@trustify-da/trustify-da-javascript-client 0.3.0-ea.189199e → 0.3.0-ea.1938f68

package/dist/package.json

@@ -48,7 +48,6 @@
     },
     "dependencies": {
         "@babel/core": "^7.23.2",
-        "@cyclonedx/cyclonedx-library": "^10.0.0",
         "eslint-import-resolver-typescript": "^4.4.4",
         "fast-glob": "^3.3.3",
         "fast-xml-parser": "^5.3.4",

package/dist/src/cyclone_dx_sbom.d.ts

@@ -26,6 +26,19 @@ export default class CycloneDxSbom {
         alg: string;
         content: string;
     }>): CycloneDxSbom;
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): CycloneDxSbom;
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */

package/dist/src/cyclone_dx_sbom.js

@@ -135,6 +135,30 @@ export default class CycloneDxSbom {
         }
         return this;
     }
+    /**
+     * Attach hashes to already-added components by matching their PURL. This is a
+     * post-processing step so ecosystem-specific hash sources (e.g. Maven reading
+     * the local .m2 cache) can enrich the SBOM without threading their concern
+     * through the shared dependency-tree parser. Components without a matching
+     * entry, or whose hashes are already set, are left untouched.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {CycloneDxSbom} the updated SBOM
+     */
+    attachHashes(hashMap) {
+        if (!hashMap || hashMap.size === 0) {
+            return this;
+        }
+        for (const component of this.components) {
+            if (component.hashes) {
+                continue;
+            }
+            const hashes = hashMap.get(component.purl);
+            if (hashes && hashes.length > 0) {
+                component.hashes = hashes;
+            }
+        }
+        return this;
+    }
     /** @param {{}} opts - various options, settings and configuration of application.
      * @return String CycloneDx Sbom json object in a string format
      */

package/dist/src/providers/base_java.d.ts

@@ -10,6 +10,13 @@ export type ecosystem_maven = any;
 export const ecosystem_maven: string;
 export const ecosystem_gradle: "gradle";
 export default class Base_Java {
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES: string[];
     /**
      *
      * @param {string} globalBinary name of the global binary
@@ -40,6 +47,52 @@ export default class Base_Java {
      * @protected
      */
     protected _getDepth(line: string): number;
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line: string): {
+        groupId: string;
+        artifactId: string;
+        packaging: string;
+        classifier: (string | null);
+        version: string;
+        scope: (string | null);
+        overridden: boolean;
+    };
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    protected _coordinateToPurl(coord: {
+        groupId: string;
+        artifactId: string;
+        classifier: (string | null);
+        version: string;
+        overridden: boolean;
+    }): PackageURL;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file

package/dist/src/providers/base_java.js

@@ -14,6 +14,13 @@ export const ecosystem_gradle = 'gradle';
 export default class Base_Java {
     DEP_REGEX = /(([-a-zA-Z0-9._]{2,})|[0-9])/g;
     CONFLICT_REGEX = /.*omitted for conflict with (\S+)\)/;
+    /**
+     * Maven dependency scopes. Used to detect whether the trailing column of a
+     * dependency-tree line is a scope keyword — which in turn signals that an
+     * optional classifier column is present between the packaging and version.
+     * @type {string[]}
+     */
+    static MAVEN_SCOPES = ['compile', 'provided', 'runtime', 'test', 'system', 'import'];
     globalBinary;
     localWrapper;
     /**
@@ -82,31 +89,71 @@ export default class Base_Java {
         }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
+    /**
+     * Parse a single dependency-tree line into its Maven coordinate parts.
+     *
+     * This is the single source of truth for interpreting a dependency-tree
+     * line. Both {@link parseDep} (used to build SBOM component PURLs) and the
+     * Maven hash-map builder rely on it, so the PURL key and the artifact file
+     * path can never drift from one another.
+     *
+     * A line has the shape `groupId:artifactId:packaging[:classifier]:version[:scope]`.
+     * The classifier column is only present when a sixth column holds a known
+     * Maven scope keyword; otherwise the fourth column is the version.
+     *
+     * @param {string} line - line to parse from a dependency tree
+     * @returns {{groupId: string, artifactId: string, packaging: string, classifier: (string|null), version: string, scope: (string|null), overridden: boolean}}
+     *   Parsed coordinate. `version` is the resolved concrete version — when the
+     *   line carries a conflict override the override version replaces it and
+     *   `overridden` is set, mirroring how Maven records the winning version.
+     */
+    parseCoordinate(line) {
+        const parts = line.split(':').map(part => part ? part.match(this.DEP_REGEX)?.[0] ?? '' : '');
+        const groupId = parts[0] ?? '';
+        const artifactId = parts[1] ?? '';
+        const packaging = parts[2] ?? '';
+        // A classifier column exists only when a sixth column holds a scope keyword.
+        const hasClassifier = parts.length >= 6 && Base_Java.MAVEN_SCOPES.includes(parts[5]);
+        const classifier = hasClassifier ? parts[3] : null;
+        let version = (hasClassifier ? parts[4] : parts[3]) ?? '';
+        const scope = hasClassifier ? parts[5] : (parts.length >= 5 ? parts[4] : null);
+        // A conflict override replaces the resolved version entirely.
+        const override = line.match(this.CONFLICT_REGEX);
+        const overridden = Boolean(override);
+        if (overridden) {
+            version = override[1];
+        }
+        return { groupId, artifactId, packaging, classifier, version, scope, overridden };
+    }
+    /**
+     * Build the canonical PackageURL for a parsed coordinate.
+     *
+     * The classifier is folded into the version component (e.g.
+     * `4.1.0-linux-x86_64`) except when the version came from a conflict
+     * override, in which case the override version stands alone — matching the
+     * historical behavior of {@link parseDep}.
+     *
+     * @param {{groupId: string, artifactId: string, classifier: (string|null), version: string, overridden: boolean}} coord
+     * @returns {PackageURL} The canonical packageURL for the coordinate
+     * @protected
+     */
+    _coordinateToPurl(coord) {
+        const purlVersion = (coord.classifier && !coord.overridden)
+            ? `${coord.version}-${coord.classifier}`
+            : coord.version;
+        return this.toPurl(coord.groupId, coord.artifactId, purlVersion);
+    }
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
      * @returns {PackageURL} The parsed packageURL
      */
     parseDep(line) {
-        let match = line.split(':').map(part => part ? part.match(this.DEP_REGEX)[0] : '');
-        if (!match) {
-            throw new Error(`Unable generate SBOM from dependency tree. Line: ${line} cannot be parsed into a PackageURL`);
-        }
-        let version;
-        if (match.length >= 5 && ['compile', 'provided', 'runtime'].includes(match[5])) {
-            version = `${match[4]}-${match[3]}`;
-        }
-        else {
-            version = match[3];
-        }
-        let override = line.match(this.CONFLICT_REGEX);
-        if (override) {
-            version = override[1];
-        }
-        if (match[0].trim() === '') {
+        const coord = this.parseCoordinate(line);
+        if (coord.groupId.trim() === '') {
             throw new Error(`Artifact coordinates should have a non-empty group ID: ${line}`);
         }
-        return this.toPurl(match[0], match[1], version);
+        return this._coordinateToPurl(coord);
     }
     /**
      * Returns a PackageUrl For Java maven dependencies

package/dist/src/providers/java_maven.d.ts

@@ -11,6 +11,10 @@ export function discoverMavenModules(workspaceRoot: string, opts?: object): Prom
 /** @typedef {{name: string, version: string}} Package */
 /** @typedef {{groupId: string, artifactId: string, version: string, scope: string, ignore: boolean}} Dependency */
 export default class Java_maven extends Base_java {
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR: {
+        [x: string]: string;
+    };
     constructor();
     /**
      * @param {string} manifestName - the subject manifest name-type
@@ -25,9 +29,9 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: {}): Provided;
+    provideStack(manifest: string, opts?: {}): Promise<Provided>;
     /**
      * Provide content and content type for maven-maven component analysis.
      * @param {string} manifest - path to the manifest file
@@ -42,13 +46,34 @@ export default class Java_maven extends Base_java {
      */
     readLicenseFromManifest(manifestPath: string): string | null;
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    _buildMavenHashMap(depTreeText: string, opts?: {}): Promise<Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>>;
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
+    createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: {}, manifestPath: string, hashMap?: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): string;
     #private;
 }
 export type Java_maven = any;

package/dist/src/providers/java_maven.js

@@ -1,3 +1,4 @@
+import crypto from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -31,12 +32,12 @@ export default class Java_maven extends Base_java {
      * Provide content and content type for maven-maven stack analysis.
      * @param {string} manifest - the manifest path or name
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {Provided}
+     * @returns {Promise<Provided>}
      */
-    provideStack(manifest, opts = {}) {
+    async provideStack(manifest, opts = {}) {
         return {
             ecosystem: ecosystem_maven,
-            content: this.#createSbomStackAnalysis(manifest, opts),
+            content: await this.#createSbomStackAnalysis(manifest, opts),
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
@@ -81,10 +82,10 @@ export default class Java_maven extends Base_java {
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
      * @param {{}} [opts={}] - optional various options to pass along the application
-     * @returns {string} the Dot Graph content
+     * @returns {Promise<string>} the Dot Graph content
      * @private
      */
-    #createSbomStackAnalysis(manifest, opts = {}) {
+    async #createSbomStackAnalysis(manifest, opts = {}) {
         const manifestDir = path.dirname(manifest);
         const mvn = this.selectToolBinary(manifest, opts);
         const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
@@ -131,20 +132,105 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
+        const depTreeContent = content.toString();
+        const hashMap = await this._buildMavenHashMap(depTreeContent, opts);
+        let sbom = this.createSbomFileFromTextFormat(depTreeContent, ignoredDeps, opts, manifest, hashMap);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
         return sbom;
     }
+    /** @type {Object<string, string>} Packaging types that produce .jar files despite non-jar packaging names. */
+    static PACKAGING_TO_JAR = { 'bundle': 'jar', 'eclipse-plugin': 'jar' };
     /**
+     * Build a Map of PURL string → CycloneDX hash entries by reading artifact files from the local Maven repository.
+     *
+     * Both the artifact file path and the hash-map key are derived from the
+     * shared {@link Base_java#parseCoordinate} parser: the file path uses the
+     * resolved version and raw classifier, while the key uses the same canonical
+     * PURL builder as {@link Base_java#parseDep}. This guarantees the key always
+     * matches the PURL that {@link Base_java#parseDependencyTree} looks up.
      *
+     * @param {string} depTreeText Raw dependency tree text from mvn dependency:tree
+     * @param {{}} [opts={}] Options bag (may contain TRUSTIFY_DA_MVN_REPO)
+     * @returns {Promise<Map<string, Array<{alg: string, content: string}>>>}
+     */
+    async _buildMavenHashMap(depTreeText, opts = {}) {
+        const m2Repo = getCustom('TRUSTIFY_DA_MVN_REPO', path.join(os.homedir(), '.m2', 'repository'), opts);
+        const hashMap = new Map();
+        const lines = depTreeText.split(EOL);
+        // Track hash coverage so an incomplete .m2 cache (e.g. ephemeral CI
+        // containers or resolve-only phases) surfaces a summary warning instead
+        // of silently producing an SBOM with missing hashes.
+        let attempted = 0;
+        let missed = 0;
+        for (const rawLine of lines) {
+            const trimmed = rawLine.trim();
+            // Strip leading tree-drawing characters (e.g. "\-", "+-", "|") so the
+            // parenthesized-line check sees the coordinate itself. Omitted
+            // duplicate/conflict lines start with these characters after trim(),
+            // then an opening "(" — without stripping, the "(" check never fires.
+            const cleaned = trimmed.replace(/^[|+\\\- ]+/, '');
+            if (!cleaned || cleaned.startsWith('(')) {
+                continue;
+            }
+            const coord = this.parseCoordinate(rawLine);
+            if (!coord.groupId || !coord.artifactId || !coord.packaging) {
+                continue;
+            }
+            if (coord.packaging === 'pom') {
+                continue;
+            }
+            // Key by the exact PURL parseDep() produces, so the lookup in
+            // parseDependencyTree (hashMap.get(to.toString())) always hits.
+            const purl = this._coordinateToPurl(coord).toString();
+            // The same artifact recurs across dependency-tree branches — notably in
+            // multi-module reactor builds, where every module re-lists shared deps.
+            // The digest is deterministic per PURL, so skip the redundant file read
+            // and SHA-256 computation once this PURL is already hashed.
+            if (hashMap.has(purl)) {
+                continue;
+            }
+            const ext = Java_maven.PACKAGING_TO_JAR[coord.packaging] || coord.packaging;
+            const groupPath = coord.groupId.replaceAll('.', path.sep);
+            const fileName = coord.classifier
+                ? `${coord.artifactId}-${coord.version}-${coord.classifier}.${ext}`
+                : `${coord.artifactId}-${coord.version}.${ext}`;
+            const artifactPath = path.join(m2Repo, groupPath, coord.artifactId, coord.version, fileName);
+            attempted++;
+            try {
+                const stream = fs.createReadStream(artifactPath);
+                const hash = crypto.createHash('sha256');
+                for await (const chunk of stream) {
+                    hash.update(chunk);
+                }
+                const digest = hash.digest('hex');
+                hashMap.set(purl, [{ alg: 'SHA-256', content: digest }]);
+            }
+            catch {
+                missed++;
+                if (process.env['TRUSTIFY_DA_DEBUG'] === 'true') {
+                    console.error(`Maven hash: artifact not found at ${artifactPath}, omitting hash`);
+                }
+            }
+        }
+        // Mirror the pip provider's convention (python_controller.js): surface an
+        // unconditional warning when hashes could not be computed, so incomplete
+        // hash coverage is visible even without TRUSTIFY_DA_DEBUG.
+        if (missed > 0) {
+            console.warn(`Maven hash: ${missed} of ${attempted} artifacts could not be read from the local .m2 cache; SBOM will be generated without hashes for those components.`);
+        }
+        return hashMap;
+    }
+    /**
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {{}} opts Options
      * @param {String} manifestPath Path to the pom.xml manifest
+     * @param {Map<string, Array<{alg: string, content: string}>>} [hashMap] PURL→hashes map
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath, hashMap) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
@@ -153,6 +239,9 @@ export default class Java_maven extends Base_java {
         let sbom = new Sbom();
         sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
+        // Attach Maven artifact hashes as a post-processing step, keeping this
+        // Maven-specific concern out of the shared dependency-tree parser.
+        sbom.attachHashes(hashMap);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
     /**

package/dist/src/remediate.d.ts

@@ -14,7 +14,7 @@ export function runRemediation(targetPath: string, options?: {
     dryRun?: boolean | undefined;
     providers?: string | undefined;
     sources?: string | undefined;
-    groupBy?: "dependency" | "bundle" | undefined;
+    groupBy?: "bundle" | "dependency" | undefined;
 }): Promise<{
     exitCode: number;
     output: string;

package/dist/src/remediation_report.d.ts

@@ -26,7 +26,7 @@ export function generateReport(remediations: Array<{
     severity: string;
     cves: string[];
 }>, options?: {
-    groupBy?: "dependency" | "bundle" | undefined;
+    groupBy?: "bundle" | "dependency" | undefined;
     format?: "markdown" | "json" | undefined;
     dryRun?: boolean | undefined;
 }): string;

package/dist/src/sbom.d.ts

@@ -33,6 +33,17 @@ export default class Sbom {
         alg: string;
         content: string;
     }>): CycloneDxSbom;
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap: Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>): Sbom;
     /**
      * @return String sbom json in a string format
      */

package/dist/src/sbom.js

@@ -50,6 +50,16 @@ export default class Sbom {
     addDependency(sourceRef, targetRef, scope, targetHashes) {
         return this.sbomModel.addDependency(sourceRef, targetRef, scope, targetHashes);
     }
+    /**
+     * Attach hashes to existing components by matching their PURL. Post-processing
+     * step used by ecosystem-specific providers (e.g. Maven) to enrich the SBOM
+     * with artifact hashes without leaking their concern into the shared parser.
+     * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - PURL→hashes map
+     * @return {Sbom}
+     */
+    attachHashes(hashMap) {
+        return this.sbomModel.attachHashes(hashMap);
+    }
     /**
      * @return String sbom json in a string format
      */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@trustify-da/trustify-da-javascript-client",
-	"version": "0.3.0-ea.189199e",
+	"version": "0.3.0-ea.1938f68",
 	"description": "Code-Ready Dependency Analytics JavaScript API.",
 	"license": "Apache-2.0",
 	"homepage": "https://github.com/guacsec/trustify-da-javascript-client#README.md",
@@ -48,7 +48,6 @@
 	},
 	"dependencies": {
 		"@babel/core": "^7.23.2",
-		"@cyclonedx/cyclonedx-library": "^10.0.0",
 		"eslint-import-resolver-typescript": "^4.4.4",
 		"fast-glob": "^3.3.3",
 		"fast-xml-parser": "^5.3.4",