@cyclonedx/cdxgen 8.4.1 → 8.4.3

package/README.md

@@ -246,33 +246,33 @@ cdxgen can retain the dependency tree under the `dependencies` attribute for a s
 
 ## Environment variables
 
-| Variable                     | Description                                                                                                        |
-| ---------------------------- | -------------------------------------------------------------------------------------------------------------------|
-| SCAN_DEBUG_MODE              | Set to debug to enable debug messages                                                                              |
-| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                        |
-| MVN_CMD                      | Set to override maven command                                                                                      |
-| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                              |
-| MAVEN_HOME                   | Specify maven home                                                                                                 |
-| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                    |
-| GRADLE_MULTI_PROJECT_MODE    | Set this variable for gradle multi-project applications. Do not use this with recurse mode.                        |
-| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle. Eg: --configuration runtimeClassPath       |
-| GRADLE_HOME                  | Specify gradle home                                                                                                |
-| GRADLE_CMD                   | Set to override gradle command                                                                                     |
-| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                  |
-| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                       |
-| FETCH_LICENSE                | Set this variable to fetch license information from the registry. npm and golang only                              |
-| USE_GOSUM                    | Set to true to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
-| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                 |
-| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                     |
-| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                             |
-| CLJ_CMD                      | Set to override the clojure cli command                                                                            |
-| LEIN_CMD                     | Set to override the leiningen command                                                                              |
-| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                     |
-| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                     |
-| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                              |
-| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                |
-| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom               |
-| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                             |
+| Variable                     | Description                                                                                                                 |
+| ---------------------------- | --------------------------------------------------------------------------------------------------------------------------- |
+| SCAN_DEBUG_MODE              | Set to `debug` to enable debug messages                                                                                     |
+| GITHUB_TOKEN                 | Specify GitHub token to prevent traffic shaping while querying license and repo information                                 |
+| MVN_CMD                      | Set to override maven command                                                                                               |
+| MVN_ARGS                     | Set to pass additional arguments such as profile or settings to maven                                                       |
+| MAVEN_HOME                   | Specify maven home                                                                                                          |
+| GRADLE_CACHE_DIR             | Specify gradle cache directory. Useful for class name resolving                                                             |
+| GRADLE_MULTI_PROJECT_MODE    | Set this variable for gradle multi-project applications. Do not use this with recurse mode.                                 |
+| GRADLE_ARGS                  | Set to pass additional arguments such as profile or settings to gradle. Eg: --configuration runtimeClassPath                |
+| GRADLE_HOME                  | Specify gradle home                                                                                                         |
+| GRADLE_CMD                   | Set to override gradle command                                                                                              |
+| GRADLE_DEPENDENCY_TASK       | By default cdxgen use the task "dependencies" to collect packages. Set to override the task name.                           |
+| SBT_CACHE_DIR                | Specify sbt cache directory. Useful for class name resolving                                                                |
+| FETCH_LICENSE                | Set this variable to `true` or `1` to fetch license information from the registry. npm and golang                           |
+| USE_GOSUM                    | Set to `true` or `1` to generate BOMs for golang projects using go.sum as the dependency source of truth, instead of go.mod |
+| CDXGEN_TIMEOUT_MS            | Default timeout for known execution involving maven, gradle or sbt                                                          |
+| CDXGEN_SERVER_TIMEOUT_MS     | Default timeout in server mode                                                                                              |
+| BAZEL_TARGET                 | Bazel target to build. Default :all (Eg: //java-maven)                                                                      |
+| CLJ_CMD                      | Set to override the clojure cli command                                                                                     |
+| LEIN_CMD                     | Set to override the leiningen command                                                                                       |
+| SBOM_SIGN_ALGORITHM          | Signature algorithm. Some valid values are RS256, RS384, RS512, PS256, PS384, PS512, ES256 etc                              |
+| SBOM_SIGN_PRIVATE_KEY        | Private key to use for signing                                                                                              |
+| SBOM_SIGN_PUBLIC_KEY         | Optional. Public key to include in the SBoM signature                                                                       |
+| CDX_MAVEN_PLUGIN             | CycloneDX Maven plugin to use. Default "org.cyclonedx:cyclonedx-maven-plugin:2.7.8"                                         |
+| CDX_MAVEN_GOAL               | CycloneDX Maven plugin goal to use. Default makeAggregateBom. Other options: makeBom, makePackageBom                        |
+| CDX_MAVEN_INCLUDE_TEST_SCOPE | Whether test scoped dependencies should be included from Maven projects, Default: true                                      |
 
 ## Plugins
 

package/index.js

@@ -2156,8 +2156,9 @@ const createGoBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "go.sum"
   );
 
-  // If USE_GOSUM is true, generate BOM components only using go.sum.
-  const useGosum = process.env.USE_GOSUM == "true";
+  // If USE_GOSUM is true|1, generate BOM components only using go.sum.
+  const useGosum =
+    process.env.USE_GOSUM && ["true", "1"].includes(process.env.USE_GOSUM);
   if (useGosum && gosumFiles.length) {
     console.warn(
       "Using go.sum to generate BOMs for go projects may return an inaccurate representation of transitive dependencies.\nSee: https://github.com/golang/go/wiki/Modules#is-gosum-a-lock-file-why-does-gosum-include-information-for-module-versions-i-am-no-longer-using\n",
@@ -2919,7 +2920,8 @@ const createSwiftBom = async (path, options) => {
         pkgList = pkgList.concat(dlist);
       }
     }
-  } else if (swiftFiles.length) {
+  }
+  if (swiftFiles.length) {
     for (let f of swiftFiles) {
       const basePath = pathLib.dirname(f);
       if (completedPath.includes(basePath)) {
@@ -3913,6 +3915,22 @@ const createMultiXBom = async (pathList, options) => {
         )
       );
     }
+    bomData = await createSwiftBom(path, options);
+    if (bomData && bomData.bomJson && bomData.bomJson.components) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Found ${bomData.bomJson.components.length} Swift packages at ${path}`
+        );
+      }
+      components = components.concat(bomData.bomJson.components);
+      dependencies = dependencies.concat(bomData.bomJson.dependencies);
+      if (!parentComponent || !Object.keys(parentComponent).length) {
+        parentComponent = bomData.parentComponent;
+      }
+      componentsXmls = componentsXmls.concat(
+        listComponents(options, {}, bomData.bomJson.components, "swift", "xml")
+      );
+    }
     // jar scanning is quite slow so this is limited to only deep scans
     if (options.deep) {
       bomData = createJarBom(path, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "8.4.1",
+  "version": "8.4.3",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -32,6 +32,11 @@ const includeMavenTestScope =
   ["true", "1"].includes(process.env.CDX_MAVEN_INCLUDE_TEST_SCOPE);
 exports.includeMavenTestScope = includeMavenTestScope;
 
+// Whether license information should be fetched
+const fetchLicenses =
+  process.env.FETCH_LICENSE &&
+  ["true", "1"].includes(process.env.FETCH_LICENSE);
+
 const MAX_LICENSE_ID_LENGTH = 100;
 
 /**
@@ -345,7 +350,7 @@ const parsePkgJson = async (pkgJsonFile) => {
       // continue regardless of error
     }
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePkgJson`
@@ -452,7 +457,7 @@ const parsePkgLock = async (pkgLockFile) => {
       lockData
     );
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePkgLock`
@@ -658,7 +663,7 @@ const parseYarnLock = async function (yarnLockFile) {
       }
     });
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseYarnLock`
@@ -725,7 +730,7 @@ const parseNodeShrinkwrap = async function (swFile) {
       }
     }
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseNodeShrinkwrap`
@@ -880,7 +885,7 @@ const parsePnpmLock = async function (pnpmLock, parentComponent = null) {
       }
     }
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parsePnpmLock`
@@ -927,7 +932,7 @@ const parseBowerJson = async (bowerJsonFile) => {
       // continue regardless of error
     }
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseBowerJson`
@@ -1001,7 +1006,7 @@ const parseMinJs = async (minJsFile) => {
       // continue regardless of error
     }
   }
-  if (process.env.FETCH_LICENSE && pkgList && pkgList.length) {
+  if (fetchLicenses && pkgList && pkgList.length) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch license information for ${pkgList.length} packages in parseMinJs`
@@ -1538,7 +1543,7 @@ const getMvnMetadata = async function (pkgList) {
   }
   for (const p of pkgList) {
     // If the package already has key metadata skip querying maven
-    if (p.group && p.name && p.version && !process.env.FETCH_LICENSE) {
+    if (p.group && p.name && p.version && !fetchLicenses) {
       cdepList.push(p);
       continue;
     }
@@ -1648,7 +1653,7 @@ exports.parsePyRequiresDist = parsePyRequiresDist;
  * @param {Boolean} fetchIndirectDeps Should we also fetch data about indirect dependencies from pypi
  */
 const getPyMetadata = async function (pkgList, fetchIndirectDeps) {
-  if (!process.env.FETCH_LICENSE && !fetchIndirectDeps) {
+  if (!fetchLicenses && !fetchIndirectDeps) {
     return pkgList;
   }
   const PYPI_URL = "https://pypi.org/pypi/";
@@ -2050,7 +2055,7 @@ exports.getGoPkgLicense = getGoPkgLicense;
 const getGoPkgComponent = async function (group, name, version, hash) {
   let pkg = {};
   let license = undefined;
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     if (DEBUG_MODE) {
       console.log(
         `About to fetch go package license information for ${group}:${name}`
@@ -2224,7 +2229,7 @@ const parseGosumData = async function (gosumData) {
       const version = tmpA[1].replace("/go.mod", "");
       const hash = tmpA[tmpA.length - 1].replace("h1:", "sha256-");
       let license = undefined;
-      if (process.env.FETCH_LICENSE) {
+      if (fetchLicenses) {
         if (DEBUG_MODE) {
           console.log(
             `About to fetch go package license information for ${name}`
@@ -2277,7 +2282,7 @@ const parseGopkgData = async function (gopkgData) {
         case "name":
           pkg.group = "";
           pkg.name = value;
-          if (process.env.FETCH_LICENSE) {
+          if (fetchLicenses) {
             pkg.license = await getGoPkgLicense({
               group: pkg.group,
               name: pkg.name
@@ -2407,7 +2412,7 @@ const parseGemspecData = async function (gemspecData) {
     }
   });
   pkgList = [pkg];
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getRubyGemsMetadata(pkgList);
   } else {
     return pkgList;
@@ -2456,7 +2461,7 @@ const parseGemfileLockData = async function (gemLockData) {
       specsFound = false;
     }
   });
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getRubyGemsMetadata(pkgList);
   } else {
     return pkgList;
@@ -2623,7 +2628,7 @@ const parseCargoTomlData = async function (cargoData) {
   if (pkg) {
     pkgList.push(pkg);
   }
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -2671,7 +2676,7 @@ const parseCargoData = async function (cargoData) {
       }
     }
   });
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -2700,7 +2705,7 @@ const parseCargoAuditableData = async function (cargoData) {
       });
     }
   });
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getCratesMetadata(pkgList);
   } else {
     return pkgList;
@@ -2740,7 +2745,7 @@ const parsePubLockData = async function (pubLockData) {
       }
     }
   });
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getDartMetadata(pkgList);
   } else {
     return pkgList;
@@ -3434,7 +3439,7 @@ const parseNupkg = async function (nupkgFile) {
     }
   ];
   pkgList.push(pkg);
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
   } else {
     return pkgList;
@@ -3466,7 +3471,7 @@ const parseCsPkgData = async function (pkgData) {
     pkg.version = p.version;
     pkgList.push(pkg);
   }
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
   } else {
     return pkgList;
@@ -3521,7 +3526,7 @@ const parseCsProjData = async function (csProjData) {
       }
     }
   }
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
   } else {
     return pkgList;
@@ -3561,7 +3566,7 @@ const parseCsProjAssetsData = async function (csProjData) {
       pkgList.push(pkg);
     }
   }
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
   } else {
     return pkgList;
@@ -3590,7 +3595,7 @@ const parseCsPkgLockData = async function (csLockData) {
       pkgList.push(pkg);
     }
   }
-  if (process.env.FETCH_LICENSE) {
+  if (fetchLicenses) {
     return await getNugetMetadata(pkgList);
   } else {
     return pkgList;