@exodus/stasis 1.0.0-beta.6 → 1.0.0-beta.7

package/README.md

@@ -83,7 +83,7 @@ _Lockfiles (npm/pnpm/etc) not mentioned: they are like the "tarball" column, but
 | `stasis audit --why-deep app.stasis.code.br` | like `--why`, but keep those longer chains too (every path, shared tails collapsed to `a -> b -> ... -> d`) |
 | `stasis audit --why-full app.stasis.code.br` | like `--why`, but spell every chain out with no `...` collapse (combine with `--why-deep` for the complete raw listing) |
 | `stasis audit --reason=run app.stasis.code.br` | show only advisories related to one consumer (`run`); with `--why`, keep only that consumer's chains |
-| `GITHUB_TOKEN=... stasis audit --repo-advisories stasis.lock.json` | also ask each dependency's GitHub repository for the advisories its maintainers published there, which npm's database has only once GitHub reviews them; needs a GitHub token in `GITHUB_TOKEN`. Each package's repository is the one its artifact records (its `package.json`'s, see `repo` in [file formats](https://github.com/ExodusOSS/stasis/blob/main/doc/file-formats.md)), else it is looked up in npm's registry, Packagist or crates.io and cached for a month in the user cache directory (`$XDG_CACHE_HOME/stasis`, `~/.cache/stasis`, `~/Library/Caches/stasis` on macOS, `%LOCALAPPDATA%\stasis\Cache` on Windows) |
+| `GITHUB_TOKEN=... stasis audit --repo-advisories stasis.lock.json` | also ask each dependency's GitHub repository for the advisories its maintainers published there, which npm's database has only once GitHub reviews them; needs a GitHub token in `GITHUB_TOKEN`. Each package's repository is the one its artifact records (its `package.json`'s, see `repo` in [file formats](https://github.com/ExodusOSS/stasis/blob/main/doc/file-formats.md)), else, for an npm package a bundle records none for but carries the `package.json` of (one built before the field), the one that names, else it is looked up in npm's registry, Packagist or crates.io and cached for a month in the user cache directory (`$XDG_CACHE_HOME/stasis`, `~/.cache/stasis`, `~/Library/Caches/stasis` on macOS, `%LOCALAPPDATA%\stasis\Cache` on Windows) |
 | `stasis sbom --format=spdx stasis.lock.json` | export an SPDX SBOM for a lockfile or bundle |
 | `stasis sbom --format=cyclonedx app.stasis.code.br` | export a CycloneDX SBOM for a lockfile or bundle |
 

package/bin/stasis.js

@@ -115,8 +115,9 @@ function usage(prefix = '') {
   --reason=consumer shows only advisories related to that consumer, and with --why only its chains;
   --repo-advisories also asks each package's GitHub repository for the advisories its maintainers
   published there, before GitHub reviews them into the databases above; it needs a token in
-  GITHUB_TOKEN, and asks the repository each package's artifact records, else looks one up and
-  caches it for a month in the user cache dir, e.g. ~/.cache/stasis)
+  GITHUB_TOKEN, and asks the repository each package's artifact records, else the one the
+  package.json a bundle carries of an npm package names, else looks one up and caches it for a
+  month in the user cache dir, e.g. ~/.cache/stasis)
  stasis sbom --format=(spdx|cyclonedx) [--output=(path|-)] path/to/(lockfile|bundle) ...
  (streams to stdout by default; --output=- is explicit stdout)
 `.trim())

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/stasis",
-  "version": "1.0.0-beta.6",
+  "version": "1.0.0-beta.7",
   "description": "File-level source bundles and lockfiles",
   "type": "module",
   "exports": {
@@ -93,8 +93,8 @@
   "homepage": "https://github.com/PreventiveMeasures/stasis#readme",
   "dependencies": {
     "@exodus/bytes": "^1.16.0",
-    "@exodus/stasis-core": "1.0.0-beta.6",
-    "@exodus/stasis-plugins": "1.0.0-beta.6",
+    "@exodus/stasis-core": "1.0.0-beta.7",
+    "@exodus/stasis-plugins": "1.0.0-beta.7",
     "@preventive/archive": "1.0.0-beta.4",
     "@preventive/deptree": "1.0.0-alpha.8",
     "@preventive/lockfile": "1.0.0-alpha.7",

package/src/audit.js

@@ -1,8 +1,9 @@
+import { packageRepo } from '@exodus/stasis-core/bundle-util'
 import { dependencyEcosystem, moduleFileKey, sameGithub } from '@exodus/stasis-core/util'
 import { advisories } from '@preventive/upstream/advisories.js'
 import { compareVersions, valid } from '@preventive/upstream/semver.js'
 import { isEvidenceFile } from './audit-corrections.js'
-import { parseFile } from './parse.js'
+import { parseFile, parseFileWithKind } from './parse.js'
 import { collectWhy, invertReason } from './why.js'
 
 // Where advisories() asks for each ecosystem's advisories: npm's registry; OSV for crates (those
@@ -57,21 +58,37 @@ function unaudited({ ecosystem, version }) {
 // why.js apply the same evidence rule per file/edge there.
 //
 // A package's `github` is the repository its artifact records for it (its package.json's), where
-// one does; a GitHub repo is its own, and has none.
+// one does; else, for an npm package a bundle carries the package.json of (one built before builds
+// recorded `repo`), the one that names, read by the rule builds record it by. A GitHub repo is its
+// own, and has none.
 export function collectPackagesFromFile(file) {
   const out = []
-  for (const [dir, { name, version, ecosystem: tagged, repo, files }] of parseFile(file).modules) {
+  const { kind, artifact } = parseFileWithKind(file)
+  for (const [dir, { name, version, ecosystem: tagged, repo, files }] of artifact.modules) {
     const ecosystem = dependencyEcosystem(dir, tagged)
     // First-party code is never sent to a public registry (leaks names, adds noise).
     if (ecosystem === undefined) continue
     if (!name || !version) continue
     if (!Object.keys(files).some((rel) => isEvidenceFile(name, version, rel, ecosystem))) continue
-    const github = ecosystem === 'github' ? undefined : repo?.github
+    let github = ecosystem === 'github' ? undefined : repo?.github
+    if (github === undefined && ecosystem === 'npm' && kind === 'bundle') github = manifestRepo(files['package.json'])
     out.push({ ecosystem, name, version: versionOf(ecosystem, version), ...(github === undefined ? {} : { github }) })
   }
   return out
 }
 
+// The GitHub repository a bundled package.json's text names (packageRepo), or undefined where it
+// names none or doesn't parse. Read as Node reads one, past a byte order mark (packageJSONText),
+// which a bundle keeps in the text. A lockfile holds the file's digest alone, never asked here.
+function manifestRepo(text) {
+  if (typeof text !== 'string') return undefined
+  try {
+    return packageRepo(JSON.parse(text.replace(/^\uFEFF/u, '')))?.github
+  } catch {
+    return undefined
+  }
+}
+
 // Versions in semver's order where both are semver's, else as numbers in text compare.
 const byNumbers = new Intl.Collator('en', { numeric: true }).compare
 const byVersion = (a, b) => (valid(a) && valid(b) ? compareVersions(a, b) : byNumbers(a, b))