@cyclonedx/cdxgen 8.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.eslintrc.js +15 -0
- package/LICENSE +201 -0
- package/README.md +354 -0
- package/analyzer.js +189 -0
- package/bin/cdxgen +316 -0
- package/binary.js +507 -0
- package/docker.js +769 -0
- package/docker.test.js +72 -0
- package/index.js +4292 -0
- package/jest.config.js +181 -0
- package/known-licenses.json +27 -0
- package/lic-mapping.json +294 -0
- package/package.json +94 -0
- package/queries.json +68 -0
- package/server.js +110 -0
- package/spdx-licenses.json +500 -0
- package/utils.js +4284 -0
- package/utils.test.js +1660 -0
- package/vendor-alias.json +10 -0
package/jest.config.js
ADDED
|
@@ -0,0 +1,181 @@
|
|
|
1
|
+
// For a detailed explanation regarding each configuration property, visit:
|
|
2
|
+
// https://jestjs.io/docs/en/configuration.html
|
|
3
|
+
|
|
4
|
+
module.exports = {
|
|
5
|
+
// All imported modules in your tests should be mocked automatically
|
|
6
|
+
// automock: false,
|
|
7
|
+
|
|
8
|
+
// Stop running tests after `n` failures
|
|
9
|
+
// bail: 0,
|
|
10
|
+
|
|
11
|
+
// Respect "browser" field in package.json when resolving modules
|
|
12
|
+
// browser: false,
|
|
13
|
+
|
|
14
|
+
// The directory where Jest should store its cached dependency information
|
|
15
|
+
// cacheDirectory: "/private/var/folders/v6/5570bhc90w3ddx8_vw4ghrjm0000gn/T/jest_dx",
|
|
16
|
+
|
|
17
|
+
// Automatically clear mock calls and instances between every test
|
|
18
|
+
clearMocks: true,
|
|
19
|
+
|
|
20
|
+
// Indicates whether the coverage information should be collected while executing the test
|
|
21
|
+
// collectCoverage: false,
|
|
22
|
+
|
|
23
|
+
// An array of glob patterns indicating a set of files for which coverage information should be collected
|
|
24
|
+
// collectCoverageFrom: undefined,
|
|
25
|
+
|
|
26
|
+
// The directory where Jest should output its coverage files
|
|
27
|
+
coverageDirectory: "coverage",
|
|
28
|
+
|
|
29
|
+
// An array of regexp pattern strings used to skip coverage collection
|
|
30
|
+
coveragePathIgnorePatterns: ["/node_modules/", "/.github/"],
|
|
31
|
+
|
|
32
|
+
// A list of reporter names that Jest uses when writing coverage reports
|
|
33
|
+
coverageReporters: ["json", "lcov"],
|
|
34
|
+
|
|
35
|
+
// An object that configures minimum threshold enforcement for coverage results
|
|
36
|
+
// coverageThreshold: undefined,
|
|
37
|
+
|
|
38
|
+
// A path to a custom dependency extractor
|
|
39
|
+
// dependencyExtractor: undefined,
|
|
40
|
+
|
|
41
|
+
// Make calling deprecated APIs throw helpful error messages
|
|
42
|
+
// errorOnDeprecated: false,
|
|
43
|
+
|
|
44
|
+
// Force coverage collection from ignored files using an array of glob patterns
|
|
45
|
+
// forceCoverageMatch: [],
|
|
46
|
+
|
|
47
|
+
// A path to a module which exports an async function that is triggered once before all test suites
|
|
48
|
+
// globalSetup: undefined,
|
|
49
|
+
|
|
50
|
+
// A path to a module which exports an async function that is triggered once after all test suites
|
|
51
|
+
// globalTeardown: undefined,
|
|
52
|
+
|
|
53
|
+
// A set of global variables that need to be available in all test environments
|
|
54
|
+
// globals: {},
|
|
55
|
+
|
|
56
|
+
// The maximum amount of workers used to run your tests. Can be specified as % or a number. E.g. maxWorkers: 10% will use 10% of your CPU amount + 1 as the maximum worker number. maxWorkers: 2 will use a maximum of 2 workers.
|
|
57
|
+
// maxWorkers: "50%",
|
|
58
|
+
|
|
59
|
+
// An array of directory names to be searched recursively up from the requiring module's location
|
|
60
|
+
// moduleDirectories: [
|
|
61
|
+
// "node_modules"
|
|
62
|
+
// ],
|
|
63
|
+
|
|
64
|
+
// An array of file extensions your modules use
|
|
65
|
+
// moduleFileExtensions: [
|
|
66
|
+
// "js",
|
|
67
|
+
// "json",
|
|
68
|
+
// "jsx",
|
|
69
|
+
// "ts",
|
|
70
|
+
// "tsx",
|
|
71
|
+
// "node"
|
|
72
|
+
// ],
|
|
73
|
+
|
|
74
|
+
// A map from regular expressions to module names that allow to stub out resources with a single module
|
|
75
|
+
// moduleNameMapper: {},
|
|
76
|
+
|
|
77
|
+
// An array of regexp pattern strings, matched against all module paths before considered 'visible' to the module loader
|
|
78
|
+
// modulePathIgnorePatterns: [],
|
|
79
|
+
|
|
80
|
+
// Activates notifications for test results
|
|
81
|
+
// notify: false,
|
|
82
|
+
|
|
83
|
+
// An enum that specifies notification mode. Requires { notify: true }
|
|
84
|
+
// notifyMode: "failure-change",
|
|
85
|
+
|
|
86
|
+
// A preset that is used as a base for Jest's configuration
|
|
87
|
+
// preset: undefined,
|
|
88
|
+
|
|
89
|
+
// Run tests from one or more projects
|
|
90
|
+
// projects: undefined,
|
|
91
|
+
|
|
92
|
+
// Use this configuration option to add custom reporters to Jest
|
|
93
|
+
// reporters: undefined,
|
|
94
|
+
|
|
95
|
+
// Automatically reset mock state between every test
|
|
96
|
+
// resetMocks: false,
|
|
97
|
+
|
|
98
|
+
// Reset the module registry before running each individual test
|
|
99
|
+
// resetModules: false,
|
|
100
|
+
|
|
101
|
+
// A path to a custom resolver
|
|
102
|
+
// resolver: undefined,
|
|
103
|
+
|
|
104
|
+
// Automatically restore mock state between every test
|
|
105
|
+
// restoreMocks: false,
|
|
106
|
+
|
|
107
|
+
// The root directory that Jest should scan for tests and modules within
|
|
108
|
+
// rootDir: undefined,
|
|
109
|
+
|
|
110
|
+
// A list of paths to directories that Jest should use to search for files in
|
|
111
|
+
// roots: [
|
|
112
|
+
// "<rootDir>"
|
|
113
|
+
// ],
|
|
114
|
+
|
|
115
|
+
// Allows you to use a custom runner instead of Jest's default test runner
|
|
116
|
+
// runner: "jest-runner",
|
|
117
|
+
|
|
118
|
+
// The paths to modules that run some code to configure or set up the testing environment before each test
|
|
119
|
+
// setupFiles: [],
|
|
120
|
+
|
|
121
|
+
// A list of paths to modules that run some code to configure or set up the testing framework before each test
|
|
122
|
+
// setupFilesAfterEnv: [],
|
|
123
|
+
|
|
124
|
+
// A list of paths to snapshot serializer modules Jest should use for snapshot testing
|
|
125
|
+
// snapshotSerializers: [],
|
|
126
|
+
|
|
127
|
+
// The test environment that will be used for testing
|
|
128
|
+
testEnvironment: "node"
|
|
129
|
+
|
|
130
|
+
// Options that will be passed to the testEnvironment
|
|
131
|
+
// testEnvironmentOptions: {},
|
|
132
|
+
|
|
133
|
+
// Adds a location field to test results
|
|
134
|
+
// testLocationInResults: false,
|
|
135
|
+
|
|
136
|
+
// The glob patterns Jest uses to detect test files
|
|
137
|
+
// testMatch: [
|
|
138
|
+
// "**/__tests__/**/*.[jt]s?(x)",
|
|
139
|
+
// "**/?(*.)+(spec|test).[tj]s?(x)"
|
|
140
|
+
// ],
|
|
141
|
+
|
|
142
|
+
// An array of regexp pattern strings that are matched against all test paths, matched tests are skipped
|
|
143
|
+
// testPathIgnorePatterns: [
|
|
144
|
+
// "/node_modules/"
|
|
145
|
+
// ],
|
|
146
|
+
|
|
147
|
+
// The regexp pattern or array of patterns that Jest uses to detect test files
|
|
148
|
+
// testRegex: [],
|
|
149
|
+
|
|
150
|
+
// This option allows the use of a custom results processor
|
|
151
|
+
// testResultsProcessor: undefined,
|
|
152
|
+
|
|
153
|
+
// This option allows use of a custom test runner
|
|
154
|
+
// testRunner: "jasmine2",
|
|
155
|
+
|
|
156
|
+
// This option sets the URL for the jsdom environment. It is reflected in properties such as location.href
|
|
157
|
+
// testURL: "http://localhost",
|
|
158
|
+
|
|
159
|
+
// Setting this value to "fake" allows the use of fake timers for functions such as "setTimeout"
|
|
160
|
+
// timers: "real",
|
|
161
|
+
|
|
162
|
+
// A map from regular expressions to paths to transformers
|
|
163
|
+
// transform: undefined,
|
|
164
|
+
|
|
165
|
+
// An array of regexp pattern strings that are matched against all source file paths, matched files will skip transformation
|
|
166
|
+
// transformIgnorePatterns: [
|
|
167
|
+
// "/node_modules/"
|
|
168
|
+
// ],
|
|
169
|
+
|
|
170
|
+
// An array of regexp pattern strings that are matched against all modules before the module loader will automatically return a mock for them
|
|
171
|
+
// unmockedModulePathPatterns: undefined,
|
|
172
|
+
|
|
173
|
+
// Indicates whether each individual test should be reported during the run
|
|
174
|
+
// verbose: undefined,
|
|
175
|
+
|
|
176
|
+
// An array of regexp patterns that are matched against all source file paths before re-running tests in watch mode
|
|
177
|
+
// watchPathIgnorePatterns: [],
|
|
178
|
+
|
|
179
|
+
// Whether to use watchman for file crawling
|
|
180
|
+
// watchman: true,
|
|
181
|
+
};
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
[
|
|
2
|
+
{"license": "Apache-2.0", "group": "cloud.google.com", "name": "go"},
|
|
3
|
+
{"license": "Apache-2.0", "group": "cloud.google.com/go", "name": "*"},
|
|
4
|
+
{"license": "Apache-2.0", "group": "cuelang.org", "name": "go"},
|
|
5
|
+
{"license": "MIT", "group": "pack.ag", "name": "amqp"},
|
|
6
|
+
{"license": "Apache-2.0", "group": "google.golang.org", "name": "*"},
|
|
7
|
+
{"license": "BSD-3-Clause", "group": "golang.org/x", "name": "*"},
|
|
8
|
+
{"license": "BSD-3-Clause", "group": "dmitri.shuralyov.com/gpu", "name": "*"},
|
|
9
|
+
{"license": "Apache-2.0", "group": "contrib.go.opencensus.io", "name": "*"},
|
|
10
|
+
{"license": "Apache-2.0", "group": "git.apache.org", "name": "*"},
|
|
11
|
+
{"license": "Apache-2.0", "group": ".", "name": "go.opencensus.io"},
|
|
12
|
+
{"license": "MIT", "group": "sigs.k8s.io", "name": "*"},
|
|
13
|
+
{"license": "BSD-3-Clause", "group": "rsc.io", "name": "*"},
|
|
14
|
+
{"license": "Apache-2.0", "group": "openpitrix.io", "name": "*"},
|
|
15
|
+
{"license": "BSD-3-Clause", "group": "modernc.org", "name": "*"},
|
|
16
|
+
{"license": "Apache-2.0", "group": "kubesphere.io", "name": "*"},
|
|
17
|
+
{"license": "Apache-2.0", "group": "k8s.io", "name": "*"},
|
|
18
|
+
{"license": "Apache-2.0", "group": "istio.io", "name": "*"},
|
|
19
|
+
{"license": "MIT", "group": "honnef.co/go", "name": "*"},
|
|
20
|
+
{"license": "Apache-2.0", "group": ".", "name": "gotest.tools"},
|
|
21
|
+
{"license": "Apache-2.0", "group": "gopkg.in", "name": "*"},
|
|
22
|
+
{"license": "Apache-2.0", "group": "code.cloudfoundry.org", "name": "*"},
|
|
23
|
+
{"license": "BSD-3-Clause", "group": "gonum.org/v1", "name": "*"},
|
|
24
|
+
{"license": "Apache-2.0", "group": "gomodules.xyz/jsonpatch", "name": "*"},
|
|
25
|
+
{"license": "MIT", "group": "go.uber.org", "name": "*"},
|
|
26
|
+
{"license": "MIT", "group": "go.etcd.io", "name": "*"}
|
|
27
|
+
]
|
package/lic-mapping.json
ADDED
|
@@ -0,0 +1,294 @@
|
|
|
1
|
+
[
|
|
2
|
+
{
|
|
3
|
+
"exp": "Apache-2.0",
|
|
4
|
+
"names": [
|
|
5
|
+
"Apache 2",
|
|
6
|
+
"Apache 2.0",
|
|
7
|
+
"Apache Version 2.0",
|
|
8
|
+
"Apache 2.0 License",
|
|
9
|
+
"Apache Software License, Version 2.0",
|
|
10
|
+
"The Apache Software License, Version 2.0",
|
|
11
|
+
"Apache License (v2.0)",
|
|
12
|
+
"Apache License 2.0",
|
|
13
|
+
"Apache License Version 2.0",
|
|
14
|
+
"Apache License, Version 2.0",
|
|
15
|
+
"Apache Public License 2.0",
|
|
16
|
+
"Apache Software License - Version 2.0",
|
|
17
|
+
"The Apache License, Version 2.0",
|
|
18
|
+
"BSD or Apache License, Version 2.0",
|
|
19
|
+
"Apache Software License",
|
|
20
|
+
"Apache-2.0 OR MIT"
|
|
21
|
+
]
|
|
22
|
+
},
|
|
23
|
+
{
|
|
24
|
+
"exp": "0BSD",
|
|
25
|
+
"names": [
|
|
26
|
+
"Zero-Clause BSD",
|
|
27
|
+
"BSD",
|
|
28
|
+
"BSD License",
|
|
29
|
+
"BSD-like"
|
|
30
|
+
]
|
|
31
|
+
},
|
|
32
|
+
{
|
|
33
|
+
"exp": "BSD-2-Clause",
|
|
34
|
+
"names": [
|
|
35
|
+
"BSD 2 Clause",
|
|
36
|
+
"BSD 2-Clause",
|
|
37
|
+
"BSD-2-Clause",
|
|
38
|
+
"BSD 2-Clause License",
|
|
39
|
+
"The BSD 2-Clause License",
|
|
40
|
+
"The 2-Clause BSD License"
|
|
41
|
+
]
|
|
42
|
+
},
|
|
43
|
+
{
|
|
44
|
+
"exp": "BSD-3-Clause",
|
|
45
|
+
"names": [
|
|
46
|
+
"BSD 3 Clause",
|
|
47
|
+
"BSD 3-Clause",
|
|
48
|
+
"BSD-3-Clause",
|
|
49
|
+
"BSD 3-Clause License",
|
|
50
|
+
"The BSD 3-Clause License",
|
|
51
|
+
"BSD 3-Clause \"New\" or \"Revised\" License (BSD-3-Clause)",
|
|
52
|
+
"Eclipse Distribution License (New BSD License)",
|
|
53
|
+
"New BSD License",
|
|
54
|
+
"Modified BSD License",
|
|
55
|
+
"Revised BSD",
|
|
56
|
+
"Revised BSD License",
|
|
57
|
+
"The New BSD License",
|
|
58
|
+
"BSD (3-clause)"
|
|
59
|
+
]
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"exp": "CDDL-1.0",
|
|
63
|
+
"names": [
|
|
64
|
+
"CDDL",
|
|
65
|
+
"CDDL 1.0",
|
|
66
|
+
"CDDL License",
|
|
67
|
+
"Common Development And Distribution License (CDDL) V1.0",
|
|
68
|
+
"COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL) Version 1.0"
|
|
69
|
+
]
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
"exp": "(CDDL-1.0 OR GPL-2.0-with-classpath-exception)",
|
|
73
|
+
"names": [
|
|
74
|
+
"CDDL + GPLv2 with classpath exception",
|
|
75
|
+
"CDDL/GPLv2+CE"
|
|
76
|
+
]
|
|
77
|
+
},
|
|
78
|
+
{
|
|
79
|
+
"exp": "CDDL-1.1",
|
|
80
|
+
"names": [
|
|
81
|
+
"CDDL 1.1"
|
|
82
|
+
]
|
|
83
|
+
},
|
|
84
|
+
{
|
|
85
|
+
"exp": "(CDDL-1.1 OR GPL-2.0-only)",
|
|
86
|
+
"names": [
|
|
87
|
+
"Dual license consisting of the CDDL v1.1 and GPL v2"
|
|
88
|
+
]
|
|
89
|
+
},
|
|
90
|
+
{
|
|
91
|
+
"exp": "EPL-1.0",
|
|
92
|
+
"names": [
|
|
93
|
+
"Eclipse Public License - Version 1.0",
|
|
94
|
+
"Eclipse Public License (EPL) 1.0",
|
|
95
|
+
"Eclipse Public License v1.0",
|
|
96
|
+
"Eclipse Public License, Version 1.0",
|
|
97
|
+
"Eclipse Public License - v 1.0",
|
|
98
|
+
"Eclipse Public License - v1.0",
|
|
99
|
+
"EPL 1.0",
|
|
100
|
+
"Eclipse Public License 1.0"
|
|
101
|
+
]
|
|
102
|
+
},
|
|
103
|
+
{
|
|
104
|
+
"exp": "EPL-2.0",
|
|
105
|
+
"names": [
|
|
106
|
+
"Eclipse Public License - Version 2.0",
|
|
107
|
+
"Eclipse Public License (EPL) 2.0",
|
|
108
|
+
"Eclipse Public License v2.0",
|
|
109
|
+
"Eclipse Public License, Version 2.0",
|
|
110
|
+
"Eclipse Public License - v 2.0",
|
|
111
|
+
"Eclipse Public License - v2.0",
|
|
112
|
+
"EPL 2.0"
|
|
113
|
+
]
|
|
114
|
+
},
|
|
115
|
+
{
|
|
116
|
+
"exp": "ECL-1.0",
|
|
117
|
+
"names": [
|
|
118
|
+
"Educational Community License, Version 1.0"
|
|
119
|
+
]
|
|
120
|
+
},
|
|
121
|
+
{
|
|
122
|
+
"exp": "ECL-2.0",
|
|
123
|
+
"names": [
|
|
124
|
+
"Educational Community License, Version 2.0"
|
|
125
|
+
]
|
|
126
|
+
},
|
|
127
|
+
{
|
|
128
|
+
"exp": "LGPL-2.0-only",
|
|
129
|
+
"names": [
|
|
130
|
+
"GNU Lesser General Public License (LGPL), version 2",
|
|
131
|
+
"GNU Lesser General Public License (LGPL), version 2.0",
|
|
132
|
+
"GNU Lesser General Public License v2",
|
|
133
|
+
"GNU Lesser General Public License v2.0"
|
|
134
|
+
]
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"exp": "LGPL-2.0-or-later",
|
|
138
|
+
"names": [
|
|
139
|
+
"GNU Lesser General Public License (LGPL), version 2 or later",
|
|
140
|
+
"GNU Lesser General Public License (LGPL), version 2.0 or later",
|
|
141
|
+
"GNU Lesser General Public License v2 or later",
|
|
142
|
+
"GNU Lesser General Public License v2.0 or later",
|
|
143
|
+
"LGPLv2+"
|
|
144
|
+
]
|
|
145
|
+
},
|
|
146
|
+
{
|
|
147
|
+
"exp": "LGPL-2.1-only",
|
|
148
|
+
"names": [
|
|
149
|
+
"LGPL 2.1",
|
|
150
|
+
"LGPL v2.1",
|
|
151
|
+
"LGPL-2.1",
|
|
152
|
+
"LGPL2.1",
|
|
153
|
+
"GNU Lesser General Public License",
|
|
154
|
+
"GNU Lesser General Public License Version 2.1",
|
|
155
|
+
"GNU Lesser General Public License Version 2.1, February 1999",
|
|
156
|
+
"GNU Library or Lesser General Public License (LGPL) V2.1"
|
|
157
|
+
]
|
|
158
|
+
},
|
|
159
|
+
{
|
|
160
|
+
"exp": "LGPL-2.1-or-later",
|
|
161
|
+
"names": [
|
|
162
|
+
"GNU Lesser General Public License (LGPL), version 2.1 or later",
|
|
163
|
+
"GNU Lesser General Public License v2.1 or later",
|
|
164
|
+
"LGPL, v2.1 or later"
|
|
165
|
+
]
|
|
166
|
+
},
|
|
167
|
+
{
|
|
168
|
+
"exp": "LGPL-3.0-only",
|
|
169
|
+
"names": [
|
|
170
|
+
"LGPL 3.0",
|
|
171
|
+
"LGPL v3.0",
|
|
172
|
+
"LGPL-3.0",
|
|
173
|
+
"LGPL3.0",
|
|
174
|
+
"GNU Lesser General Public License (LGPL), version 3",
|
|
175
|
+
"GNU Lesser General Public License (LGPL), version 3.0",
|
|
176
|
+
"GNU Lesser General Public License v3.0",
|
|
177
|
+
"GNU Lesser General Public License (LGPL), Version 3"
|
|
178
|
+
]
|
|
179
|
+
},
|
|
180
|
+
{
|
|
181
|
+
"exp": "LGPL-3.0-or-later",
|
|
182
|
+
"names": [
|
|
183
|
+
"GNU Lesser General Public License (LGPL), version 3 or later",
|
|
184
|
+
"GNU Lesser General Public License (LGPL), version 3.0 or later",
|
|
185
|
+
"GNU Lesser General Public License v3.0 or later"
|
|
186
|
+
]
|
|
187
|
+
},
|
|
188
|
+
{
|
|
189
|
+
"exp": "GPL-2.0-only",
|
|
190
|
+
"names": [
|
|
191
|
+
"GNU General Public License (GPL) version 2",
|
|
192
|
+
"GNU General Public License (GPL) version 2.0",
|
|
193
|
+
"GNU General Public License v2",
|
|
194
|
+
"GNU General Public License v2.0",
|
|
195
|
+
"GNU General Public License Version 2",
|
|
196
|
+
"GNU General Public License, version 2",
|
|
197
|
+
"GNU General Public License as published by the Free Software Foundation; version 2."
|
|
198
|
+
]
|
|
199
|
+
},
|
|
200
|
+
{
|
|
201
|
+
"exp": "GPL-2.0-or-later",
|
|
202
|
+
"names": [
|
|
203
|
+
"GNU General Public License (GPL) version 2, or any later version",
|
|
204
|
+
"GNU General Public License (GPL) version 2.0, or any later version",
|
|
205
|
+
"GNU General Public License v2 or later",
|
|
206
|
+
"GNU General Public License v2.0 or later",
|
|
207
|
+
"GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version",
|
|
208
|
+
"GNU GPLv2 or any later version",
|
|
209
|
+
"GPLv2+"
|
|
210
|
+
]
|
|
211
|
+
},
|
|
212
|
+
{
|
|
213
|
+
"exp": "GPL-2.0-with-classpath-exception",
|
|
214
|
+
"names": [
|
|
215
|
+
"GPL2 w/ CPE",
|
|
216
|
+
"GPLv2+CE",
|
|
217
|
+
"GPLv2 with classpath exception",
|
|
218
|
+
"GNU General Public License v2.0 only, with Classpath exception",
|
|
219
|
+
"As a special exception, the copyright holders of this library give you permission to link this library with independent modules to produce an executable, regardless of the license terms of these independent modules"
|
|
220
|
+
]
|
|
221
|
+
},
|
|
222
|
+
{
|
|
223
|
+
"exp": "GPL-3.0",
|
|
224
|
+
"names": [
|
|
225
|
+
"GNU General Public License (GPL) version 3",
|
|
226
|
+
"GNU General Public License (GPL) version 3.0",
|
|
227
|
+
"GNU General Public License v3",
|
|
228
|
+
"GNU General Public License v3.0",
|
|
229
|
+
"GNU General Public License as published by the Free Software Foundation, version 3.",
|
|
230
|
+
"GPL-3"
|
|
231
|
+
]
|
|
232
|
+
},
|
|
233
|
+
{
|
|
234
|
+
"exp": "GPL-3.0-or-later",
|
|
235
|
+
"names": [
|
|
236
|
+
"GNU General Public License (GPL) version 3, or any later version",
|
|
237
|
+
"GNU General Public License (GPL) version 3.0, or any later version",
|
|
238
|
+
"GNU General Public License v3 or later",
|
|
239
|
+
"GNU General Public License v3.0 or later",
|
|
240
|
+
"GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version"
|
|
241
|
+
]
|
|
242
|
+
},
|
|
243
|
+
{
|
|
244
|
+
"exp": "AGPL-3.0",
|
|
245
|
+
"names": [
|
|
246
|
+
"GNU Affero General Public License (GPL) version 3",
|
|
247
|
+
"GNU Affero General Public License (GPL) version 3.0",
|
|
248
|
+
"GNU Affero General Public License v3",
|
|
249
|
+
"GNU Affero General Public License v3.0"
|
|
250
|
+
]
|
|
251
|
+
},
|
|
252
|
+
{
|
|
253
|
+
"exp": "MIT",
|
|
254
|
+
"names": [
|
|
255
|
+
"MIT License",
|
|
256
|
+
"The MIT License",
|
|
257
|
+
"MIT license",
|
|
258
|
+
"The MIT License (MIT)",
|
|
259
|
+
"Apache-2.0 OR MIT"
|
|
260
|
+
]
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"exp": "MPL-1.1",
|
|
264
|
+
"names": [
|
|
265
|
+
"MPL 1.1"
|
|
266
|
+
]
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"exp": "MPL-2.0",
|
|
270
|
+
"names": [
|
|
271
|
+
"MPL 2.0",
|
|
272
|
+
"Mozilla Public License 2.0"
|
|
273
|
+
]
|
|
274
|
+
},
|
|
275
|
+
{
|
|
276
|
+
"exp": "NetCDF",
|
|
277
|
+
"names": [
|
|
278
|
+
"(MIT-style) netCDF C library license"
|
|
279
|
+
]
|
|
280
|
+
},
|
|
281
|
+
{
|
|
282
|
+
"exp": "JSON",
|
|
283
|
+
"names": [
|
|
284
|
+
"The JSON License",
|
|
285
|
+
"JSON License"
|
|
286
|
+
]
|
|
287
|
+
},
|
|
288
|
+
{
|
|
289
|
+
"exp": "ISC",
|
|
290
|
+
"names": [
|
|
291
|
+
"ISC license"
|
|
292
|
+
]
|
|
293
|
+
}
|
|
294
|
+
]
|
package/package.json
ADDED
|
@@ -0,0 +1,94 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "@cyclonedx/cdxgen",
|
|
3
|
+
"version": "8.0.0",
|
|
4
|
+
"description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
|
|
5
|
+
"homepage": "http://github.com/cyclonedx/cdxgen",
|
|
6
|
+
"author": "Prabhu Subramanian <prabhu@appthreat.com>",
|
|
7
|
+
"license": "Apache-2.0",
|
|
8
|
+
"keywords": [
|
|
9
|
+
"sbom",
|
|
10
|
+
"bom",
|
|
11
|
+
"inventory",
|
|
12
|
+
"spdx",
|
|
13
|
+
"package-url",
|
|
14
|
+
"purl",
|
|
15
|
+
"owasp",
|
|
16
|
+
"component",
|
|
17
|
+
"dependency",
|
|
18
|
+
"appsec",
|
|
19
|
+
"scrm"
|
|
20
|
+
],
|
|
21
|
+
"contributors": [
|
|
22
|
+
{
|
|
23
|
+
"name": "Erlend Oftedal"
|
|
24
|
+
},
|
|
25
|
+
{
|
|
26
|
+
"name": "Steve Springett",
|
|
27
|
+
"email": "steve.springett@owasp.org",
|
|
28
|
+
"url": "https://about.me/stevespringett"
|
|
29
|
+
}
|
|
30
|
+
],
|
|
31
|
+
"main": "index.js",
|
|
32
|
+
"bin": {
|
|
33
|
+
"cdxgen": "./bin/cdxgen"
|
|
34
|
+
},
|
|
35
|
+
"scripts": {
|
|
36
|
+
"test": "jest",
|
|
37
|
+
"watch": "jest --watch",
|
|
38
|
+
"lint": "eslint index.js utils.js binary.js server.js docker.js bin/cdxgen",
|
|
39
|
+
"pretty": "prettier --write *.js bin/cdxgen --trailing-comma=none"
|
|
40
|
+
},
|
|
41
|
+
"engines": {
|
|
42
|
+
"node": ">=12.0.0"
|
|
43
|
+
},
|
|
44
|
+
"repository": {
|
|
45
|
+
"type": "git",
|
|
46
|
+
"url": "git+https://github.com/cyclonedx/cdxgen.git"
|
|
47
|
+
},
|
|
48
|
+
"bugs": {
|
|
49
|
+
"url": "https://github.com/cyclonedx/cdxgen/issues"
|
|
50
|
+
},
|
|
51
|
+
"dependencies": {
|
|
52
|
+
"@babel/parser": "^7.20.7",
|
|
53
|
+
"@babel/traverse": "^7.20.12",
|
|
54
|
+
"cheerio": "^1.0.0-rc.12",
|
|
55
|
+
"edn-data": "^1.0.0",
|
|
56
|
+
"glob": "^8.0.3",
|
|
57
|
+
"global-agent": "^3.0.0",
|
|
58
|
+
"got": "^11.8.5",
|
|
59
|
+
"js-yaml": "^4.1.0",
|
|
60
|
+
"jws": "^4.0.0",
|
|
61
|
+
"node-stream-zip": "^1.15.0",
|
|
62
|
+
"packageurl-js": "^1.0.0",
|
|
63
|
+
"parse-packagejson-name": "^1.0.1",
|
|
64
|
+
"prettify-xml": "^1.2.0",
|
|
65
|
+
"properties-reader": "^2.2.0",
|
|
66
|
+
"semver": "^7.3.8",
|
|
67
|
+
"ssri": "^8.0.1",
|
|
68
|
+
"table": "^6.8.1",
|
|
69
|
+
"tar": "^6.1.13",
|
|
70
|
+
"uuid": "^9.0.0",
|
|
71
|
+
"xml-js": "^1.6.11",
|
|
72
|
+
"xmlbuilder": "^15.1.1",
|
|
73
|
+
"yargs": "^17.6.2"
|
|
74
|
+
},
|
|
75
|
+
"optionalDependencies": {
|
|
76
|
+
"@cyclonedx/cdxgen-plugins-bin": "^1.0.0",
|
|
77
|
+
"connect": "^3.7.0",
|
|
78
|
+
"body-parser": "^1.20.1",
|
|
79
|
+
"compression": "^1.7.4"
|
|
80
|
+
},
|
|
81
|
+
"files": [
|
|
82
|
+
"*.js",
|
|
83
|
+
"bin/",
|
|
84
|
+
"spdx-licenses.json",
|
|
85
|
+
"lic-mapping.json",
|
|
86
|
+
"known-licenses.json",
|
|
87
|
+
"vendor-alias.json",
|
|
88
|
+
"queries.json"
|
|
89
|
+
],
|
|
90
|
+
"devDependencies": {
|
|
91
|
+
"eslint": "^8.31.0",
|
|
92
|
+
"jest": "^26.6.3"
|
|
93
|
+
}
|
|
94
|
+
}
|
package/queries.json
ADDED
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
{
|
|
2
|
+
"kernel_info": {
|
|
3
|
+
"query": "select * from kernel_info;",
|
|
4
|
+
"name": "os-image",
|
|
5
|
+
"description": "Retrieves information from the current kernel in the target system.",
|
|
6
|
+
"purlType": "swid"
|
|
7
|
+
},
|
|
8
|
+
"os_version": {
|
|
9
|
+
"query": "select * from os_version;",
|
|
10
|
+
"description": "Retrieves the current version of the running osquery in the target system and where the configuration was loaded from.",
|
|
11
|
+
"purlType": "swid"
|
|
12
|
+
},
|
|
13
|
+
"chrome_extensions": {
|
|
14
|
+
"query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
|
|
15
|
+
"description": "Retrieves the list of extensions for Chrome in the target system.",
|
|
16
|
+
"purlType": "swid"
|
|
17
|
+
},
|
|
18
|
+
"firefox_addons": {
|
|
19
|
+
"query": "select firefox_addons.* from users join firefox_addons using (uid);",
|
|
20
|
+
"description": "Retrieves the list of addons for Firefox in the target system.",
|
|
21
|
+
"purlType": "swid"
|
|
22
|
+
},
|
|
23
|
+
"deb_packages": {
|
|
24
|
+
"query": "select * from deb_packages;",
|
|
25
|
+
"description": "Retrieves all the installed DEB packages in the target Linux system.",
|
|
26
|
+
"purlType": "deb"
|
|
27
|
+
},
|
|
28
|
+
"apt_sources": {
|
|
29
|
+
"query": "select * from apt_sources;",
|
|
30
|
+
"description": "Retrieves all the APT sources to install packages from in the target Linux system.",
|
|
31
|
+
"purlType": "deb"
|
|
32
|
+
},
|
|
33
|
+
"portage_packages": {
|
|
34
|
+
"query": "select * from portage_packages;",
|
|
35
|
+
"description": "Retrieves all the installed packages on the target Linux system.",
|
|
36
|
+
"purlType": "ebuild"
|
|
37
|
+
},
|
|
38
|
+
"rpm_packages": {
|
|
39
|
+
"query": "select * from rpm_packages;",
|
|
40
|
+
"description": "Retrieves all the installed RPM packages in the target Linux system.",
|
|
41
|
+
"purlType": "rpm"
|
|
42
|
+
},
|
|
43
|
+
"backdoored_python_packages": {
|
|
44
|
+
"query": "select name as package_name, version as package_version, path as package_path from python_packages where package_name = 'acqusition' or package_name = 'apidev-coop' or package_name = 'bzip' or package_name = 'crypt' or package_name = 'django-server' or package_name = 'pwd' or package_name = 'setup-tools' or package_name = 'telnet' or package_name = 'urlib3' or package_name = 'urllib';",
|
|
45
|
+
"description": "Watches for the backdoored Python packages installed on system.",
|
|
46
|
+
"purlType": "pypi"
|
|
47
|
+
},
|
|
48
|
+
"windows_programs": {
|
|
49
|
+
"query" : "select * from programs;",
|
|
50
|
+
"description" : "Retrieves the list of products as they are installed by Windows Installer in the target Windows system.",
|
|
51
|
+
"purlType": "swid"
|
|
52
|
+
},
|
|
53
|
+
"windows_patches": {
|
|
54
|
+
"query" : "select * from patches;",
|
|
55
|
+
"description" : "Retrieves all the information for the current windows drivers in the target Windows system.",
|
|
56
|
+
"purlType": "swid"
|
|
57
|
+
},
|
|
58
|
+
"windows_drivers": {
|
|
59
|
+
"query" : "select * from drivers;",
|
|
60
|
+
"description" : "Retrieves all the information for the current windows drivers in the target Windows system.",
|
|
61
|
+
"purlType": "swid"
|
|
62
|
+
},
|
|
63
|
+
"windows_shared_resources": {
|
|
64
|
+
"query" : "select * from shared_resources;",
|
|
65
|
+
"description" : "Retrieves the list of shared resources in the target Windows system.",
|
|
66
|
+
"purlType": "swid"
|
|
67
|
+
}
|
|
68
|
+
}
|