@cyclonedx/cdxgen 8.2.2 → 8.2.4

package/README.md

@@ -270,6 +270,8 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 | SBOM_SIGN_ALGORITHM       | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                     |
 | SBOM_SIGN_PRIVATE_KEY     | Private key to use for signing                                                                                     |
 | SBOM_SIGN_PUBLIC_KEY      | Optional. Public key to include in the SBoM signature                                                              |
+| CDX_MAVEN_PLUGIN          | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.6"                                |
+| CDX_MAVEN_GOAL            | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom               |
 
 ## Plugins
 

package/index.js

@@ -986,10 +986,11 @@ const createJavaBom = async (path, options) => {
       (options.multiProject ? "**/" : "") + "pom.xml"
     );
     if (pomFiles && pomFiles.length) {
-      let mvnArgs = [
-        "org.cyclonedx:cyclonedx-maven-plugin:2.7.2:makeAggregateBom",
-        "-DoutputName=bom"
-      ];
+      const cdxMavenPlugin =
+        process.env.CDX_MAVEN_PLUGIN ||
+        "org.cyclonedx:cyclonedx-maven-plugin:2.7.6";
+      const cdxMavenGoal = process.env.CDX_MAVEN_GOAL || "makeAggregateBom";
+      let mvnArgs = [`${cdxMavenPlugin}:${cdxMavenGoal}`, "-DoutputName=bom"];
       // By using quiet mode we can reduce the maxBuffer used and avoid crashes
       if (!DEBUG_MODE) {
         mvnArgs.push("-q");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.2.2",
+  "version": "8.2.4",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -773,13 +773,22 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         dependsOn: ddeplist
       });
     }
-    const lockfileVersion = yamlObj.lockfileVersion;
+    let lockfileVersion = yamlObj.lockfileVersion;
+    try {
+      lockfileVersion = parseInt(lockfileVersion, 10);
+    } catch (e) {
+      // ignore parse errors
+    }
     const packages = yamlObj.packages;
     const pkgKeys = Object.keys(packages);
     for (var k in pkgKeys) {
       // Eg: @babel/code-frame/7.10.1
       // In lockfileVersion 6, /@babel/code-frame@7.18.6
-      const fullName = pkgKeys[k].replace("/@", "@");
+      let fullName = pkgKeys[k].replace("/@", "@");
+      // Handle /vite@4.2.1(@types/node@18.15.11) in lockfileVersion 6
+      if (lockfileVersion >= 6 && fullName.includes("(")) {
+        fullName = fullName.split("(")[0];
+      }
       const parts = fullName.split("/");
       const integrity = packages[pkgKeys[k]].resolution.integrity;
       const deps = packages[pkgKeys[k]].dependencies || [];
@@ -788,12 +797,14 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
         let name = "";
         let version = "";
         let group = "";
-        if (lockfileVersion === "6.0" && fullName.includes("@")) {
+        if (lockfileVersion >= 6 && fullName.includes("@")) {
           const tmpA = parts[parts.length - 1].split("@");
           group = parts[0];
           if (parts.length === 2 && tmpA.length > 1) {
             name = tmpA[0];
             version = tmpA[1];
+          } else {
+            console.log(parts, fullName);
           }
         } else {
           if (parts.length === 2) {
@@ -805,6 +816,13 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
             version = parts[2];
           }
         }
+        // Let's have some warnings till we fully support pnpm 8
+        if (!name) {
+          console.warn(
+            `Unable to extract name and version for string ${pkgKeys[k]}`
+          );
+          continue;
+        }
         if (group !== "@types" && name.indexOf("file:") !== 0) {
           const purlString = new PackageURL(
             "npm",

package/utils.test.js

@@ -1215,6 +1215,18 @@ test("parsePnpmLock", async () => {
       "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
     properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
   });
+  parsedList = await utils.parsePnpmLock("./test/data/pnpm-lock6a.yaml");
+  expect(parsedList.pkgList.length).toEqual(229);
+  expect(parsedList.dependenciesList.length).toEqual(229);
+  expect(parsedList.pkgList[0]).toEqual({
+    group: "@babel",
+    name: "code-frame",
+    version: "7.18.6",
+    scope: "optional",
+    _integrity:
+      "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6a.yaml" }]
+  });
 });
 
 test("parseYarnLock", async () => {