@trustify-da/trustify-da-javascript-client 0.3.0-ea.63ae5c2 → 0.3.0-ea.7144952

package/dist/src/providers/java_maven.js

@@ -3,6 +3,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { EOL } from 'os';
 import { XMLParser } from 'fast-xml-parser';
+import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { getCustom } from '../tools.js';
 import Base_java, { ecosystem_maven } from "./base_java.js";
@@ -51,6 +52,30 @@ export default class Java_maven extends Base_java {
             contentType: 'application/vnd.cyclonedx+json'
         };
     }
+    /**
+     * Read license from pom.xml manifest, with fallback to LICENSE file
+     * @param {string} manifestPath - path to pom.xml
+     * @returns {string|null}
+     */
+    readLicenseFromManifest(manifestPath) {
+        let fromPom = null;
+        try {
+            const xml = fs.readFileSync(manifestPath, 'utf-8');
+            const parser = new XMLParser({ ignoreAttributes: false });
+            const obj = parser.parse(xml);
+            const project = obj?.project;
+            if (project?.licenses?.license) {
+                const license = Array.isArray(project.licenses.license)
+                    ? project.licenses.license[0]
+                    : project.licenses.license;
+                fromPom = (license?.name && license.name.trim()) || null;
+            }
+        }
+        catch {
+            // leave fromPom as null
+        }
+        return getLicense(fromPom, manifestPath);
+    }
     /**
      * Create a Dot Graph dependency tree for a manifest path.
      * @param {string} manifest - path for pom.xml
@@ -105,7 +130,7 @@ export default class Java_maven extends Base_java {
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             console.error("Dependency tree that will be used as input for creating the BOM =>" + EOL + EOL + content.toString());
         }
-        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts);
+        let sbom = this.createSbomFileFromTextFormat(content.toString(), ignoredDeps, opts, manifest);
         // delete temp file and directory
         fs.rmSync(tmpDir, { recursive: true, force: true });
         // return dependency graph as string
@@ -115,15 +140,17 @@ export default class Java_maven extends Base_java {
      *
      * @param {String} textGraphList Text graph String of the manifest
      * @param {[String]} ignoredDeps List of ignored dependencies to be omitted from sbom
+     * @param {String} manifestPath Path to the pom.xml manifest
      * @return {String} formatted sbom Json String with all dependencies
      */
-    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts) {
+    createSbomFileFromTextFormat(textGraphList, ignoredDeps, opts, manifestPath) {
         let lines = textGraphList.split(EOL);
         // get root component
         let root = lines[0];
         let rootPurl = this.parseDep(root);
+        const license = this.readLicenseFromManifest(manifestPath);
         let sbom = new Sbom();
-        sbom.addRoot(rootPurl);
+        sbom.addRoot(rootPurl, license);
         this.parseDependencyTree(root, 0, lines.slice(1), sbom);
         return sbom.filterIgnoredDeps(ignoredDeps).getAsJsonString(opts);
     }
@@ -156,7 +183,8 @@ export default class Java_maven extends Base_java {
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
-        sbom.addRoot(purlRoot);
+        const license = this.readLicenseFromManifest(manifestPath);
+        sbom.addRoot(purlRoot, license);
         dependencies.forEach(dep => {
             let currentPurl = this.toPurl(dep.groupId, dep.artifactId, dep.version);
             sbom.addDependency(purlRoot, currentPurl);

package/dist/src/providers/javascript_pnpm.d.ts

@@ -1,5 +1,5 @@
 export default class Javascript_pnpm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, manifest: any): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/javascript_pnpm.js

@@ -12,8 +12,8 @@ export default class Javascript_pnpm extends Base_javascript {
     _updateLockFileCmdArgs() {
         return ['install', '--frozen-lockfile'];
     }
-    _buildDependencyTree(includeTransitive, manifest) {
-        const tree = super._buildDependencyTree(includeTransitive, manifest);
+    _buildDependencyTree(includeTransitive, opts = {}) {
+        const tree = super._buildDependencyTree(includeTransitive, opts);
         if (Array.isArray(tree) && tree.length > 0) {
             return tree[0];
         }

package/dist/src/providers/python_pip.d.ts

@@ -3,6 +3,7 @@ declare namespace _default {
     export { validateLockFile };
     export { provideComponent };
     export { provideStack };
+    export { readLicenseFromManifest };
 }
 export default _default;
 export type DependencyEntry = {
@@ -33,3 +34,9 @@ declare function provideComponent(manifest: string, opts?: {}): Promise<Provided
  * @returns {Promise<Provided>}
  */
 declare function provideStack(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;

package/dist/src/providers/python_pip.js

@@ -1,10 +1,11 @@
 import fs from 'node:fs';
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
 import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'
@@ -18,6 +19,13 @@ const ecosystem = 'pip';
 function isSupported(manifestName) {
     return 'requirements.txt' === manifestName;
 }
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+// eslint-disable-next-line no-unused-vars
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */
@@ -167,7 +175,8 @@ async function createSbomStackAnalysis(manifest, opts = {}) {
     let dependencies = await pythonController.getDependencies(true);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
         addAllDependencies(rootPurl, dep, sbom);
     });
@@ -190,7 +199,8 @@ async function getSbomForComponentAnalysis(manifest, opts = {}) {
     let dependencies = await pythonController.getDependencies(false);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
         sbom.addDependency(rootPurl, toPurl(dep.name, dep.version));
     });

package/dist/src/providers/requirements_parser.js

@@ -1,13 +1,10 @@
-import { createRequire } from 'node:module';
+import { readFile } from 'node:fs/promises';
 import { Language, Parser, Query } from 'web-tree-sitter';
-const require = createRequire(import.meta.url);
+const wasmUrl = new URL('./tree-sitter-requirements.wasm', import.meta.url);
 async function init() {
-    await Parser.init({
-        locateFile() {
-            return require.resolve('web-tree-sitter/web-tree-sitter.wasm');
-        }
-    });
-    return await Language.load(require.resolve('tree-sitter-requirements/tree-sitter-requirements.wasm'));
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
 }
 export async function getParser() {
     const language = await init();

package/dist/src/providers/rust_cargo.d.ts

@@ -0,0 +1,52 @@
+declare namespace _default {
+    export { isSupported };
+    export { validateLockFile };
+    export { provideComponent };
+    export { provideStack };
+    export { readLicenseFromManifest };
+}
+export default _default;
+export type Provided = import("../provider").Provided;
+/**
+ * @param {string} manifestName - the subject manifest name-type
+ * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
+ */
+declare function isSupported(manifestName: string): boolean;
+/**
+ * Validates that Cargo.lock exists in the manifest directory or in a parent
+ * workspace root directory.  In Cargo workspaces the lock file always lives at
+ * the workspace root, so when a member crate's Cargo.toml is provided we walk
+ * up the directory tree looking for Cargo.lock (stopping when we find a
+ * Cargo.toml that contains a [workspace] section, or when we reach the
+ * filesystem root).
+ * When TRUSTIFY_DA_WORKSPACE_DIR is provided (via env var or opts),
+ * checks only that directory for Cargo.lock — no walk-up.
+ * @param {string} manifestDir - the directory where the manifest lies
+ * @param {{TRUSTIFY_DA_WORKSPACE_DIR?: string}} [opts={}] - optional workspace root
+ * @returns {boolean} true if Cargo.lock is found
+ */
+declare function validateLockFile(manifestDir: string, opts?: {
+    TRUSTIFY_DA_WORKSPACE_DIR?: string;
+}): boolean;
+/**
+ * Provide content and content type for Cargo component analysis.
+ * @param {string} manifest - path to Cargo.toml for component report
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideComponent(manifest: string, opts?: {}): Provided;
+/**
+ * Provide content and content type for Cargo stack analysis.
+ * @param {string} manifest - the manifest path
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideStack(manifest: string, opts?: {}): Provided;
+/**
+ * Read project license from Cargo.toml, with fallback to LICENSE file.
+ * Supports the `license` field under `[package]` (single crate / workspace
+ * with root) and under `[workspace.package]` (virtual workspaces).
+ * @param {string} manifestPath - path to Cargo.toml
+ * @returns {string|null} SPDX identifier or null
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;