@cyclonedx/cdxgen 9.7.5 → 9.8.0

package/README.md

@@ -31,7 +31,7 @@ A typical application might comprise of several repos, components, and libraries
 | dart                            | pubspec.lock, pubspec.yaml                                                                                        | Only for pubspec.lock                                                                             |
 | haskell                         | cabal.project.freeze                                                                                              | Yes                                                                                               |
 | elixir                          | mix.lock                                                                                                          | Yes                                                                                               |
-| c/c++                           | conan.lock, conanfile.txt, \*.cmake, CMakeLists.txt, meson.build                                                  | Yes only for conan.lock. Best effort basis for cmake without version numbers.                     |
+| c/c++/Objective C/c++11         | conan.lock, conanfile.txt, \*.cmake, CMakeLists.txt, meson.build, codebase without package managers!              | Yes only for conan.lock. Best effort basis for cmake without version numbers.                     |
 | clojure                         | Clojure CLI (deps.edn), Leiningen (project.clj)                                                                   | Yes unless the files are parsed manually due to lack of clojure cli or leiningen command          |
 | swift                           | Package.resolved, Package.swift (swiftpm)                                                                         | Yes                                                                                               |
 | docker / oci image              | All supported languages. Linux OS packages with plugins [4]                                                       | Best effort based on lock files                                                                   |
@@ -147,6 +147,7 @@ $ cdxgen -h
       --project-version        Dependency track project version    [default: ""]
       --project-id             Dependency track project id. Either provide the i
                                d or the project name and version together
+      --parent-project-id      Dependency track parent project id
       --required-only          Include only the packages with required scope on
                                the SBoM.                               [boolean]
       --fail-on-error          Fail if any dependency extractor fails. [boolean]

package/bin/cdxgen.js

@@ -73,6 +73,9 @@ const args = yargs(hideBin(process.argv))
     description:
       "Dependency track project id. Either provide the id or the project name and version together"
   })
+  .option("parent-project-id", {
+    description: "Dependency track parent project id"
+  })
   .option("required-only", {
     type: "boolean",
     description: "Include only the packages with required scope on the SBoM."

package/index.js

@@ -97,7 +97,9 @@ import {
   addEvidenceForImports,
   parseSbtTree,
   parseCmakeLikeFile,
-  getCppModules
+  getCppModules,
+  FETCH_LICENSE,
+  getNugetMetadata
 } from "./utils.js";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -3913,39 +3915,17 @@ export const createRubyBom = async (path, options) => {
   return {};
 };
 
-const removeDuplicates = (pkgList, dependencies) => {
-  const uniqueItems = {};
-  const uniqueRefs = new Set();
-  const newPkgList = [];
-  const newDependencies = [];
-
-  for (const item of pkgList) {
-    if (item) {
-      const { name, version } = item;
-      const key = `${name}-${version}`;
-      if (!uniqueItems[key] && key) {
-        uniqueItems[key] = item;
-        newPkgList.push(item);
-      }
-    }
-  }
-
-  for (const item of dependencies) {
-    const { ref } = item;
-    if (!uniqueRefs.has(ref)) {
-      uniqueRefs.add(ref);
-      newDependencies.push(item);
-    }
-  }
-  return [newPkgList, newDependencies];
-};
 /**
  * Function to create bom string for csharp projects
  *
  * @param path to the project
  * @param options Parse options from the cli
  */
-export const createCsharpBom = async (path, options) => {
+export const createCsharpBom = async (
+  path,
+  options,
+  parentComponent = undefined
+) => {
   let manifestFiles = [];
   let pkgData = undefined;
   let dependencies = [];
@@ -3970,7 +3950,7 @@ export const createCsharpBom = async (path, options) => {
     (options.multiProject ? "**/" : "") + "*.nupkg"
   );
   let pkgList = [];
-  if (nupkgFiles.length) {
+  if (nupkgFiles.length && projAssetsFiles.length === 0) {
     manifestFiles = manifestFiles.concat(nupkgFiles);
     for (const nf of nupkgFiles) {
       if (DEBUG_MODE) {
@@ -4048,17 +4028,27 @@ export const createCsharpBom = async (path, options) => {
       }
     }
   }
+  if (!parentComponent) {
+    parentComponent = createDefaultParentComponent(path, options.type, options);
+  }
   if (pkgList.length) {
-    const uniquePkg = removeDuplicates(pkgList, dependencies);
-    dependencies = uniquePkg[1];
-    pkgList = uniquePkg[0];
-    return buildBomNSData(options, pkgList, "nuget", {
-      src: path,
-      filename: manifestFiles.join(", "),
-      dependencies
-    });
+    dependencies = mergeDependencies(dependencies, [], parentComponent);
+    pkgList = trimComponents(pkgList, "json");
   }
-  return {};
+  if (FETCH_LICENSE) {
+    const retMap = await getNugetMetadata(pkgList, dependencies);
+    if (retMap.dependencies && retMap.dependencies.length) {
+      dependencies = dependencies.concat(retMap.dependencies);
+    }
+    dependencies = mergeDependencies(dependencies, [], parentComponent);
+    pkgList = trimComponents(pkgList, "json");
+  }
+  return buildBomNSData(options, pkgList, "nuget", {
+    src: path,
+    filename: manifestFiles.join(", "),
+    dependencies,
+    parentComponent
+  });
 };
 
 export const mergeDependencies = (
@@ -4404,7 +4394,7 @@ export const createMultiXBom = async (pathList, options) => {
         listComponents(options, {}, bomData.bomJson.components, "gem", "xml")
       );
     }
-    bomData = await createCsharpBom(path, options);
+    bomData = await createCsharpBom(path, options, parentComponent);
     if (bomData && bomData.bomJson && bomData.bomJson.components) {
       if (DEBUG_MODE) {
         console.log(
@@ -5229,6 +5219,9 @@ export async function submitBom(args, bomContents) {
     autoCreate: "true",
     bom: encodedBomContents
   };
+  if (typeof args.parentProjectId !== "undefined") {
+    bomPayload.parentUUID = args.parentProjectId;
+  }
   if (DEBUG_MODE) {
     console.log(
       "Submitting BOM to",
@@ -5265,13 +5258,7 @@ export async function submitBom(args, bomContents) {
             "Content-Type": "application/json",
             "user-agent": `@CycloneDX/cdxgen ${_version}`
           },
-          json: {
-            project: args.projectId,
-            projectName: args.projectName,
-            projectVersion: projectVersion,
-            autoCreate: "true",
-            bom: encodedBomContents
-          },
+          json: bomPayload,
           responseType: "json"
         }).json();
       } catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyclonedx/cdxgen",
-  "version": "9.7.5",
+  "version": "9.8.0",
   "description": "Creates CycloneDX Software Bill-of-Materials (SBOM) from source or container image",
   "homepage": "http://github.com/cyclonedx/cdxgen",
   "author": "Prabhu Subramanian <prabhu@appthreat.com>",
@@ -55,7 +55,8 @@
   },
   "dependencies": {
     "@babel/parser": "^7.22.16",
-    "@babel/traverse": "^7.22.17",
+    "@babel/traverse": "^7.22.19",
+    "@npmcli/arborist": "^7.1.0",
     "ajv": "^8.12.0",
     "ajv-formats": "^2.1.1",
     "cheerio": "^1.0.0-rc.12",
@@ -74,13 +75,13 @@
     "ssri": "^10.0.4",
     "table": "^6.8.1",
     "tar": "^6.2.0",
-    "uuid": "^9.0.0",
+    "uuid": "^9.0.1",
     "xml-js": "^1.6.11",
     "xmlbuilder": "^15.1.1",
     "yargs": "^17.7.2"
   },
   "optionalDependencies": {
-    "@appthreat/atom": "^1.1.15",
+    "@appthreat/atom": "^1.2.0",
     "@cyclonedx/cdxgen-plugins-bin": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-arm64": "^1.4.0",
     "@cyclonedx/cdxgen-plugins-bin-ppc64": "^1.4.0",
@@ -98,8 +99,8 @@
   ],
   "devDependencies": {
     "caxa": "^3.0.1",
-    "eslint": "^8.48.0",
-    "jest": "^29.6.4",
+    "eslint": "^8.49.0",
+    "jest": "^29.7.0",
     "prettier": "3.0.3"
   }
 }