@pnpm/deps.compliance.sbom 1100.4.0 → 1100.4.1

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @pnpm/deps.compliance.sbom
 
+## 1100.4.1
+
+### Patch Changes
+
+- An `integrity` recorded on a git dependency's resolution (`resolution: {type: git, repo, commit, integrity: sha512-…}`) is no longer treated as a checksum. pnpm never verifies a git checkout against such a hash — the commit pins the content — so it is now dropped when the lockfile is rewritten, and `pnpm sbom` no longer republishes it as a CycloneDX/SPDX checksum. Lockfiles carrying one also load again instead of failing with `ERR_PNPM_BROKEN_LOCKFILE` [#13042](https://github.com/pnpm/pnpm/issues/13042).
+
+  `pnpm sbom` now also publishes the checksum of a `type: binary` runtime archive, which pnpm does verify.
+
+- `pnpm sbom` no longer emits components for optional platform-specific dependencies that cannot be installed on the current platform (for example, the native `@rolldown/binding-*` variants for other operating systems). Such packages are present in the lockfile but are never downloaded, so their license (and other metadata) could not be resolved and they appeared in the SBOM without one. `pnpm sbom --lockfile-only` still describes the whole lockfile graph, which is platform-independent by design.
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.1.3
+  - @pnpm/error@1100.1.2
+  - @pnpm/lockfile.utils@1101.1.0
+  - @pnpm/pkg-manifest.reader@1100.0.16
+  - @pnpm/store.index@1100.2.4
+  - @pnpm/store.pkg-finder@1100.0.29
+
 ## 1100.4.0
 
 ### Minor Changes

package/lib/collectComponents.d.ts

@@ -1,6 +1,6 @@
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { Resolution } from '@pnpm/resolving.resolver-base';
-import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
+import type { DependenciesField, ProjectId, Registries, SupportedArchitectures } from '@pnpm/types';
 import type { SbomComponentType, SbomResult } from './types.js';
 export interface WorkspacePackageInfo {
     name: string;
@@ -27,6 +27,7 @@ export interface CollectSbomComponentsOptions {
     namedRegistries?: Record<string, string>;
     lockfileDir: string;
     includedImporterIds?: ProjectId[];
+    supportedArchitectures?: SupportedArchitectures;
     lockfileOnly?: boolean;
     storeDir?: string;
     virtualStoreDirMaxLength?: number;

package/lib/collectComponents.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { checkPackageInstallability } from '@pnpm/config.package-is-installable';
 import { PnpmError } from '@pnpm/error';
 import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
 import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
@@ -132,6 +133,23 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         const { name, version, nonSemverVersion, registryName } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
         if (!name || !version)
             return;
+        // An optional dependency for another platform is in the lockfile but was
+        // never fetched, so the store holds no metadata to describe it with.
+        // `checkPackageInstallability`, not `packageIsInstallable`: the latter
+        // reports every skip through the install loggers, which reading a
+        // lockfile must not do.
+        if (!opts.lockfileOnly && pkgSnapshot.optional === true && checkPackageInstallability(pkgSnapshot.id ?? depPath, {
+            name,
+            version,
+            cpu: pkgSnapshot.cpu,
+            os: pkgSnapshot.os,
+            libc: pkgSnapshot.libc,
+        }, {
+            optional: true,
+            supportedArchitectures: opts.supportedArchitectures,
+        }) != null) {
+            return;
+        }
         // Resolve the alias before the purl is built. An unknown alias would
         // otherwise yield an unqualified purl that collides with the same
         // package from the default registry, and the `componentsMap.has(purl)`
@@ -153,7 +171,7 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         relationships.push({ from: parentPurl, to: purl });
         if (componentsMap.has(purl))
             return;
-        const integrity = pkgSnapshot.resolution.integrity;
+        const integrity = verifiedIntegrity(pkgSnapshot.resolution);
         const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, { registries: opts.registries, namedRegistries: opts.namedRegistries });
         const tarballUrl = resolution.tarball ?? gitDownloadUrl(resolution);
         let metadata = {};
@@ -225,4 +243,22 @@ export function resolveWorkspaceDeps(lockfile, importerIds, include) {
     }
     return { links, additionalImporterIds };
 }
+/**
+ * The resolution's integrity, but only where pnpm verifies the downloaded
+ * bytes against it: the tarball/registry hash and a `type: binary` runtime
+ * archive's. Nothing checks a git checkout against a hash, so an `integrity`
+ * recorded on one is not a checksum and is never published as one.
+ *
+ * Read from an untyped lockfile, so the shape is probed rather than trusted:
+ * reading a checksum out of a malformed resolution yields nothing instead of
+ * throwing, and a non-string integrity never reaches `ssri.parse` downstream.
+ * (A malformed resolution still fails the walk further along, in
+ * `pkgSnapshotToResolution` — this only keeps the checksum lookup total.)
+ */
+function verifiedIntegrity(resolution) {
+    const { type, integrity } = (resolution ?? {});
+    if (typeof integrity !== 'string')
+        return undefined;
+    return (type === undefined || type === 'binary') ? integrity : undefined;
+}
 //# sourceMappingURL=collectComponents.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.4.0",
+  "version": "1100.4.1",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -30,19 +30,20 @@
     "!*.map"
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "10.1.0",
+    "@cyclonedx/cyclonedx-library": "10.1.1",
     "@pnpm/config.normalize-registries": "1100.1.0",
+    "@pnpm/config.package-is-installable": "1100.1.3",
     "@pnpm/constants": "1101.0.0",
     "@pnpm/deps.compliance.license-resolver": "1100.0.1",
-    "@pnpm/error": "1100.1.1",
+    "@pnpm/error": "1100.1.2",
     "@pnpm/lockfile.detect-dep-types": "1100.0.19",
     "@pnpm/lockfile.types": "1100.0.19",
-    "@pnpm/lockfile.utils": "1101.0.0",
+    "@pnpm/lockfile.utils": "1101.1.0",
     "@pnpm/lockfile.walker": "1100.0.19",
-    "@pnpm/pkg-manifest.reader": "1100.0.15",
+    "@pnpm/pkg-manifest.reader": "1100.0.16",
     "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.index": "1100.2.3",
-    "@pnpm/store.pkg-finder": "1100.0.28",
+    "@pnpm/store.index": "1100.2.4",
+    "@pnpm/store.pkg-finder": "1100.0.29",
     "@pnpm/types": "1101.9.0",
     "p-limit": "^7.3.1",
     "ssri": "13.0.1"
@@ -52,9 +53,9 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.compliance.sbom": "1100.4.0",
+    "@pnpm/deps.compliance.sbom": "1100.4.1",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.18",
+    "@pnpm/store.cafs": "1100.1.19",
     "@types/ssri": "^7.1.5"
   },
   "engines": {