@trustify-da/trustify-da-javascript-client 0.2.4-ea.4321869 → 0.2.4-ea.acd33be
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +37 -26
- package/dist/package.json +4 -3
- package/dist/src/analysis.js +13 -13
- package/dist/src/cli.js +5 -5
- package/dist/src/index.d.ts +6 -8
- package/dist/src/index.js +12 -20
- package/dist/src/providers/base_java.js +4 -1
- package/dist/src/providers/java_gradle.js +1 -1
- package/dist/src/providers/java_maven.js +1 -1
- package/dist/src/providers/python_controller.js +1 -1
- package/dist/src/providers/python_pip.js +2 -2
- package/package.json +5 -4
package/README.md
CHANGED
|
@@ -1,12 +1,14 @@
|
|
|
1
|
-
#
|
|
1
|
+
# Trustify Dependency Analytics JavaScript Client<br/>![latest-no-snapshot][0] ![latest-snapshot][1]
|
|
2
2
|
|
|
3
|
-
* Looking for the OpenAPI Spec? Try [
|
|
4
|
-
* Looking for our Java API? Try [
|
|
5
|
-
* Looking for our Backend implementation? Try [
|
|
3
|
+
* Looking for the OpenAPI Spec? Try [Trustify Dependency Analytics API](https://github.com/guacsec/trustify-da-api-spec)
|
|
4
|
+
* Looking for our Java API? Try [Trustify Dependency Analytics Java Client](https://github.com/guacsec/trustify-da-java-client).
|
|
5
|
+
* Looking for our Backend implementation? Try [Trustify Dependency Analytics](https://github.com/guacsec/trustify-dependency-analytics).
|
|
6
6
|
|
|
7
7
|
<h3>Usage</h3>
|
|
8
8
|
<p>
|
|
9
9
|
|
|
10
|
+
<strong>Prerequisites:</strong> The <code>TRUSTIFY_DA_BACKEND_URL</code> environment variable must be set to the URL of the Trustify Dependency Analytics backend service. You can set it as an environment variable or pass it in the options object (see <a href="#customization">Customization</a> section).
|
|
11
|
+
|
|
10
12
|
<ul>
|
|
11
13
|
<li>
|
|
12
14
|
Use as ESM Module from an ESM module
|
|
@@ -15,24 +17,29 @@ Use as ESM Module from an ESM module
|
|
|
15
17
|
npm install @trustify-da/trustify-da-javascript-client
|
|
16
18
|
```
|
|
17
19
|
|
|
20
|
+
```shell
|
|
21
|
+
# Set the mandatory backend URL
|
|
22
|
+
export TRUSTIFY_DA_BACKEND_URL=https://trustify-da.example.com
|
|
23
|
+
```
|
|
24
|
+
|
|
18
25
|
```javascript
|
|
19
|
-
import
|
|
26
|
+
import client from '@trustify-da/trustify-da-javascript-client'
|
|
20
27
|
import fs from 'node:fs'
|
|
21
28
|
|
|
22
29
|
// Get stack analysis in JSON format
|
|
23
|
-
let stackAnalysis = await
|
|
30
|
+
let stackAnalysis = await client.stackAnalysis('/path/to/pom.xml')
|
|
24
31
|
// Get stack analysis in HTML format (string)
|
|
25
|
-
let stackAnalysisHtml = await
|
|
32
|
+
let stackAnalysisHtml = await client.stackAnalysis('/path/to/pom.xml', true)
|
|
26
33
|
// Get component analysis in JSON format
|
|
27
|
-
let componentAnalysis = await
|
|
34
|
+
let componentAnalysis = await client.componentAnalysis('/path/to/pom.xml')
|
|
28
35
|
// Get image analysis in JSON format
|
|
29
|
-
let imageAnalysis = await
|
|
36
|
+
let imageAnalysis = await client.imageAnalysis(['docker.io/library/node:18'])
|
|
30
37
|
// Get image analysis in HTML format (string)
|
|
31
|
-
let imageAnalysisHtml = await
|
|
38
|
+
let imageAnalysisHtml = await client.imageAnalysis(['docker.io/library/node:18'], true)
|
|
32
39
|
// Analyze multiple images
|
|
33
|
-
let multipleImagesAnalysis = await
|
|
40
|
+
let multipleImagesAnalysis = await client.imageAnalysis(['docker.io/library/node:18', 'docker.io/library/python:3.9'])
|
|
34
41
|
// Specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)
|
|
35
|
-
let imageAnalysisWithArch = await
|
|
42
|
+
let imageAnalysisWithArch = await client.imageAnalysis(['httpd:2.4.49^^amd64'])
|
|
36
43
|
```
|
|
37
44
|
</li>
|
|
38
45
|
</ul>
|
|
@@ -45,16 +52,16 @@ npm install @trustify-da/trustify-da-javascript-client
|
|
|
45
52
|
```
|
|
46
53
|
|
|
47
54
|
```javascript
|
|
48
|
-
async function
|
|
55
|
+
async function loadTrustifyDa()
|
|
49
56
|
{
|
|
50
57
|
// dynamic import is the only way to import ESM module into commonJS module
|
|
51
|
-
const { default:
|
|
52
|
-
return
|
|
58
|
+
const { default: client } = await import('@trustify-da/trustify-da-javascript-client');
|
|
59
|
+
return client
|
|
53
60
|
}
|
|
54
|
-
const
|
|
61
|
+
const runTrustifyDa = (manifestPath) => {
|
|
55
62
|
return new Promise(async ( resolve, reject) => {
|
|
56
63
|
try {
|
|
57
|
-
let stackAnalysisReport = await (await
|
|
64
|
+
let stackAnalysisReport = await (await loadTrustifyDa()).stackAnalysis(manifestPath,false)
|
|
58
65
|
resolve(stackAnalysisReport)
|
|
59
66
|
|
|
60
67
|
} catch (error)
|
|
@@ -64,7 +71,7 @@ const runExhort = (manifestPath) => {
|
|
|
64
71
|
});
|
|
65
72
|
};
|
|
66
73
|
|
|
67
|
-
|
|
74
|
+
runTrustifyDa("./path/to/manifest").then(resp => console.log(JSON.stringify(resp,null,4)))
|
|
68
75
|
```
|
|
69
76
|
</li>
|
|
70
77
|
|
|
@@ -297,17 +304,21 @@ All of the 5 above examples are valid for marking a package to be ignored
|
|
|
297
304
|
|
|
298
305
|
<h3>Customization</h3>
|
|
299
306
|
<p>
|
|
300
|
-
There are 2 approaches for customizing <em>
|
|
307
|
+
There are 2 approaches for customizing <em>Trustify Dependency Analytics JavaScript Client</em>. Whether you're using this API as a
|
|
301
308
|
<em>Global Module</em>, a <em>Remote Script</em>, or an <em>ESM Module</em>, you can use <em>Environment Variables</em>
|
|
302
309
|
for various customization.
|
|
303
310
|
|
|
311
|
+
<strong>Note:</strong> The <code>TRUSTIFY_DA_BACKEND_URL</code> environment variable is <strong>mandatory</strong> and must be set to the URL of the Trustify Dependency Analytics backend service. Without this variable, the API will throw an error.
|
|
312
|
+
|
|
304
313
|
However, <em>ESM Module</em> users, can opt for customizing programmatically:
|
|
305
314
|
|
|
306
315
|
```javascript
|
|
307
|
-
import
|
|
316
|
+
import client from '@trustify-da/trustify-da-javascript-client'
|
|
308
317
|
import fs from 'node:fs'
|
|
309
318
|
|
|
310
319
|
let options = {
|
|
320
|
+
// Mandatory: Backend URL for Trustify Dependency Analytics service
|
|
321
|
+
'TRUSTIFY_DA_BACKEND_URL': 'https://api.trustify.dev',
|
|
311
322
|
'TRUSTIFY_DA_MVN_PATH': '/path/to/my/mvn',
|
|
312
323
|
'TRUSTIFY_DA_NPM_PATH': '/path/to/npm',
|
|
313
324
|
'TRUSTIFY_DA_PNPM_PATH': '/path/to/pnpm',
|
|
@@ -323,19 +334,19 @@ let options = {
|
|
|
323
334
|
}
|
|
324
335
|
|
|
325
336
|
// Get stack analysis in JSON format ( all package managers, pom.xml is as an example here)
|
|
326
|
-
let stackAnalysis = await
|
|
337
|
+
let stackAnalysis = await client.stackAnalysis('/path/to/pom.xml', false, options)
|
|
327
338
|
// Get stack analysis in HTML format in string ( all package managers, pom.xml is as an example here)
|
|
328
|
-
let stackAnalysisHtml = await
|
|
339
|
+
let stackAnalysisHtml = await client.stackAnalysis('/path/to/pom.xml', true, options)
|
|
329
340
|
|
|
330
341
|
// Get component analysis in JSON format
|
|
331
|
-
let componentAnalysis = await
|
|
342
|
+
let componentAnalysis = await client.componentAnalysis('/path/to/pom.xml', options)
|
|
332
343
|
|
|
333
344
|
// Get image analysis in JSON format
|
|
334
|
-
let imageAnalysis = await
|
|
345
|
+
let imageAnalysis = await client.imageAnalysis(['docker.io/library/node:18'], false, options)
|
|
335
346
|
// Get image analysis in HTML format in string
|
|
336
|
-
let imageAnalysisHtml = await
|
|
347
|
+
let imageAnalysisHtml = await client.imageAnalysis(['docker.io/library/node:18'], true, options)
|
|
337
348
|
// Specify architecture using ^^ notation (e.g., httpd:2.4.49^^amd64)
|
|
338
|
-
let imageAnalysisWithArch = await
|
|
349
|
+
let imageAnalysisWithArch = await client.imageAnalysis(['httpd:2.4.49^^amd64'], false, options)
|
|
339
350
|
```
|
|
340
351
|
**_Environment variables takes precedence._**
|
|
341
352
|
</p>
|
package/dist/package.json
CHANGED
|
@@ -12,7 +12,9 @@
|
|
|
12
12
|
"exhort",
|
|
13
13
|
"secure",
|
|
14
14
|
"supply-chain",
|
|
15
|
-
"vulnerability"
|
|
15
|
+
"vulnerability",
|
|
16
|
+
"trustify",
|
|
17
|
+
"dependency analytics"
|
|
16
18
|
],
|
|
17
19
|
"engines": {
|
|
18
20
|
"node": ">= 20.0.0",
|
|
@@ -36,9 +38,8 @@
|
|
|
36
38
|
"lint": "eslint src test --ext js",
|
|
37
39
|
"lint:fix": "eslint src test --ext js --fix",
|
|
38
40
|
"test": "c8 npm run tests",
|
|
39
|
-
"tests": "mocha --config .mocharc.json --grep \"
|
|
41
|
+
"tests": "mocha --config .mocharc.json --grep \".*analysis module.*\" --invert",
|
|
40
42
|
"tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
|
|
41
|
-
"integration-tests": "mocha --grep \"Integration Tests\"",
|
|
42
43
|
"precompile": "rm -rf dist",
|
|
43
44
|
"compile": "tsc -p tsconfig.json"
|
|
44
45
|
},
|
package/dist/src/analysis.js
CHANGED
|
@@ -13,7 +13,7 @@ const rhdaPackageManagerHeader = "rhda-pkg-manager";
|
|
|
13
13
|
/**
|
|
14
14
|
* Adds proxy agent configuration to fetch options if a proxy URL is specified
|
|
15
15
|
* @param {RequestInit} options - The base fetch options
|
|
16
|
-
* @param {import("index.js").Options} opts - The
|
|
16
|
+
* @param {import("index.js").Options} opts - The trustify DA options that may contain proxy configuration
|
|
17
17
|
* @returns {RequestInit} The fetch options with proxy agent if applicable
|
|
18
18
|
*/
|
|
19
19
|
function addProxyAgent(options, opts) {
|
|
@@ -41,7 +41,7 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
|
|
|
41
41
|
let startTime = new Date();
|
|
42
42
|
let endTime;
|
|
43
43
|
if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
|
|
44
|
-
console.log("Starting time of sending stack analysis request to
|
|
44
|
+
console.log("Starting time of sending stack analysis request to the dependency analytics server= " + startTime);
|
|
45
45
|
}
|
|
46
46
|
opts[rhdaPackageManagerHeader.toUpperCase().replaceAll("-", "_")] = provided.ecosystem;
|
|
47
47
|
const fetchOptions = addProxyAgent({
|
|
@@ -72,15 +72,15 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
|
|
|
72
72
|
console.log("Unique Identifier associated with this request - ex-request-id=" + exRequestId);
|
|
73
73
|
}
|
|
74
74
|
endTime = new Date();
|
|
75
|
-
console.log("Response body received from
|
|
75
|
+
console.log("Response body received from Trustify DA backend server : " + EOL + EOL);
|
|
76
76
|
console.log(console.log(JSON.stringify(result, null, 4)));
|
|
77
|
-
console.log("Ending time of sending stack analysis request to
|
|
77
|
+
console.log("Ending time of sending stack analysis request to Trustify DA backend server= " + endTime);
|
|
78
78
|
let time = (endTime - startTime) / 1000;
|
|
79
79
|
console.log("Total Time in seconds: " + time);
|
|
80
80
|
}
|
|
81
81
|
}
|
|
82
82
|
else {
|
|
83
|
-
throw new Error(`Got error response from
|
|
83
|
+
throw new Error(`Got error response from Trustify DA backend - http return code : ${resp.status}, error message => ${await resp.text()}`);
|
|
84
84
|
}
|
|
85
85
|
return Promise.resolve(result);
|
|
86
86
|
}
|
|
@@ -98,7 +98,7 @@ async function requestComponent(provider, manifest, url, opts = {}) {
|
|
|
98
98
|
opts["source-manifest"] = "";
|
|
99
99
|
opts[rhdaOperationTypeHeader.toUpperCase().replaceAll("-", "_")] = "component-analysis";
|
|
100
100
|
if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
|
|
101
|
-
console.log("Starting time of sending component analysis request to
|
|
101
|
+
console.log("Starting time of sending component analysis request to Trustify DA backend server= " + new Date());
|
|
102
102
|
}
|
|
103
103
|
opts[rhdaPackageManagerHeader.toUpperCase().replaceAll("-", "_")] = provided.ecosystem;
|
|
104
104
|
const fetchOptions = addProxyAgent({
|
|
@@ -123,13 +123,13 @@ async function requestComponent(provider, manifest, url, opts = {}) {
|
|
|
123
123
|
if (exRequestId) {
|
|
124
124
|
console.log("Unique Identifier associated with this request - ex-request-id=" + exRequestId);
|
|
125
125
|
}
|
|
126
|
-
console.log("Response body received from
|
|
126
|
+
console.log("Response body received from Trustify DA backend server : " + EOL + EOL);
|
|
127
127
|
console.log(JSON.stringify(result, null, 4));
|
|
128
|
-
console.log("Ending time of sending component analysis request to
|
|
128
|
+
console.log("Ending time of sending component analysis request to Trustify DA backend server= " + new Date());
|
|
129
129
|
}
|
|
130
130
|
}
|
|
131
131
|
else {
|
|
132
|
-
throw new Error(`Got error response from
|
|
132
|
+
throw new Error(`Got error response from Trustify DA backend - http return code : ${resp.status}, ex-request-id: ${resp.headers.get("ex-request-id")} error message => ${await resp.text()}`);
|
|
133
133
|
}
|
|
134
134
|
return Promise.resolve(result);
|
|
135
135
|
}
|
|
@@ -172,14 +172,14 @@ async function requestImages(imageRefs, url, html = false, opts = {}) {
|
|
|
172
172
|
if (exRequestId) {
|
|
173
173
|
console.log("Unique Identifier associated with this request - ex-request-id=" + exRequestId);
|
|
174
174
|
}
|
|
175
|
-
console.log("Response body received from
|
|
175
|
+
console.log("Response body received from Trustify DA backend server : " + EOL + EOL);
|
|
176
176
|
console.log(JSON.stringify(result, null, 4));
|
|
177
|
-
console.log("Ending time of sending component analysis request to
|
|
177
|
+
console.log("Ending time of sending component analysis request to Trustify DA backend server= " + new Date());
|
|
178
178
|
}
|
|
179
179
|
return result;
|
|
180
180
|
}
|
|
181
181
|
else {
|
|
182
|
-
throw new Error(`Got error response from
|
|
182
|
+
throw new Error(`Got error response from Trustify DA backend - http return code : ${resp.status}, ex-request-id: ${resp.headers.get("ex-request-id")} error message => ${await resp.text()}`);
|
|
183
183
|
}
|
|
184
184
|
}
|
|
185
185
|
/**
|
|
@@ -241,7 +241,7 @@ function getTokenHeaders(opts = {}) {
|
|
|
241
241
|
setRhdaHeader(rhdaPackageManagerHeader, headers, opts);
|
|
242
242
|
setRhdaHeader(rhdaTelemetryId, headers, opts);
|
|
243
243
|
if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
|
|
244
|
-
console.log("Headers Values to be sent to
|
|
244
|
+
console.log("Headers Values to be sent to Trustify DA backend:" + EOL);
|
|
245
245
|
for (const headerKey in headers) {
|
|
246
246
|
if (!headerKey.match(RegexNotToBeLogged)) {
|
|
247
247
|
console.log(`${headerKey}: ${headers[headerKey]}`);
|
package/dist/src/cli.js
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
import * as path from "path";
|
|
3
3
|
import yargs from 'yargs';
|
|
4
4
|
import { hideBin } from 'yargs/helpers';
|
|
5
|
-
import
|
|
5
|
+
import client from './index.js';
|
|
6
6
|
// command for component analysis take manifest type and content
|
|
7
7
|
const component = {
|
|
8
8
|
command: 'component </path/to/manifest>',
|
|
@@ -14,7 +14,7 @@ const component = {
|
|
|
14
14
|
}),
|
|
15
15
|
handler: async (args) => {
|
|
16
16
|
let manifestName = args['/path/to/manifest'];
|
|
17
|
-
let res = await
|
|
17
|
+
let res = await client.componentAnalysis(manifestName);
|
|
18
18
|
console.log(JSON.stringify(res, null, 2));
|
|
19
19
|
}
|
|
20
20
|
};
|
|
@@ -39,7 +39,7 @@ const validateToken = {
|
|
|
39
39
|
let tokenValue = args['tokenValue'].trim();
|
|
40
40
|
opts[`TRUSTIFY_DA_${tokenProvider}_TOKEN`] = tokenValue;
|
|
41
41
|
}
|
|
42
|
-
let res = await
|
|
42
|
+
let res = await client.validateToken(opts);
|
|
43
43
|
console.log(res);
|
|
44
44
|
}
|
|
45
45
|
};
|
|
@@ -72,7 +72,7 @@ const image = {
|
|
|
72
72
|
}
|
|
73
73
|
let html = args['html'];
|
|
74
74
|
let summary = args['summary'];
|
|
75
|
-
let res = await
|
|
75
|
+
let res = await client.imageAnalysis(imageRefs, html);
|
|
76
76
|
if (summary && !html) {
|
|
77
77
|
let summaries = {};
|
|
78
78
|
for (let [imageRef, report] of Object.entries(res)) {
|
|
@@ -125,7 +125,7 @@ const stack = {
|
|
|
125
125
|
let summary = args['summary'];
|
|
126
126
|
let theProvidersSummary = new Map();
|
|
127
127
|
let theProvidersObject = {};
|
|
128
|
-
let res = await
|
|
128
|
+
let res = await client.stackAnalysis(manifest, html);
|
|
129
129
|
if (summary) {
|
|
130
130
|
for (let provider in res.providers) {
|
|
131
131
|
if (res.providers[provider].sources !== undefined) {
|
package/dist/src/index.d.ts
CHANGED
|
@@ -1,17 +1,15 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* This function is used to determine
|
|
3
|
-
*
|
|
4
|
-
* take it as environment variable if exists, otherwise, take it from opts object if exists, otherwise, use the hardcoded default of DEV environment.
|
|
5
|
-
* If TRUSTIFY_DA_DEV_MODE = false , then select the production theUrl of EXHORT Backend, which is hardcoded.
|
|
6
|
-
* TRUSTIFY_DA_DEV_MODE evaluated in the following order and selected when it finds it first:
|
|
2
|
+
* This function is used to determine the Trustify DA backend URL.
|
|
3
|
+
* The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
|
|
7
4
|
* 1. Environment Variable
|
|
8
5
|
* 2. (key,value) from opts object
|
|
9
|
-
*
|
|
6
|
+
* If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
|
|
10
7
|
* @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
|
|
11
|
-
* @return {string} - The selected
|
|
8
|
+
* @return {string} - The selected Trustify DA backend URL
|
|
9
|
+
* @throws {Error} if TRUSTIFY_DA_BACKEND_URL is unset
|
|
12
10
|
* @private
|
|
13
11
|
*/
|
|
14
|
-
export function
|
|
12
|
+
export function selectTrustifyDABackend(opts?: {
|
|
15
13
|
TRUSTIFY_DA_DEBUG?: string | undefined;
|
|
16
14
|
TRUSTIFY_DA_BACKEND_URL?: string | undefined;
|
|
17
15
|
} | undefined): string;
|
package/dist/src/index.js
CHANGED
|
@@ -77,33 +77,25 @@ function readAndPrintVersionFromPackageJson() {
|
|
|
77
77
|
logOptionsAndEnvironmentsVariables("trustify-da-javascript-client analysis started, version: ", packageJson.version);
|
|
78
78
|
}
|
|
79
79
|
/**
|
|
80
|
-
* This function is used to determine
|
|
81
|
-
*
|
|
82
|
-
* take it as environment variable if exists, otherwise, take it from opts object if exists, otherwise, use the hardcoded default of DEV environment.
|
|
83
|
-
* If TRUSTIFY_DA_DEV_MODE = false , then select the production theUrl of EXHORT Backend, which is hardcoded.
|
|
84
|
-
* TRUSTIFY_DA_DEV_MODE evaluated in the following order and selected when it finds it first:
|
|
80
|
+
* This function is used to determine the Trustify DA backend URL.
|
|
81
|
+
* The TRUSTIFY_DA_BACKEND_URL is evaluated in the following order and selected when it finds it first:
|
|
85
82
|
* 1. Environment Variable
|
|
86
83
|
* 2. (key,value) from opts object
|
|
87
|
-
*
|
|
84
|
+
* If TRUSTIFY_DA_BACKEND_URL is not set, the function will throw an error.
|
|
88
85
|
* @param {{TRUSTIFY_DA_DEBUG?: string | undefined; TRUSTIFY_DA_BACKEND_URL?: string | undefined}} [opts={}]
|
|
89
|
-
* @return {string} - The selected
|
|
86
|
+
* @return {string} - The selected Trustify DA backend URL
|
|
87
|
+
* @throws {Error} if TRUSTIFY_DA_BACKEND_URL is unset
|
|
90
88
|
* @private
|
|
91
89
|
*/
|
|
92
|
-
export function
|
|
90
|
+
export function selectTrustifyDABackend(opts = {}) {
|
|
93
91
|
if (getCustom("TRUSTIFY_DA_DEBUG", "false", opts) === "true") {
|
|
94
92
|
readAndPrintVersionFromPackageJson();
|
|
95
93
|
}
|
|
96
|
-
let url;
|
|
97
|
-
if (getCustom('TRUSTIFY_DA_DEV_MODE', 'false', opts) === 'true') {
|
|
98
|
-
url = getCustom('DEV_TRUSTIFY_DA_BACKEND_URL', undefined, opts);
|
|
99
|
-
}
|
|
100
|
-
else {
|
|
101
|
-
url = getCustom('TRUSTIFY_DA_BACKEND_URL', undefined, opts);
|
|
102
|
-
}
|
|
94
|
+
let url = getCustom('TRUSTIFY_DA_BACKEND_URL', null, opts);
|
|
103
95
|
if (!url) {
|
|
104
96
|
throw new Error(`TRUSTIFY_DA_BACKEND_URL is unset`);
|
|
105
97
|
}
|
|
106
|
-
logOptionsAndEnvironmentsVariables("Chosen
|
|
98
|
+
logOptionsAndEnvironmentsVariables("Chosen Trustify DA backend URL:", url);
|
|
107
99
|
return url;
|
|
108
100
|
}
|
|
109
101
|
/**
|
|
@@ -133,7 +125,7 @@ export function selectExhortBackend(opts = {}) {
|
|
|
133
125
|
* or backend request failed
|
|
134
126
|
*/
|
|
135
127
|
async function stackAnalysis(manifest, html = false, opts = {}) {
|
|
136
|
-
const theUrl =
|
|
128
|
+
const theUrl = selectTrustifyDABackend(opts);
|
|
137
129
|
fs.accessSync(manifest, fs.constants.R_OK); // throws error if file unreadable
|
|
138
130
|
let provider = match(manifest, availableProviders); // throws error if no matching provider
|
|
139
131
|
return await analysis.requestStack(provider, manifest, theUrl, html, opts); // throws error request sending failed
|
|
@@ -146,7 +138,7 @@ async function stackAnalysis(manifest, html = false, opts = {}) {
|
|
|
146
138
|
* @throws {Error} if no matching provider, failed to get create content, or backend request failed
|
|
147
139
|
*/
|
|
148
140
|
async function componentAnalysis(manifest, opts = {}) {
|
|
149
|
-
const theUrl =
|
|
141
|
+
const theUrl = selectTrustifyDABackend(opts);
|
|
150
142
|
fs.accessSync(manifest, fs.constants.R_OK);
|
|
151
143
|
opts["manifest-type"] = path.basename(manifest);
|
|
152
144
|
let provider = match(manifest, availableProviders); // throws error if no matching provider
|
|
@@ -179,7 +171,7 @@ async function componentAnalysis(manifest, opts = {}) {
|
|
|
179
171
|
* or backend request failed
|
|
180
172
|
*/
|
|
181
173
|
async function imageAnalysis(imageRefs, html = false, opts = {}) {
|
|
182
|
-
const theUrl =
|
|
174
|
+
const theUrl = selectTrustifyDABackend(opts);
|
|
183
175
|
return await analysis.requestImages(imageRefs, theUrl, html, opts);
|
|
184
176
|
}
|
|
185
177
|
/**
|
|
@@ -189,6 +181,6 @@ async function imageAnalysis(imageRefs, html = false, opts = {}) {
|
|
|
189
181
|
* @throws {Error} if the backend request failed.
|
|
190
182
|
*/
|
|
191
183
|
async function validateToken(opts = {}) {
|
|
192
|
-
const theUrl =
|
|
184
|
+
const theUrl = selectTrustifyDABackend(opts);
|
|
193
185
|
return await analysis.validateToken(theUrl, opts); // throws error request sending failed
|
|
194
186
|
}
|
|
@@ -79,7 +79,7 @@ export default class Base_Java {
|
|
|
79
79
|
* @returns {PackageURL} The parsed packageURL
|
|
80
80
|
*/
|
|
81
81
|
parseDep(line) {
|
|
82
|
-
let match = line.match(this.DEP_REGEX);
|
|
82
|
+
let match = line.split(':').map(part => part ? part.match(this.DEP_REGEX)[0] : '');
|
|
83
83
|
if (!match) {
|
|
84
84
|
throw new Error(`Unable generate SBOM from dependency tree. Line: ${line} cannot be parsed into a PackageURL`);
|
|
85
85
|
}
|
|
@@ -94,6 +94,9 @@ export default class Base_Java {
|
|
|
94
94
|
if (override) {
|
|
95
95
|
version = override[1];
|
|
96
96
|
}
|
|
97
|
+
if (match[0].trim() === '') {
|
|
98
|
+
throw new Error(`Artifact coordinates should have a non-empty group ID: ${line}`);
|
|
99
|
+
}
|
|
97
100
|
return this.toPurl(match[0], match[1], version);
|
|
98
101
|
}
|
|
99
102
|
/**
|
|
@@ -192,7 +192,7 @@ export default class Java_gradle extends Base_java {
|
|
|
192
192
|
#extractProperties(manifestPath, opts) {
|
|
193
193
|
let properties = {};
|
|
194
194
|
let propertiesContent = this.#getProperties(manifestPath, opts);
|
|
195
|
-
let regExpMatchArray = propertiesContent.match(/([
|
|
195
|
+
let regExpMatchArray = propertiesContent.match(/([^\n:]+):[\t ]*(.*)/g);
|
|
196
196
|
for (let i = 0; i < regExpMatchArray.length - 1; i++) {
|
|
197
197
|
let parts = regExpMatchArray[i].split(":");
|
|
198
198
|
properties[parts[0].trim()] = parts[1].trim();
|
|
@@ -73,7 +73,7 @@ export default class Java_maven extends Base_java {
|
|
|
73
73
|
throw new Error(`failed to clean maven target`, { cause: error });
|
|
74
74
|
}
|
|
75
75
|
// create dependency graph in a temp file
|
|
76
|
-
let tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), '
|
|
76
|
+
let tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'trustify_da_'));
|
|
77
77
|
let tmpDepTree = path.join(tmpDir, 'mvn_deptree.txt');
|
|
78
78
|
// build initial command (dot outputType is not available for verbose mode)
|
|
79
79
|
let depTreeCmdArgs = ['-q', 'org.apache.maven.plugins:maven-dependency-plugin:3.6.0:tree',
|
|
@@ -44,7 +44,7 @@ export default class Python_controller {
|
|
|
44
44
|
}
|
|
45
45
|
prepareEnvironment() {
|
|
46
46
|
if (!this.realEnvironment) {
|
|
47
|
-
this.pythonEnvDir = path.join(path.sep, "tmp", "
|
|
47
|
+
this.pythonEnvDir = path.join(path.sep, "tmp", "trustify_da_env_js");
|
|
48
48
|
try {
|
|
49
49
|
invokeCommand(this.pathToPythonBin, ['-m', 'venv', this.pythonEnvDir]);
|
|
50
50
|
}
|
|
@@ -188,7 +188,7 @@ function createSbomStackAnalysis(manifest, opts = {}) {
|
|
|
188
188
|
});
|
|
189
189
|
let requirementTxtContent = fs.readFileSync(manifest).toString();
|
|
190
190
|
handleIgnoredDependencies(requirementTxtContent, sbom, opts);
|
|
191
|
-
// In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by
|
|
191
|
+
// In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
|
|
192
192
|
// sbom.removeRootComponent()
|
|
193
193
|
return sbom.getAsJsonString(opts);
|
|
194
194
|
}
|
|
@@ -212,7 +212,7 @@ function getSbomForComponentAnalysis(manifest, opts = {}) {
|
|
|
212
212
|
});
|
|
213
213
|
let requirementTxtContent = fs.readFileSync(manifest).toString();
|
|
214
214
|
handleIgnoredDependencies(requirementTxtContent, sbom, opts);
|
|
215
|
-
// In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by
|
|
215
|
+
// In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
|
|
216
216
|
// sbom.removeRootComponent()
|
|
217
217
|
return sbom.getAsJsonString(opts);
|
|
218
218
|
}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@trustify-da/trustify-da-javascript-client",
|
|
3
|
-
"version": "0.2.4-ea.
|
|
3
|
+
"version": "0.2.4-ea.acd33be",
|
|
4
4
|
"description": "Code-Ready Dependency Analytics JavaScript API.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
|
|
@@ -12,7 +12,9 @@
|
|
|
12
12
|
"exhort",
|
|
13
13
|
"secure",
|
|
14
14
|
"supply-chain",
|
|
15
|
-
"vulnerability"
|
|
15
|
+
"vulnerability",
|
|
16
|
+
"trustify",
|
|
17
|
+
"dependency analytics"
|
|
16
18
|
],
|
|
17
19
|
"engines": {
|
|
18
20
|
"node": ">= 20.0.0",
|
|
@@ -36,9 +38,8 @@
|
|
|
36
38
|
"lint": "eslint src test --ext js",
|
|
37
39
|
"lint:fix": "eslint src test --ext js --fix",
|
|
38
40
|
"test": "c8 npm run tests",
|
|
39
|
-
"tests": "mocha --config .mocharc.json --grep \"
|
|
41
|
+
"tests": "mocha --config .mocharc.json --grep \".*analysis module.*\" --invert",
|
|
40
42
|
"tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
|
|
41
|
-
"integration-tests": "mocha --grep \"Integration Tests\"",
|
|
42
43
|
"precompile": "rm -rf dist",
|
|
43
44
|
"compile": "tsc -p tsconfig.json"
|
|
44
45
|
},
|