@cyclonedx/cdxgen 11.2.3 → 11.2.5

package/bin/cdxgen.js

@@ -56,10 +56,6 @@ if (configPath) {
   }
 }
 
-let url = import.meta.url;
-if (!url.startsWith("file://")) {
-  url = new URL(`file://${import.meta.url}`).toString();
-}
 const dirName = dirNameStr;
 
 import yargs from "yargs";
@@ -218,6 +214,10 @@ const args = yargs(hideBin(process.argv))
     default: "semantics.slices.json",
     hidden: true,
   })
+  .option("openapi-spec-file", {
+    description: "Path for the openapi specification file (SaaSBOM).",
+    hidden: true,
+  })
   .option("spec-version", {
     description: "CycloneDX Specification version to use. Defaults to 1.6",
     default: 1.6,
@@ -993,6 +993,7 @@ const checkPermissions = (filePath, options) => {
       dataFlowSlicesFile: options.dataFlowSlicesFile,
       reachablesSlicesFile: options.reachablesSlicesFile,
       semanticsSlicesFile: options.semanticsSlicesFile,
+      openapiSpecFile: options.openapiSpecFile,
       includeCrypto: options.includeCrypto,
       specVersion: options.specVersion,
       profile: options.profile,

package/bin/verify.js

@@ -9,10 +9,6 @@ import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { dirNameStr } from "../lib/helpers/utils.js";
 
-let url = import.meta.url;
-if (!url.startsWith("file://")) {
-  url = new URL(`file://${import.meta.url}`).toString();
-}
 const dirName = dirNameStr;
 
 const args = yargs(hideBin(process.argv))

package/data/helpers/init.gradle

@@ -0,0 +1,5 @@
+gradle.taskGraph.whenReady {
+    gradle.includedBuilds.each { includedBuild ->
+        println "<CDXGEN:includedBuild>:${includedBuild.name}"
+    }
+}

package/index.cjs

@@ -0,0 +1,15 @@
+// this file is a wrapper of ./lib/cli/index.js that can be used by commonjs projects importing this module
+// that prefer to use require instead of await import()
+const importPromise = import("./lib/cli/index.js");
+
+module.exports = new Proxy(
+  {},
+  {
+    get:
+      (_, prop) =>
+      async (...args) => {
+        const mod = await importPromise;
+        return typeof mod[prop] === "function" ? mod[prop](...args) : mod[prop];
+      },
+  },
+);

package/lib/cli/index.js

@@ -33,8 +33,6 @@ import {
   listFiles,
 } from "../helpers/envcontext.js";
 import { thoughtLog } from "../helpers/logger.js";
-
-import { analyzeBuildSettings } from "../helpers/package_specific/gradleutils.js";
 import {
   CARGO_CMD,
   CLJ_CMD,
@@ -73,6 +71,7 @@ import {
   getGradleCommand,
   getLicenses,
   getMavenCommand,
+  getMillCommand,
   getMvnMetadata,
   getNugetMetadata,
   getPipFrozenTree,
@@ -130,6 +129,7 @@ import {
   parseLeiningenData,
   parseMakeDFile,
   parseMavenTree,
+  parseMillDependency,
   parseMinJs,
   parseMixLockData,
   parseNodeShrinkwrap,
@@ -180,10 +180,6 @@ import {
   parseImageName,
 } from "../managers/docker.js";
 
-let url = import.meta.url;
-if (!url.startsWith("file://")) {
-  url = new URL(`file://${import.meta.url}`).toString();
-}
 const dirName = dirNameStr;
 
 const selfPJson = JSON.parse(
@@ -228,6 +224,14 @@ if (process.env.GRADLE_USER_HOME) {
   );
 }
 
+// Construct path to gradle init script
+const GRADLE_INIT_SCRIPT = resolve(
+  dirNameStr,
+  "data",
+  "helpers",
+  "init.gradle",
+);
+
 // Construct sbt cache directory
 const SBT_CACHE_DIR =
   process.env.SBT_CACHE_DIR || join(homedir(), ".ivy2", "cache");
@@ -416,7 +420,10 @@ const addLifecyclesSection = (options) => {
     if (inspectData) {
       lifecycles.push({ phase: "post-build" });
     }
-  } else if (options.deep) {
+  } else if (
+    options?.projectType?.length &&
+    options?.projectType?.includes("binary")
+  ) {
     lifecycles.push({ phase: "post-build" });
   }
   if (options.projectType?.includes("os")) {
@@ -1393,8 +1400,8 @@ export async function createJarBom(path, options) {
   if (hpiFiles.length) {
     jarFiles = jarFiles.concat(hpiFiles);
   }
-  const tempDir = mkdtempSync(join(getTmpDir(), "jar-deps-"));
   for (const jar of jarFiles) {
+    const tempDir = mkdtempSync(join(getTmpDir(), "jar-deps-"));
     if (DEBUG_MODE) {
       console.log(`Parsing ${jar}`);
     }
@@ -1405,10 +1412,10 @@ export async function createJarBom(path, options) {
     if (pkgList.length) {
       pkgList = await getMvnMetadata(pkgList);
     }
-  }
-  // Clean up
-  if (tempDir?.startsWith(getTmpDir()) && rmSync) {
-    rmSync(tempDir, { recursive: true, force: true });
+    // Clean up
+    if (tempDir?.startsWith(getTmpDir()) && rmSync) {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
   }
   pkgList = pkgList.concat(convertJarNSToPackages(nsMapping));
   return buildBomNSData(options, pkgList, "maven", {
@@ -1513,10 +1520,20 @@ export async function createJavaBom(path, options) {
     `${options.multiProject ? "**/" : ""}build.gradle*`,
     options,
   );
+  // mill
+  const millFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}build.mill`,
+    options,
+  );
   let bomJsonFiles = [];
   if (
     pomFiles?.length &&
-    isPackageManagerAllowed("maven", ["bazel", "sbt", "gradle"], options)
+    isPackageManagerAllowed(
+      "maven",
+      ["bazel", "sbt", "gradle", "mill"],
+      options,
+    )
   ) {
     if (gradleFiles.length) {
       thoughtLog(
@@ -1942,61 +1959,56 @@ export async function createJavaBom(path, options) {
   // Execute gradle properties
   if (
     gradleFiles?.length &&
-    isPackageManagerAllowed("gradle", ["maven", "bazel", "sbt"], options)
+    isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    )
   ) {
-    let rootProjects = [null];
     let allProjectsStr = [];
-    let rootGradleModule = {};
-    let includedProjectsFound = false;
     if (process.env.GRADLE_INCLUDED_BUILDS) {
       // Automatically add the colon prefix
-      const includedBuilds = process.env.GRADLE_INCLUDED_BUILDS.split(",").map(
-        (b) => (!b.startsWith(":") ? `:${b}` : b),
+      allProjectsStr = process.env.GRADLE_INCLUDED_BUILDS.split(",").map((b) =>
+        !b.startsWith(":") ? `:${b}` : b,
       );
-      rootProjects = rootProjects.concat(includedBuilds);
-      includedProjectsFound = true;
-    } else {
-      // Automatically detect included builds
-      // Only from the root path for now
-      for (const abuildFile of [
-        join(gradleRootPath, "build.gradle"),
-        join(gradleRootPath, "build.gradle.kts"),
-        join(gradleRootPath, "settings.gradle"),
-        join(gradleRootPath, "settings.gradle.kts"),
-      ]) {
-        if (!safeExistsSync(abuildFile)) {
-          continue;
+    }
+    let parallelPropTaskOut = executeParallelGradleProperties(
+      gradleRootPath,
+      [null],
+      process.env.GRADLE_INCLUDED_BUILDS
+        ? []
+        : ["--init-script", GRADLE_INIT_SCRIPT],
+    );
+    if (!process.env.GRADLE_INCLUDED_BUILDS) {
+      const outputLines = parallelPropTaskOut.split("\n");
+      for (const [i, line] of outputLines.entries()) {
+        if (line.startsWith("Root project '")) {
+          break;
         }
-        const buildSettings = analyzeBuildSettings(abuildFile);
-        if (buildSettings?.includedBuilds?.length) {
-          for (const aib of buildSettings.includedBuilds) {
-            if (!rootProjects.includes(aib)) {
-              rootProjects.push(aib);
-              includedProjectsFound = true;
-            }
+        if (line.startsWith("<CDXGEN:includedBuild>")) {
+          const includedBuild = line.split(">");
+          if (!allProjectsStr.includes(includedBuild[1].trim())) {
+            allProjectsStr.push(includedBuild[1].trim());
           }
-          break;
         }
       }
     }
-    if (includedProjectsFound) {
+    if (allProjectsStr.length > 0) {
       thoughtLog(
-        `Wait, this gradle project uses composite builds. I must carefully process these ${rootProjects.length} projects including the root.`,
+        `Wait, this gradle project uses composite builds. I must carefully process these ${allProjectsStr.length} projects, in addition to the root.`,
       );
       if (DEBUG_MODE) {
-        console.log(
-          `Additional root projects: ${rootProjects.join(" ").trim()}.`,
-        );
+        console.log(`Composite builds: ${allProjectsStr.join(" ").trim()}.`);
       }
+      parallelPropTaskOut = parallelPropTaskOut.concat(
+        "\n",
+        executeParallelGradleProperties(gradleRootPath, allProjectsStr),
+      );
+      allProjectsStr = [];
     }
-    const parallelPropTaskOut = executeParallelGradleProperties(
-      gradleRootPath,
-      rootProjects,
-    );
     const splitPropTaskOut = splitOutputByGradleProjects(parallelPropTaskOut, [
       "properties",
     ]);
-
     for (const [key, propTaskOut] of splitPropTaskOut.entries()) {
       const retMap = parseGradleProperties(propTaskOut);
       const rootProject = retMap.rootProject;
@@ -2005,18 +2017,11 @@ export async function createJavaBom(path, options) {
           rootProject,
           retMap.metadata,
         );
+        if (!key.startsWith(":")) {
+          parentComponent = rootComponent;
+        }
         gradleModules.set(key, rootComponent);
-        if (!rootProjects.includes(key)) {
-          if (rootGradleModule.name) {
-            if (DEBUG_MODE) {
-              console.log(
-                `Received new root component: ${rootComponent.name} with key ${key}. Please verify the value used for included builds. Using the name ${rootGradleModule.name}.`,
-              );
-            }
-          } else {
-            rootGradleModule = rootComponent;
-          }
-        } else if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
+        if (!allProjectsAddedPurls.includes(rootComponent["purl"])) {
           allProjects.push(rootComponent);
           rootDependsOn.add(rootComponent["bom-ref"]);
           allProjectsAddedPurls.push(rootComponent["purl"]);
@@ -2024,7 +2029,6 @@ export async function createJavaBom(path, options) {
         allProjectsStr = allProjectsStr.concat(retMap.projects);
       }
     }
-    parentComponent = rootGradleModule;
     // Get the sub-project properties and set the root dependencies
     if (allProjectsStr?.length) {
       const modulesToSkip = process.env.GRADLE_SKIP_MODULES
@@ -2078,7 +2082,11 @@ export async function createJavaBom(path, options) {
   if (
     gradleFiles?.length &&
     options.installDeps &&
-    isPackageManagerAllowed("gradle", ["maven", "bazel", "sbt"], options)
+    isPackageManagerAllowed(
+      "gradle",
+      ["maven", "bazel", "sbt", "mill"],
+      options,
+    )
   ) {
     allProjects.push(parentComponent);
     const gradleCmd = getGradleCommand(gradleRootPath, null);
@@ -2110,32 +2118,36 @@ export async function createJavaBom(path, options) {
       process.env.GRADLE_ARGS_DEPENDENCIES
         ? process.env.GRADLE_ARGS_DEPENDENCIES.split(" ")
         : [],
+      gradleCmd.length,
     );
-    if (DEBUG_MODE) {
-      console.log(
-        "Executing",
-        gradleCmd,
-        `${gradleArguments.join(" ").substring(0, 150)} ...`,
-        "in",
-        gradleRootPath,
+    const allOutputs = [];
+    for (const gradleArg of gradleArguments) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Executing ${gradleCmd} with arguments ${gradleArg.join(" ").substring(0, 150)}... in ${gradleRootPath}`,
+        );
+      }
+      thoughtLog(
+        `Let's invoke '${basename(gradleCmd)}' with the arguments '${gradleArg.join(" ").substring(0, 100)} ...'.`,
       );
-    }
-    thoughtLog(
-      `Let's invoke '${basename(gradleCmd)}' with the arguments '${gradleArguments.join(" ").substring(0, 100)} ...'.`,
-    );
-    const sresult = spawnSync(gradleCmd, gradleArguments, {
-      cwd: gradleRootPath,
-      encoding: "utf-8",
-      timeout: TIMEOUT_MS,
-      maxBuffer: MAX_BUFFER,
-    });
-    if (sresult.status !== 0 || sresult.error) {
-      if (options.failOnError || DEBUG_MODE) {
-        console.error(sresult.stdout, sresult.stderr);
+      const sresult = spawnSync(gradleCmd, gradleArg, {
+        cwd: gradleRootPath,
+        encoding: "utf-8",
+        shell: isWin,
+        timeout: TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+      if (sresult.stdout !== null) {
+        allOutputs.push(sresult.stdout);
       }
-      options.failOnError && process.exit(1);
     }
-    const sstdout = sresult.stdout;
+    const sstdout = allOutputs.join("\n");
     if (sstdout) {
       const cmdOutput = Buffer.from(sstdout).toString();
       const perProjectOutput = splitOutputByGradleProjects(cmdOutput, [
@@ -2194,6 +2206,29 @@ export async function createJavaBom(path, options) {
       }
       options.failOnError && process.exit(1);
     }
+    if (
+      (!process.env.GRADLE_STOP_DAEMON &&
+        (!process.env.GRADLE_USE_DAEMON ||
+          ["true", "1"].includes(process.env.GRADLE_USE_DAEMON))) ||
+      ["true", "1"].includes(process.env.GRADLE_STOP_DAEMON)
+    ) {
+      if (DEBUG_MODE) {
+        console.log("Stopping gradle daemon...");
+      }
+      const sresult = spawnSync(gradleCmd, ["--stop"], {
+        cwd: gradleRootPath,
+        encoding: "utf-8",
+        shell: isWin,
+        timeout: TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+    }
     // Should we attempt to resolve class names
     if (options.resolveClass || options.deep) {
       const tmpjarNSMapping = await collectJarNS(GRADLE_CACHE_DIR);
@@ -2214,7 +2249,11 @@ export async function createJavaBom(path, options) {
   if (
     bazelFiles?.length &&
     !hasAnyProjectType(["docker", "oci", "container", "os"], options, false) &&
-    isPackageManagerAllowed("bazel", ["maven", "gradle", "sbt"], options)
+    isPackageManagerAllowed(
+      "bazel",
+      ["maven", "gradle", "sbt", "mill"],
+      options,
+    )
   ) {
     let BAZEL_CMD = "bazel";
     if (process.env.BAZEL_HOME) {
@@ -2356,7 +2395,11 @@ export async function createJavaBom(path, options) {
   safeMkdirSync(tempCacheDir, { recursive: true });
   if (
     sbtProjects?.length &&
-    isPackageManagerAllowed("sbt", ["bazel", "maven", "gradle"], options)
+    isPackageManagerAllowed(
+      "sbt",
+      ["bazel", "maven", "gradle", "mill"],
+      options,
+    )
   ) {
     // If the project use sbt lock files
     if (sbtLockFiles?.length) {
@@ -2537,6 +2580,142 @@ export async function createJavaBom(path, options) {
       force: true,
     });
   }
+
+  if (
+    millFiles?.length &&
+    isPackageManagerAllowed(
+      "mill",
+      ["bazel", "sbt", "gradle", "maven"],
+      options,
+    )
+  ) {
+    const millRootPath = dirname(millFiles[0]);
+    parentComponent = createDefaultParentComponent(
+      millRootPath,
+      "maven",
+      options,
+    );
+    const millCmd = getMillCommand(millRootPath);
+    const millCommonArgs = [
+      "--color",
+      "false",
+      "--disable-callgraph",
+      "--disable-prompt",
+      "--keep-going",
+      "--silent",
+    ];
+    if (!["true", "1"].includes(process.env.MILL_USE_SERVER)) {
+      millCommonArgs.unshift("--no-server");
+    }
+    const millArgs = [...millCommonArgs, "__.ivyDepsTree"];
+    if (DEBUG_MODE) {
+      console.log("Executing", millCmd, millArgs.join(" "), "in", millRootPath);
+    }
+    let sresult = spawnSync(millCmd, millArgs, {
+      cwd: millRootPath,
+      encoding: "utf-8",
+      shell: isWin,
+      timeout: TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER * 10,
+    });
+    if (sresult.status !== 0 || sresult.error) {
+      if (options.failOnError || DEBUG_MODE) {
+        console.error(sresult.stdout, sresult.stderr);
+      }
+      options.failOnError && process.exit(1);
+    }
+    const millResolveArgs = [...millCommonArgs, "resolve", "__.ivyDepsTree"];
+    if (DEBUG_MODE) {
+      console.log(
+        "Executing",
+        millCmd,
+        millResolveArgs.join(" "),
+        "in",
+        millRootPath,
+      );
+    }
+    sresult = spawnSync(millCmd, millResolveArgs, {
+      cwd: millRootPath,
+      encoding: "utf-8",
+      shell: isWin,
+      timeout: TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER,
+    });
+    if (sresult.status !== 0 || sresult.error) {
+      if (options.failOnError || DEBUG_MODE) {
+        console.error(sresult.stdout, sresult.stderr);
+      }
+      options.failOnError && process.exit(1);
+    }
+    const sstdout = sresult.stdout;
+    if (sstdout) {
+      parentComponent.components = [];
+      const modules = sstdout
+        .trim()
+        .split("\n")
+        .map((a) => a.substring(0, a.lastIndexOf(".")))
+        .filter((a) =>
+          ["true", "1"].includes(process.env.MILL_EXCLUDE_TEST)
+            ? !a.endsWith(".test")
+            : true,
+        );
+      const moduleBomRefs = [];
+      const packages = new Map();
+      const relations = new Map();
+      relations.set(parentComponent["bom-ref"], []);
+      for (const module of modules) {
+        moduleBomRefs.push(
+          parseMillDependency(module, packages, relations, millRootPath),
+        );
+      }
+      for (const module of moduleBomRefs) {
+        parentComponent.components.push(packages.get(module));
+        relations.get(parentComponent["bom-ref"]).push(module);
+        packages.delete(module);
+      }
+      const newDependencies = [];
+      for (const [ref, dependsOn] of relations.entries()) {
+        newDependencies.push({
+          ref,
+          dependsOn,
+        });
+      }
+      if (DEBUG_MODE) {
+        console.log(
+          `Obtained ${packages.size} components and ${relations.size} dependencies from mill.`,
+        );
+      }
+      pkgList = pkgList.concat(...packages.values());
+      dependencies = mergeDependencies(
+        dependencies,
+        newDependencies,
+        parentComponent,
+      );
+    }
+    if (
+      (!process.env.MILL_SHUTDOWN_SERVER &&
+        ["true", "1"].includes(process.env.MILL_USE_SERVER)) ||
+      ["true", "1"].includes(process.env.MILL_SHUTDOWN_SERVER)
+    ) {
+      if (DEBUG_MODE) {
+        console.log("Shutting down mill server...");
+      }
+      const sresult = spawnSync(millCmd, ["shutdown"], {
+        cwd: millRootPath,
+        encoding: "utf-8",
+        shell: isWin,
+        timeout: TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+      });
+      if (sresult.status !== 0 || sresult.error) {
+        if (options.failOnError || DEBUG_MODE) {
+          console.error(sresult.stdout, sresult.stderr);
+        }
+        options.failOnError && process.exit(1);
+      }
+    }
+  }
+
   pkgList = trimComponents(pkgList);
   pkgList = await getMvnMetadata(pkgList, jarNSMapping, options.deep);
   return buildBomNSData(options, pkgList, "maven", {

package/lib/evinser/evinser.js

@@ -251,7 +251,9 @@ export async function createSlice(
         ? path.basename(options.output)
         : path.dirname(options.output);
   }
-  const slicesFile = join(sliceOutputDir, `${sliceType}.slices.json`);
+  const slicesFile =
+    options[`${sliceType}SlicesFile`] ||
+    join(sliceOutputDir, `${sliceType}.slices.json`);
   const openapiSpecFile = basename(
     options.openapiSpecFile ||
       process.env?.ATOM_TOOLS_OPENAPI_FILENAME ||