@cyclonedx/cdxgen 11.3.0 → 11.3.2

package/bin/cdxgen.js

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
-
+import { Buffer } from "node:buffer";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import process from "node:process";
-import { URL } from "node:url";
 import { findUpSync } from "find-up";
 import globalAgent from "global-agent";
-import { load as _load } from "js-yaml";
 import jws from "jws";
+import { parse as _load } from "yaml";
 import { createBom, submitBom } from "../lib/cli/index.js";
 import {
   printCallStack,
@@ -781,6 +780,13 @@ const checkPermissions = (filePath, options) => {
   return true;
 };
 
+const needsBomSigning = ({ generateKeyAndSign }) =>
+  generateKeyAndSign ||
+  (process.env.SBOM_SIGN_ALGORITHM &&
+    process.env.SBOM_SIGN_ALGORITHM !== "none" &&
+    process.env.SBOM_SIGN_PRIVATE_KEY &&
+    safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY));
+
 /**
  * Method to start the bom creation process
  */
@@ -838,14 +844,7 @@ const checkPermissions = (filePath, options) => {
           thoughtLog(`Let's save the file to "${jsonFile}".`);
         }
       }
-      if (
-        jsonPayload &&
-        (options.generateKeyAndSign ||
-          (process.env.SBOM_SIGN_ALGORITHM &&
-            process.env.SBOM_SIGN_ALGORITHM !== "none" &&
-            process.env.SBOM_SIGN_PRIVATE_KEY &&
-            safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY)))
-      ) {
+      if (jsonPayload && needsBomSigning(options)) {
         let alg = process.env.SBOM_SIGN_ALGORITHM || "RS512";
         if (alg.includes("none")) {
           alg = "RS512";
@@ -857,6 +856,7 @@ const checkPermissions = (filePath, options) => {
           const jdirName = dirname(jsonFile);
           publicKeyFile = join(jdirName, "public.key");
           const privateKeyFile = join(jdirName, "private.key");
+          const privateKeyB64File = join(jdirName, "private.key.base64");
           const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
             modulusLength: 4096,
             publicKeyEncoding: {
@@ -870,10 +870,15 @@ const checkPermissions = (filePath, options) => {
           });
           fs.writeFileSync(publicKeyFile, publicKey);
           fs.writeFileSync(privateKeyFile, privateKey);
+          fs.writeFileSync(
+            privateKeyB64File,
+            Buffer.from(privateKey, "utf8").toString("base64"),
+          );
           console.log(
             "Created public/private key pairs for testing purposes",
             publicKeyFile,
             privateKeyFile,
+            privateKeyB64File,
           );
           privateKeyToUse = privateKey;
           jwkPublicKey = crypto

package/bin/evinse.js

@@ -3,7 +3,7 @@
 import fs from "node:fs";
 import process from "node:process";
 import { findUpSync } from "find-up";
-import { load as _load } from "js-yaml";
+import { parse as _load } from "yaml";
 // Evinse (Evinse Verification Is Nearly SBOM Evidence)
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";

package/bin/verify.js

@@ -3,11 +3,11 @@
 import fs from "node:fs";
 import { join } from "node:path";
 import process from "node:process";
-import { URL } from "node:url";
 import jws from "jws";
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import { dirNameStr } from "../lib/helpers/utils.js";
+import { getBomWithOras } from "../lib/managers/oci.js";
 
 const dirName = dirNameStr;
 
@@ -26,6 +26,7 @@ const args = yargs(hideBin(process.argv))
   .scriptName("cdx-verify")
   .version()
   .help("h")
+  .alias("h", "help")
   .wrap(Math.min(120, yargs().terminalWidth())).argv;
 
 if (args.version) {
@@ -43,7 +44,25 @@ if (process.env?.CDXGEN_NODE_OPTIONS) {
   process.env.NODE_OPTIONS = `${process.env.NODE_OPTIONS || ""} ${process.env.CDXGEN_NODE_OPTIONS}`;
 }
 
-const bomJson = JSON.parse(fs.readFileSync(args.input, "utf8"));
+function getBom(args) {
+  if (fs.existsSync(args.input)) {
+    return JSON.parse(fs.readFileSync(args.input, "utf8"));
+  }
+  if (
+    args.input.includes(":") ||
+    args.input.includes("docker") ||
+    args.input.includes("ghcr")
+  ) {
+    return getBomWithOras(args.input);
+  }
+  return undefined;
+}
+
+const bomJson = getBom(args);
+if (!bomJson) {
+  console.log(`${args.input} is invalid!`);
+  process.exit(1);
+}
 let hasInvalidComp = false;
 // Validate any component signature
 for (const comp of bomJson.components) {
@@ -77,7 +96,7 @@ if (!bomSignature) {
   if (validationResult) {
     console.log("Signature is valid!");
   } else {
-    console.log("SBOM signature is invalid!");
+    console.log("BOM signature is invalid!");
     process.exit(1);
   }
 }

package/lib/cli/index.js

@@ -16,12 +16,12 @@ import { platform as _platform, arch, homedir } from "node:os";
 import { basename, dirname, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
 import got from "got";
-import { load as loadYaml } from "js-yaml";
 import { PackageURL } from "packageurl-js";
 import { gte, lte } from "semver";
 import { parse } from "ssri";
 import { table } from "table";
 import { v4 as uuidv4 } from "uuid";
+import { parse as loadYaml } from "yaml";
 import { findJSImportsExports } from "../helpers/analyzer.js";
 import { collectOSCryptoLibs } from "../helpers/cbomutils.js";
 import {
@@ -119,6 +119,7 @@ import {
   parseGoModData,
   parseGoModGraph,
   parseGoModWhy,
+  parseGoModulesTxt,
   parseGopkgData,
   parseGosumData,
   parseGradleDep,
@@ -4223,6 +4224,12 @@ export async function createGoBom(path, options) {
     `${options.multiProject ? "**/" : ""}go.mod`,
     options,
   );
+  // Collect any vendored dependencies
+  const modulesTxtFiles = getAllFiles(path, "vendor/**/modules.txt", options);
+  for (const f of modulesTxtFiles) {
+    const dlist = await parseGoModulesTxt(f, gosumMap);
+    pkgList = pkgList.concat(dlist);
+  }
   if (gomodFiles.length) {
     let shouldManuallyParse = false;
     // Use the go list -deps and go mod why commands to generate a good quality BOM for non-docker invocations

package/lib/helpers/envcontext.js

@@ -30,7 +30,7 @@ export const GIT_COMMAND = process.env.GIT_CMD || "git";
 // sdkman tool aliases
 export const SDKMAN_JAVA_TOOL_ALIASES = {
   java8: process.env.JAVA8_TOOL || "8.0.452-amzn", // Temurin no longer offers java8 :(
-  java11: process.env.JAVA11_TOOL || "11.0.26-tem",
+  java11: process.env.JAVA11_TOOL || "11.0.27-tem",
   java17: process.env.JAVA17_TOOL || "17.0.15-tem",
   java21: process.env.JAVA21_TOOL || "21.0.7-tem",
   java22: process.env.JAVA22_TOOL || "22.0.2-tem",

package/lib/helpers/utils.js

@@ -35,7 +35,6 @@ import { parseEDNString } from "edn-data";
 import { globSync } from "glob";
 import got from "got";
 import iconv from "iconv-lite";
-import { load as _load } from "js-yaml";
 import StreamZip from "node-stream-zip";
 import { PackageURL } from "packageurl-js";
 import propertiesReader from "properties-reader";
@@ -50,6 +49,7 @@ import {
 } from "semver";
 import { IriValidationStrategy, validateIri } from "validate-iri";
 import { xml2js } from "xml-js";
+import { parse as _load } from "yaml";
 import { getTreeWithPlugin } from "../managers/piptree.js";
 import { thoughtLog } from "./logger.js";
 
@@ -5029,6 +5029,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   let parentComponent;
   let workspacePaths;
   let workspaceWarningShown = false;
+  let hasWorkspaces = false;
   // Keep track of any workspace components to be added to the parent component
   const workspaceComponentMap = {};
   const workspacePyProjMap = {};
@@ -5053,6 +5054,9 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
     parentComponent = pyProjMap.parentComponent;
     workspacePaths = pyProjMap.workspacePaths;
     if (workspacePaths?.length) {
+      if (!hasWorkspaces) {
+        hasWorkspaces = true;
+      }
       // Parent component is going to have children
       parentComponent.components = [];
       for (const awpath of workspacePaths) {
@@ -5136,6 +5140,9 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   // Check for workspaces
   if (lockTomlObj?.manifest?.members) {
     const workspaceMembers = lockTomlObj.manifest.members;
+    if (workspaceMembers && !hasWorkspaces) {
+      hasWorkspaces = true;
+    }
     for (const amember of workspaceMembers) {
       if (amember === parentComponent.name) {
         continue;
@@ -5286,7 +5293,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
     }
     if (
       directDepsKeys[pkg.name] ||
-      !Object.keys(workspaceComponentMap).length
+      (hasWorkspaces && !Object.keys(workspaceComponentMap).length)
     ) {
       rootList.push(pkg);
     }
@@ -6257,6 +6264,7 @@ export async function parseGoModData(goModData, gosumMap) {
   const parentComponent = {};
   const rootList = [];
   let isModReplacement = false;
+  let isTool = false;
 
   if (!goModData) {
     return {};
@@ -6265,7 +6273,7 @@ export async function parseGoModData(goModData, gosumMap) {
   const pkgs = goModData.split("\n");
   for (let l of pkgs) {
     // Windows of course
-    l = l.replace("\r", "");
+    l = l.replace("\r", "").replace(/[\t ]+/g, " ");
     // Capture the parent component name from the module
     if (l.startsWith("module ")) {
       parentComponent.name = l.split(" ").pop().trim();
@@ -6276,9 +6284,28 @@ export async function parseGoModData(goModData, gosumMap) {
       parentComponent["bom-ref"] = decodeURIComponent(parentComponent["purl"]);
       continue;
     }
+
+    // The `tool` block dependency relations will be recorded into `require` block(need run `go mod tidy`), just ignore that
+    if (l.includes("tool (")) {
+      isTool = !l.includes(")");
+      continue;
+    }
+    if (l.includes(")")) {
+      isTool = false;
+      continue;
+    }
+    if (l.includes("tool ")) {
+      continue;
+    }
+    if (isTool) {
+      continue;
+    }
+
     // Skip go.mod file headers, whitespace, and/or comments
     if (
       l.startsWith("go ") ||
+      //TODO: should toolchain be considered as a dependency
+      l.startsWith("toolchain ") ||
       l.includes(")") ||
       l.trim() === "" ||
       l.trim().startsWith("//")
@@ -6346,6 +6373,32 @@ export async function parseGoModData(goModData, gosumMap) {
   };
 }
 
+export async function parseGoModulesTxt(txtFile, gosumMap) {
+  const pkgList = [];
+  const txtData = readFileSync(txtFile, { encoding: "utf-8" });
+  const pkgs = txtData
+    .split("\n")
+    .filter((p) => p.trim().replace(/["']/g, "").startsWith("# "));
+  for (const l of pkgs) {
+    // # cel.dev/expr v0.18.0
+    const tmpA = l.split(" ");
+    if (!tmpA.length === 3) {
+      continue;
+    }
+    const version = tmpA[2];
+    const gosumHash = gosumMap[`${tmpA[1]}@${version}`];
+    const component = await getGoPkgComponent("", tmpA[1], tmpA[2], gosumHash);
+    let confidence = 0.7;
+    if (gosumHash) {
+      component.scope = "required";
+    } else {
+      confidence = 0.3;
+    }
+    pkgList.push(_addGoComponentEvidence(component, txtFile, confidence));
+  }
+  return pkgList;
+}
+
 /**
  * Parse go list output
  *
@@ -6358,10 +6411,11 @@ export async function parseGoListDep(rawOutput, gosumMap) {
   const deps = [];
   if (typeof rawOutput === "string") {
     const keys_cache = {};
-    const pkgs = rawOutput.split("\n");
+    const pkgs = rawOutput
+      .split("\n")
+      .filter((p) => p.trim().replace(/["']/g, "").length);
     for (const l of pkgs) {
       const verArr = l.trim().replace(/["']/g, "").split(" ");
-
       if (verArr && verArr.length >= 5) {
         const key = `${verArr[0]}-${verArr[1]}`;
         // Filter duplicates
@@ -12245,19 +12299,27 @@ export async function parsePodfileLock(podfileLock, projectPath) {
       : dependency.metadata.name;
     if (podfileLock["EXTERNAL SOURCES"]?.[podName]) {
       const externalPod = podfileLock["EXTERNAL SOURCES"][podName];
-      if (externalPod[":podspec"]) {
-        const podspecLocation = resolve(projectPath, externalPod[":podspec"]);
+      if (externalPod[":git"]) {
+        let projectRepo = externalPod[":git"];
+        if (projectRepo.includes("github.com")) {
+          projectRepo = projectRepo.replace(
+            "github.com",
+            "raw.githubusercontent.com",
+          );
+        }
+        if (projectRepo.endsWith(".git")) {
+          projectRepo = projectRepo.substring(0, projectRepo.length - 4);
+        }
+        const projectRepoBranchOrTag = externalPod[":tag"]
+          ? `tags/${externalPod[":tag"]}`
+          : `heads/${externalPod[":branch"] ? externalPod[":branch"] : "<DEFAULT>"}`;
         dependency.metadata.properties = [
-          {
-            name: "cdx:pods:projectDir",
-            value: dirname(podspecLocation),
-          },
           {
             name: "cdx:pods:podspecLocation",
-            value: podspecLocation,
+            value: `${projectRepo}/refs/${projectRepoBranchOrTag}/${podName}.podspec`,
           },
         ];
-      } else {
+      } else if (externalPod[":path"]) {
         const projectLocation = resolve(projectPath, externalPod[":path"]);
         dependency.metadata.properties = [
           {
@@ -12275,6 +12337,18 @@ export async function parsePodfileLock(podfileLock, projectPath) {
             value: podspec,
           });
         }
+      } else if (externalPod[":podspec"]) {
+        const podspecLocation = resolve(projectPath, externalPod[":podspec"]);
+        dependency.metadata.properties = [
+          {
+            name: "cdx:pods:projectDir",
+            value: dirname(podspecLocation),
+          },
+          {
+            name: "cdx:pods:podspecLocation",
+            value: podspecLocation,
+          },
+        ];
       }
     }
     dependencies.set(dependency.metadata.name, dependency);
@@ -12533,70 +12607,93 @@ export async function buildObjectForCocoaPod(
     component["purl"] = purl;
     component["bom-ref"] = decodeURIComponent(purl);
     if (options && !["false", "0"].includes(process.env.COCOA_FULL_SCAN)) {
-      fullScanCocoaPod(dependency, component, options);
+      await fullScanCocoaPod(dependency, component, options);
     }
   }
   return component;
 }
 
-function fullScanCocoaPod(dependency, component, options) {
+async function fullScanCocoaPod(dependency, component, options) {
   let result;
   if (
-    component.properties?.find(({ name }) => name === "cdx:pods:projectDir")
+    component.properties?.find(
+      ({ name }) => name === "cdx:pods:podspecLocation",
+    )
   ) {
+    let podspecLocation = component.properties.find(
+      ({ name }) => name === "cdx:pods:podspecLocation",
+    ).value;
     if (
-      component.properties.find(
-        ({ name }) => name === "cdx:pods:podspecLocation",
-      )
+      component.properties.find(({ name }) => name === "cdx:pods:projectDir")
     ) {
-      let podspecLocation = component.properties.find(
-        ({ name }) => name === "cdx:pods:podspecLocation",
-      ).value;
       component.properties.push({
         name: "SrcFile",
         value: podspecLocation,
       });
-      let replacements;
-      if (
-        podspecLocation.endsWith(".podspec") &&
-        process.env.COCOA_PODSPEC_REPLACEMENTS
-      ) {
-        replacements = process.env.COCOA_PODSPEC_REPLACEMENTS.split(";");
-      } else if (
-        podspecLocation.endsWith(".json") &&
-        process.env.COCOA_PODSPEC_JSON_REPLACEMENTS
-      ) {
-        replacements = process.env.COCOA_PODSPEC_JSON_REPLACEMENTS.split(";");
-      }
-      if (replacements) {
-        let podspecContent = readFileSync(podspecLocation, "utf-8");
-        for (const replacement of replacements) {
-          const replacementPair = replacement.split("=");
-          let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");
-          if (match.startsWith("/") && match.endsWith("/")) {
-            match = new RegExp(match.substring(1, match.length - 1), "g");
-          }
-          const repl = replacementPair[1].replaceAll("<NEWLINE>", "\n");
-          podspecContent = podspecContent.replaceAll(match, repl);
-        }
-        podspecLocation = join(
-          dirname(podspecLocation),
-          `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
-        );
-        writeFileSync(podspecLocation, podspecContent);
-        temporaryFiles.add(podspecLocation);
+    }
+    let replacements = [];
+    if (
+      podspecLocation.endsWith(".podspec") &&
+      process.env.COCOA_PODSPEC_REPLACEMENTS
+    ) {
+      replacements = process.env.COCOA_PODSPEC_REPLACEMENTS.split(";");
+    } else if (
+      podspecLocation.endsWith(".json") &&
+      process.env.COCOA_PODSPEC_JSON_REPLACEMENTS
+    ) {
+      replacements = process.env.COCOA_PODSPEC_JSON_REPLACEMENTS.split(";");
+    }
+    if (replacements || podspecLocation.startsWith("http")) {
+      let podspecContent;
+      if (podspecLocation.startsWith("http")) {
+        let httpResult;
+        for (const branchName of ["main", "master"]) {
+          try {
+            httpResult = await cdxgenAgent.get(
+              podspecLocation.replace("<DEFAULT>", branchName),
+            );
+            podspecLocation = podspecLocation.replace("<DEFAULT>", branchName);
+          } catch (err) {
+            try {
+              httpResult = await cdxgenAgent.get(
+                `${podspecLocation.replace("<DEFAULT>", branchName)}.json`,
+              );
+              podspecLocation = `${podspecLocation.replace("<DEFAULT>", branchName)}.json`;
+            } catch (err) {
+              continue;
+            }
+          }
+          component.properties.find(
+            ({ name }) => name === "cdx:pods:podspecLocation",
+          ).value = podspecLocation;
+          podspecLocation = `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`;
+          podspecContent = httpResult.body;
+          break;
+        }
+      } else {
+        podspecContent = readFileSync(podspecLocation, "utf-8");
       }
-      result = executePodCommand(
-        ["ipc", "spec", "--silent", podspecLocation],
-        undefined,
-        options,
-      );
-    } else {
-      console.warn(
-        `Unable to do a full scan of local pod '${dependency.name}', because either its podspec doesn't exist, or it wasn't found with the currently implemented algorithms.\nIf you think this is an error, please file an issue on GitHub!`,
+      for (const replacement of replacements) {
+        const replacementPair = replacement.split("=");
+        let match = replacementPair[0].replaceAll("<NEWLINE>", "\n");
+        if (match.startsWith("/") && match.endsWith("/")) {
+          match = new RegExp(match.substring(1, match.length - 1), "g");
+        }
+        const repl = replacementPair[1].replaceAll("<NEWLINE>", "\n");
+        podspecContent = podspecContent.replaceAll(match, repl);
+      }
+      podspecLocation = join(
+        dirname(podspecLocation),
+        `${randomUUID()}.${podspecLocation.substring(podspecLocation.lastIndexOf(".") + 1)}`,
       );
-      return;
+      writeFileSync(podspecLocation, podspecContent);
+      temporaryFiles.add(podspecLocation);
     }
+    result = executePodCommand(
+      ["ipc", "spec", "--silent", podspecLocation],
+      undefined,
+      options,
+    );
   } else {
     let dependencyName = dependency.name;
     if (dependencyName.includes("/")) {
@@ -12605,7 +12702,13 @@ function fullScanCocoaPod(dependency, component, options) {
     const srcFileProperty = {
       name: "SrcFile",
       value: executePodCommand(
-        ["spec", "which", dependencyName, `--version=${dependency.version}`],
+        [
+          "spec",
+          "which",
+          `^${dependencyName}$`,
+          "--regex",
+          `--version=${dependency.version}`,
+        ],
         undefined,
         options,
       ).stdout.trim(),
@@ -12616,7 +12719,13 @@ function fullScanCocoaPod(dependency, component, options) {
       component.properties = [srcFileProperty];
     }
     result = executePodCommand(
-      ["spec", "cat", dependencyName, `--version=${dependency.version}`],
+      [
+        "spec",
+        "cat",
+        `^${dependencyName}$`,
+        "--regex",
+        `--version=${dependency.version}`,
+      ],
       undefined,
       options,
     );
@@ -14418,7 +14527,7 @@ export function parseCmakeLikeFile(cmakeListFile, pkgType, options = {}) {
               props.push({
                 name: eprop,
                 value: Array.isArray(awrap[eprop])
-                  ? awrap[eprop].join(", ")
+                  ? awrap[eprop].join("|")
                   : awrap[eprop],
               });
             }
@@ -14721,10 +14830,11 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
             !v.includes("anonymous_") &&
             !v.includes(afile),
         )
+        .map((v) => v.split(":")[0])
         .sort();
       if (!apkg["properties"] && usymbols.length) {
         apkg["properties"] = [
-          { name: "ImportedSymbols", value: usymbols.join(", ") },
+          { name: "ImportedSymbols", value: usymbols.join("|") },
         ];
       } else {
         apkg["properties"] = [];
@@ -14734,16 +14844,16 @@ export function getCppModules(src, options, osPkgsList, epkgList) {
       for (const prop of apkg["properties"]) {
         if (prop.name === "ImportedSymbols") {
           symbolsPropertyFound = true;
-          let existingSymbols = prop.value.split(", ");
+          let existingSymbols = prop.value.split("|");
           existingSymbols = existingSymbols.concat(usymbols);
-          prop.value = Array.from(new Set(existingSymbols)).sort().join(", ");
+          prop.value = Array.from(new Set(existingSymbols)).sort().join("|");
         }
         newProps.push(prop);
       }
       if (!symbolsPropertyFound && usymbols.length) {
         apkg["properties"].push({
           name: "ImportedSymbols",
-          value: usymbols.join(", "),
+          value: usymbols.join("|"),
         });
       }
       apkg["properties"] = newProps;

package/lib/helpers/utils.test.js

@@ -2,8 +2,8 @@ import { Buffer } from "node:buffer";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { afterAll, beforeAll, describe, expect, test } from "@jest/globals";
-import { load as loadYaml } from "js-yaml";
 import { parse } from "ssri";
+import { parse as loadYaml } from "yaml";
 import {
   buildObjectForCocoaPod,
   buildObjectForGradleModule,
@@ -56,6 +56,7 @@ import {
   parseGoModData,
   parseGoModGraph,
   parseGoModWhy,
+  parseGoModulesTxt,
   parseGoVersionData,
   parseGopkgData,
   parseGosumData,
@@ -1178,6 +1179,7 @@ describe("go data with vcs", () => {
   }, 120000);
 
   test("parseGoModData", async () => {
+    process.env.GO_FETCH_VCS = "false";
     let retMap = await parseGoModData(null);
     expect(retMap).toEqual({});
     const gosumMap = {
@@ -1196,6 +1198,8 @@ describe("go data with vcs", () => {
       gosumMap,
     );
     expect(retMap.pkgList.length).toEqual(6);
+    // Doesn't reliably work in CI/CD due to rate limiting.
+    /*
     expect(retMap.pkgList).toEqual([
       {
         group: "",
@@ -1280,6 +1284,7 @@ describe("go data with vcs", () => {
         ],
       },
     ]);
+    */
 
     retMap.pkgList.forEach((d) => {
       expect(d.license);
@@ -1311,6 +1316,24 @@ describe("go data with vcs", () => {
   }, 120000);
 });
 
+describe("go vendor modules tests", () => {
+  test("parseGoModulesTxt", async () => {
+    const gosumMap = {
+      "cel.dev/expr@v0.18.0":
+        "sha256-CJ6drgk+Hf96lkLikr4rFf19WrU0BOWEihyZnI2TAzo=",
+      "github.com/AdaLogics/go-fuzz-headers@v0.0.0-20230811130428-ced1acdcaa24":
+        "sha256-bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=",
+      "github.com/Azure/go-ansiterm@v0.0.0-20230124172434-306776ec8161":
+        "sha256-L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=",
+    };
+    const pkgList = await parseGoModulesTxt(
+      "./test/data/modules.txt",
+      gosumMap,
+    );
+    expect((await pkgList).length).toEqual(212);
+  });
+});
+
 describe("go data with licenses", () => {
   beforeAll(() => {
     process.env.FETCH_LICENSE = "true";
@@ -2447,7 +2470,7 @@ test("parse github actions workflow data", () => {
   let dep_list = parseGitHubWorkflowData(
     readFileSync("./.github/workflows/nodejs.yml", { encoding: "utf-8" }),
   );
-  expect(dep_list.length).toEqual(5);
+  expect(dep_list.length).toEqual(7);
   expect(dep_list[0]).toEqual({
     group: "actions",
     name: "checkout",
@@ -3779,8 +3802,8 @@ test("parsePnpmLock", async () => {
   expect(parsedList.dependenciesList).toHaveLength(462);
   expect(parsedList.pkgList.filter((pkg) => !pkg.scope)).toHaveLength(3);
   parsedList = await parsePnpmLock("./pnpm-lock.yaml");
-  expect(parsedList.pkgList.length).toEqual(625);
-  expect(parsedList.dependenciesList.length).toEqual(625);
+  expect(parsedList.pkgList.length).toEqual(624);
+  expect(parsedList.dependenciesList.length).toEqual(624);
   expect(parsedList.pkgList[0]).toEqual({
     group: "@ampproject",
     name: "remapping",

package/lib/managers/docker.js

@@ -84,6 +84,9 @@ export const stripAbsolutePath = (path) => {
  * Detect colima
  */
 export function detectColima() {
+  if (isColima) {
+    return true;
+  }
   if (_platform() === "darwin") {
     const result = spawnSync("colima", ["version"], {
       encoding: "utf-8",

package/lib/managers/oci.js

@@ -0,0 +1,66 @@
+import { Buffer } from "node:buffer";
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import { MAX_BUFFER, getAllFiles, getTmpDir, isWin } from "../helpers/utils.js";
+
+export function getBomWithOras(image) {
+  let result = spawnSync(
+    "oras",
+    [
+      "discover",
+      "--format",
+      "json",
+      "--artifact-type",
+      "sbom/cyclonedx",
+      image,
+    ],
+    {
+      encoding: "utf-8",
+      shell: isWin,
+      maxBuffer: MAX_BUFFER,
+    },
+  );
+  if (result.status !== 0 || result.error) {
+    console.log(
+      "Install oras by following the instructions at: https://oras.land/docs/installation",
+    );
+    if (result.stderr) {
+      console.log(result.stderr);
+    }
+    return undefined;
+  }
+  if (result.stdout) {
+    const out = Buffer.from(result.stdout).toString();
+    try {
+      const manifestObj = JSON.parse(out);
+      if (
+        manifestObj?.manifests?.length &&
+        Array.isArray(manifestObj.manifests) &&
+        manifestObj.manifests[0]?.reference
+      ) {
+        const imageRef = manifestObj.manifests[0].reference;
+        const tmpDir = getTmpDir();
+        result = spawnSync("oras", ["pull", imageRef, "-o", tmpDir], {
+          encoding: "utf-8",
+          shell: isWin,
+          maxBuffer: MAX_BUFFER,
+        });
+        if (result.status !== 0 || result.error) {
+          console.log(
+            `Unable to pull the SBOM attachment for ${imageRef} with oras!`,
+          );
+          return undefined;
+        }
+        const bomFiles = getAllFiles(tmpDir, "**/*.{bom,cdx}.json");
+        if (bomFiles.length) {
+          return JSON.parse(fs.readFileSync(bomFiles.pop(), "utf8"));
+        }
+      } else {
+        console.log(`${image} does not contain any SBOM attachment!`);
+      }
+    } catch (e) {
+      console.log(e);
+    }
+  }
+  return undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "11.3.0",
+  "version": "11.3.2",
   "description": "Creates CycloneDX Software Bill of Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -74,7 +74,7 @@
     "@babel/parser": "^7.27.2",
     "@babel/traverse": "^7.27.1",
     "@iarna/toml": "2.2.5",
-    "@npmcli/arborist": "9.0.2",
+    "@npmcli/arborist": "^9.1.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "cheerio": "^1.0.0",
@@ -84,7 +84,6 @@
     "global-agent": "^3.0.0",
     "got": "^14.4.7",
     "iconv-lite": "^0.6.3",
-    "js-yaml": "^4.1.0",
     "jws": "^4.0.0",
     "node-stream-zip": "^1.15.0",
     "packageurl-js": "1.0.2",
@@ -97,6 +96,7 @@
     "uuid": "^11.0.2",
     "validate-iri": "^1.0.1",
     "xml-js": "^1.6.11",
+    "yaml": "^2.8.0",
     "yargs": "^17.7.2",
     "yoctocolors": "^2.1.1"
   },

package/types/lib/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AA27BA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAqYD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAyEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAgvChB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAmvBhB;AAED;;;;;;;;;;GAUG;AACH,+DAsEC;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAkehB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BA+YhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAuIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAkEhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAkLhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BA8IhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAmJhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAmUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAiJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAwNhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA8ZhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDAiGC;AAED;;;;;;;;;GASG;AACH,2GAuCC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BA6vBlB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAqUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBA2QhB;AAED;;;;;;;GAOG;AACH,wDAHY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA2HjD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/cli/index.js"],"names":[],"mappings":"AA47BA;;;;;;;;GAQG;AACH,gFAFW,MAAM,SAchB;AAqYD;;;;;;;GAOG;AACH,mCALW,MAAM,qBAyEhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM;;;;EAKhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM;;;;EAkBhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAgvChB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAmvBhB;AAED;;;;;;;;;;GAUG;AACH,+DAsEC;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BAkehB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,8BAqZhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAuIhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAkEhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAkLhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBAsHhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,qBAuBhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,8BAqDhB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,8BA4ChB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,qBA2BhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BA8IhB;AAED;;;;;GAKG;AACH,qCAHW,MAAM,8BAmJhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBAmUhB;AAED;;;;;GAKG;AACH,mCAHW,MAAM,qBAiJhB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,8BAwNhB;AAED;;;;;GAKG;AACH,sCAHW,MAAM,8BA8ZhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM;;;;;;;;;;;;;;;;;;;;GAoChB;AAED;;;;;;;;KA+DC;AAED;;;;;;GAMG;AACH,yDAiGC;AAED;;;;;;;;;GASG;AACH,2GAuCC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,EAAE,8BA6vBlB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,8BAqUhB;AAED;;;;;GAKG;AACH,gCAHW,MAAM,qBA2QhB;AAED;;;;;;;GAOG;AACH,wDAHY,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA2HjD"}

package/types/lib/helpers/utils.d.ts

@@ -575,6 +575,7 @@ export function getGoPkgComponent(group: any, name: any, version: any, hash: any
  * @returns {Object} Object containing parent component, rootList and packages list
  */
 export function parseGoModData(goModData: string, gosumMap: any): any;
+export function parseGoModulesTxt(txtFile: any, gosumMap: any): Promise<any[]>;
 /**
  * Parse go list output
  *

package/types/lib/helpers/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/utils.js"],"names":[],"mappings":"AA8EA;;;;;GAKG;AACH,0DAUC;AAED;;;;;;GAMG;AACH,yDAHmB,OAAO,UAazB;AAmFD,8CAKC;AAED,0CAIC;AAsBD,yCAYC;AAID,2CAQC;AAiOD;;;;;;;GAOG;AACH,4EAiBC;AAED;;;;;;GAMG;AACH,mGA2EC;AAED;;;;;;;;GAQG;AACH,yGAeC;AAyBD;;;;;;GAMG;AACH,qCAJW,MAAM,WACN,MAAM,2BA8BhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BA0BhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED,iCAQC;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAWnB;AAED;;;;;;;;;GASG;AACH,iEA2BC;AAED;;;;;GAKG;AACH,6CAqDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBA+EjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqgBhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MA2DhB;AAgCD;;;;GAIG;AACH,4CAFW,MAAM;;;GAuOhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AAoHD;;;;;GAKG;AACH,kDAHW,MAAM,GACJ,MAAM,CAgBlB;AAED;;;;;;;;;;GAUG;AACH,wCARW,MAAM;;;;;;;;;;;;;;;;;;GA6uBhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,OAqIhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,WACN,MAAM,OA+JhB;AAED;;;;;;;;;GASG;AACH,4CAPW,MAAM,gBACN,GAAG,aACH,GAAG,gBACH,MAAM,OA+GhB;AAiBD;;;;;;GAMG;AACH,0CALW,MAAM,oBACN,MAAM,kBACN,GAAG,mBACH,MAAM;;;;;;;;;GA6OhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EAwDhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBACN,MAAM;;;;;;;;EAmDhB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,6CAIJ,MAAM,CAoFlB;AAED;;;GAGG;AACH,iDAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,wCAFW,MAAM,OAYhB;AAED;;;;;;;;GAQG;AACH,2FA0GC;AAED;;;;;;;;;GASG;AACH,sFAGC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CA6B3B;AAED;;;;;;;;;GASG;AACH,0EAFY,OAAO,QAAQ,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,OAAO,QAAQ,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,iFAFW,GAAC,OA0BX;AAED;;;;;GAKG;AACH,sFAsNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;;GAKG;AACH,iDAHW,MAAM,OAoLhB;AAED;;;;;;GAMG;AACH,yDAHW,MAAM,iBACN,MAAM;;;;;;;;;;;;;;;;;;;;GA4bhB;AAED;;;;;GAKG;AACH,mFAgKC;AAED;;;;;;;GAOG;AACH,kCALW,MAAM;;;;;;;;GA4EhB;AAED;;;;GAIG;AACH,mEAqBC;AAeD;;;;;GAKG;AACH;;;;;;;;;EAkLC;AAED;;;;GAIG;AACH;;;;;;EAcC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,uDAoBC;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,OAAO,QAAQ,CA8D1B;AAED;;;;GAIG;AACH,iEA2CC;AA+BD;;;;;;;;GAkCC;AAyBD;;;;;;;GAOG;AACH,sEA4FC;AAED;;;;;;GAMG;AACH,0CAJW,MAAM;;;;;;;;;;;GA2DhB;AA4BD;;;;;;;;;;GAUG;AACH,2CARW,MAAM,aACN,MAAM;;;;;;;;GAkMhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAsBhB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAMD;;;;GAIG;AACH,sDAsBC;AAED;;;;;;;;;;GAUG;AACH,uIAFa,KAAK,CAAC,MAAM,CAAC,CA0IzB;AAED;;;;;GAKG;AACH,8CAHW,MAAM,eACN,MAAM,kBAwKhB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;GAoQhB;AAED;;;;GAIG;AACH,kEAqEC;AAED;;;;GAIG;AACH,gEA+CC;AAyFD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAuIjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BA4GjB;AAED,oEAyDC;AAED,wEA0BC;AAED;;;;;;;GAOG;AACH,uEAgEC;AAED,0DAwBC;AAED,wDA+DC;AAED,0FAkEC;AAmBD;;IAiEC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAyCD,qFA2HC;AAED,8DA0BC;AAED,sDAiCC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EAyJC;AAED,kEAoDC;AAED;;;;;;;;GAQG;AACH,kGAiVC;AAED;;;EAqPC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;;GAMG;AACH,oDAJW,MAAM,OAsChB;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsJhB;AAED;;;;;;EAmIC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH,qDALW,MAAM;;;;;;;;;;IAgJhB;AA0CD;;;;;;;GAOG;AACH,8FAHW,MAAM,WACN,MAAM,UAqFhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;;;EAuBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,wIA+BC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA8JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;GAMG;AACH,kDA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,yDAHW,MAAM,GACJ,OAAO,KAAQ,CAkB3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBA2UhB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA2EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,GAAC,IAAI,UAiCrB;AAED;;;;GAIG;AACH,wCAFW,MAAM,UAehB;AAED;;;;;;;;;GASG;AACH,6DAPW,MAAM,EAAE,qBACR,MAAM,EAAE,6BACR,MAAM,EAAE,uBACR,GAAG,GAED,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AAEH,uDALW,MAAM,iBACN,MAAM,EAAE,GACN,GAAG,CAsCf;AAED;;;;;;GAMG;AACH,uFAuHC;AAED;;;;;;GAMG;AACH,wGA6BC;AAED;;;;;;GAMG;AACH,4EAHW,OAAO,OAajB;AAED;;;;;;;GAOG;AACH,8CALW,QAAQ,mCA6ClB;AAED;;;;;;;GAOG;AACH,0FAgFC;AAwRD;;;;;;GAMG;AACH,iDAJW,MAAM,YACN,MAAM,GACJ,MAAM,CA6ClB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0EAuGC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OA6ChB;AA2FD;;;;;GAKG;AACH,uCAHW,MAAM,sBAuDhB;AAED;;;;;;;;;GASG;AACH,2CAPW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4chB;AAED;;;;;;;;;;;GAWG;AACH,gDAPW,MAAM,+BAEN,MAAM;;;;;;;;;;;;;;;;EA+KhB;AAGD;;;;;EAmBC;AAED;;;;;;;GAOG;AACH,kEAJW,MAAM,cACN,MAAM,iCA2IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EAgQC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAuQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AAgID;;;;;GAKG;AACH;;;GA2HC;AAED,yEAiIC;AAED;;;;;;GAMG;AACH,mDAkBC;AAED;;;;;;;;;;GAUG;AACH,0DAkBC;AAED;;;;;;GAMG;AACH,sFAsBC;AAED;;;;;;;GAOG;AACH,2EAgCC;AAED;;;;;GAKG;AACH,oDAsCC;AAED;;;;;;GAMG;AACH,sEA0BC;AAED;;;;;;;;;GASG;AACH,+GA+CC;AAlkeD,gCAEc;AAEd,+BAEsD;AAEtD,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AA2DnE,iCAEE;AA2BF,iCAE0C;AAG1C,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAe/B,4CAEmE;AAGnE,6CAEE;AAgBF,oCAAkD;AAGlD,uCAEuD;AAYvD,8BAAyC;AAgBzC,gCAA6C;AAY7C,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,mCAAoC;AAOpC,gDAC2D;AAE3D,2BAAuD;AAGvD,kDAWE;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiJE;;;;AA6JF,8BAQG;AA0+LH,8CAUE"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../../lib/helpers/utils.js"],"names":[],"mappings":"AA8EA;;;;;GAKG;AACH,0DAUC;AAED;;;;;;GAMG;AACH,yDAHmB,OAAO,UAazB;AAmFD,8CAKC;AAED,0CAIC;AAsBD,yCAYC;AAID,2CAQC;AAiOD;;;;;;;GAOG;AACH,4EAiBC;AAED;;;;;;GAMG;AACH,mGA2EC;AAED;;;;;;;;GAQG;AACH,yGAeC;AAyBD;;;;;;GAMG;AACH,qCAJW,MAAM,WACN,MAAM,2BA8BhB;AAED;;;;;;GAMG;AACH,+CAJW,MAAM,WACN,MAAM,+BA0BhB;AAYD;;;;GAIG;AACH,gCAFa,MAAM,CAIlB;AAED,iCAQC;AAED;;;;;;IAMI;AACJ,iDAJW,MAAM,GACJ,OAAO,CAWnB;AAED;;;;;;;;;GASG;AACH,iEA2BC;AAED;;;;;GAKG;AACH,6CAqDC;AAED;;;;;;GAMG;AACH,sEA0DC;AAED;;;;GAIG;AACH,4EAoCC;AAED;;;GAGG;AACH;;EAUC;AAED,sEA0BC;AAED;;;;GAIG;AACH,+DA4CC;AAED;;;;;GAKG;AACH,0CAHW,MAAM,WACN,OAAO,kBA+EjB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM;;;GAqgBhB;AAED;;;;;;;GAOG;AACH,6CAFW,MAAM,MA2DhB;AAgCD;;;;GAIG;AACH,4CAFW,MAAM;;;GAuOhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,kBAiEhB;AAoHD;;;;;GAKG;AACH,kDAHW,MAAM,GACJ,MAAM,CAgBlB;AAED;;;;;;;;;;GAUG;AACH,wCARW,MAAM;;;;;;;;;;;;;;;;;;GA6uBhB;AAED;;;;GAIG;AACH,8CAFW,MAAM,kBA+ChB;AAED;;;;GAIG;AACH,sCAFW,MAAM,kBAgFhB;AAED;;;;;GAKG;AACH,kCAHW,MAAM,OAqIhB;AAED;;;;;;GAMG;AACH,0CALW,MAAM,WACN,MAAM,OA+JhB;AAED;;;;;;;;;GASG;AACH,4CAPW,MAAM,gBACN,GAAG,aACH,GAAG,gBACH,MAAM,OA+GhB;AAiBD;;;;;;GAMG;AACH,0CALW,MAAM,oBACN,MAAM,kBACN,GAAG,mBACH,MAAM;;;;;;;;;GA6OhB;AAED;;;GAGG;AACH,uCAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,wCAFW,MAAM,OAahB;AAED,yEAwBC;AAED;;;;GAIG;AACH,+CAFW,MAAM;;;EAwDhB;AAED;;;;;GAKG;AACH,iDAHW,MAAM,qBACN,MAAM;;;;;;;;EAmDhB;AAED;;;;;;;;GAQG;AACH,qDANW,MAAM,6CAIJ,MAAM,CAoFlB;AAED;;;GAGG;AACH,iDAFW,MAAM,SAoChB;AAED;;;GAGG;AACH,8CAFW,MAAM,SAsDhB;AAED;;;GAGG;AACH,2CAFW,MAAM,SAiBhB;AAED;;GAEG;AACH,kDAoCC;AAED;;;;GAIG;AACH,oCAFW,MAAM,OAchB;AAED;;;;GAIG;AACH,wCAFW,MAAM,OAYhB;AAED;;;;;;;;GAQG;AACH,2FA0GC;AAED;;;;;;;;;GASG;AACH,sFAGC;AAED;;;;;;;;;GASG;AACH,gFAFY,MAAO,SAAS,CA6B3B;AAED;;;;;;;;;GASG;AACH,0EAFY,OAAO,QAAQ,CAU1B;AAED;;;;GAIG;AACH,4DAFW,WAAY,SAYtB;AAED;;;;;;;;;GASG;AACH,+FAFY,OAAO,QAAQ,CAc1B;AAED;;;;GAIG;AACH;;;EAqBC;AAED;;;;;GAKG;AACH,iFAFW,GAAC,OA0BX;AAED;;;;;GAKG;AACH,sFAsNC;AAED;;;;GAIG;AACH,qDAmBC;AAED;;;;GAIG;AACH,gEAeC;AAED;;;;;GAKG;AACH,iDAHW,MAAM,OAoLhB;AAED;;;;;;GAMG;AACH,yDAHW,MAAM,iBACN,MAAM;;;;;;;;;;;;;;;;;;;;GAmchB;AAED;;;;;GAKG;AACH,mFAgKC;AAED;;;;;;;GAOG;AACH,kCALW,MAAM;;;;;;;;GA4EhB;AAED;;;;GAIG;AACH,mEAqBC;AAeD;;;;;GAKG;AACH;;;;;;;;;EAkLC;AAED;;;;GAIG;AACH;;;;;;EAcC;AAED;;;;GAIG;AACH,+DAFY,SAAO,SAAS,CAc3B;AAED;;;;GAIG;AACH,uDAoBC;AAED;;;;GAIG;AACH,oDAFY,QAAQ,CAQnB;AAED;;;;;GAKG;AACH,oEAFY,SAAO,SAAS,CAc3B;AAED;;;;;;GAMG;AACH,oEAFY,OAAO,QAAQ,CA8D1B;AAED;;;;GAIG;AACH,iEA2CC;AA+BD;;;;;;;;GAkCC;AAyBD;;;;;;;GAOG;AACH,sEAgHC;AAED,+EAwBC;AAED;;;;;;GAMG;AACH,0CAJW,MAAM;;;;;;;;;;;GA4DhB;AA4BD;;;;;;;;;;GAUG;AACH,2CARW,MAAM,aACN,MAAM;;;;;;;;GAkMhB;AAED;;;;GAIG;AACH,yCAHW,MAAM,OAehB;AAED;;;;GAIG;AACH,0CAHW,MAAM,kBAsBhB;AAED,+DA+CC;AAED,uEAwBC;AA6BD;;;;GAIG;AACH,oEAmGC;AAMD;;;;GAIG;AACH,sDAsBC;AAED;;;;;;;;;;GAUG;AACH,uIAFa,KAAK,CAAC,MAAM,CAAC,CA0IzB;AAED;;;;;GAKG;AACH,8CAHW,MAAM,eACN,MAAM,kBAwKhB;AAED;;;;;GAKG;AACH,kDAHW,MAAM,YACN,MAAM;;;;;;;GAoQhB;AAED;;;;GAIG;AACH,kEAqEC;AAED;;;;GAIG;AACH,gEA+CC;AAyFD;;;;;;;;;;;;;;;;;GAiBG;AACH,mEALW,OAAO,4BAuIjB;AAED;;;;;;;;GAQG;AACH,+DALW,OAAO,4BA4GjB;AAED,oEAyDC;AAED,wEA0BC;AAED;;;;;;;GAOG;AACH,uEAgEC;AAED,0DAwBC;AAED,wDA+DC;AAED,0FAkEC;AAmBD;;IAiEC;AAED;;IA2DC;AAED,2DAiEC;AAED,yDAaC;AAaD,gDA+EC;AAED,yDAkDC;AAED,sDA0BC;AAED,sDAyBC;AAED,6DAwCC;AAED,yDAmCC;AAyCD,qFA2HC;AAED,8DA0BC;AAED,sDAiCC;AAED,yDAgCC;AAED,qDAkDC;AAED;;;;;GAKG;AACH,mDASC;AAED;;;;;;GAMG;AACH,4EAyJC;AAED,kEAoDC;AAED;;;;;;;;GAQG;AACH,kGAiVC;AAED;;;EAqPC;AAED;;;;EAsHC;AAED;;;EA+GC;AAED;;;;;;GAMG;AACH,oDAJW,MAAM,OAsChB;AAED;;;;;GAKG;AACH,+CAHW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsJhB;AAED;;;;;;EAmIC;AAED;;;;GAIG;AACH,0CAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAqDhB;AAmBD;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAchB;AAED;;;;;GAKG;AACH,wCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YAQhB;AAED;;;;;GAKG;AACH,2CAHW,MAAM,YAQhB;AAED;;;;;;;GAOG;AACH,qDALW,MAAM;;;;;;;;;;IAgJhB;AA0CD;;;;;;;GAOG;AACH,8FAHW,MAAM,WACN,MAAM,UAqFhB;AAED;;;;GAIG;AACH,8CAHW,MAAM,WACN,MAAM;;;;;;;;EAuBhB;AAED;;;GAGG;AACH,iDAFW,MAAM;;;;;;;;;;;;;;;;;;;;;IAwDhB;AAED;;;;;;;GAOG;AACH,iDALW,MAAM,YACN,MAAM,YACN,OAAO,oBACP,OAAO,eA6DjB;AAED,wIA+BC;AAED;;;;;;;GAOG;AACH,sCALW,MAAM,eACN,MAAM,eA8JhB;AAED;;;;;;;;;;;;;;;;;;;;;;IA6DC;AAED;;;;;;GAMG;AACH,kDA8BC;AAED,uDAeC;AAED,2DAeC;AAED,2CAIC;AAED;;;;;;GAMG;AACH,uDAJW,MAAM,MAgBhB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,QACN,MAAM,GACJ,OAAO,QAAQ,CAU3B;AAED;;;;;;GAMG;AACH,yDAHW,MAAM,GACJ,OAAO,KAAQ,CAkB3B;AAED;;;;;;;;GAQG;AACH,2CANW,MAAM,WACN,MAAM,iBACN,MAAM,kBA2UhB;AAED;;;;;;;GAOG;AACH,iDAFW,MAAM,OAehB;AAED;;;;;;;;;;;GAWG;AACH,uCAHW,MAAM,UACN,MAAM,UAYhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,uBACN,MAAM,WAgBhB;AAED;;;;GAIG;AACH,4CAFW,MAAM,UAIhB;AAED;;;;;;;;GAQG;AACH,sCANW,MAAM,eACN,MAAM,oBACN,MAAM,gBAgChB;AAED;;;;;;GAMG;AACH,uCAJW,MAAM,kBA2EhB;AAED;;;;;GAKG;AACH,0CAHW,MAAM,YACN,MAAM,GAAC,IAAI,UAiCrB;AAED;;;;GAIG;AACH,wCAFW,MAAM,UAehB;AAED;;;;;;;;;GASG;AACH,6DAPW,MAAM,EAAE,qBACR,MAAM,EAAE,6BACR,MAAM,EAAE,uBACR,GAAG,GAED,MAAM,EAAE,CA2CpB;AAcD;;;;;;GAMG;AAEH,uDALW,MAAM,iBACN,MAAM,EAAE,GACN,GAAG,CAsCf;AAED;;;;;;GAMG;AACH,uFA2IC;AAED;;;;;;GAMG;AACH,wGA6BC;AAED;;;;;;GAMG;AACH,4EAHW,OAAO,OAajB;AAED;;;;;;;GAOG;AACH,8CALW,QAAQ,mCA6ClB;AAED;;;;;;;GAOG;AACH,0FAgFC;AA2TD;;;;;;GAMG;AACH,iDAJW,MAAM,YACN,MAAM,GACJ,MAAM,CA6ClB;AAED;;;;;GAKG;AACH,yCAHW,MAAM,YACN,MAAM,UAsEhB;AAED;;GAEG;AACH,sCAmBC;AAED,0EAuGC;AAED;;;;;;;;GAQG;AACH,oCANW,MAAM,YACN,MAAM,gBACN,MAAM,eACN,MAAM,OA6ChB;AA2FD;;;;;GAKG;AACH,uCAHW,MAAM,sBAuDhB;AAED;;;;;;;;;GASG;AACH,2CAPW,MAAM,kBACN,MAAM,eACN,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4chB;AAED;;;;;;;;;;;GAWG;AACH,gDAPW,MAAM,+BAEN,MAAM;;;;;;;;;;;;;;;;EA+KhB;AAGD;;;;;EAmBC;AAED;;;;;;;GAOG;AACH,kEAJW,MAAM,cACN,MAAM,iCA2IhB;AAED,qDASC;AAED;;;;;;;EA2GC;AAED;;;EAgQC;AAED,sEA6BC;AAED;;;;;;;GAOG;AACH,mCALW,MAAM,WACN,MAAM;;;;;;;EAwQhB;AAED;;;;;;GAMG;AACH,2CAHW,MAAM,OAKhB;AAED,qDA0CC;AAgID;;;;;GAKG;AACH;;;GA2HC;AAED,yEAiIC;AAED;;;;;;GAMG;AACH,mDAkBC;AAED;;;;;;;;;;GAUG;AACH,0DAkBC;AAED;;;;;;GAMG;AACH,sFAsBC;AAED;;;;;;;GAOG;AACH,2EAgCC;AAED;;;;;GAKG;AACH,oDAsCC;AAED;;;;;;GAMG;AACH,sEA0BC;AAED;;;;;;;;;GASG;AACH,+GA+CC;AAhreD,gCAEc;AAEd,+BAEsD;AAEtD,4BAA4C;AAC5C,4BAA6C;AAC7C,2BAAmE;AA2DnE,iCAEE;AA2BF,iCAE0C;AAG1C,gCACmE;AAGnE,gCACsE;AAGtE,8BAA+B;AAe/B,4CAEmE;AAGnE,6CAEE;AAgBF,oCAAkD;AAGlD,uCAEuD;AAYvD,8BAAyC;AAgBzC,gCAA6C;AAY7C,8BAAiC;AAIjC,4BAA6B;AAI7B,2BAA2B;AAI3B,4BAA6B;AAI7B,2BAA2B;AAI3B,6BAA+B;AAI/B,0BAAyB;AAIzB,6BAA+B;AAM/B,2BAA2B;AAK3B,4BAA6B;AAK7B,mCAAoC;AAOpC,gDAC2D;AAE3D,2BAAuD;AAGvD,kDAWE;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiJE;;;;AA6JF,8BAQG;AAgiMH,8CAUE"}

package/types/lib/managers/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAkFA;;GAEG;AACH,oCAmBC;AAED;;GAEG;AACH,4CA6CC;AA7HD,4BAA6C;AAC7C,kCAAmC,WAAW,CAAC;AAmCxC,kDAeN;AAqFM,iCAHI,MAAM,WACN,MAAM,iDAehB;AAqBM,6DAmBN;AAgLM,4EAsGN;AAEM,oFAwBN;AAUM;;;;;;;;EA2EN;AAsBM,2DAuMN;AAgBM,yFAuGN;AAMM;;;;;;;;;;;;;;GAwDN;AAEM;;;;;;;;GAyGN;AAMM,4EA+IN;AAKM,4EA2GN;AAEM,+EAEN;AAEM,4EA2CN;AAEM,iFA0BN"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../lib/managers/docker.js"],"names":[],"mappings":"AAkFA;;GAEG;AACH,oCAsBC;AAED;;GAEG;AACH,4CA6CC;AAhID,4BAA6C;AAC7C,kCAAmC,WAAW,CAAC;AAmCxC,kDAeN;AAwFM,iCAHI,MAAM,WACN,MAAM,iDAehB;AAqBM,6DAmBN;AAgLM,4EAsGN;AAEM,oFAwBN;AAUM;;;;;;;;EA2EN;AAsBM,2DAuMN;AAgBM,yFAuGN;AAMM;;;;;;;;;;;;;;GAwDN;AAEM;;;;;;;;GAyGN;AAMM,4EA+IN;AAKM,4EA2GN;AAEM,+EAEN;AAEM,4EA2CN;AAEM,iFA0BN"}

package/types/lib/managers/oci.d.ts

@@ -0,0 +1,2 @@
+export function getBomWithOras(image: any): any;
+//# sourceMappingURL=oci.d.ts.map

package/types/lib/managers/oci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../lib/managers/oci.js"],"names":[],"mappings":"AAKA,gDA4DC"}