@cyclonedx/cdxgen 12.1.4 → 12.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (184) hide show
  1. package/README.md +47 -39
  2. package/bin/cdxgen.js +181 -90
  3. package/bin/evinse.js +4 -4
  4. package/bin/repl.js +3 -3
  5. package/bin/sign.js +102 -0
  6. package/bin/validate.js +233 -0
  7. package/bin/verify.js +69 -28
  8. package/data/queries.json +1 -1
  9. package/data/rules/ci-permissions.yaml +186 -0
  10. package/data/rules/dependency-sources.yaml +123 -0
  11. package/data/rules/package-integrity.yaml +135 -0
  12. package/data/rules/vscode-extensions.yaml +228 -0
  13. package/lib/cli/index.js +484 -440
  14. package/lib/evinser/db.js +137 -0
  15. package/lib/{helpers → evinser}/db.poku.js +2 -6
  16. package/lib/evinser/evinser.js +5 -18
  17. package/lib/evinser/swiftsem.js +1 -1
  18. package/lib/helpers/bomSigner.js +312 -0
  19. package/lib/helpers/bomSigner.poku.js +156 -0
  20. package/lib/helpers/caxa.js +1 -1
  21. package/lib/helpers/ciParsers/azurePipelines.js +295 -0
  22. package/lib/helpers/ciParsers/azurePipelines.poku.js +253 -0
  23. package/lib/helpers/ciParsers/circleCi.js +286 -0
  24. package/lib/helpers/ciParsers/circleCi.poku.js +230 -0
  25. package/lib/helpers/ciParsers/common.js +24 -0
  26. package/lib/helpers/ciParsers/githubActions.js +636 -0
  27. package/lib/helpers/ciParsers/githubActions.poku.js +802 -0
  28. package/lib/helpers/ciParsers/gitlabCi.js +213 -0
  29. package/lib/helpers/ciParsers/gitlabCi.poku.js +247 -0
  30. package/lib/helpers/ciParsers/jenkins.js +181 -0
  31. package/lib/helpers/ciParsers/jenkins.poku.js +197 -0
  32. package/lib/helpers/depsUtils.js +203 -0
  33. package/lib/helpers/depsUtils.poku.js +150 -0
  34. package/lib/helpers/display.js +429 -14
  35. package/lib/helpers/envcontext.js +23 -8
  36. package/lib/helpers/formulationParsers.js +351 -0
  37. package/lib/helpers/logger.js +14 -0
  38. package/lib/helpers/protobom.js +9 -9
  39. package/lib/helpers/pythonutils.js +305 -0
  40. package/lib/helpers/pythonutils.poku.js +469 -0
  41. package/lib/helpers/utils.js +970 -528
  42. package/lib/helpers/utils.poku.js +139 -256
  43. package/lib/helpers/versutils.js +202 -0
  44. package/lib/helpers/versutils.poku.js +315 -0
  45. package/lib/helpers/vsixutils.js +1061 -0
  46. package/lib/helpers/vsixutils.poku.js +2247 -0
  47. package/lib/managers/binary.js +19 -19
  48. package/lib/managers/docker.js +108 -1
  49. package/lib/managers/oci.js +10 -0
  50. package/lib/managers/piptree.js +4 -10
  51. package/lib/parsers/npmrc.js +92 -0
  52. package/lib/parsers/npmrc.poku.js +528 -0
  53. package/lib/server/openapi.yaml +1 -10
  54. package/lib/server/server.js +58 -16
  55. package/lib/server/server.poku.js +123 -144
  56. package/lib/stages/postgen/annotator.js +1 -1
  57. package/lib/stages/postgen/auditBom.js +197 -0
  58. package/lib/stages/postgen/auditBom.poku.js +378 -0
  59. package/lib/stages/postgen/postgen.js +54 -1
  60. package/lib/stages/postgen/postgen.poku.js +90 -1
  61. package/lib/stages/postgen/ruleEngine.js +369 -0
  62. package/lib/stages/pregen/envAudit.js +299 -0
  63. package/lib/stages/pregen/envAudit.poku.js +572 -0
  64. package/lib/stages/pregen/pregen.js +12 -8
  65. package/lib/third-party/arborist/lib/deepest-nesting-target.js +1 -1
  66. package/lib/third-party/arborist/lib/node.js +3 -3
  67. package/lib/third-party/arborist/lib/shrinkwrap.js +1 -1
  68. package/lib/third-party/arborist/lib/tree-check.js +1 -1
  69. package/lib/{helpers/validator.js → validator/bomValidator.js} +107 -47
  70. package/lib/validator/complianceEngine.js +241 -0
  71. package/lib/validator/complianceEngine.poku.js +168 -0
  72. package/lib/validator/complianceRules.js +1610 -0
  73. package/lib/validator/complianceRules.poku.js +328 -0
  74. package/lib/validator/index.js +222 -0
  75. package/lib/validator/index.poku.js +144 -0
  76. package/lib/validator/reporters/annotations.js +121 -0
  77. package/lib/validator/reporters/console.js +149 -0
  78. package/lib/validator/reporters/index.js +41 -0
  79. package/lib/validator/reporters/json.js +37 -0
  80. package/lib/validator/reporters/sarif.js +184 -0
  81. package/lib/validator/reporters.poku.js +150 -0
  82. package/package.json +8 -8
  83. package/types/bin/sign.d.ts +3 -0
  84. package/types/bin/sign.d.ts.map +1 -0
  85. package/types/bin/validate.d.ts +3 -0
  86. package/types/bin/validate.d.ts.map +1 -0
  87. package/types/helpers/utils.d.ts +0 -1
  88. package/types/lib/cli/index.d.ts +49 -52
  89. package/types/lib/cli/index.d.ts.map +1 -1
  90. package/types/lib/evinser/db.d.ts +34 -0
  91. package/types/lib/evinser/db.d.ts.map +1 -0
  92. package/types/lib/evinser/evinser.d.ts +63 -16
  93. package/types/lib/evinser/evinser.d.ts.map +1 -1
  94. package/types/lib/helpers/bomSigner.d.ts +27 -0
  95. package/types/lib/helpers/bomSigner.d.ts.map +1 -0
  96. package/types/lib/helpers/ciParsers/azurePipelines.d.ts +17 -0
  97. package/types/lib/helpers/ciParsers/azurePipelines.d.ts.map +1 -0
  98. package/types/lib/helpers/ciParsers/circleCi.d.ts +17 -0
  99. package/types/lib/helpers/ciParsers/circleCi.d.ts.map +1 -0
  100. package/types/lib/helpers/ciParsers/common.d.ts +11 -0
  101. package/types/lib/helpers/ciParsers/common.d.ts.map +1 -0
  102. package/types/lib/helpers/ciParsers/githubActions.d.ts +34 -0
  103. package/types/lib/helpers/ciParsers/githubActions.d.ts.map +1 -0
  104. package/types/lib/helpers/ciParsers/gitlabCi.d.ts +17 -0
  105. package/types/lib/helpers/ciParsers/gitlabCi.d.ts.map +1 -0
  106. package/types/lib/helpers/ciParsers/jenkins.d.ts +17 -0
  107. package/types/lib/helpers/ciParsers/jenkins.d.ts.map +1 -0
  108. package/types/lib/helpers/depsUtils.d.ts +21 -0
  109. package/types/lib/helpers/depsUtils.d.ts.map +1 -0
  110. package/types/lib/helpers/display.d.ts +111 -11
  111. package/types/lib/helpers/display.d.ts.map +1 -1
  112. package/types/lib/helpers/envcontext.d.ts +19 -7
  113. package/types/lib/helpers/envcontext.d.ts.map +1 -1
  114. package/types/lib/helpers/formulationParsers.d.ts +50 -0
  115. package/types/lib/helpers/formulationParsers.d.ts.map +1 -0
  116. package/types/lib/helpers/logger.d.ts +15 -1
  117. package/types/lib/helpers/logger.d.ts.map +1 -1
  118. package/types/lib/helpers/protobom.d.ts +2 -2
  119. package/types/lib/helpers/pythonutils.d.ts +18 -0
  120. package/types/lib/helpers/pythonutils.d.ts.map +1 -0
  121. package/types/lib/helpers/utils.d.ts +532 -128
  122. package/types/lib/helpers/utils.d.ts.map +1 -1
  123. package/types/lib/helpers/versutils.d.ts +8 -0
  124. package/types/lib/helpers/versutils.d.ts.map +1 -0
  125. package/types/lib/helpers/vsixutils.d.ts +130 -0
  126. package/types/lib/helpers/vsixutils.d.ts.map +1 -0
  127. package/types/lib/managers/docker.d.ts +12 -31
  128. package/types/lib/managers/docker.d.ts.map +1 -1
  129. package/types/lib/managers/oci.d.ts +11 -1
  130. package/types/lib/managers/oci.d.ts.map +1 -1
  131. package/types/lib/managers/piptree.d.ts.map +1 -1
  132. package/types/lib/parsers/npmrc.d.ts +26 -0
  133. package/types/lib/parsers/npmrc.d.ts.map +1 -0
  134. package/types/lib/server/server.d.ts +21 -2
  135. package/types/lib/server/server.d.ts.map +1 -1
  136. package/types/lib/stages/postgen/auditBom.d.ts +20 -0
  137. package/types/lib/stages/postgen/auditBom.d.ts.map +1 -0
  138. package/types/lib/stages/postgen/postgen.d.ts +8 -1
  139. package/types/lib/stages/postgen/postgen.d.ts.map +1 -1
  140. package/types/lib/stages/postgen/ruleEngine.d.ts +18 -0
  141. package/types/lib/stages/postgen/ruleEngine.d.ts.map +1 -0
  142. package/types/lib/stages/pregen/envAudit.d.ts +8 -0
  143. package/types/lib/stages/pregen/envAudit.d.ts.map +1 -0
  144. package/types/lib/stages/pregen/pregen.d.ts.map +1 -1
  145. package/types/lib/{helpers/validator.d.ts → validator/bomValidator.d.ts} +1 -1
  146. package/types/lib/validator/bomValidator.d.ts.map +1 -0
  147. package/types/lib/validator/complianceEngine.d.ts +66 -0
  148. package/types/lib/validator/complianceEngine.d.ts.map +1 -0
  149. package/types/lib/validator/complianceRules.d.ts +70 -0
  150. package/types/lib/validator/complianceRules.d.ts.map +1 -0
  151. package/types/lib/validator/index.d.ts +70 -0
  152. package/types/lib/validator/index.d.ts.map +1 -0
  153. package/types/lib/validator/reporters/annotations.d.ts +31 -0
  154. package/types/lib/validator/reporters/annotations.d.ts.map +1 -0
  155. package/types/lib/validator/reporters/console.d.ts +30 -0
  156. package/types/lib/validator/reporters/console.d.ts.map +1 -0
  157. package/types/lib/validator/reporters/index.d.ts +21 -0
  158. package/types/lib/validator/reporters/index.d.ts.map +1 -0
  159. package/types/lib/validator/reporters/json.d.ts +11 -0
  160. package/types/lib/validator/reporters/json.d.ts.map +1 -0
  161. package/types/lib/validator/reporters/sarif.d.ts +16 -0
  162. package/types/lib/validator/reporters/sarif.d.ts.map +1 -0
  163. package/lib/helpers/db.js +0 -162
  164. package/types/helpers/db.d.ts +0 -35
  165. package/types/helpers/db.d.ts.map +0 -1
  166. package/types/lib/helpers/db.d.ts +0 -35
  167. package/types/lib/helpers/db.d.ts.map +0 -1
  168. package/types/lib/helpers/validator.d.ts.map +0 -1
  169. package/types/managers/binary.d.ts +0 -37
  170. package/types/managers/binary.d.ts.map +0 -1
  171. package/types/managers/docker.d.ts +0 -56
  172. package/types/managers/docker.d.ts.map +0 -1
  173. package/types/managers/oci.d.ts +0 -2
  174. package/types/managers/oci.d.ts.map +0 -1
  175. package/types/managers/piptree.d.ts +0 -2
  176. package/types/managers/piptree.d.ts.map +0 -1
  177. package/types/server/server.d.ts +0 -34
  178. package/types/server/server.d.ts.map +0 -1
  179. package/types/stages/postgen/annotator.d.ts +0 -27
  180. package/types/stages/postgen/annotator.d.ts.map +0 -1
  181. package/types/stages/postgen/postgen.d.ts +0 -51
  182. package/types/stages/postgen/postgen.d.ts.map +0 -1
  183. package/types/stages/pregen/pregen.d.ts +0 -59
  184. package/types/stages/pregen/pregen.d.ts.map +0 -1
@@ -0,0 +1,70 @@
1
+ /**
2
+ * Run structural + compliance validation against a parsed BOM.
3
+ *
4
+ * @param {object} bomJson Parsed CycloneDX JSON BOM.
5
+ * @param {object} [options]
6
+ * @param {boolean} [options.schema] Run JSON-Schema validation (default true).
7
+ * @param {boolean} [options.deep] Run purl/ref/metadata deep checks (default true).
8
+ * @param {Array<string>} [options.benchmarks] Aliases to include in the scorecards (default: all).
9
+ * @param {Array<string>} [options.categories] Restrict compliance rules to these categories.
10
+ * @param {string} [options.minSeverity] Minimum severity for returned findings.
11
+ * @param {boolean} [options.includeManual] Include manual-review findings (default true).
12
+ * @param {boolean} [options.includePass] Include passing findings (default false).
13
+ * @param {string} [options.publicKey] If set, verify the BOM signature.
14
+ * @returns {{
15
+ * schemaValid: boolean,
16
+ * deepValid: boolean,
17
+ * signatureVerified: boolean | null,
18
+ * signatureDetails: object | null,
19
+ * findings: Array<object>,
20
+ * allFindings: Array<object>,
21
+ * benchmarks: Array<object>,
22
+ * summary: object
23
+ * }}
24
+ */
25
+ export function validateBomAdvanced(bomJson: object, options?: {
26
+ schema?: boolean | undefined;
27
+ deep?: boolean | undefined;
28
+ benchmarks?: string[] | undefined;
29
+ categories?: string[] | undefined;
30
+ minSeverity?: string | undefined;
31
+ includeManual?: boolean | undefined;
32
+ includePass?: boolean | undefined;
33
+ publicKey?: string | undefined;
34
+ }): {
35
+ schemaValid: boolean;
36
+ deepValid: boolean;
37
+ signatureVerified: boolean | null;
38
+ signatureDetails: object | null;
39
+ findings: Array<object>;
40
+ allFindings: Array<object>;
41
+ benchmarks: Array<object>;
42
+ summary: object;
43
+ };
44
+ /**
45
+ * Decide whether a report should trigger a non-zero CLI exit.
46
+ *
47
+ * @param {object} report
48
+ * @param {object} opts
49
+ * @param {string} [opts.failSeverity] Severity level at or above which failing findings are considered a failure (default "high").
50
+ * @param {boolean} [opts.strict] When true, failing on any `fail` status regardless of severity, and a failing schema/deep validation also counts.
51
+ * @param {boolean} [opts.requireSignature] Require a valid signature when verification was requested.
52
+ * @returns {{ shouldFail: boolean, reason: string | null }}
53
+ */
54
+ export function shouldFail(report: object, opts?: {
55
+ failSeverity?: string | undefined;
56
+ strict?: boolean | undefined;
57
+ requireSignature?: boolean | undefined;
58
+ }): {
59
+ shouldFail: boolean;
60
+ reason: string | null;
61
+ };
62
+ export namespace SEVERITY_ORDER {
63
+ let info: number;
64
+ let low: number;
65
+ let medium: number;
66
+ let high: number;
67
+ let critical: number;
68
+ }
69
+ export { buildBenchmarkReports, evaluateAll } from "./complianceEngine.js";
70
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/validator/index.js"],"names":[],"mappings":"AAqHA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,6CArBW,MAAM,YAEd;IAA0B,MAAM;IACN,IAAI;IACE,UAAU;IACV,UAAU;IACjB,WAAW;IACV,aAAa;IACb,WAAW;IACZ,SAAS;CAClC,GAAU;IACR,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAA;CAChB,CA2CH;AAED;;;;;;;;;GASG;AACH,mCAPW,MAAM,SAEd;IAAsB,YAAY;IACX,MAAM;IACN,gBAAgB;CACvC,GAAU;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CA0B1D"}
@@ -0,0 +1,31 @@
1
+ /**
2
+ * Render a set of findings into CycloneDX annotations.
3
+ *
4
+ * @param {Array<object>} findings Finding objects emitted by the validator or auditBom engine.
5
+ * @param {object} bomJson Full CycloneDX BOM (needed for annotator/subject wiring).
6
+ * @returns {Array<object>} CycloneDX annotation objects.
7
+ */
8
+ export function buildAnnotations(findings: Array<object>, bomJson: object): Array<object>;
9
+ /**
10
+ * Produce a new BOM object with findings embedded as annotations. The caller
11
+ * is responsible for writing the result to disk.
12
+ *
13
+ * @param {object} bomJson
14
+ * @param {Array<object>} findings
15
+ * @returns {object}
16
+ */
17
+ export function renderBom(bomJson: object, findings: Array<object>): object;
18
+ /**
19
+ * Convenience wrapper matching the signature of the other reporters. The
20
+ * second argument expects `{ bomJson }` because annotations are BOM-shaped,
21
+ * not report-shaped.
22
+ *
23
+ * @param {object} report Output of validateBomAdvanced().
24
+ * @param {object} options
25
+ * @param {object} options.bomJson The BOM to annotate.
26
+ * @returns {string} JSON string of the annotated BOM.
27
+ */
28
+ export function render(report: object, options?: {
29
+ bomJson: object;
30
+ }): string;
31
+ //# sourceMappingURL=annotations.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/annotations.js"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,2CAJW,KAAK,CAAC,MAAM,CAAC,WACb,MAAM,GACJ,KAAK,CAAC,MAAM,CAAC,CAqEzB;AAED;;;;;;;GAOG;AACH,mCAJW,MAAM,YACN,KAAK,CAAC,MAAM,CAAC,GACX,MAAM,CAUlB;AAED;;;;;;;;;GASG;AACH,+BALW,MAAM,YAEd;IAAwB,OAAO,EAAvB,MAAM;CACd,GAAU,MAAM,CAMlB"}
@@ -0,0 +1,30 @@
1
+ /**
2
+ * Produce a human-readable summary of findings.
3
+ *
4
+ * @param {Array<object>} findings
5
+ * @param {object} [options]
6
+ * @returns {string}
7
+ */
8
+ export function formatFindings(findings: Array<object>, options?: object): string;
9
+ /**
10
+ * Produce a scorecard table for benchmark reports.
11
+ *
12
+ * @param {Array<object>} reports
13
+ * @returns {string}
14
+ */
15
+ export function formatBenchmarks(reports: Array<object>): string;
16
+ /**
17
+ * Produce a compact one-line summary for CI logs.
18
+ *
19
+ * @param {object} summary
20
+ * @returns {string}
21
+ */
22
+ export function formatSummary(summary: object): string;
23
+ /**
24
+ * Render the full report as a single string.
25
+ *
26
+ * @param {object} report Output of validateBomAdvanced().
27
+ * @returns {string}
28
+ */
29
+ export function render(report: object): string;
30
+ //# sourceMappingURL=console.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"console.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/console.js"],"names":[],"mappings":"AAuBA;;;;;;GAMG;AACH,yCAJW,KAAK,CAAC,MAAM,CAAC,YACb,MAAM,GACJ,MAAM,CAiClB;AAED;;;;;GAKG;AACH,0CAHW,KAAK,CAAC,MAAM,CAAC,GACX,MAAM,CAmClB;AAED;;;;;GAKG;AACH,uCAHW,MAAM,GACJ,MAAM,CAWlB;AAED;;;;;GAKG;AACH,+BAHW,MAAM,GACJ,MAAM,CAuBlB"}
@@ -0,0 +1,21 @@
1
+ /**
2
+ * Render a validation report using the named reporter.
3
+ *
4
+ * @param {string} name Reporter identifier.
5
+ * @param {object} report Output of validateBomAdvanced().
6
+ * @param {object} [opts] Reporter-specific options.
7
+ * @returns {string}
8
+ */
9
+ export function render(name: string, report: object, opts?: object): string;
10
+ export namespace reporters {
11
+ export { consoleReporter as console };
12
+ export { json };
13
+ export { sarif };
14
+ export { annotations };
15
+ }
16
+ import * as consoleReporter from "./console.js";
17
+ import * as json from "./json.js";
18
+ import * as sarif from "./sarif.js";
19
+ import * as annotations from "./annotations.js";
20
+ export { annotations, consoleReporter as console, json, sarif };
21
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/index.js"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,6BALW,MAAM,UACN,MAAM,SACN,MAAM,GACJ,MAAM,CAUlB;;;;;;;iCA9BgC,cAAc;sBACzB,WAAW;uBACV,YAAY;6BAHN,kBAAkB"}
@@ -0,0 +1,11 @@
1
+ /**
2
+ * JSON reporter — emits a stable, documented structure for programmatic use.
3
+ * No dependencies.
4
+ */
5
+ /**
6
+ * @param {object} report Output of validateBomAdvanced().
7
+ * @param {object} [_options] Unused
8
+ * @returns {string}
9
+ */
10
+ export function render(report: object, _options?: object): string;
11
+ //# sourceMappingURL=json.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/json.js"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;GAIG;AACH,+BAJW,MAAM,aACN,MAAM,GACJ,MAAM,CA4BlB"}
@@ -0,0 +1,16 @@
1
+ /**
2
+ * Render a validation report as SARIF.
3
+ *
4
+ * @param {object} report Output of validateBomAdvanced().
5
+ * @param {object} [options]
6
+ * @param {string} [options.toolName] Override driver name.
7
+ * @param {string} [options.toolVersion] Driver version to embed.
8
+ * @param {boolean} [options.includeManual] Include manual-review findings (default false).
9
+ * @returns {string}
10
+ */
11
+ export function render(report: object, options?: {
12
+ toolName?: string | undefined;
13
+ toolVersion?: string | undefined;
14
+ includeManual?: boolean | undefined;
15
+ }): string;
16
+ //# sourceMappingURL=sarif.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"sarif.d.ts","sourceRoot":"","sources":["../../../../lib/validator/reporters/sarif.js"],"names":[],"mappings":"AAqIA;;;;;;;;;GASG;AACH,+BAPW,MAAM,YAEd;IAAyB,QAAQ;IACR,WAAW;IACV,aAAa;CACvC,GAAU,MAAM,CA0ClB"}
package/lib/helpers/db.js DELETED
@@ -1,162 +0,0 @@
1
- import path from "node:path";
2
-
3
- import sqlite3 from "@appthreat/sqlite3";
4
-
5
- const {
6
- Database,
7
- OPEN_READWRITE,
8
- OPEN_CREATE,
9
- OPEN_NOMUTEX,
10
- OPEN_SHAREDCACHE,
11
- } = sqlite3;
12
-
13
- /**
14
- * A lightweight Model wrapper to mimic Sequelize behavior using raw sqlite3
15
- */
16
- class Model {
17
- constructor(db, tableName) {
18
- this.db = db;
19
- this.tableName = tableName;
20
- }
21
-
22
- /**
23
- * Initialize table
24
- */
25
- async init() {
26
- const sql = `CREATE TABLE IF NOT EXISTS ${this.tableName} (
27
- purl TEXT PRIMARY KEY,
28
- data JSON NOT NULL,
29
- createdAt DATETIME NOT NULL,
30
- updatedAt DATETIME NOT NULL
31
- )`;
32
- return new Promise((resolve, reject) => {
33
- this.db.run(sql, (err) => {
34
- if (err) reject(err);
35
- else resolve();
36
- });
37
- });
38
- }
39
-
40
- /**
41
- * findByPk
42
- * Returns null if not found, or an object { purl, data (parsed object) }
43
- */
44
- async findByPk(purl) {
45
- const sql = `SELECT * FROM ${this.tableName} WHERE purl = ?`;
46
- return new Promise((resolve, reject) => {
47
- this.db.get(sql, [purl], (err, row) => {
48
- if (err) {
49
- reject(err);
50
- } else if (!row) {
51
- resolve(null);
52
- } else {
53
- try {
54
- row.data = JSON.parse(row.data);
55
- } catch (_e) {
56
- // ignore
57
- }
58
- resolve(row);
59
- }
60
- });
61
- });
62
- }
63
-
64
- /**
65
- * findOrCreate
66
- * @param {Object} options { where: { purl }, defaults: { purl, data } }
67
- */
68
- async findOrCreate(options) {
69
- const { where, defaults } = options;
70
- const existing = await this.findByPk(where.purl);
71
-
72
- if (existing) {
73
- return [existing, false];
74
- }
75
-
76
- const insertSql = `INSERT INTO ${this.tableName} (purl, data, createdAt, updatedAt) VALUES (?, ?, ?, ?)`;
77
- const dataStr =
78
- typeof defaults.data === "string"
79
- ? defaults.data
80
- : JSON.stringify(defaults.data);
81
- const now = new Date().toISOString();
82
- return new Promise((resolve, reject) => {
83
- this.db.run(insertSql, [defaults.purl, dataStr, now, now], (err) => {
84
- if (err) reject(err);
85
- else {
86
- const instance = {
87
- purl: defaults.purl,
88
- data: defaults.data,
89
- createdAt: now,
90
- updatedAt: now,
91
- };
92
- resolve([instance, true]);
93
- }
94
- });
95
- });
96
- }
97
-
98
- /**
99
- * findAll to handle the specific LIKE query from evinser.js
100
- * @param {Object} options
101
- */
102
- async findAll(options) {
103
- let sql = `SELECT * FROM ${this.tableName}`;
104
- const params = [];
105
-
106
- if (options?.where?.data) {
107
- if (options.where.data.like) {
108
- sql += " WHERE data LIKE ?";
109
- params.push(options.where.data.like);
110
- }
111
- }
112
-
113
- return new Promise((resolve, reject) => {
114
- this.db.all(sql, params, (err, rows) => {
115
- if (err) {
116
- reject(err);
117
- } else {
118
- const results = rows.map((r) => {
119
- try {
120
- r.data = JSON.parse(r.data);
121
- } catch (_e) {
122
- // ignore
123
- }
124
- return r;
125
- });
126
- resolve(results);
127
- }
128
- });
129
- });
130
- }
131
- }
132
-
133
- export const createOrLoad = async (dbName, dbPath, logging = false) => {
134
- const fullPath = dbPath.includes("memory")
135
- ? dbPath
136
- : path.join(dbPath, dbName);
137
-
138
- const mode = OPEN_READWRITE | OPEN_CREATE | OPEN_NOMUTEX | OPEN_SHAREDCACHE;
139
-
140
- const db = new Database(fullPath, mode, (err) => {
141
- if (err && logging) console.error(err.message);
142
- });
143
-
144
- if (logging) {
145
- db.on("trace", (sql) => console.log(`[sqlite] ${sql}`));
146
- }
147
-
148
- const Namespaces = new Model(db, "Namespaces");
149
- const Usages = new Model(db, "Usages");
150
- const DataFlows = new Model(db, "DataFlows");
151
-
152
- await Namespaces.init();
153
- await Usages.init();
154
- await DataFlows.init();
155
-
156
- return {
157
- sequelize: db,
158
- Namespaces,
159
- Usages,
160
- DataFlows,
161
- };
162
- };
@@ -1,35 +0,0 @@
1
- export function createOrLoad(dbName: any, dbPath: any, logging?: boolean): Promise<{
2
- sequelize: any;
3
- Namespaces: Model;
4
- Usages: Model;
5
- DataFlows: Model;
6
- }>;
7
- /**
8
- * A lightweight Model wrapper to mimic Sequelize behavior using raw sqlite3
9
- */
10
- declare class Model {
11
- constructor(db: any, tableName: any);
12
- db: any;
13
- tableName: any;
14
- /**
15
- * Initialize table
16
- */
17
- init(): Promise<any>;
18
- /**
19
- * findByPk
20
- * Returns null if not found, or an object { purl, data (parsed object) }
21
- */
22
- findByPk(purl: any): Promise<any>;
23
- /**
24
- * findOrCreate
25
- * @param {Object} options { where: { purl }, defaults: { purl, data } }
26
- */
27
- findOrCreate(options: any): Promise<any>;
28
- /**
29
- * findAll to handle the specific LIKE query from evinser.js
30
- * @param {Object} options
31
- */
32
- findAll(options: any): Promise<any>;
33
- }
34
- export {};
35
- //# sourceMappingURL=db.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../lib/helpers/db.js"],"names":[],"mappings":"AAoIO;;;;;GA6BN;AArJD;;GAEG;AACH;IACE,qCAGC;IAFC,QAAY;IACZ,eAA0B;IAG5B;;OAEG;IACH,qBAaC;IAED;;;OAGG;IACH,kCAkBC;IAED;;;OAGG;IACH,yCA4BC;IAED;;;OAGG;IACH,oCA4BC;CACF"}
@@ -1,35 +0,0 @@
1
- export function createOrLoad(dbName: any, dbPath: any, logging?: boolean): Promise<{
2
- sequelize: any;
3
- Namespaces: Model;
4
- Usages: Model;
5
- DataFlows: Model;
6
- }>;
7
- /**
8
- * A lightweight Model wrapper to mimic Sequelize behavior using raw sqlite3
9
- */
10
- declare class Model {
11
- constructor(db: any, tableName: any);
12
- db: any;
13
- tableName: any;
14
- /**
15
- * Initialize table
16
- */
17
- init(): Promise<any>;
18
- /**
19
- * findByPk
20
- * Returns null if not found, or an object { purl, data (parsed object) }
21
- */
22
- findByPk(purl: any): Promise<any>;
23
- /**
24
- * findOrCreate
25
- * @param {Object} options { where: { purl }, defaults: { purl, data } }
26
- */
27
- findOrCreate(options: Object): Promise<any>;
28
- /**
29
- * findAll to handle the specific LIKE query from evinser.js
30
- * @param {Object} options
31
- */
32
- findAll(options: Object): Promise<any>;
33
- }
34
- export {};
35
- //# sourceMappingURL=db.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../../lib/helpers/db.js"],"names":[],"mappings":"AAoIO;;;;;GA6BN;AArJD;;GAEG;AACH;IACE,qCAGC;IAFC,QAAY;IACZ,eAA0B;IAG5B;;OAEG;IACH,qBAaC;IAED;;;OAGG;IACH,kCAkBC;IAED;;;OAGG;IACH,sBAFW,MAAM,gBA8BhB;IAED;;;OAGG;IACH,iBAFW,MAAM,gBA8BhB;CACF"}
@@ -1 +0,0 @@
1
- {"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../lib/helpers/validator.js"],"names":[],"mappings":"AA8XA;;;;GAIG;AACH,uCAFW,MAAM,WA0FhB;AAvcM,qCAJI,MAAM,WAiEhB;AAOM,0CAFI,MAAM,WAmEhB;AAOM,uCAFI,MAAM,WA2GhB;AA6BM,sCAFI,MAAM,WAwFhB"}
@@ -1,37 +0,0 @@
1
- export function getCargoAuditableInfo(src: any): any;
2
- /**
3
- * Execute sourcekitten plugin with the given arguments
4
- *
5
- * @param args {Array} Arguments
6
- * @returns {undefined|Object} Command output
7
- */
8
- export function executeSourcekitten(args: any[]): undefined | any;
9
- /**
10
- * Get the packages installed in the container image filesystem.
11
- *
12
- * @param src {String} Source directory containing the extracted filesystem.
13
- * @param imageConfig {Object} Image configuration containing environment variables, command, entrypoints etc
14
- *
15
- * @returns {Object} Metadata containing packages, dependencies, etc
16
- */
17
- export function getOSPackages(src: string, imageConfig: any): any;
18
- export function executeOsQuery(query: any): any;
19
- /**
20
- * Method to execute dosai to create slices for dotnet
21
- *
22
- * @param {string} src Source Path
23
- * @param {string} slicesFile Slices file name
24
- * @returns boolean
25
- */
26
- export function getDotnetSlices(src: string, slicesFile: string): boolean;
27
- /**
28
- * Method to generate binary SBOM using blint
29
- *
30
- * @param {string} src Path to binary or its directory
31
- * @param {string} binaryBomFile Path to binary
32
- * @param {boolean} deepMode Deep mode flag
33
- *
34
- * @return {boolean} Result of the generation
35
- */
36
- export function getBinaryBom(src: string, binaryBomFile: string, deepMode: boolean): boolean;
37
- //# sourceMappingURL=binary.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"binary.d.ts","sourceRoot":"","sources":["../../lib/managers/binary.js"],"names":[],"mappings":"AAsYA,qDAgBC;AAED;;;;;GAKG;AACH,kDAFa,SAAS,MAAO,CAkB5B;AAED;;;;;;;GAOG;AACH,kEAieC;AA+DD,gDAgDC;AAED;;;;;;GAMG;AACH,qCAJW,MAAM,cACN,MAAM,WAwChB;AAED;;;;;;;;GAQG;AACH,kCANW,MAAM,iBACN,MAAM,YACN,OAAO,GAEN,OAAO,CAiClB"}
@@ -1,56 +0,0 @@
1
- /**
2
- * Detect colima
3
- */
4
- export function detectColima(): any;
5
- /**
6
- * Detect if Rancher desktop is running on a mac.
7
- */
8
- export function detectRancherDesktop(): any;
9
- export const isWin: boolean;
10
- export const DOCKER_HUB_REGISTRY: "docker.io";
11
- export function stripAbsolutePath(path: any): any;
12
- export function getDirs(dirPath: string, dirName: string, hidden?: boolean, recurse?: boolean): string[];
13
- export function getOnlyDirs(srcpath: any, dirName: any): any[];
14
- export function getConnection(options: any, forRegistry: any): Promise<any>;
15
- export function makeRequest(path: any, method: any, forRegistry: any): Promise<any>;
16
- export function parseImageName(fullImageName: any): {
17
- registry: string;
18
- repo: string;
19
- tag: string;
20
- digest: string;
21
- platform: string;
22
- group: string;
23
- name: string;
24
- };
25
- export function getImage(fullImageName: any): Promise<any>;
26
- export function extractTar(fullImageName: any, dir: any, options: any): Promise<boolean>;
27
- export function exportArchive(fullImageName: any, options?: {}): Promise<{
28
- manifest: {};
29
- allLayersDir: any;
30
- allLayersExplodedDir: any;
31
- lastLayerConfig: {};
32
- lastWorkingDir: string;
33
- } | {
34
- inspectData: any;
35
- manifest: any;
36
- allLayersDir: any;
37
- allLayersExplodedDir: any;
38
- lastLayerConfig: {};
39
- lastWorkingDir: string;
40
- binPaths: any;
41
- }>;
42
- export function extractFromManifest(manifestFile: any, localData: any, tempDir: any, allLayersExplodedDir: any, options: any): Promise<{
43
- inspectData: any;
44
- manifest: any;
45
- allLayersDir: any;
46
- allLayersExplodedDir: any;
47
- lastLayerConfig: {};
48
- lastWorkingDir: string;
49
- binPaths: any;
50
- }>;
51
- export function exportImage(fullImageName: any, options: any): Promise<any>;
52
- export function getPkgPathList(exportData: any, lastWorkingDir: any): any;
53
- export function removeImage(fullImageName: any, force?: boolean): Promise<any>;
54
- export function getCredsFromHelper(exeSuffix: any, serverAddress: any): any;
55
- export function addSkippedSrcFiles(skippedImageSrcs: any, components: any): void;
56
- //# sourceMappingURL=docker.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../lib/managers/docker.js"],"names":[],"mappings":"AAmFA;;GAEG;AACH,oCAoBC;AAED;;GAEG;AACH,4CA2CC;AA5HD,4BAA6C;AAC7C,kCAAmC,WAAW,CAAC;AAmCxC,kDAeN;AAoFM,iCAHI,MAAM,WACN,MAAM,iDAehB;AAqBM,+DAkBN;AA0LM,4EAoGN;AAEM,oFAwBN;AAUM;;;;;;;;EA2EN;AAyBM,2DA+LN;AA6EM,yFAsFN;AAMM;;;;;;;;;;;;;;GAwDN;AAEM;;;;;;;;GAyGN;AAMM,4EA8IN;AAKM,0EA8GN;AAEM,+EAEN;AAEM,4EA0CN;AAEM,iFA0BN"}
@@ -1,2 +0,0 @@
1
- export function getBomWithOras(image: any, platform?: any): any;
2
- //# sourceMappingURL=oci.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../lib/managers/oci.js"],"names":[],"mappings":"AAWA,gEAyEC"}
@@ -1,2 +0,0 @@
1
- export function getTreeWithPlugin(env: any, python_cmd: string, basePath: string): any;
2
- //# sourceMappingURL=piptree.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"piptree.d.ts","sourceRoot":"","sources":["../../lib/managers/piptree.js"],"names":[],"mappings":"AAwOO,uFAmCN"}
@@ -1,34 +0,0 @@
1
- /**
2
- * Checks the given hostname against the allowed list.
3
- *
4
- * @param {string} hostname Host name to check
5
- * @returns {boolean} true if the hostname in its entirety is allowed. false otherwise.
6
- */
7
- export function isAllowedHost(hostname: string): boolean;
8
- /**
9
- * Checks the given path string to belong to a drive in Windows.
10
- *
11
- * @param {string} p Path string to check
12
- * @returns {boolean} true if the windows path belongs to a drive. false otherwise (device names)
13
- */
14
- export function isAllowedWinPath(p: string): boolean;
15
- /**
16
- * Checks the given path against the allowed list.
17
- *
18
- * @param {string} p Path string to check
19
- * @returns {boolean} true if the path is present in the allowed paths. false otherwise.
20
- */
21
- export function isAllowedPath(p: string): boolean;
22
- /**
23
- * Method to safely parse value passed via the query string or body.
24
- *
25
- * @param {string|number|Array<string|number>} raw
26
- * @returns {string|number|boolean|Array<string|number|boolean>}
27
- * @throws {TypeError} if raw (or any array element) isn’t string or number
28
- */
29
- export function parseValue(raw: string | number | Array<string | number>): string | number | boolean | Array<string | number | boolean>;
30
- export function parseQueryString(q: any, body?: {}, options?: {}): {};
31
- export function getQueryParams(req: any): {};
32
- export function configureServer(cdxgenServer: any): void;
33
- export function start(options: any): void;
34
- //# sourceMappingURL=server.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../lib/server/server.js"],"names":[],"mappings":"AAoEA;;;;;GAKG;AACH,wCAHW,MAAM,GACJ,OAAO,CAanB;AAED;;;;;GAKG;AACH,oCAHW,MAAM,GACJ,OAAO,CAsCnB;AAED;;;;;GAKG;AACH,iCAHW,MAAM,GACJ,OAAO,CAoBnB;AA0CD;;;;;;GAMG;AACH,gCAJW,MAAM,GAAC,MAAM,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,CAAC,GAChC,MAAM,GAAC,MAAM,GAAC,OAAO,GAAC,KAAK,CAAC,MAAM,GAAC,MAAM,GAAC,OAAO,CAAC,CAwC9D;AAED,sEAiBC;AAED,6CA+BC;AAiBD,yDAKC;AAID,0CA0LC"}
@@ -1,27 +0,0 @@
1
- /**
2
- * Method to determine the type of the BOM.
3
- *
4
- * @param {Object} bomJson BOM JSON Object
5
- *
6
- * @returns {String} Type of the bom such as sbom, cbom, obom, ml-bom etc
7
- */
8
- export function findBomType(bomJson: any): string;
9
- /**
10
- * Create the textual representation of the metadata section.
11
- *
12
- * @param {Object} bomJson BOM JSON Object
13
- *
14
- * @returns {String | undefined} Textual representation of the metadata
15
- */
16
- export function textualMetadata(bomJson: any): string | undefined;
17
- /**
18
- * Extract interesting tags from the component attribute
19
- *
20
- * @param {Object} component CycloneDX component
21
- * @param {String} bomType BOM type
22
- * @param {String} parentComponentType Parent component type
23
- *
24
- * @returns {Array | undefined} Array of string tags
25
- */
26
- export function extractTags(component: any, bomType?: string, parentComponentType?: string): any[] | undefined;
27
- //# sourceMappingURL=annotator.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"annotator.d.ts","sourceRoot":"","sources":["../../../lib/stages/postgen/annotator.js"],"names":[],"mappings":"AA4CA;;;;;;GAMG;AACH,kDAkCC;AAED;;;;;;GAMG;AACH,+CAFa,SAAS,SAAS,CA2N9B;AAED;;;;;;;;GAQG;AACH,6FAFa,QAAQ,SAAS,CAsF7B"}