@cyclonedx/cdxgen 9.6.0 → 9.6.1

package/README.md

@@ -376,7 +376,7 @@ cdxgen -t os
 
 This feature is powered by osquery which is [installed](https://github.com/cyclonedx/cdxgen-plugins-bin/blob/main/build.sh#L8) along with the binary plugins. cdxgen would opportunistically try to detect as many components, apps and extensions as possible using the [default queries](queries.json). The process would take several minutes and result in an SBoM file with thousands of components.
 
-## Generating component evidence
+## Generating SaaSBoM and component evidences
 
 See [evinse mode](./ADVANCED.md) in the advanced documentation.
 

package/binary.js

@@ -6,13 +6,12 @@ import { PackageURL } from "packageurl-js";
 import { DEBUG_MODE } from "./utils.js";
 
 import { fileURLToPath } from "node:url";
-import path from "node:path";
 
 let url = import.meta.url;
 if (!url.startsWith("file://")) {
   url = new URL(`file://${import.meta.url}`).toString();
 }
-const dirName = import.meta ? path.dirname(fileURLToPath(url)) : __dirname;
+const dirName = import.meta ? dirname(fileURLToPath(url)) : __dirname;
 
 const isWin = _platform() === "win32";
 
@@ -181,6 +180,7 @@ const OS_DISTRO_ALIAS = {
   "ubuntu-19.10": "eoan",
   "ubuntu-20.04": "focal",
   "ubuntu-20.10": "groovy",
+  "ubuntu-22.04": "jammy",
   "ubuntu-23.04": "lunar",
   "debian-14": "forky",
   "debian-14.5": "forky",
@@ -266,6 +266,7 @@ export const getCargoAuditableInfo = (src) => {
 
 export const getOSPackages = (src) => {
   const pkgList = [];
+  const dependenciesList = [];
   const allTypes = new Set();
   if (TRIVY_BIN) {
     let imageType = "image";
@@ -321,6 +322,54 @@ export const getOSPackages = (src) => {
           rmSync(tempDir, { recursive: true, force: true });
         }
       }
+      const osReleaseData = {};
+      // Let's try to read the os-release file
+      if (existsSync(join(src, "usr", "lib", "os-release"))) {
+        const osReleaseInfo = readFileSync(
+          join(src, "usr", "lib", "os-release"),
+          "utf-8"
+        );
+        if (osReleaseInfo) {
+          osReleaseInfo.split("\n").forEach((l) => {
+            if (l.includes("=")) {
+              const tmpA = l.split("=");
+              osReleaseData[tmpA[0]] = tmpA[1].replace(/"/g, "");
+            }
+          });
+        }
+      }
+      if (DEBUG_MODE) {
+        console.log(osReleaseData);
+      }
+      let distro_codename = osReleaseData["VERSION_CODENAME"] || "";
+      let distro_id = osReleaseData["ID"] || "";
+      let distro_id_like = osReleaseData["ID_LIKE"] || "";
+      let purl_type = "rpm";
+      switch (distro_id) {
+        case "debian":
+        case "ubuntu":
+        case "pop":
+          purl_type = "deb";
+          break;
+        default:
+          if (distro_id_like.includes("debian")) {
+            purl_type = "deb";
+          } else if (
+            distro_id_like.includes("rhel") ||
+            distro_id_like.includes("centos") ||
+            distro_id_like.includes("fedora")
+          ) {
+            purl_type = "rpm";
+          }
+          break;
+      }
+      if (osReleaseData["VERSION_ID"]) {
+        distro_id = distro_id + "-" + osReleaseData["VERSION_ID"];
+      }
+      const tmpDependencies = {};
+      (tmpBom.dependencies || []).forEach((d) => {
+        tmpDependencies[d.ref] = d.dependsOn;
+      });
       if (tmpBom && tmpBom.components) {
         for (const comp of tmpBom.components) {
           if (comp.purl) {
@@ -342,11 +391,11 @@ export const getOSPackages = (src) => {
             ) {
               continue;
             }
+            const origBomRef = comp["bom-ref"];
             // Fix the group
             let group = dirname(comp.name);
             const name = basename(comp.name);
             let purlObj = undefined;
-            let distro_codename = "";
             if (group === ".") {
               group = "";
             }
@@ -360,19 +409,23 @@ export const getOSPackages = (src) => {
                   comp.group = group;
                   purlObj.namespace = group;
                 }
+                if (distro_id && distro_id.length) {
+                  purlObj.qualifiers["distro"] = distro_id;
+                }
+                if (distro_codename && distro_codename.length) {
+                  purlObj.qualifiers["distro_name"] = distro_codename;
+                }
                 // Bug fix for mageia and oracle linux
+                // Type is being returned as none for ubuntu as well!
                 if (purlObj.type === "none") {
-                  purlObj["type"] = "rpm";
+                  purlObj["type"] = purl_type;
                   purlObj["namespace"] = "";
                   comp.group = "";
-                  distro_codename = undefined;
                   if (comp.purl && comp.purl.includes(".mga")) {
                     purlObj["namespace"] = "mageia";
                     comp.group = "mageia";
                     purlObj.qualifiers["distro"] = "mageia";
                     distro_codename = "mga";
-                  } else if (comp.purl && comp.purl.includes(".el8")) {
-                    purlObj.qualifiers["distro"] = "el8";
                   }
                   comp.purl = new PackageURL(
                     purlObj.type,
@@ -412,25 +465,25 @@ export const getOSPackages = (src) => {
                       );
                     }
                   }
-                  if (distro_codename !== "") {
-                    allTypes.add(distro_codename);
-                    allTypes.add(purlObj.namespace);
-                    purlObj.qualifiers["distro_name"] = distro_codename;
-                    comp.purl = new PackageURL(
-                      purlObj.type,
-                      purlObj.namespace,
-                      name,
-                      purlObj.version,
-                      purlObj.qualifiers,
-                      purlObj.subpath
-                    ).toString();
-                    comp["bom-ref"] = decodeURIComponent(comp.purl);
-                  }
+                }
+                if (distro_codename !== "") {
+                  allTypes.add(distro_codename);
+                  allTypes.add(purlObj.namespace);
+                  comp.purl = new PackageURL(
+                    purlObj.type,
+                    purlObj.namespace,
+                    name,
+                    purlObj.version,
+                    purlObj.qualifiers,
+                    purlObj.subpath
+                  ).toString();
+                  comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
               } catch (err) {
                 // continue regardless of error
               }
             }
+            // Fix licenses
             if (
               comp.licenses &&
               Array.isArray(comp.licenses) &&
@@ -438,6 +491,17 @@ export const getOSPackages = (src) => {
             ) {
               comp.licenses = [comp.licenses[0]];
             }
+            // Fix hashes
+            if (
+              comp.hashes &&
+              Array.isArray(comp.hashes) &&
+              comp.hashes.length
+            ) {
+              const hashContent = comp.hashes[0].content;
+              if (!hashContent || hashContent.length < 32) {
+                delete comp.hashes;
+              }
+            }
             const compProperties = comp.properties;
             let srcName = undefined;
             let srcVersion = undefined;
@@ -453,6 +517,14 @@ export const getOSPackages = (src) => {
             }
             delete comp.properties;
             pkgList.push(comp);
+            const compDeps = retrieveDependencies(
+              tmpDependencies,
+              origBomRef,
+              comp
+            );
+            if (compDeps) {
+              dependenciesList.push(compDeps);
+            }
             // If there is a source package defined include it as well
             if (srcName && srcVersion && srcName !== comp.name) {
               const newComp = Object.assign({}, comp);
@@ -474,10 +546,43 @@ export const getOSPackages = (src) => {
           }
         }
       }
-      return { osPackages: pkgList, allTypes: Array.from(allTypes) };
     }
   }
-  return { osPackages: pkgList, allTypes: Array.from(allTypes) };
+  return {
+    osPackages: pkgList,
+    dependenciesList,
+    allTypes: Array.from(allTypes)
+  };
+};
+
+const retrieveDependencies = (tmpDependencies, origBomRef, comp) => {
+  try {
+    const tmpDependsOn = tmpDependencies[origBomRef] || [];
+    const dependsOn = new Set();
+    tmpDependsOn.forEach((d) => {
+      try {
+        const compPurl = PackageURL.fromString(comp.purl);
+        const tmpPurl = PackageURL.fromString(d.replace("none", compPurl.type));
+        tmpPurl.type = compPurl.type;
+        tmpPurl.namespace = compPurl.namespace;
+        if (compPurl.qualifiers) {
+          if (compPurl.qualifiers.distro_name) {
+            tmpPurl.qualifiers.distro_name = compPurl.qualifiers.distro_name;
+          }
+          if (compPurl.qualifiers.distro) {
+            tmpPurl.qualifiers.distro = compPurl.qualifiers.distro;
+          }
+        }
+        dependsOn.add(decodeURIComponent(tmpPurl.toString()));
+      } catch (e) {
+        // ignore
+      }
+    });
+    return { ref: comp["bom-ref"], dependsOn: Array.from(dependsOn).sort() };
+  } catch (e) {
+    // ignore
+  }
+  return undefined;
 };
 
 export const executeOsQuery = (query) => {

package/index.js

@@ -372,7 +372,16 @@ function addMetadata(parentComponent = {}, format = "xml", options = {}) {
           // We cannot use purl or bom-ref here since they would not match
           // purl - could have application on one side and a different type
           // bom-ref could have qualifiers on one side
-          if (fullName !== parentFullName) {
+          // Ignore components that have the same name as the parent component but with latest as the version.
+          // These are default components created based on directory names
+          if (
+            fullName !== parentFullName &&
+            !(
+              (comp.name === parentComponent.name ||
+                comp.name === parentComponent.name + ":latest") &&
+              comp.version === "latest"
+            )
+          ) {
             if (!comp["bom-ref"]) {
               comp["bom-ref"] = `pkg:${comp.type}/${fullName}`;
             }
@@ -380,6 +389,7 @@ function addMetadata(parentComponent = {}, format = "xml", options = {}) {
           }
         }
       } // for
+      parentComponent.components = subComponents;
     }
     if (format === "json") {
       metadata.component = parentComponent;
@@ -2199,10 +2209,13 @@ export const createPythonBom = async (path, options) => {
   if (pdmLockFiles && pdmLockFiles.length) {
     poetryFiles = poetryFiles.concat(pdmLockFiles);
   }
-  const reqFiles = getAllFiles(
+  let reqFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "*requirements*.txt"
   );
+  reqFiles = reqFiles.filter(
+    (f) => !f.includes(join("mercurial", "helptext", "internals"))
+  );
   const reqDirFiles = getAllFiles(
     path,
     (options.multiProject ? "**/" : "") + "requirements/*.txt"
@@ -3910,7 +3923,7 @@ export const mergeDependencies = (
   for (const akey of Object.keys(deps_map)) {
     retlist.push({
       ref: akey,
-      dependsOn: Array.from(deps_map[akey])
+      dependsOn: Array.from(deps_map[akey]).sort()
     });
   }
   return retlist;
@@ -4003,7 +4016,7 @@ export const createMultiXBom = async (pathList, options) => {
     ["docker", "oci", "container"].includes(options.projectType) &&
     options.allLayersExplodedDir
   ) {
-    const { osPackages, allTypes } = getOSPackages(
+    const { osPackages, dependenciesList, allTypes } = getOSPackages(
       options.allLayersExplodedDir
     );
     if (DEBUG_MODE) {
@@ -4018,6 +4031,17 @@ export const createMultiXBom = async (pathList, options) => {
     componentsXmls = componentsXmls.concat(
       listComponents(options, {}, osPackages, "", "xml")
     );
+    if (dependenciesList && dependenciesList.length) {
+      dependencies = dependencies.concat(dependenciesList);
+    }
+    if (parentComponent && Object.keys(parentComponent).length) {
+      // Make the parent oci image depend on all os components
+      const parentDependsOn = new Set(osPackages.map((p) => p["bom-ref"]));
+      dependencies.splice(0, 0, {
+        ref: parentComponent["bom-ref"],
+        dependsOn: Array.from(parentDependsOn).sort()
+      });
+    }
   }
   if (options.projectType === "os" && options.bomData) {
     bomData = options.bomData;
@@ -4409,7 +4433,12 @@ export const createMultiXBom = async (pathList, options) => {
     // Jar scanning is enabled by default
     // See #330
     bomData = createJarBom(path, options);
-    if (bomData && bomData.bomJson && bomData.bomJson.components) {
+    if (
+      bomData &&
+      bomData.bomJson &&
+      bomData.bomJson.components &&
+      bomData.bomJson.components.length
+    ) {
       if (DEBUG_MODE) {
         console.log(
           `Found ${bomData.bomJson.components.length} jar packages at ${path}`
@@ -4430,7 +4459,12 @@ export const createMultiXBom = async (pathList, options) => {
   } // for
   if (options.lastWorkingDir && options.lastWorkingDir !== "") {
     bomData = createJarBom(options.lastWorkingDir, options);
-    if (bomData && bomData.bomJson && bomData.bomJson.components) {
+    if (
+      bomData &&
+      bomData.bomJson &&
+      bomData.bomJson.components &&
+      bomData.bomJson.components.length
+    ) {
       if (DEBUG_MODE) {
         console.log(
           `Found ${bomData.bomJson.components.length} jar packages at ${options.lastWorkingDir}`
@@ -4818,8 +4852,26 @@ export const createBom = async (path, options) => {
             purl: "pkg:oci/" + inspectData.RepoDigests[0],
             _integrity: inspectData.RepoDigests[0].replace("sha256:", "sha256-")
           };
+          options.parentComponent["bom-ref"] = options.parentComponent.purl;
         }
+      } else if (inspectData.Id) {
+        options.parentComponent = {
+          name: inspectData.RepoDigests[0].split("@")[0],
+          version: inspectData.RepoDigests[0]
+            .split("@")[1]
+            .replace("sha256:", ""),
+          type: "container",
+          purl: "pkg:oci/" + inspectData.RepoDigests[0],
+          _integrity: inspectData.RepoDigests[0].replace("sha256:", "sha256-")
+        };
+        options.parentComponent["bom-ref"] = options.parentComponent.purl;
       }
+    } else {
+      options.parentComponent = createDefaultParentComponent(
+        path,
+        "container",
+        options
+      );
     }
     // Pass the entire export data about the image layers
     options.exportData = exportData;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.6.0",
+  "version": "9.6.1",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -53,8 +53,8 @@
     "url": "https://github.com/cyclonedx/cdxgen/issues"
   },
   "dependencies": {
-    "@babel/parser": "^7.22.10",
-    "@babel/traverse": "^7.22.10",
+    "@babel/parser": "^7.22.11",
+    "@babel/traverse": "^7.22.11",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "cheerio": "^1.0.0-rc.12",
@@ -68,7 +68,7 @@
     "node-stream-zip": "^1.15.0",
     "packageurl-js": "^1.0.2",
     "prettify-xml": "^1.2.0",
-    "properties-reader": "^2.2.0",
+    "properties-reader": "^2.3.0",
     "semver": "^7.5.3",
     "ssri": "^10.0.4",
     "table": "^6.8.1",
@@ -80,7 +80,7 @@
   },
   "optionalDependencies": {
     "@appthreat/atom": "^1.1.4",
-    "@cyclonedx/cdxgen-plugins-bin": "^1.2.0",
+    "@cyclonedx/cdxgen-plugins-bin": "^1.3.0",
     "body-parser": "^1.20.2",
     "compression": "^1.7.4",
     "connect": "^3.7.0",
@@ -95,8 +95,8 @@
   ],
   "devDependencies": {
     "caxa": "^3.0.1",
-    "eslint": "^8.47.0",
-    "jest": "^29.5.0",
-    "prettier": "3.0.1"
+    "eslint": "^8.48.0",
+    "jest": "^29.6.4",
+    "prettier": "3.0.2"
   }
 }