@cyclonedx/cdxgen 9.0.1 → 9.1.1

package/utils.test.js

@@ -64,8 +64,8 @@ import {
   parseSwiftJsonTree,
   parseSwiftResolved,
   guessPypiMatchingVersion
-} from "./utils";
-import { readFileSync } from "fs";
+} from "./utils.js";
+import { readFileSync } from "node:fs";
 import { parse } from "ssri";
 import { expect, test } from "@jest/globals";
 
@@ -91,6 +91,12 @@ test("SSRI test", () => {
   expect(ss.sha256[0].digest).toStrictEqual(
     "LKUyprxlVmM0QAS6ECQ20pAxAY6rI2JHZ42x2JeGJ78="
   );
+  ss = parse(
+    "sha512-Vn0lE2mprXEFPcRoI89xjw1fk1VJiyVbwfaPnVnvCXxEieByioO8Mj6sMwa6ON9PRuqbAjIxaQpkzccu41sYlw=="
+  );
+  expect(ss.sha512[0].digest).toStrictEqual(
+    "Vn0lE2mprXEFPcRoI89xjw1fk1VJiyVbwfaPnVnvCXxEieByioO8Mj6sMwa6ON9PRuqbAjIxaQpkzccu41sYlw=="
+  );
 });
 
 test("Parse requires dist string", () => {
@@ -633,7 +639,7 @@ test("parseGoSumData", async () => {
 }, 120000);
 
 test("parse go list dependencies", async () => {
-  let dep_list = await parseGoListDep(
+  const dep_list = await parseGoListDep(
     readFileSync("./test/data/golist-dep.txt", { encoding: "utf-8" }),
     {}
   );
@@ -766,7 +772,7 @@ test("parse cargo toml", async () => {
 
 test("parse cargo auditable data", async () => {
   expect(await parseCargoAuditableData(null)).toEqual([]);
-  let dep_list = await parseCargoAuditableData(
+  const dep_list = await parseCargoAuditableData(
     readFileSync("./test/data/cargo-auditable.txt", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(32);
@@ -1003,7 +1009,7 @@ test("parse github actions workflow data", async () => {
   dep_list = await parseGitHubWorkflowData(
     readFileSync("./.github/workflows/repotests.yml", { encoding: "utf-8" })
   );
-  expect(dep_list.length).toEqual(5);
+  expect(dep_list.length).toEqual(6);
   expect(dep_list[0]).toEqual({
     group: "actions",
     name: "checkout",
@@ -1359,7 +1365,20 @@ test("parsePnpmLock", async () => {
         name: "SrcFile",
         value: "./test/pnpm-lock.yaml"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/pnpm-lock.yaml"
+          }
+        ]
+      }
+    }
   });
   parsedList = await parsePnpmLock("./test/data/pnpm-lock.yaml");
   expect(parsedList.pkgList.length).toEqual(308);
@@ -1376,7 +1395,20 @@ test("parsePnpmLock", async () => {
         name: "SrcFile",
         value: "./test/data/pnpm-lock.yaml"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock.yaml"
+          }
+        ]
+      }
+    }
   });
   parsedList = await parsePnpmLock("./test/data/pnpm-lock2.yaml");
   expect(parsedList.pkgList.length).toEqual(7);
@@ -1387,7 +1419,20 @@ test("parsePnpmLock", async () => {
     version: "2.1.1",
     scope: undefined,
     _integrity: "sha1-w7M6te42DYbg5ijwRorn7yfWVN8=",
-    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock2.yaml" }]
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock2.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock2.yaml"
+          }
+        ]
+      }
+    }
   });
   expect(parsedList.dependenciesList[2]).toEqual({
     ref: "pkg:npm/chalk@1.1.3",
@@ -1409,7 +1454,20 @@ test("parsePnpmLock", async () => {
     scope: undefined,
     _integrity:
       "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
-    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock3.yaml" }]
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock3.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock3.yaml"
+          }
+        ]
+      }
+    }
   });
   expect(parsedList.dependenciesList[2]).toEqual({
     ref: "pkg:npm/@nodelib/fs.walk@1.2.8",
@@ -1429,7 +1487,20 @@ test("parsePnpmLock", async () => {
     scope: "optional",
     _integrity:
       "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
-    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock6.yaml"
+          }
+        ]
+      }
+    }
   });
   expect(parsedList.pkgList[parsedList.pkgList.length - 1]).toEqual({
     group: "",
@@ -1438,7 +1509,20 @@ test("parsePnpmLock", async () => {
     scope: "optional",
     _integrity:
       "sha512-cwiTb08Xuv5fqF4AovYacTFNxk62th7LKJ6BL9IGUpTJrWoU7/7WdQGTP2SjKf1dUNBGzDd28p/Yfs/GI6JrLw==",
-    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }]
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock6.yaml"
+          }
+        ]
+      }
+    }
   });
   parsedList = await parsePnpmLock("./test/data/pnpm-lock6a.yaml");
   expect(parsedList.pkgList.length).toEqual(229);
@@ -1450,7 +1534,20 @@ test("parsePnpmLock", async () => {
     scope: "optional",
     _integrity:
       "sha512-TDCmlK5eOvH+eH7cdAFlNXeVJqWIQ7gW9tY1GJIpUtFb6CmjVyq2VM3u71bOyR8CRihcCgMUYoDNyLXao3+70Q==",
-    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6a.yaml" }]
+    properties: [{ name: "SrcFile", value: "./test/data/pnpm-lock6a.yaml" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/pnpm-lock6a.yaml"
+          }
+        ]
+      }
+    }
   });
 });
 
@@ -1469,7 +1566,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/yarn.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/yarn.lock"
+          }
+        ]
+      }
+    }
   });
   expect(parsedList.dependenciesList.length).toEqual(56);
   identMap = yarnLockToIdentMap(
@@ -1490,7 +1600,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarn.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarn.lock"
+          }
+        ]
+      }
+    }
   });
   parsedList.pkgList.forEach((d) => {
     expect(d.name).toBeDefined();
@@ -1511,7 +1634,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarn-multi.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarn-multi.lock"
+          }
+        ]
+      }
+    }
   });
 
   parsedList = await parseYarnLock("./test/data/yarn_locks/yarn-light.lock");
@@ -1528,7 +1664,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarn-light.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarn-light.lock"
+          }
+        ]
+      }
+    }
   });
 
   parsedList = await parseYarnLock("./test/data/yarn_locks/yarn3.lock");
@@ -1545,7 +1694,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarn3.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarn3.lock"
+          }
+        ]
+      }
+    }
   });
 
   parsedList = await parseYarnLock("./test/data/yarn_locks/yarnv2.lock");
@@ -1562,7 +1724,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarnv2.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarnv2.lock"
+          }
+        ]
+      }
+    }
   });
   parsedList = await parseYarnLock("./test/data/yarn_locks/yarnv3.lock");
   expect(parsedList.pkgList.length).toEqual(325);
@@ -1578,7 +1753,20 @@ test("parseYarnLock", async () => {
         name: "SrcFile",
         value: "./test/data/yarn_locks/yarnv3.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarnv3.lock"
+          }
+        ]
+      }
+    }
   });
   parsedList = await parseYarnLock("./test/data/yarn_locks/yarn4.lock");
   expect(parsedList.pkgList.length).toEqual(1);
@@ -1594,7 +1782,20 @@ test("parseYarnLock", async () => {
       "sha512-JE93VWVyVa07xkK1wJ5ogjSZ30Nn4ptUuUXdPnu8MsKme1xFHLFFD3UtnHxnxnNDSnGx+WLlhuyHdIFfSCYqYg==",
     properties: [
       { name: "SrcFile", value: "./test/data/yarn_locks/yarn-at.lock" }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/yarn_locks/yarn-at.lock"
+          }
+        ]
+      }
+    }
   });
 });
 
@@ -1618,7 +1819,20 @@ test("parseComposerLock", () => {
         name: "SrcFile",
         value: "./test/data/composer.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/composer.lock"
+          }
+        ]
+      }
+    }
   });
 
   deps = parseComposerLock("./test/data/composer-2.lock");
@@ -1640,7 +1854,20 @@ test("parseComposerLock", () => {
         name: "SrcFile",
         value: "./test/data/composer-2.lock"
       }
-    ]
+    ],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/composer-2.lock"
+          }
+        ]
+      }
+    }
   });
 
   deps = parseComposerLock("./test/data/composer-3.lock");
@@ -1657,12 +1884,25 @@ test("parseComposerLock", () => {
     license: ["MIT"],
     description: "A non-blocking concurrency framework for PHP applications.",
     scope: "required",
-    properties: [{ name: "SrcFile", value: "./test/data/composer-3.lock" }]
+    properties: [{ name: "SrcFile", value: "./test/data/composer-3.lock" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/composer-3.lock"
+          }
+        ]
+      }
+    }
   });
 });
 
 test("parseGemfileLockData", async () => {
-  let deps = await parseGemfileLockData(
+  const deps = await parseGemfileLockData(
     readFileSync("./test/data/Gemfile.lock", { encoding: "utf-8" })
   );
   expect(deps.length).toEqual(140);
@@ -1673,7 +1913,7 @@ test("parseGemfileLockData", async () => {
 });
 
 test("parseGemspecData", async () => {
-  let deps = await parseGemspecData(
+  const deps = await parseGemspecData(
     readFileSync("./test/data/xmlrpc.gemspec", { encoding: "utf-8" })
   );
   expect(deps.length).toEqual(1);
@@ -1752,7 +1992,7 @@ test("parse wheel metadata", () => {
 });
 
 test("parse wheel", async () => {
-  let metadata = await readZipEntry(
+  const metadata = await readZipEntry(
     "./test/data/appthreat_depscan-2.0.2-py3-none-any.whl",
     "METADATA"
   );
@@ -1769,13 +2009,13 @@ test("parse wheel", async () => {
 });
 
 test("parse pipfile.lock with hashes", async () => {
-  let deps = await parsePiplockData(
+  const deps = await parsePiplockData(
     JSON.parse(readFileSync("./test/data/Pipfile.lock", { encoding: "utf-8" }))
   );
   expect(deps.length).toEqual(46);
 }, 120000);
 
-test("parse scala sbt list", async () => {
+test("parse scala sbt list", () => {
   let deps = parseKVDep(
     readFileSync("./test/data/sbt-dl.list", { encoding: "utf-8" })
   );
@@ -1786,19 +2026,19 @@ test("parse scala sbt list", async () => {
   expect(deps.length).toEqual(117);
 });
 
-test("parse scala sbt lock", async () => {
-  let deps = parseSbtLock("./test/data/build.sbt.lock");
+test("parse scala sbt lock", () => {
+  const deps = parseSbtLock("./test/data/build.sbt.lock");
   expect(deps.length).toEqual(117);
 });
 
 test("parse nupkg file", async () => {
-  let deps = await parseNupkg("./test/data/jquery.3.6.0.nupkg");
+  const deps = await parseNupkg("./test/data/jquery.3.6.0.nupkg");
   expect(deps.length).toEqual(1);
   expect(deps[0].name).toEqual("jQuery");
 });
 
 test("parse bazel skyframe", () => {
-  let deps = parseBazelSkyframe(
+  const deps = parseBazelSkyframe(
     readFileSync("./test/data/bazel/bazel-state.txt", { encoding: "utf-8" })
   );
   expect(deps.length).toEqual(16);
@@ -1806,7 +2046,7 @@ test("parse bazel skyframe", () => {
 });
 
 test("parse bazel build", () => {
-  let projs = parseBazelBuild(
+  const projs = parseBazelBuild(
     readFileSync("./test/data/bazel/BUILD", { encoding: "utf-8" })
   );
   expect(projs.length).toEqual(2);
@@ -1932,7 +2172,7 @@ test("parse container spec like files", async () => {
 
 test("parse cloudbuild data", async () => {
   expect(await parseCloudBuildData(null)).toEqual([]);
-  let dep_list = await parseCloudBuildData(
+  const dep_list = await parseCloudBuildData(
     readFileSync("./test/data/cloudbuild.yaml", { encoding: "utf-8" })
   );
   expect(dep_list.length).toEqual(1);
@@ -1944,7 +2184,7 @@ test("parse cloudbuild data", async () => {
 });
 
 test("parse privado files", () => {
-  let servList = parsePrivadoFile("./test/data/privado.json");
+  const servList = parsePrivadoFile("./test/data/privado.json");
   expect(servList.length).toEqual(1);
   expect(servList[0].data.length).toEqual(11);
   expect(servList[0].endpoints.length).toEqual(17);
@@ -2124,6 +2364,19 @@ test("parse swift deps files", () => {
     group: "",
     version: "1.0.3",
     properties: [{ name: "SrcFile", value: "./test/data/Package.resolved" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/Package.resolved"
+          }
+        ]
+      }
+    },
     repository: { url: "https://github.com/apple/swift-argument-parser" }
   });
   pkgList = parseSwiftResolved("./test/data/Package2.resolved");
@@ -2133,6 +2386,19 @@ test("parse swift deps files", () => {
     group: "",
     version: "1.2.2",
     properties: [{ name: "SrcFile", value: "./test/data/Package2.resolved" }],
+    evidence: {
+      identity: {
+        field: "purl",
+        confidence: 1,
+        methods: [
+          {
+            technique: "manifest-analysis",
+            confidence: 1,
+            value: "./test/data/Package2.resolved"
+          }
+        ]
+      }
+    },
     repository: { url: "https://github.com/apple/swift-argument-parser.git" }
   });
 });