@cyclonedx/cdxgen 12.3.3 → 12.4.1

package/lib/managers/docker.js

@@ -20,8 +20,12 @@ import {
   getAllFiles,
   getTmpDir,
   isDryRun,
+  readEnvironmentVariable,
   recordActivity,
+  recordDecisionActivity,
+  recordSensitiveFileRead,
   safeExistsSync,
+  safeExtractArchive,
   safeMkdirSync,
   safeMkdtempSync,
   safeRmSync,
@@ -404,8 +408,34 @@ const REQUEST_TIMEOUT_SECS = 60000;
  */
 const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
   let authTokenSet = false;
+  const credentialSourceEvaluations = [];
+  let selectedCredentialSource;
+  const noteCredentialSource = (source, outcome, detail = undefined) => {
+    credentialSourceEvaluations.push({
+      detail,
+      outcome,
+      source,
+    });
+    if (outcome === "selected") {
+      selectedCredentialSource = source;
+    }
+  };
+  const dockerServerAddress = readEnvironmentVariable("DOCKER_SERVER_ADDRESS");
+  const dockerConfig = readEnvironmentVariable("DOCKER_CONFIG");
+  const dockerAuthConfig = readEnvironmentVariable("DOCKER_AUTH_CONFIG", {
+    sensitive: true,
+  });
+  const dockerUser = readEnvironmentVariable("DOCKER_USER", {
+    sensitive: true,
+  });
+  const dockerPassword = readEnvironmentVariable("DOCKER_PASSWORD", {
+    sensitive: true,
+  });
+  const dockerEmail = readEnvironmentVariable("DOCKER_EMAIL", {
+    sensitive: true,
+  });
   if (!forRegistry) {
-    forRegistry = process.env.DOCKER_SERVER_ADDRESS ?? DOCKER_HUB_REGISTRY;
+    forRegistry = dockerServerAddress ?? DOCKER_HUB_REGISTRY;
   }
   requestedRegistryRef = resolveRequestedRegistryRef(
     forRegistry,
@@ -413,6 +443,11 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
   );
   const normalizedForRegistry =
     parseRegistryReference(forRegistry)?.authority ?? forRegistry;
+  const authDecisionTarget =
+    requestedRegistryRef ||
+    normalizedForRegistry ||
+    forRegistry ||
+    DOCKER_HUB_REGISTRY;
   const opts = {
     enableUnixSockets: true,
     throwHttpErrors: true,
@@ -429,41 +464,57 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
     hooks: { beforeError: [] },
     mutableDefaults: true,
   };
-  const DOCKER_CONFIG = process.env.DOCKER_CONFIG || join(homedir(), ".docker");
+  const DOCKER_CONFIG = dockerConfig || join(homedir(), ".docker");
+  const dockerConfigFile = join(DOCKER_CONFIG, "config.json");
   // Support for private registry
-  if (process.env.DOCKER_AUTH_CONFIG) {
+  if (dockerAuthConfig) {
     opts.headers = {
-      "X-Registry-Auth": process.env.DOCKER_AUTH_CONFIG,
+      "X-Registry-Auth": dockerAuthConfig,
     };
     authTokenSet = true;
+    noteCredentialSource("DOCKER_AUTH_CONFIG", "selected");
+  } else {
+    noteCredentialSource("DOCKER_AUTH_CONFIG", "skipped", "not set");
   }
   if (
     !authTokenSet &&
-    process.env.DOCKER_USER &&
-    process.env.DOCKER_PASSWORD &&
-    process.env.DOCKER_EMAIL &&
+    dockerUser &&
+    dockerPassword &&
+    dockerEmail &&
     normalizedForRegistry
   ) {
     const authPayload = {
-      username: process.env.DOCKER_USER,
-      email: process.env.DOCKER_EMAIL,
+      username: dockerUser,
+      email: dockerEmail,
       serveraddress: normalizedForRegistry,
     };
-    if (process.env.DOCKER_USER === "<token>") {
-      authPayload.IdentityToken = process.env.DOCKER_PASSWORD;
+    if (dockerUser === "<token>") {
+      authPayload.IdentityToken = dockerPassword;
     } else {
-      authPayload.password = process.env.DOCKER_PASSWORD;
+      authPayload.password = dockerPassword;
     }
     opts.headers = {
       "X-Registry-Auth": toBase64Url(JSON.stringify(authPayload)),
     };
     authTokenSet = true;
-  }
-  if (!authTokenSet && safeExistsSync(join(DOCKER_CONFIG, "config.json"))) {
-    const configData = readFileSync(
-      join(DOCKER_CONFIG, "config.json"),
-      "utf-8",
+    noteCredentialSource(
+      "DOCKER_USER/DOCKER_PASSWORD/DOCKER_EMAIL",
+      "selected",
     );
+  } else if (!authTokenSet) {
+    noteCredentialSource(
+      "DOCKER_USER/DOCKER_PASSWORD/DOCKER_EMAIL",
+      "skipped",
+      dockerUser || dockerPassword || dockerEmail
+        ? "incomplete environment credentials"
+        : "not set",
+    );
+  }
+  if (!authTokenSet && safeExistsSync(dockerConfigFile)) {
+    const configData = readFileSync(dockerConfigFile, "utf-8");
+    recordSensitiveFileRead(dockerConfigFile, {
+      label: "Docker credential file",
+    });
     if (configData) {
       try {
         const configJson = JSON.parse(configData);
@@ -490,6 +541,11 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
                 "X-Registry-Auth": toBase64Url(JSON.stringify(authPayload)),
               };
               authTokenSet = true;
+              noteCredentialSource(
+                "docker-config-auth",
+                "selected",
+                serverAddress,
+              );
               break;
             }
             if (configJson.credsStore) {
@@ -502,6 +558,11 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
                   "X-Registry-Auth": helperAuthToken,
                 };
                 authTokenSet = true;
+                noteCredentialSource(
+                  `docker-credential-helper:${configJson.credsStore}`,
+                  "selected",
+                  serverAddress,
+                );
                 break;
               }
             }
@@ -522,22 +583,40 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
                   "X-Registry-Auth": helperAuthToken,
                 };
                 authTokenSet = true;
+                noteCredentialSource(
+                  `docker-credential-helper:${configJson.credHelpers[serverAddress]}`,
+                  "selected",
+                  serverAddress,
+                );
                 break;
               }
             }
           }
         }
+        if (!authTokenSet) {
+          noteCredentialSource(
+            "docker-config",
+            "skipped",
+            "no matching config.json auth entry",
+          );
+        }
       } catch (_err) {
         // pass
+        noteCredentialSource("docker-config", "skipped", "config parse failed");
       }
     }
+  } else if (!authTokenSet) {
+    noteCredentialSource("docker-config", "skipped", "config.json not found");
   }
   const userInfo = _userInfo();
   opts.podmanPrefixUrl = isWin ? "" : "http://unix:/run/podman/podman.sock:";
   opts.podmanRootlessPrefixUrl = isWin
     ? ""
     : `http://unix:/run/user/${userInfo.uid}/podman/podman.sock:`;
-  if (!process.env.DOCKER_HOST) {
+  const dockerHost = readEnvironmentVariable("DOCKER_HOST");
+  const dockerCertPath = readEnvironmentVariable("DOCKER_CERT_PATH");
+  const dockerTlsVerify = readEnvironmentVariable("DOCKER_TLS_VERIFY");
+  if (!dockerHost) {
     if (isPodman) {
       opts.prefixUrl = isPodmanRootless
         ? opts.podmanRootlessPrefixUrl
@@ -561,7 +640,7 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
       }
     }
   } else {
-    let hostStr = process.env.DOCKER_HOST;
+    let hostStr = dockerHost;
     if (hostStr.startsWith("unix:///")) {
       hostStr = hostStr.replace("unix:///", "http://unix:/");
       if (hostStr.includes("docker.sock")) {
@@ -570,29 +649,54 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
       }
     }
     opts.prefixUrl = hostStr;
-    if (process.env.DOCKER_CERT_PATH) {
+    if (dockerCertPath) {
+      const dockerCertFile = join(dockerCertPath, "cert.pem");
+      const dockerKeyFile = join(dockerCertPath, "key.pem");
+      const dockerCertificate = readFileSync(dockerCertFile, "utf8");
+      recordSensitiveFileRead(dockerCertFile, {
+        label: "Docker client certificate",
+      });
+      const dockerKey = readFileSync(dockerKeyFile, "utf8");
+      recordSensitiveFileRead(dockerKeyFile, {
+        label: "Docker client private key",
+      });
       opts.https = {
-        certificate: readFileSync(
-          join(process.env.DOCKER_CERT_PATH, "cert.pem"),
-          "utf8",
-        ),
-        key: readFileSync(
-          join(process.env.DOCKER_CERT_PATH, "key.pem"),
-          "utf8",
-        ),
+        certificate: dockerCertificate,
+        key: dockerKey,
       };
       // Disable tls on empty values
       // From the docker docs: Setting the DOCKER_TLS_VERIFY environment variable to any value other than the empty string is equivalent to setting the --tlsverify flag
-      if (
-        process.env.DOCKER_TLS_VERIFY &&
-        process.env.DOCKER_TLS_VERIFY === ""
-      ) {
+      if (dockerTlsVerify === "") {
         opts.https.rejectUnauthorized = false;
         console.log("TLS Verification disabled for", hostStr);
       }
     }
   }
 
+  if (!selectedCredentialSource) {
+    noteCredentialSource(
+      "anonymous",
+      "selected",
+      "no credential source resolved",
+    );
+  }
+  const skippedSources = credentialSourceEvaluations
+    .filter((entry) => entry.outcome !== "selected")
+    .map((entry) =>
+      entry.detail ? `${entry.source} (${entry.detail})` : entry.source,
+    );
+  recordDecisionActivity(`docker-auth:${authDecisionTarget}`, {
+    metadata: {
+      decisionType: "credential-source-selection",
+      evaluatedSources: credentialSourceEvaluations.map(
+        ({ detail, outcome, source }) =>
+          detail ? `${source}:${outcome}:${detail}` : `${source}:${outcome}`,
+      ),
+      selectedSource: selectedCredentialSource,
+    },
+    reason: `Selected Docker auth source '${selectedCredentialSource}' for ${authDecisionTarget}. Skipped: ${skippedSources.length ? skippedSources.join(", ") : "none"}.`,
+  });
+
   return opts;
 };
 
@@ -611,7 +715,20 @@ const getDefaultOptions = (forRegistry, requestedRegistryRef = forRegistry) => {
  *   daemon base URL, or `undefined`
  */
 export const getConnection = async (options, forRegistry) => {
+  if (isContainerd || isNerdctl) {
+    return undefined;
+  }
   if (isDryRun) {
+    try {
+      getDefaultOptions(forRegistry);
+    } catch (error) {
+      recordActivity({
+        kind: "read",
+        reason: `Dry run mode failed while tracing Docker credential inputs: ${error.message}`,
+        status: "failed",
+        target: error?.path || forRegistry || "container-daemon",
+      });
+    }
     recordActivity({
       kind: "network",
       reason:
@@ -621,9 +738,6 @@ export const getConnection = async (options, forRegistry) => {
     });
     return undefined;
   }
-  if (isContainerd || isNerdctl) {
-    return undefined;
-  }
   if (!dockerConn) {
     const defaultOptions = getDefaultOptions(forRegistry);
     const podmanRootlessUrl = defaultOptions.podmanRootlessPrefixUrl;
@@ -1204,34 +1318,36 @@ const EXTRACT_EXCLUDE_TYPES = new Set([
  *   empty or a non-fatal error was encountered
  */
 export const extractTar = async (fullImageName, dir, options) => {
-  if (isDryRun) {
-    recordActivity({
-      kind: "untar",
-      reason:
-        "Dry run mode blocks untar and layer extraction operations because they create files on disk.",
-      status: "blocked",
-      target: `${fullImageName} -> ${dir}`,
-    });
-    return false;
-  }
   try {
-    await stream.pipeline(
-      createReadStream(fullImageName),
-      x({
-        sync: false,
-        preserveOwner: false,
-        noMtime: true,
-        noChmod: true,
-        strict: !NON_STRICT_TAR_EXTRACT,
-        C: dir,
-        portable: true,
-        unlink: true,
-        onwarn: handleTarWarning,
-        onReadEntry: handleAbsolutePath,
-        filter: tarFilter,
-      }),
+    return await safeExtractArchive(
+      fullImageName,
+      dir,
+      async () =>
+        await stream.pipeline(
+          createReadStream(fullImageName),
+          x({
+            sync: false,
+            preserveOwner: false,
+            noMtime: true,
+            noChmod: true,
+            strict: !NON_STRICT_TAR_EXTRACT,
+            C: dir,
+            portable: true,
+            unlink: true,
+            onwarn: handleTarWarning,
+            onReadEntry: handleAbsolutePath,
+            filter: tarFilter,
+          }),
+        ),
+      "untar",
+      {
+        blockedReason:
+          "Dry run mode blocks untar and layer extraction operations because they create files on disk.",
+        metadata: {
+          archiveFormat: "tar",
+        },
+      },
     );
-    return true;
   } catch (err) {
     if (err.code === "EPERM" && err.syscall === "symlink") {
       console.log(
@@ -1605,7 +1721,22 @@ export const extractFromManifest = async (
  * Returns the location of the layers with additional packages related metadata
  */
 export const exportImage = async (fullImageName, options) => {
+  // Safely ignore local directories
+  if (
+    !fullImageName ||
+    fullImageName === "." ||
+    safeExistsSync(resolve(fullImageName))
+  ) {
+    return undefined;
+  }
   if (isDryRun) {
+    const imageDetails = parseImageName(fullImageName);
+    const requestedRegistryRef = imageDetails.registry
+      ? imageDetails.repo
+        ? `${imageDetails.registry}/${imageDetails.repo}`
+        : imageDetails.registry
+      : DOCKER_HUB_REGISTRY;
+    await getConnection({}, requestedRegistryRef);
     recordActivity({
       kind: "container",
       reason:
@@ -1615,14 +1746,6 @@ export const exportImage = async (fullImageName, options) => {
     });
     return undefined;
   }
-  // Safely ignore local directories
-  if (
-    !fullImageName ||
-    fullImageName === "." ||
-    safeExistsSync(resolve(fullImageName))
-  ) {
-    return undefined;
-  }
   // Try to get the data locally first
   const localData = await getImage(fullImageName);
   if (!localData) {
@@ -1935,18 +2058,17 @@ export const getCredsFromHelper = (exeSuffix, serverAddress) => {
   } else if (result.stdout) {
     const cmdOutput = Buffer.from(result.stdout).toString();
     try {
+      const dockerUser = readEnvironmentVariable("DOCKER_USER", {
+        sensitive: true,
+      });
+      const dockerPassword = readEnvironmentVariable("DOCKER_PASSWORD", {
+        sensitive: true,
+      });
       const authPayload = JSON.parse(cmdOutput);
       const fixedAuthPayload = {
-        username:
-          authPayload.username ||
-          authPayload.Username ||
-          process.env.DOCKER_USER,
-        password:
-          authPayload.password ||
-          authPayload.Secret ||
-          process.env.DOCKER_PASSWORD,
-        email:
-          authPayload.email || authPayload.username || process.env.DOCKER_USER,
+        username: authPayload.username || authPayload.Username || dockerUser,
+        password: authPayload.password || authPayload.Secret || dockerPassword,
+        email: authPayload.email || authPayload.username || dockerUser,
         serveraddress: serverAddress,
       };
       const authKey = toBase64Url(JSON.stringify(fixedAuthPayload));