilizes many languages like python, rust, C/C++, ruby, etc.
+ * It produces a Lockfile which help produce reproducible envs across operating systems.
+ * This code will look at the operating system of our machine and create a BOM specific to that machine.
+ *
+ *
+ * @param {String} path
+ * @param {Object} options
+ */
+export function createPixiBom(path: string, options: any): Promise<any>;
 /**
  * Function to create bom string for Python projects
  *

package/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AA2vBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAyUD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BA4/BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA2chB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA4ahB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAkUhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAiUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA6XhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDA2CC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BAmclB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAiUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAsOhB;AAED;;;;;;GAMG;AACH,wDAFY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAAC,CAwHxE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.js"],"names":[],"mappings":"AA6vBA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAyUD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAiEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BA4/BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA2chB;AAED;;;;;;;;;;GAUG;AACH,wEAyEC;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA2bhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqWhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAqIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAiDhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBA+KhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAwFhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAiUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAwJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAmFhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA6XhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDA2CC;AAED;;;;;;;;;GASG;AACH,2GA6BC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BAmclB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAiUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBAsOhB;AAED;;;;;;GAMG;AACH,wDAFY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG,SAAS,CAAC,CAwHxE"}

package/types/postgen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../postgen.js"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,+DAcC;AAED;;;;;;;GAOG;AACH,+DAqCC;AAED;;;;;;;GAOG;AACH,gEA+BC;AAED;;;;;;;GAOG;AACH,2DAwIC;AAED;;GAEG;AACH,+CAIC"}
+{"version":3,"file":"postgen.d.ts","sourceRoot":"","sources":["../postgen.js"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,+DAcC;AAED;;;;;;;GAOG;AACH,+DAqCC;AAED;;;;;;;GAOG;AACH,gEA+BC;AAED;;;;;;;GAOG;AACH,2DAuIC;AAED;;GAEG;AACH,+CAIC"}

package/types/utils.d.ts

@@ -455,12 +455,45 @@ export function getPyModules(src: string, epkgList: any[], options: any): Promis
  * @param {Object} setupPyData Contents of setup.py
  */
 export function parseSetupPyFile(setupPyData: any): Promise<any[]>;
+/**
+ * Method to parse pixi.lock data
+ *
+ * @param {Object} pixiData Contents of pixi.lock file
+ */
+export function parsePixiLockFile(pixiLockFileName: any, path: any): {
+    pkgList: any;
+    formulationList: any[];
+    rootList: any[];
+    dependenciesList: {
+        ref: string;
+        dependsOn: string[];
+    }[];
+    frozen: boolean;
+};
+/**
+ * Method to parse pixi.toml file
+ *
+ * @param {String} pixiToml
+ */
+export function parsePixiTomlFile(pixiToml: string): {
+    description: any;
+    name: any;
+    version: any;
+    homepage: any;
+    repository: any;
+};
 /**
  * Method to construct a GitHub API url for the given repo metadata
  * @param {Object} repoMetadata Repo metadata with group and name
  * @return {String|undefined} github api url (or undefined - if not enough data)
  */
 export function repoMetadataToGitHubApiUrl(repoMetadata: any): string | undefined;
+/**
+ * Method to run cli command `pixi install`
+ *
+ *
+ */
+export function generatePixiLockFile(path: any): void;
 /**
  * Method to split GitHub url into its parts
  * @param {String} repoUrl Repository url

package/types/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../utils.js"],"names":[],"mappings":"AAsJA,yCAYC;AAED,2CAQC;AAqKD;;;;;;;GAOG;AACH,4EAoBC;AAED;;;;;;GAMG;AACH,mGAkDC;AAED;;;;;;;;GAQG;AACH,yGASC;AAgBD;;;;;GAKG;AACH,qCAHW,MAAM,WACN,MAAM,0BAqBhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BAoBhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAiBnB;AAED;;;;;;;;;GASG;AACH,iEA2BC;AAED;;;;;GAKG;AACH,6CAqDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBAkFjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqVhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MA2DhB;AAwBD;;;;GAIG;AACH,4CAFW,MAAM;;;GAkOhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AA2BD;;;;;GAKG;AACH,wCAHW,MAAM,oBACN,MAAM;;;;;;;;;GA0ZhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;IAqDC;AAED;;;;;;GAMG;AACH,0CALW,MAAM,WACN,MAAM,OAgJhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,qBACN,MAAM,oBACN,MAAM,uBACN,MAAM;;;;;;;;;;;;;;;;EAkNhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EA6ChB;AAED;;;;GAIG;AACH,iDAFW,MAAM;;;;;;;;EAsChB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,YACN,MAAM,0BAGJ,MAAM,CAkElB;AAED;;;;;;GAMG;AACH,6CAJW,MAAM,YACN,MAAM,cACN,MAAM,MA2EhB;AAED;;;GAGG;AACH,iDAFW,MAAM,SA4ChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,kDAUC;AAED;;;;;GAKG;AACH,mFAmGC;AAED;;;;;;;;;GASG;AACH,sFAMC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CA8B3B;AAED;;;;;;;;;GASG;AACH,0EAFY,OAAO,QAAQ,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,OAAO,QAAQ,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,iFAFW,GAAC,OA0BX;AAED;;;;;GAKG;AACH,sFAsNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;GAIG;AACH,6CAFW,MAAM,MAmEhB;AAED;;;;;GAKG;AACH,6DAFW,MAAM;;;;;;;GAqHhB;AAED;;;;;GAKG;AACH,mFAgKC;AAED;;;;;;GAMG;AACH,kCAJW,MAAM;;;;;;;;GA2EhB;AAED;;;;GAIG;AACH,mEAqBC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CASnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,OAAO,QAAQ,CA8D1B;AAED;;;;GAIG;AACH,iEAgDC;AAED,+FA4BC;AAED,8EA2EC;AAED;;;;;GAKG;AACH,0CAHW,MAAM;;;GA0DhB;AA0BD;;;;;;;;;GASG;AACH,2CAPW,MAAM,aACN,MAAM;;;;;;GA6FhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAuChB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBAgChB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;;;;;;;;GAuPhB;AAED;;;;GAIG;AACH,kEAqEC;AAED;;;;GAIG;AACH,gEA0DC;AA0BD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAiLjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BAsIjB;AAED;;;IAwIC;AAED,wEA0BC;AAED,mEAqCC;AAED,0DAkBC;AAED,wDA+DC;AAED,0FAkEC;AAED;;IAsCC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAyCD,qFA2HC;AAED,8DA0BC;AAED,sDAiCC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EA4EC;AAED,kEAoDC;AAED;;;;;;;;GAQG;AACH,kGAwPC;AAED;;;EAiNC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2IhB;AAED;;;;;;EA+HC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;IA2IC;AA2CD;;;;GAIG;AACH,0FAHW,MAAM,WACN,MAAM,UAuDhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;EAqBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,oIAgCC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA6JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;;EA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,OAAO,QAAQ,CAU3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBAqThB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA4EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,UAiChB;AACD;;;;;;GAMG;AAEH,uDALW,MAAM,iBACN,MAAM,EAAE,GACN,GAAG,CAuCf;AACD;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0DA2EC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OA6ChB;AAqFD;;;;;;;;;GASG;AACH,2CAPW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyYhB;AAED;;;;;;;;;;;GAWG;AACH,gDAPW,MAAM,+BAEN,MAAM;;;;;;;;;;;;;;;;EA4KhB;AAGD;;;;;EAmBC;AAED;;;;;;GAMG;AACH,kEAHW,MAAM,cACN,MAAM,6BA0IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EA6PC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAgQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AA8HD;;;;GAIG;AACH;;;GAkHC;AAED,yEA0GC;AAED;;;;;;GAMG;AACH,mDAkBC;AAED;;;;;;;;;;GAUG;AACH,0DAqBC;AAED;;;;;GAKG;AACH,4DAWC;AAED;;;;;;;GAOG;AACH,2EAgCC;AAp/WD,gCAAgF;AAChF,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AAsBnE,iCAEE;AAiBF,iCAIyC;AAGzC,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAK/B,4CAEmE;AAGnE,6CAE6D;AAG7D,oCAEoD;AAGpD,uCAEuD;AAYvD,8BAAyC;AAczC,gCAA6C;AAU7C,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,6BAA+B;AAM/B,kDAWE;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6FE;;;;AAwHF,8BAQG;AAkzIH,8CAUE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../utils.js"],"names":[],"mappings":"AA2JA,yCAYC;AAED,2CAQC;AAsKD;;;;;;;GAOG;AACH,4EAoBC;AAED;;;;;;GAMG;AACH,mGAkDC;AAED;;;;;;;;GAQG;AACH,yGASC;AAgBD;;;;;GAKG;AACH,qCAHW,MAAM,WACN,MAAM,0BAqBhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BAoBhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAiBnB;AAED;;;;;;;;;GASG;AACH,iEA2BC;AAED;;;;;GAKG;AACH,6CAqDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBAkFjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqVhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MA2DhB;AAwBD;;;;GAIG;AACH,4CAFW,MAAM;;;GAkOhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AA2BD;;;;;GAKG;AACH,wCAHW,MAAM,oBACN,MAAM;;;;;;;;;GA0ZhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;IAqDC;AAED;;;;;;GAMG;AACH,0CALW,MAAM,WACN,MAAM,OAgJhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,qBACN,MAAM,oBACN,MAAM,uBACN,MAAM;;;;;;;;;;;;;;;;EAkNhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EA6ChB;AAED;;;;GAIG;AACH,iDAFW,MAAM;;;;;;;;EAsChB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,YACN,MAAM,0BAGJ,MAAM,CAkElB;AAED;;;;;;GAMG;AACH,6CAJW,MAAM,YACN,MAAM,cACN,MAAM,MA2EhB;AAED;;;GAGG;AACH,iDAFW,MAAM,SA4ChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,kDAUC;AAED;;;;;GAKG;AACH,mFAmGC;AAED;;;;;;;;;GASG;AACH,sFAMC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CA8B3B;AAED;;;;;;;;;GASG;AACH,0EAFY,OAAO,QAAQ,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,OAAO,QAAQ,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,iFAFW,GAAC,OA0BX;AAED;;;;;GAKG;AACH,sFAsNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;GAIG;AACH,6CAFW,MAAM,MAmEhB;AAED;;;;;GAKG;AACH,6DAFW,MAAM;;;;;;;GAqHhB;AAED;;;;;GAKG;AACH,mFAgKC;AAED;;;;;;GAMG;AACH,kCAJW,MAAM;;;;;;;;GA2EhB;AAED;;;;GAIG;AACH,mEAqBC;AAgBD;;;;GAIG;AACH;;;;;;;;;EA8KC;AAED;;;;GAIG;AACH;;;;;;EAcC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,sDAoBC;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CASnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,OAAO,QAAQ,CA8D1B;AAED;;;;GAIG;AACH,iEAgDC;AAED,+FA4BC;AAED,8EA2EC;AAED;;;;;GAKG;AACH,0CAHW,MAAM;;;GA0DhB;AA0BD;;;;;;;;;GASG;AACH,2CAPW,MAAM,aACN,MAAM;;;;;;GA6FhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAuChB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBAgChB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;;;;;;;;GAuPhB;AAED;;;;GAIG;AACH,kEAqEC;AAED;;;;GAIG;AACH,gEA0DC;AA0BD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAiLjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BAsIjB;AAED;;;IAwIC;AAED,wEA0BC;AAED,mEAqCC;AAED,0DAkBC;AAED,wDA+DC;AAED,0FAkEC;AAuBD;;IA+DC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAyCD,qFA2HC;AAED,8DA0BC;AAED,sDAiCC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EA4EC;AAED,kEAoDC;AAED;;;;;;;;GAQG;AACH,kGAwPC;AAED;;;EAoNC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2IhB;AAED;;;;;;EA+HC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;IA2IC;AA2CD;;;;GAIG;AACH,0FAHW,MAAM,WACN,MAAM,UAuDhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;EAqBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,oIAgCC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA6JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;;EA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,OAAO,QAAQ,CAU3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBAqThB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA4EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,UAiChB;AACD;;;;;;GAMG;AAEH,uDALW,MAAM,iBACN,MAAM,EAAE,GACN,GAAG,CAuCf;AACD;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0DA2EC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OA6ChB;AAqFD;;;;;;;;;GASG;AACH,2CAPW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyYhB;AAED;;;;;;;;;;;GAWG;AACH,gDAPW,MAAM,+BAEN,MAAM;;;;;;;;;;;;;;;;EA4KhB;AAGD;;;;;EAmBC;AAED;;;;;;GAMG;AACH,kEAHW,MAAM,cACN,MAAM,6BA0IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EA6PC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAuQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AA8HD;;;;GAIG;AACH;;;GAkHC;AAED,yEA0GC;AAED;;;;;;GAMG;AACH,mDAkBC;AAED;;;;;;;;;;GAUG;AACH,0DAqBC;AAED;;;;;GAKG;AACH,4DAWC;AAED;;;;;;;GAOG;AACH,2EAgCC;AApyXD,gCAAgF;AAChF,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AAsBnE,iCAEE;AAqBF,iCAIyC;AAGzC,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAK/B,4CAEmE;AAGnE,6CAE6D;AAG7D,oCAEoD;AAGpD,uCAEuD;AAYvD,8BAAyC;AAczC,gCAA6C;AAU7C,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,6BAA+B;AAM/B,kDAWE;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8FE;;;;AAwHF,8BAQG;AAqiJH,8CAUE"}

package/utils.js

@@ -46,6 +46,7 @@ import {
   satisfies,
   valid,
 } from "semver";
+import toml from "toml";
 import { IriValidationStrategy, validateIri } from "validate-iri";
 import { xml2js } from "xml-js";
 import { getTreeWithPlugin } from "./piptree.js";
@@ -85,6 +86,10 @@ export const frameworksList = JSON.parse(
 const selfPJson = JSON.parse(
   readFileSync(join(dirNameStr, "package.json"), "utf-8"),
 );
+
+const CPP_STD_MODULES = JSON.parse(
+  readFileSync(join(dirNameStr, "data", "glibc-stdlib.json"), "utf-8"),
+);
 const _version = selfPJson.version;
 
 // Refer to contrib/py-modules.py for a script to generate this list
@@ -280,6 +285,7 @@ export const PROJECT_TYPE_ALIASES = {
     "python310",
     "python311",
     "python312",
+    "pixi",
   ],
   go: ["go", "golang", "gomod", "gopkg"],
   rust: ["rust", "rust-lang", "cargo"],
@@ -2604,7 +2610,7 @@ export function parseGradleDep(
               version = undefined;
             }
           }
-          let purlString = new PackageURL(
+          const purl = new PackageURL(
             "maven",
             group !== "project" ? group : rootProjectGroup,
             name,
@@ -2612,7 +2618,7 @@ export function parseGradleDep(
             { type: "jar" },
             null,
           ).toString();
-          purlString = decodeURIComponent(purlString);
+          const purlString = decodeURIComponent(purl);
           keys_cache[`${purlString}_${last_purl}`] = true;
           // Filter duplicates
           if (!deps_keys_cache[purlString]) {
@@ -2623,8 +2629,8 @@ export function parseGradleDep(
               version: version !== undefined ? version : rootProjectVersion,
               qualifiers: { type: "jar" },
             };
-            adep["purl"] = purlString;
-            adep["bom-ref"] = decodeURIComponent(purlString);
+            adep["purl"] = purl;
+            adep["bom-ref"] = purlString;
             if (scope) {
               adep["scope"] = scope;
             }
@@ -4251,6 +4257,222 @@ export async function parseSetupPyFile(setupPyData) {
   return await parseReqFile(lines.join("\n"), false);
 }
 
+/**
+ * Method to create purl using information in pixi.lock file.
+ * According to pixi lock file satisfiability (https://pixi.sh/latest/features/lockfile/#lockfile-satisfiability)
+ *
+ *
+ *
+ * @param {*} packageData
+ * @returns
+ */
+function createPurlTemplate(packageData) {
+  const purlTemplate = `pkg:${packageData["kind"]}/${packageData["name"]}@${packageData["version"]}-${packageData["build"]}?os=${packageData["subdir"]}`;
+  return purlTemplate;
+}
+
+/**
+ * Method to parse pixi.lock data
+ *
+ * @param {Object} pixiData Contents of pixi.lock file
+ */
+export function parsePixiLockFile(pixiLockFileName, path) {
+  const pixiFileData = readFileSync(pixiLockFileName, { encoding: "utf-8" });
+  const pixiLockData = _load(pixiFileData);
+
+  // this function returns
+  let pkgList = [];
+  const formulationList = [];
+  const rootList = [];
+  let dependenciesList = [];
+  // we do not set false because we have assumed that pixi lock is accurate
+  const frozen = true;
+
+  /**
+   * pixiMapper used with a map on pixi packages list.
+   * the pixi list contains the following information e.g.
+   * {kind: conda
+   *  name: alsa-lib
+   *  version: 1.2.11
+   *  build: h31becfc_1
+   *  build_number: 1
+   *  subdir: linux-aarch64
+   *  url: https://conda.anaconda.org/conda-forge/linux-aarch64/alsa-lib-1.2.11-h31becfc_1.conda
+   *  sha256: d062bc712dd307714dfdb0f7da095a510c138c5db76321494a516ac127f9e5cf
+   *  md5: 76bf292a85a0556cef4f500420cabe6c
+   *  depends:
+   *  - libgcc-ng >=12
+   *  license: LGPL-2.1-or-later
+   *  license_family: GPL
+   *  size: 584152
+   *  timestamp: 1709396718705
+   * }
+   * We create the purl using the following logic:
+   * "purl": "pkg:{kind}/{name}@{version}-{build}?os={os}"
+   * type would be "library" and evidence would be
+   * {
+   *  "identity": {
+   *                    "field": "purl",
+   *                    "confidence": 1,
+   *                    "methods": [
+   *                        {
+   *                            "technique": "instrumentation",
+   *                            "confidence": 1,
+   *                            "value": "pixi.lock"
+   *                        }
+   *                    ]
+   *                }
+   * }
+   *
+   */
+  function pixiMapper(packageData) {
+    // return pkgList
+    /** E.g. of what a pkgList element looks like
+     * {
+     *      name: "conda-content-trust",
+     *      version: "latest",
+     *      purl: "pkg:pypi/conda-content-trust@latest",
+     *      type: "library",
+     *      "bom-ref": "pkg:pypi/conda-content-trust@latest",
+     *      scope: "excluded",
+     *      evidence: {
+     *        identity: {
+     *          field: "purl",
+     *          confidence: 1,
+     *          methods: [
+     *            {
+     *              technique: "instrumentation",
+     *              confidence: 1,
+     *              value: "/home/greatsage/miniconda3",
+     *            },
+     *          ],
+     *        },
+     *      },
+     *      properties: [
+     *        {
+     *          name: "SrcFile",
+     *          value: "/home/greatsage/projects/supplyChain/trials/pythonprojs/fastapi/requirements.txt",
+     *        },
+     *      ],
+     *    }
+     *
+     */
+    const purlTemplate = createPurlTemplate(packageData);
+    return {
+      name: packageData["name"],
+      version: packageData["version"],
+      purl: purlTemplate,
+      type: "library",
+      "bom-ref": purlTemplate,
+      // "licenses": [
+      //   [{
+      //       "id": packageData["license"]
+      //   }]
+      // ],
+      supplier: {
+        name: packageData["build"],
+        url: packageData["url"],
+      },
+      // "hashes": [
+      //   {"md5": packageData["md5"]},
+      //   {"sha256": packageData["sha256"]}
+      // ],
+      evidence: {
+        identity: {
+          field: "purl",
+          confidence: 1,
+          methods: [
+            {
+              technique: "instrumentation",
+              confidence: 1,
+              // "value": `${path}/.pixi/envs/default`
+            },
+          ],
+        },
+      },
+      properties: [
+        { operatingSystem: packageData["subdir"] },
+        { build_number: packageData["build_number"] },
+        { build: packageData["build"] },
+      ],
+    };
+  }
+
+  function mapAddEvidenceValue(p) {
+    // TODO: get pixi environment variable (PR #1343)
+    p["evidence"]["identity"]["methods"]["value"] =
+      `${path}/.pixi/envs/default`;
+    return p;
+  }
+  // create the pkgList
+  pkgList = pixiLockData["packages"].map(pixiMapper);
+  pkgList = pkgList.map(mapAddEvidenceValue);
+
+  // create dependencies
+  const dictionary_packages = pixiLockData["packages"].reduce(
+    (accumulator, currentObject) => {
+      accumulator[currentObject["name"]] = currentObject;
+      return accumulator;
+    },
+    {},
+  );
+
+  dependenciesList = [];
+  for (const package_iter of pixiLockData["packages"]) {
+    const depends = package_iter["depends"];
+    if (!depends) {
+      continue;
+    }
+
+    const purltemplate = createPurlTemplate(package_iter);
+    const subdir = package_iter["subdir"];
+    const dependsOn = [];
+    for (const depends_package of depends) {
+      const depends_package_name = depends_package.split(" ");
+      const depends_package_information =
+        dictionary_packages[depends_package_name[0] + subdir];
+      if (!depends_package_information) {
+        continue;
+      }
+      dependsOn.push(createPurlTemplate(depends_package_information));
+    }
+
+    dependenciesList.push({
+      ref: purltemplate,
+      dependsOn: dependsOn,
+    });
+  }
+
+  return {
+    pkgList,
+    formulationList,
+    rootList,
+    dependenciesList,
+    frozen,
+  };
+}
+
+/**
+ * Method to parse pixi.toml file
+ *
+ * @param {String} pixiToml
+ */
+export function parsePixiTomlFile(pixiToml) {
+  const pixiTomlFile = readFileSync(pixiToml, { encoding: "utf-8" });
+  const tomlData = toml.parse(pixiTomlFile);
+  const pkg = {};
+  if (!tomlData) {
+    return pkg;
+  }
+  pkg.description = tomlData["project"]["description"];
+  pkg.name = tomlData["project"]["name"];
+  pkg.version = tomlData["project"]["version"];
+  // pkg.authors = tomlData['project']['authors'];
+  pkg.homepage = tomlData["project"]["homepage"];
+  pkg.repository = tomlData["project"]["repository"];
+  return pkg;
+}
+
 /**
  * Method to construct a GitHub API url for the given repo metadata
  * @param {Object} repoMetadata Repo metadata with group and name
@@ -4270,6 +4492,33 @@ export function repoMetadataToGitHubApiUrl(repoMetadata) {
   return undefined;
 }
 
+/**
+ * Method to run cli command `pixi install`
+ *
+ *
+ */
+export function generatePixiLockFile(path) {
+  const result = spawnSync("pixi", ["install"], {
+    encoding: "utf-8",
+  });
+
+  if (result.status !== 0) {
+    // Handle errors
+    if (result.error && result.error.code === "ENOENT") {
+      console.error(
+        "Error: pixi command not found. Make sure pixi.js is installed globally.",
+      );
+    } else {
+      console.error(
+        `Error executing pixi install: ${result.error || result.stderr.toString()}`,
+      );
+    }
+    process.exit(1);
+  } else {
+    console.log("Dependencies installed successfully.");
+  }
+}
+
 /**
  * Method to split GitHub url into its parts
  * @param {String} repoUrl Repository url
@@ -6136,7 +6385,29 @@ export function recurseImageNameLookup(keyValueObj, pkgList, imgList) {
   return imgList;
 }
 
+function substituteBuildArgs(statement, buildArgs) {
+  for (const argMatch of [
+    ...statement.matchAll(/\${?([^:\/\\}]+)}?/g),
+  ].reverse()) {
+    const fullArgName = argMatch[0];
+    const argName = argMatch[1];
+    const argIndex = argMatch.index;
+    if (buildArgs.has(argName)) {
+      statement =
+        statement.slice(0, argIndex) +
+        buildArgs.get(argName) +
+        statement.slice(argIndex + fullArgName.length);
+    } else {
+      console.warn(
+        `Unable to substitute build argument '${fullArgName}' in '${statement}'.`,
+      );
+    }
+  }
+  return statement;
+}
+
 export function parseContainerFile(fileContents) {
+  const buildArgs = new Map();
   const imagesSet = new Set();
   const buildStageNames = [];
   for (let line of fileContents.split("\n")) {
@@ -6146,11 +6417,26 @@ export function parseContainerFile(fileContents) {
       continue; // skip commented out lines
     }
 
+    if (line.startsWith("ARG")) {
+      const argStatement = line.split("ARG ")[1].split("=");
+
+      if (argStatement.length < 2) {
+        continue; // skip ARG statements without default value
+      }
+
+      const argName = argStatement[0].trim();
+      let argValue = argStatement[1].trim().replace(/['"]+/g, "");
+      if (argValue.includes("$")) {
+        argValue = substituteBuildArgs(argValue, buildArgs);
+      }
+      buildArgs.set(argName, argValue);
+    }
+
     if (line.startsWith("FROM")) {
       // The alias could be called AS or as
       const fromStatement = line.split("FROM ")[1].split(/\s(as|AS)\s/);
 
-      const imageStatement = fromStatement[0].trim();
+      let imageStatement = fromStatement[0].trim();
       const buildStageName =
         fromStatement.length > 1
           ? fromStatement[fromStatement.length - 1].trim()
@@ -6163,6 +6449,15 @@ export function parseContainerFile(fileContents) {
         }
         continue;
       }
+      if (imageStatement.includes("$")) {
+        imageStatement = substituteBuildArgs(imageStatement, buildArgs);
+        if (imageStatement.includes("$")) {
+          console.warn(
+            `Unable to substitute build arguments in '${line}' statement.`,
+          );
+          continue;
+        }
+      }
       imagesSet.add(imageStatement);
 
       if (buildStageName) {
@@ -7329,6 +7624,9 @@ export function parseCsProjAssetsData(csProjData, assetsJsonFile) {
   // extract name, operator, version from .NET package representation
   // like "NLog >= 4.5.0"
   function extractNameOperatorVersion(inputStr) {
+    if (!inputStr) {
+      return null;
+    }
     const extractNameOperatorVersion = /([\w.-]+)\s*([><=!]+)\s*([\d.]+)/;
     const match = inputStr.match(extractNameOperatorVersion);
 
@@ -7821,7 +8119,7 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
             "composer",
             group,
             name,
-            pkg.version,
+            pkg.version?.toString(),
             null,
             null,
           ).toString();
@@ -7830,7 +8128,7 @@ export function parseComposerLock(pkgLockFile, rootRequires) {
             name: name,
             purl,
             "bom-ref": decodeURIComponent(purl),
-            version: pkg.version,
+            version: pkg.version?.toString(),
             repository: pkg.source,
             license: pkg.license,
             description: pkg.description,
@@ -11045,6 +11343,7 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
   const epkgMap = {};
   let parentComponent = undefined;
   const dependsOn = [];
+
   (epkgList || []).forEach((p) => {
     epkgMap[`${p.group}/${p.name}`] = p;
   });
@@ -11193,6 +11492,12 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
     const version = "";
     // We need to resolve the name to an os package here
     const name = fileName.replace(extn, "");
+    // Logic here if name matches the standard library of cpp
+    // we skip it
+    // Load the glibc-stdlib.json file, which contains std lib for cpp
+    if (CPP_STD_MODULES.includes(name)) {
+      continue;
+    }
     let apkg = getOSPackageForFile(afile, osPkgsList) ||
       epkgMap[`${group}/${name}`] || {
         name,

package/utils.test.js

@@ -3033,8 +3033,8 @@ test("parsePnpmLock", async () => {
   expect(parsedList.dependenciesList).toHaveLength(462);
   expect(parsedList.pkgList.filter((pkg) => !pkg.scope)).toHaveLength(3);
   parsedList = await parsePnpmLock("./pnpm-lock.yaml");
-  expect(parsedList.pkgList.length).toEqual(652);
-  expect(parsedList.dependenciesList.length).toEqual(652);
+  expect(parsedList.pkgList.length).toEqual(653);
+  expect(parsedList.dependenciesList.length).toEqual(653);
   expect(parsedList.pkgList[0]).toEqual({
     group: "@ampproject",
     name: "remapping",
@@ -4047,7 +4047,7 @@ test("parse containerfiles / dockerfiles", () => {
   const dep_list = parseContainerFile(
     readFileSync("./test/data/Dockerfile", { encoding: "utf-8" }),
   );
-  expect(dep_list.length).toEqual(4);
+  expect(dep_list.length).toEqual(7);
   expect(dep_list[0]).toEqual({
     image: "hello-world",
   });
@@ -4060,6 +4060,15 @@ test("parse containerfiles / dockerfiles", () => {
   expect(dep_list[3]).toEqual({
     image: "hello-world:latest@sha256:1234567890abcdef",
   });
+  expect(dep_list[4]).toEqual({
+    image: "docker.io/hello-world@sha256:1234567890abcdef",
+  });
+  expect(dep_list[5]).toEqual({
+    image: "docker.io/hello-world:latest@sha256:1234567890abcdef",
+  });
+  expect(dep_list[6]).toEqual({
+    image: "docker.io/hello-world:latest",
+  });
 });
 
 test("parse bitbucket-pipelines", () => {