@cyclonedx/cdxgen 11.3.2 → 11.4.0

package/README.md

@@ -534,7 +534,7 @@ Use `pnpm add -g` command to quickly test the main branch.
 ```shell
 corepack pnpm bin -g
 corepack pnpm setup
-corepack pnpm add -g --allow-build sqlite3 https://github.com/CycloneDX/cdxgen
+corepack pnpm add -g --allow-build @appthreat/sqlite3 https://github.com/CycloneDX/cdxgen
 cdxgen --help
 ```
 

package/bin/cdxgen.js

@@ -4,10 +4,11 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import process from "node:process";
-import { findUpSync } from "find-up";
 import globalAgent from "global-agent";
 import jws from "jws";
 import { parse as _load } from "yaml";
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
 import { createBom, submitBom } from "../lib/cli/index.js";
 import {
   printCallStack,
@@ -35,15 +36,21 @@ import { validateBom } from "../lib/helpers/validator.js";
 import { postProcess } from "../lib/stages/postgen/postgen.js";
 import { prepareEnv } from "../lib/stages/pregen/pregen.js";
 
+const dirName = dirNameStr;
+
 // Support for config files
-const configPath = findUpSync([
+const configPaths = [
   ".cdxgenrc",
   ".cdxgen.json",
   ".cdxgen.yml",
   ".cdxgen.yaml",
-]);
+];
 let config = {};
-if (configPath) {
+for (const configPattern of configPaths) {
+  const configPath = join(process.cwd(), configPattern);
+  if (!safeExistsSync(configPath)) {
+    continue;
+  }
   try {
     if (configPath.endsWith(".yml") || configPath.endsWith(".yaml")) {
       config = _load(fs.readFileSync(configPath, "utf-8"));
@@ -55,11 +62,6 @@ if (configPath) {
   }
 }
 
-const dirName = dirNameStr;
-
-import yargs from "yargs";
-import { hideBin } from "yargs/helpers";
-
 const args = yargs(hideBin(process.argv))
   .env("CDXGEN")
   .parserConfiguration({
@@ -218,7 +220,7 @@ const args = yargs(hideBin(process.argv))
     description: "CycloneDX Specification version to use. Defaults to 1.6",
     default: 1.6,
     type: "number",
-    choices: [1.4, 1.5, 1.6],
+    choices: [1.4, 1.5, 1.6, 1.7],
   })
   .option("filter", {
     description:
@@ -329,6 +331,13 @@ const args = yargs(hideBin(process.argv))
       "filename",
     ],
   })
+  .option("tlp-classification", {
+    description:
+      'Traffic Light Protocol (TLP) is a classification system for identifying the potential risk associated with artefact, including whether it is subject to certain types of legal, financial, or technical threats. Refer to [https://www.first.org/tlp/](https://www.first.org/tlp/) for further information.\nThe default classification is "CLEAR"',
+    choices: ["CLEAR", "GREEN", "AMBER", "AMBER_AND_STRICT", "RED"],
+    default: "CLEAR",
+    hidden: true,
+  })
   .completion("completion", "Generate bash/zsh completion")
   .array("type")
   .array("excludeType")
@@ -784,8 +793,9 @@ const needsBomSigning = ({ generateKeyAndSign }) =>
   generateKeyAndSign ||
   (process.env.SBOM_SIGN_ALGORITHM &&
     process.env.SBOM_SIGN_ALGORITHM !== "none" &&
-    process.env.SBOM_SIGN_PRIVATE_KEY &&
-    safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY));
+    ((process.env.SBOM_SIGN_PRIVATE_KEY &&
+      safeExistsSync(process.env.SBOM_SIGN_PRIVATE_KEY)) ||
+      process.env.SBOM_SIGN_PRIVATE_KEY_BASE64));
 
 /**
  * Method to start the bom creation process
@@ -885,10 +895,17 @@ const needsBomSigning = ({ generateKeyAndSign }) =>
             .createPublicKey(publicKey)
             .export({ format: "jwk" });
         } else {
-          privateKeyToUse = fs.readFileSync(
-            process.env.SBOM_SIGN_PRIVATE_KEY,
-            "utf8",
-          );
+          if (process.env?.SBOM_SIGN_PRIVATE_KEY) {
+            privateKeyToUse = fs.readFileSync(
+              process.env.SBOM_SIGN_PRIVATE_KEY,
+              "utf8",
+            );
+          } else if (process.env?.SBOM_SIGN_PRIVATE_KEY_BASE64) {
+            privateKeyToUse = Buffer.from(
+              process.env.SBOM_SIGN_PRIVATE_KEY_BASE64,
+              "base64",
+            ).toString("utf8");
+          }
           if (
             process.env.SBOM_SIGN_PUBLIC_KEY &&
             safeExistsSync(process.env.SBOM_SIGN_PUBLIC_KEY)
@@ -898,6 +915,11 @@ const needsBomSigning = ({ generateKeyAndSign }) =>
                 fs.readFileSync(process.env.SBOM_SIGN_PUBLIC_KEY, "utf8"),
               )
               .export({ format: "jwk" });
+          } else if (process.env?.SBOM_SIGN_PUBLIC_KEY_BASE64) {
+            jwkPublicKey = Buffer.from(
+              process.env.SBOM_SIGN_PUBLIC_KEY_BASE64,
+              "base64",
+            ).toString("utf8");
           }
         }
         try {

package/bin/evinse.js

@@ -1,10 +1,7 @@
 #!/usr/bin/env node
+// Evinse (Evinse Verification Is Nearly SBOM Evidence)
 
-import fs from "node:fs";
 import process from "node:process";
-import { findUpSync } from "find-up";
-import { parse as _load } from "yaml";
-// Evinse (Evinse Verification Is Nearly SBOM Evidence)
 import yargs from "yargs";
 import { hideBin } from "yargs/helpers";
 import {
@@ -21,26 +18,6 @@ import {
 import { ATOM_DB } from "../lib/helpers/utils.js";
 import { validateBom } from "../lib/helpers/validator.js";
 
-// Support for config files
-const configPath = findUpSync([
-  ".cdxgenrc",
-  ".cdxgen.json",
-  ".cdxgen.yml",
-  ".cdxgen.yaml",
-]);
-let config = {};
-if (configPath) {
-  try {
-    if (configPath.endsWith(".yml") || configPath.endsWith(".yaml")) {
-      config = _load(fs.readFileSync(configPath, "utf-8"));
-    } else {
-      config = JSON.parse(fs.readFileSync(configPath, "utf-8"));
-    }
-  } catch (e) {
-    console.log("Invalid config file", configPath);
-  }
-}
-
 const args = yargs(hideBin(process.argv))
   .env("EVINSE")
   .option("input", {
@@ -150,7 +127,6 @@ const args = yargs(hideBin(process.argv))
   ])
   .completion("completion", "Generate bash/zsh completion")
   .epilogue("for documentation, visit https://cyclonedx.github.io/cdxgen")
-  .config(config)
   .scriptName("evinse")
   .version()
   .help("h")

package/bin/verify.js

@@ -17,6 +17,9 @@ const args = yargs(hideBin(process.argv))
     default: "bom.json",
     description: "Input json to validate. Default bom.json",
   })
+  .option("platform", {
+    description: "The platform to validate. No default",
+  })
   .option("public-key", {
     default: "public.key",
     description: "Public key in PEM format. Default public.key",
@@ -53,7 +56,7 @@ function getBom(args) {
     args.input.includes("docker") ||
     args.input.includes("ghcr")
   ) {
-    return getBomWithOras(args.input);
+    return getBomWithOras(args.input, args.platform);
   }
   return undefined;
 }