@pnpm/deps.compliance.sbom 1100.4.0 → 1101.0.0

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @pnpm/deps.compliance.sbom
 
+## 1101.0.0
+
+### Major Changes
+
+- The three registry lookups are now named for what they are keyed by, so that none of them is called `registries` — a name the `registries` setting itself has taken:
+
+  | before | after |
+  |---|---|
+  | `Config.registries` | `Config.registriesByScope` |
+  | `Config.namedRegistries` | `Config.registriesByPrefix` |
+  | `Config.registryOptions` | `Config.registryOptionsByUrl` |
+
+  The same rename applies to the `RegistryContext` fields, the `Registries` and `NamedRegistries` types (now `RegistriesByScope` and `RegistriesByPrefix`), `normalizeRegistries` / `normalizeNamedRegistries` (now `normalizeRegistriesByScope` / `normalizeRegistriesByPrefix`), and the `BUILTIN_NAMED_REGISTRIES` constant (now `BUILTIN_REGISTRIES_BY_PREFIX`).
+
+  This is an internal rename: no setting, error code, lockfile field, or `.pnpmfile.cjs` hook field changes. A `preResolution` hook still reads `ctx.registries`, which is the name pacquet passes as well. The `registries` and `namedRegistries` settings are read under the names users write them.
+
+  The pnpr resolve request sends `registriesByPrefix` where it sent `namedRegistries`. A pnpr server and its clients must be on matching versions, which is already the case for an experimental server.
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.normalize-registries@1101.0.0
+  - @pnpm/config.package-is-installable@1100.1.4
+  - @pnpm/constants@1102.0.0
+  - @pnpm/error@1100.1.3
+  - @pnpm/lockfile.detect-dep-types@1100.0.20
+  - @pnpm/lockfile.types@1100.0.20
+  - @pnpm/lockfile.utils@1102.0.0
+  - @pnpm/lockfile.walker@1100.0.20
+  - @pnpm/pkg-manifest.reader@1100.0.17
+  - @pnpm/resolving.resolver-base@1101.1.1
+  - @pnpm/store.index@1100.2.5
+  - @pnpm/store.pkg-finder@1100.0.30
+  - @pnpm/types@1102.0.0
+
+## 1100.4.1
+
+### Patch Changes
+
+- An `integrity` recorded on a git dependency's resolution (`resolution: {type: git, repo, commit, integrity: sha512-…}`) is no longer treated as a checksum. pnpm never verifies a git checkout against such a hash — the commit pins the content — so it is now dropped when the lockfile is rewritten, and `pnpm sbom` no longer republishes it as a CycloneDX/SPDX checksum. Lockfiles carrying one also load again instead of failing with `ERR_PNPM_BROKEN_LOCKFILE` [#13042](https://github.com/pnpm/pnpm/issues/13042).
+
+  `pnpm sbom` now also publishes the checksum of a `type: binary` runtime archive, which pnpm does verify.
+
+- `pnpm sbom` no longer emits components for optional platform-specific dependencies that cannot be installed on the current platform (for example, the native `@rolldown/binding-*` variants for other operating systems). Such packages are present in the lockfile but are never downloaded, so their license (and other metadata) could not be resolved and they appeared in the SBOM without one. `pnpm sbom --lockfile-only` still describes the whole lockfile graph, which is platform-independent by design.
+
+- Updated dependencies:
+  - @pnpm/config.package-is-installable@1100.1.3
+  - @pnpm/error@1100.1.2
+  - @pnpm/lockfile.utils@1101.1.0
+  - @pnpm/pkg-manifest.reader@1100.0.16
+  - @pnpm/store.index@1100.2.4
+  - @pnpm/store.pkg-finder@1100.0.29
+
 ## 1100.4.0
 
 ### Minor Changes

package/lib/collectComponents.d.ts

@@ -1,6 +1,6 @@
 import type { LockfileObject } from '@pnpm/lockfile.types';
 import type { Resolution } from '@pnpm/resolving.resolver-base';
-import type { DependenciesField, ProjectId, Registries } from '@pnpm/types';
+import type { DependenciesField, ProjectId, RegistriesByScope, SupportedArchitectures } from '@pnpm/types';
 import type { SbomComponentType, SbomResult } from './types.js';
 export interface WorkspacePackageInfo {
     name: string;
@@ -23,10 +23,11 @@ export interface CollectSbomComponentsOptions {
     include?: {
         [dependenciesField in DependenciesField]: boolean;
     };
-    registries: Registries;
-    namedRegistries?: Record<string, string>;
+    registriesByScope: RegistriesByScope;
+    registriesByPrefix?: Record<string, string>;
     lockfileDir: string;
     includedImporterIds?: ProjectId[];
+    supportedArchitectures?: SupportedArchitectures;
     lockfileOnly?: boolean;
     storeDir?: string;
     virtualStoreDirMaxLength?: number;

package/lib/collectComponents.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
-import { normalizeNamedRegistries } from '@pnpm/config.normalize-registries';
+import { normalizeRegistriesByPrefix } from '@pnpm/config.normalize-registries';
+import { checkPackageInstallability } from '@pnpm/config.package-is-installable';
 import { PnpmError } from '@pnpm/error';
 import { DepType, detectDepTypes } from '@pnpm/lockfile.detect-dep-types';
 import { nameVerFromPkgSnapshot, pkgSnapshotToResolution } from '@pnpm/lockfile.utils';
@@ -132,6 +133,23 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         const { name, version, nonSemverVersion, registryName } = nameVerFromPkgSnapshot(depPath, pkgSnapshot);
         if (!name || !version)
             return;
+        // An optional dependency for another platform is in the lockfile but was
+        // never fetched, so the store holds no metadata to describe it with.
+        // `checkPackageInstallability`, not `packageIsInstallable`: the latter
+        // reports every skip through the install loggers, which reading a
+        // lockfile must not do.
+        if (!opts.lockfileOnly && pkgSnapshot.optional === true && checkPackageInstallability(pkgSnapshot.id ?? depPath, {
+            name,
+            version,
+            cpu: pkgSnapshot.cpu,
+            os: pkgSnapshot.os,
+            libc: pkgSnapshot.libc,
+        }, {
+            optional: true,
+            supportedArchitectures: opts.supportedArchitectures,
+        }) != null) {
+            return;
+        }
         // Resolve the alias before the purl is built. An unknown alias would
         // otherwise yield an unqualified purl that collides with the same
         // package from the default registry, and the `componentsMap.has(purl)`
@@ -140,9 +158,9 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         // artifact from a compliance document.
         const registryUrl = registryName == null
             ? undefined
-            : normalizeNamedRegistries(opts.namedRegistries)[registryName];
+            : normalizeRegistriesByPrefix(opts.registriesByPrefix)[registryName];
         if (registryName != null && registryUrl == null) {
-            throw new PnpmError('MISSING_NAMED_REGISTRY', `Cannot describe package "${depPath}": it was resolved from the named registry '${registryName}:', which is not present in the namedRegistries setting.`, { hint: `Add '${registryName}' to the namedRegistries setting in pnpm-workspace.yaml.` });
+            throw new PnpmError('MISSING_NAMED_REGISTRY', `Cannot describe package "${depPath}": it was resolved from the named registry '${registryName}:', which is not present in the registriesByPrefix setting.`, { hint: `Add '${registryName}' to the registriesByPrefix setting in pnpm-workspace.yaml.` });
         }
         const purl = buildPurl({
             name,
@@ -153,12 +171,12 @@ async function walkStep(step, parentPurl, depTypes, componentsMap, relationships
         relationships.push({ from: parentPurl, to: purl });
         if (componentsMap.has(purl))
             return;
-        const integrity = pkgSnapshot.resolution.integrity;
-        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, { registries: opts.registries, namedRegistries: opts.namedRegistries });
+        const integrity = verifiedIntegrity(pkgSnapshot.resolution);
+        const resolution = pkgSnapshotToResolution(depPath, pkgSnapshot, { registriesByScope: opts.registriesByScope, registriesByPrefix: opts.registriesByPrefix });
         const tarballUrl = resolution.tarball ?? gitDownloadUrl(resolution);
         let metadata = {};
         if (metadataOpts) {
-            metadata = await getPkgMetadata(depPath, pkgSnapshot, { registries: opts.registries, namedRegistries: opts.namedRegistries }, metadataOpts);
+            metadata = await getPkgMetadata(depPath, pkgSnapshot, { registriesByScope: opts.registriesByScope, registriesByPrefix: opts.registriesByPrefix }, metadataOpts);
         }
         const component = {
             name,
@@ -225,4 +243,22 @@ export function resolveWorkspaceDeps(lockfile, importerIds, include) {
     }
     return { links, additionalImporterIds };
 }
+/**
+ * The resolution's integrity, but only where pnpm verifies the downloaded
+ * bytes against it: the tarball/registry hash and a `type: binary` runtime
+ * archive's. Nothing checks a git checkout against a hash, so an `integrity`
+ * recorded on one is not a checksum and is never published as one.
+ *
+ * Read from an untyped lockfile, so the shape is probed rather than trusted:
+ * reading a checksum out of a malformed resolution yields nothing instead of
+ * throwing, and a non-string integrity never reaches `ssri.parse` downstream.
+ * (A malformed resolution still fails the walk further along, in
+ * `pkgSnapshotToResolution` — this only keeps the checksum lookup total.)
+ */
+function verifiedIntegrity(resolution) {
+    const { type, integrity } = (resolution ?? {});
+    if (typeof integrity !== 'string')
+        return undefined;
+    return (type === undefined || type === 'binary') ? integrity : undefined;
+}
 //# sourceMappingURL=collectComponents.js.map

package/lib/purl.js

@@ -28,7 +28,7 @@ export function buildPurl(opts) {
  * Reduce a registry URL to the parts that identify the registry, dropping
  * anything that could carry a secret.
  *
- * An SBOM is meant to be published, and a `namedRegistries` entry may
+ * An SBOM is meant to be published, and a `registriesByPrefix` entry may
  * legitimately embed credentials — as userinfo
  * (`https://user:token@npm.example.com/`) or in a query string
  * (`?api_key=…`). Origin and path are kept because two registries can
@@ -37,7 +37,7 @@ export function buildPurl(opts) {
  * qualifier exists to prevent.
  *
  * A URL that doesn't parse is returned unchanged: it has no userinfo to
- * strip, and `namedRegistries` values are validated as http(s) URLs when
+ * strip, and `registriesByPrefix` values are validated as http(s) URLs when
  * the resolver is constructed, so this is unreachable in practice.
  */
 function sanitizeRegistryUrl(url) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.sbom",
-  "version": "1100.4.0",
+  "version": "1101.0.0",
   "description": "Generate SBOM from pnpm lockfile",
   "keywords": [
     "pnpm",
@@ -30,20 +30,21 @@
     "!*.map"
   ],
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "10.1.0",
-    "@pnpm/config.normalize-registries": "1100.1.0",
-    "@pnpm/constants": "1101.0.0",
+    "@cyclonedx/cyclonedx-library": "10.2.0",
+    "@pnpm/config.normalize-registries": "1101.0.0",
+    "@pnpm/config.package-is-installable": "1100.1.4",
+    "@pnpm/constants": "1102.0.0",
     "@pnpm/deps.compliance.license-resolver": "1100.0.1",
-    "@pnpm/error": "1100.1.1",
-    "@pnpm/lockfile.detect-dep-types": "1100.0.19",
-    "@pnpm/lockfile.types": "1100.0.19",
-    "@pnpm/lockfile.utils": "1101.0.0",
-    "@pnpm/lockfile.walker": "1100.0.19",
-    "@pnpm/pkg-manifest.reader": "1100.0.15",
-    "@pnpm/resolving.resolver-base": "1101.1.0",
-    "@pnpm/store.index": "1100.2.3",
-    "@pnpm/store.pkg-finder": "1100.0.28",
-    "@pnpm/types": "1101.9.0",
+    "@pnpm/error": "1100.1.3",
+    "@pnpm/lockfile.detect-dep-types": "1100.0.20",
+    "@pnpm/lockfile.types": "1100.0.20",
+    "@pnpm/lockfile.utils": "1102.0.0",
+    "@pnpm/lockfile.walker": "1100.0.20",
+    "@pnpm/pkg-manifest.reader": "1100.0.17",
+    "@pnpm/resolving.resolver-base": "1101.1.1",
+    "@pnpm/store.index": "1100.2.5",
+    "@pnpm/store.pkg-finder": "1100.0.30",
+    "@pnpm/types": "1102.0.0",
     "p-limit": "^7.3.1",
     "ssri": "13.0.1"
   },
@@ -52,9 +53,9 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.compliance.sbom": "1100.4.0",
+    "@pnpm/deps.compliance.sbom": "1101.0.0",
     "@pnpm/logger": "1100.0.0",
-    "@pnpm/store.cafs": "1100.1.18",
+    "@pnpm/store.cafs": "1100.2.0",
     "@types/ssri": "^7.1.5"
   },
   "engines": {