@cyclonedx/cdxgen 9.2.0 → 9.2.2

package/README.md

@@ -118,7 +118,9 @@ Options:
   -o, --output                 Output file for bom.xml or bom.json. Default bom.
                                json
   -t, --type                   Project type
-  -r, --recurse                Recurse mode suitable for mono-repos    [boolean]
+  -r, --recurse                Recurse mode suitable for mono-repos. Defaults to
+                                true. Pass --no-recurse to disable.
+                                                       [boolean] [default: true]
   -p, --print                  Print the SBoM as a table with tree. Defaults to
                                true if output file is not specified with -o
                                                                        [boolean]
@@ -151,13 +153,16 @@ Options:
                                 and oci scans. Use --no-install-deps to disable
                                this feature.           [boolean] [default: true]
       --validate               Validate the generated SBoM using json schema. De
-                               faults to true.         [boolean] [default: true]
+                               faults to true. Pass --no-validate to disable.
+                                                       [boolean] [default: true]
       --spec-version           CycloneDX Specification version to use. Defaults
-                               to 1.5                           [default: "1.5"]
+                               to 1.5                             [default: 1.5]
       --version                Show version number                     [boolean]
   -h                           Show help                               [boolean]
 ```
 
+All boolean arguments accepts `--no` prefix to toggle the behavior.
+
 ## Example
 
 Minimal example.

package/bin/cdxgen.js

@@ -34,7 +34,9 @@ const args = yargs(hideBin(process.argv))
   .option("recurse", {
     alias: "r",
     type: "boolean",
-    description: "Recurse mode suitable for mono-repos"
+    default: true,
+    description:
+      "Recurse mode suitable for mono-repos. Defaults to true. Pass --no-recurse to disable."
   })
   .option("print", {
     alias: "p",
@@ -112,11 +114,11 @@ const args = yargs(hideBin(process.argv))
     type: "boolean",
     default: true,
     description:
-      "Validate the generated SBoM using json schema. Defaults to true."
+      "Validate the generated SBoM using json schema. Defaults to true. Pass --no-validate to disable."
   })
   .option("spec-version", {
     description: "CycloneDX Specification version to use. Defaults to 1.5",
-    default: "1.5"
+    default: 1.5
   })
   .scriptName("cdxgen")
   .version()

package/index.js

@@ -1312,6 +1312,7 @@ export const createJavaBom = async (path, options) => {
         // Bug #317 fix
         parentComponent.components = allProjects.flatMap((s) => {
           delete s.qualifiers;
+          delete s.evidence;
           return s;
         });
         dependencies.push({
@@ -3787,6 +3788,7 @@ export const createMultiXBom = async (pathList, options) => {
       ) {
         parentSubComponents.push(bomData.parentComponent);
       }
+      // Retain metadata.component.components
       if (
         bomData.parentComponent.components &&
         bomData.parentComponent.components.length
@@ -3819,6 +3821,15 @@ export const createMultiXBom = async (pathList, options) => {
       ) {
         parentSubComponents.push(bomData.parentComponent);
       }
+      // Retain metadata.component.components
+      if (
+        bomData.parentComponent.components &&
+        bomData.parentComponent.components.length
+      ) {
+        parentSubComponents = parentSubComponents.concat(
+          bomData.parentComponent.components
+        );
+      }
       componentsXmls = componentsXmls.concat(
         listComponents(options, {}, bomData.bomJson.components, "maven", "xml")
       );
@@ -4581,23 +4592,18 @@ export const createBom = async (path, options) => {
     case "mvn":
     case "maven":
     case "sbt":
-      options.multiProject = true;
       return await createJavaBom(path, options);
     case "jar":
-      options.multiProject = true;
       return createJarBom(path, options);
     case "gradle-index":
     case "gradle-cache":
-      options.multiProject = true;
       return createJarBom(GRADLE_CACHE_DIR, options);
     case "sbt-index":
     case "sbt-cache":
-      options.multiProject = true;
       return createJarBom(SBT_CACHE_DIR, options);
     case "maven-index":
     case "maven-cache":
     case "maven-repo":
-      options.multiProject = true;
       return createJarBom(join(homedir(), ".m2", "repository"), options);
     case "nodejs":
     case "js":
@@ -4605,78 +4611,61 @@ export const createBom = async (path, options) => {
     case "typescript":
     case "ts":
     case "tsx":
-      options.multiProject = true;
       return await createNodejsBom(path, options);
     case "python":
     case "py":
-      options.multiProject = true;
       return await createPythonBom(path, options);
     case "go":
     case "golang":
-      options.multiProject = true;
       return await createGoBom(path, options);
     case "rust":
     case "rust-lang":
-      options.multiProject = true;
       return await createRustBom(path, options);
     case "php":
-      options.multiProject = true;
       return createPHPBom(path, options);
     case "ruby":
-      options.multiProject = true;
       return await createRubyBom(path, options);
     case "csharp":
     case "netcore":
     case "dotnet":
-      options.multiProject = true;
       return await createCsharpBom(path, options);
     case "dart":
     case "flutter":
     case "pub":
-      options.multiProject = true;
       return await createDartBom(path, options);
     case "haskell":
     case "hackage":
     case "cabal":
-      options.multiProject = true;
       return createHaskellBom(path, options);
     case "elixir":
     case "hex":
     case "mix":
-      options.multiProject = true;
       return createElixirBom(path, options);
     case "c":
     case "cpp":
     case "c++":
     case "conan":
-      options.multiProject = true;
       return createCppBom(path, options);
     case "clojure":
     case "edn":
     case "clj":
     case "leiningen":
-      options.multiProject = true;
       return createClojureBom(path, options);
     case "github":
     case "actions":
-      options.multiProject = true;
       return createGitHubBom(path, options);
     case "os":
     case "osquery":
     case "windows":
     case "linux":
-      options.multiProject = true;
       return await createOSBom(path, options);
     case "jenkins":
-      options.multiProject = true;
       return await createJenkinsBom(path, options);
     case "helm":
     case "charts":
-      options.multiProject = true;
       return createHelmBom(path, options);
     case "helm-index":
     case "helm-repo":
-      options.multiProject = true;
       return createHelmBom(
         join(homedir(), ".cache", "helm", "repository"),
         options
@@ -4691,13 +4680,10 @@ export const createBom = async (path, options) => {
     case "kubernetes":
     case "openshift":
     case "yaml-manifest":
-      options.multiProject = true;
       return await createContainerSpecLikeBom(path, options);
     case "cloudbuild":
-      options.multiProject = true;
       return createCloudBuildBom(path, options);
     case "swift":
-      options.multiProject = true;
       return createSwiftBom(path, options);
     default:
       // In recurse mode return multi-language Bom

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.2.0",
+  "version": "9.2.2",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",

package/utils.js

@@ -443,10 +443,22 @@ export const parsePkgJson = async (pkgJsonFile) => {
     try {
       const pkgData = JSON.parse(readFileSync(pkgJsonFile, "utf8"));
       const pkgIdentifier = parsePackageJsonName(pkgData.name);
+      const name = pkgIdentifier.fullName || pkgData.name;
+      const group = pkgIdentifier.scope || "";
+      const purl = new PackageURL(
+        "npm",
+        encodeForPurl(group),
+        encodeForPurl(name),
+        pkgData.version,
+        null,
+        null
+      ).toString();
       pkgList.push({
-        name: pkgIdentifier.fullName || pkgData.name,
-        group: pkgIdentifier.scope || "",
+        name,
+        group,
         version: pkgData.version,
+        purl,
+        "bom-ref": decodeURIComponent(purl),
         properties: [
           {
             name: "SrcFile",
@@ -1740,7 +1752,7 @@ export const executeGradleProperties = function (dir, rootPath, subProject) {
   if (subProject && subProject.match(/:/g).length >= 2) {
     return defaultProps;
   }
-  let gradlePropertiesArgs = [
+  const gradlePropertiesArgs = [
     subProject ? `${subProject}:properties` : "properties",
     "-q",
     "--console",

package/validator.js

@@ -68,11 +68,16 @@ export const validateMetadata = (bomJson) => {
       warningsList.push("metadata.component is missing.");
     }
     if (bomJson.metadata.component) {
+      // Do we have a purl and bom-ref for metadata.component
+      if (!bomJson.metadata.component.purl) {
+        warningsList.push(`purl is missing for metadata.component`);
+      }
+      if (!bomJson.metadata.component["bom-ref"]) {
+        warningsList.push(`bom-ref is missing for metadata.component`);
+      }
       // Do we have a version for metadata.component
       if (!bomJson.metadata.component.version) {
-        warningsList.push(
-          `Version is missing for metadata.component with ref ${bomJson.metadata.component["bom-ref"]}`
-        );
+        warningsList.push(`Version is missing for metadata.component`);
       }
       // Is the same component getting repeated inside the components block
       if (