@trustify-da/trustify-da-javascript-client 0.3.0-ea.7ed8d8c → 0.3.0-ea.7ee4047

package/dist/src/providers/oci_dockerfile.js

@@ -0,0 +1,177 @@
+import fs from 'node:fs';
+import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js';
+import { getArgQuery, getFromQuery, getParser } from './containerfile_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci'; } };
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
+/**
+ * @type {string} ecosystem identifier for OCI image packages
+ * @private
+ */
+const ecosystem = 'oci';
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+function isSupported(manifestName) {
+    return /^(Dockerfile|Containerfile)(\..+)?$/.test(manifestName);
+}
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+function validateLockFile() { return true; }
+/**
+ * Check whether a syntax node contains any expansion (variable substitution) children.
+ * @param {import('web-tree-sitter').SyntaxNode} node
+ * @returns {boolean}
+ * @private
+ */
+function containsExpansion(node) {
+    if (node.type === 'expansion') {
+        return true;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        if (containsExpansion(node.child(i))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+    if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+        return text.slice(1, -1);
+    }
+    return text;
+}
+/**
+ * Collect ARG key-value pairs from the Dockerfile AST.
+ * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
+ * @param {import('web-tree-sitter').Tree} tree the parsed Dockerfile tree
+ * @param {import('web-tree-sitter').Query} argQuery the tree-sitter query for arg_instruction nodes
+ * @returns {Map<string, string>} map of ARG names to their default values
+ * @private
+ */
+function collectArgs(tree, argQuery) {
+    const args = new Map();
+    for (const match of argQuery.matches(tree.rootNode)) {
+        const name = match.captures.find(c => c.name === 'name')?.node.text;
+        const defaultValue = match.captures.find(c => c.name === 'default')?.node.text;
+        if (name && defaultValue) {
+            args.set(name, stripQuotes(defaultValue));
+        }
+    }
+    return args;
+}
+/**
+ * Resolve ARG substitutions in an image spec text using the collected ARG map.
+ * Replaces ${VAR} and $VAR patterns with their ARG default values.
+ * @param {string} text the image spec text potentially containing variable references
+ * @param {Map<string, string>} args map of ARG names to their default values
+ * @returns {string|null} the resolved text, or null if any variable could not be resolved
+ * @private
+ */
+function resolveArgs(text, args) {
+    let resolved = text;
+    let hasUnresolved = false;
+    resolved = resolved.replace(/\$\{([^}]+)\}|\$([A-Za-z_]\w*)/g, (_match, braced, plain) => {
+        const key = braced || plain;
+        if (args.has(key)) {
+            return args.get(key);
+        }
+        hasUnresolved = true;
+        return _match;
+    });
+    return hasUnresolved ? null : resolved;
+}
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
+ */
+export async function parseAllFromImages(manifestContent) {
+    const [parser, fromQuery, argQuery] = await Promise.all([getParser(), getFromQuery(), getArgQuery()]);
+    const tree = parser.parse(manifestContent);
+    const matches = fromQuery.matches(tree.rootNode);
+    if (matches.length === 0) {
+        throw new Error('No FROM line found in Dockerfile');
+    }
+    const args = collectArgs(tree, argQuery);
+    const images = [];
+    for (const match of matches) {
+        const imageSpec = match.captures.find(c => c.name === 'image').node;
+        if (containsExpansion(imageSpec)) {
+            const resolved = resolveArgs(imageSpec.text, args);
+            if (resolved != null) {
+                images.push(resolved);
+            }
+            continue;
+        }
+        images.push(imageSpec.text);
+    }
+    if (images.length === 0) {
+        throw new Error('Dockerfile uses ARG substitution in all FROM lines — cannot resolve variable references');
+    }
+    return images;
+}
+/**
+ * Generate image SBOMs for all FROM instructions in a Dockerfile manifest using syft.
+ * Returns a batch result with a purl-to-SBOM map suitable for the batch-analysis endpoint.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string, batch: boolean}>}
+ * @private
+ */
+async function getImageSBOM(manifest, opts = {}) {
+    const manifestContent = fs.readFileSync(manifest, 'utf-8');
+    const images = await parseAllFromImages(manifestContent);
+    const sbomByPurl = {};
+    for (const image of images) {
+        const imageRef = parseImageRef(image, opts);
+        const purl = imageRef.getPackageURL().toString();
+        if (purl in sbomByPurl)
+            continue;
+        sbomByPurl[purl] = generateImageSBOM(imageRef, opts);
+    }
+    return {
+        ecosystem,
+        content: JSON.stringify(sbomByPurl),
+        contentType: 'application/vnd.cyclonedx+json',
+        batch: true
+    };
+}
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideComponent(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideStack(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+function readLicenseFromManifest() { return null; }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -29,13 +29,17 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -15,7 +15,10 @@ export default class Yarn_berry_processor extends Yarn_processor {
      * @returns {string[]} Command arguments for listing dependencies
      */
     listCmdArgs(includeTransitive) {
-        return ['info', includeTransitive ? '--recursive' : '--all', '--json'];
+        // --all is needed to include workspace members in the output
+        return includeTransitive
+            ? ['info', '--recursive', '--all', '--json']
+            : ['info', '--all', '--json'];
     }
     /**
      * Returns the command arguments for updating the lock file
@@ -48,13 +51,15 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!depTree) {
             return new Map();
         }
-        return new Map(depTree.filter(dep => !this.#isRoot(dep.value)).map(dep => {
+        return new Map(depTree.filter(dep => !this.#isRoot(dep.value))
+            .map(dep => {
             const depName = dep.value;
             const idx = depName.lastIndexOf('@');
             const name = depName.substring(0, idx);
             const version = dep.children.Version;
             return [name, toPurl(purlType, name, version)];
-        }));
+        })
+            .filter(([name]) => this._manifest.dependencies.includes(name)));
     }
     /**
    * Checks if a dependency is the root package
@@ -66,32 +71,111 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!name) {
             return false;
         }
-        return name.endsWith("@workspace:.");
+        // Workspace members use paths like "member-a@workspace:packages/member-a", not just "@workspace:."
+        return name.startsWith(`${this._manifest.name}@workspace:`);
     }
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree) {
             return;
         }
+        // Build index of nodes by their value for quick lookup
+        const nodeIndex = new Map();
+        depTree.forEach(n => nodeIndex.set(n.value, n));
+        // Determine the set of node values reachable from root via production deps
+        const prodDeps = new Set(this._manifest.dependencies);
+        const reachable = new Set();
+        const queue = [];
+        // Seed with root's production dependencies
+        const rootNode = depTree.find(n => this.#isRoot(n.value));
+        if (rootNode?.children?.Dependencies) {
+            for (const d of rootNode.children.Dependencies) {
+                const to = this.#purlFromLocator(d.locator);
+                if (to) {
+                    const fullName = to.namespace ? `${to.namespace}/${to.name}` : to.name;
+                    if (prodDeps.has(fullName)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // BFS to find all transitively reachable packages
+        while (queue.length > 0) {
+            const locator = queue.shift();
+            if (reachable.has(locator)) {
+                continue;
+            }
+            reachable.add(locator);
+            const node = nodeIndex.get(this.#nodeValueFromLocator(locator));
+            if (node?.children?.Dependencies) {
+                for (const d of node.children.Dependencies) {
+                    if (!reachable.has(d.locator)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // Only emit edges for root and reachable nodes
         depTree.forEach(n => {
             const depName = n.value;
-            const from = this.#isRoot(depName) ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
+            const isRoot = this.#isRoot(depName);
+            if (!isRoot && !this.#isReachableNode(depName, reachable)) {
+                return;
+            }
+            const from = isRoot ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
             const deps = n.children?.Dependencies;
             if (!deps) {
                 return;
             }
             deps.forEach(d => {
+                if (!reachable.has(d.locator)) {
+                    return;
+                }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
-                    sbom.addDependency(from, to);
+                    sbom.addDependency(from, to, undefined, hashesForPurl(to));
                 }
             });
         });
     }
+    /**
+     * Converts a locator to the node value format used in yarn info output
+     * @param {string} locator - e.g. "express@npm:4.17.1"
+     * @returns {string} The node value, same as locator for non-virtual
+     * @private
+     */
+    #nodeValueFromLocator(locator) {
+        // Virtual locators: "@scope/name@virtual:hash#npm:version" → "@scope/name@npm:version"
+        const virtualMatch = Yarn_berry_processor.VIRTUAL_LOCATOR_PATTERN.exec(locator);
+        if (virtualMatch) {
+            return `${virtualMatch[1]}@npm:${virtualMatch[2]}`;
+        }
+        return locator;
+    }
+    /**
+     * Checks if a node is in the reachable set by matching its value against reachable locators
+     * @param {string} depName - The node value (e.g. "express@npm:4.17.1")
+     * @param {Set<string>} reachable - Set of reachable locators
+     * @returns {boolean}
+     * @private
+     */
+    #isReachableNode(depName, reachable) {
+        if (reachable.has(depName)) {
+            return true;
+        }
+        // Check if any reachable locator resolves to this node value
+        for (const locator of reachable) {
+            if (this.#nodeValueFromLocator(locator) === depName) {
+                return true;
+            }
+        }
+        return false;
+    }
     /**
    * Creates a PackageURL from a dependency locator
    * @param {string} locator - The dependency locator

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -25,13 +25,17 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.js

@@ -50,8 +50,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree?.data?.trees) {
             return;
         }
@@ -60,12 +61,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
         depTree.data.trees.forEach(n => {
             const dep = new NodeMetaData(n);
             if (this._manifest.dependencies.includes(dep.name)) {
-                sbom.addDependency(rootPurl, dep.purl);
+                sbom.addDependency(rootPurl, dep.purl, undefined, hashesForPurl(dep.purl));
             }
             purls.set(dep.name, dep.purl);
         });
         depTree.data.trees.forEach(n => {
-            this.#addChildrenToSbom(sbom, n, purls);
+            this.#addChildrenToSbom(sbom, n, purls, hashesForPurl);
         });
     }
     /**
@@ -73,9 +74,10 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} node - The current dependency node
    * @param {Map<string, PackageURL>} purls - Map of dependency names to their PackageURL objects
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} hashesForPurl - Resolves lock-file hashes for a purl
    * @private
    */
-    #addChildrenToSbom(sbom, node, purls) {
+    #addChildrenToSbom(sbom, node, purls, hashesForPurl) {
         const dep = new NodeMetaData(node);
         const children = node.children ? node.children : [];
         children.forEach(c => {
@@ -83,9 +85,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
             const from = dep.shadow ? purls.get(dep.name) : dep.purl;
             const to = child.shadow ? purls.get(child.name) : child.purl;
             if (from && to) {
-                sbom.addDependency(from, to);
+                sbom.addDependency(from, to, undefined, hashesForPurl(to));
             }
-            this.#addChildrenToSbom(sbom, c, purls);
+            this.#addChildrenToSbom(sbom, c, purls, hashesForPurl);
         });
     }
 }

package/dist/src/providers/python_controller.d.ts

@@ -1,4 +1,4 @@
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     /**
      * Constructor to create new python controller instance to interact with pip package manager
@@ -31,4 +31,8 @@ export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };

package/dist/src/providers/python_controller.js

@@ -19,7 +19,54 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
     pathToPipBin;
@@ -95,7 +142,7 @@ export default class Python_controller {
     }
     /**
      * Parse the requirements.txt file using tree-sitter and return structured requirement data.
-     * @return {Promise<{name: string, version: string|null}[]>}
+     * @return {Promise<{name: string, version: string|null, hasMarker: boolean}[]>}
      */
     async #parseRequirements() {
         const content = fs.readFileSync(this.pathToRequirements).toString();
@@ -107,7 +154,8 @@ export default class Python_controller {
             const version = versionMatches.length > 0
                 ? versionMatches[0].captures.find(c => c.name === 'version').node.text
                 : null;
-            return { name, version };
+            const hasMarker = reqNode.children.some(c => c.type === 'marker_spec');
+            return { name, version, hasMarker };
         }));
     }
     #decideIfWindowsOrLinuxPath(fileName) {
@@ -130,8 +178,11 @@ export default class Python_controller {
             startingTime = new Date();
             console.log("Starting time to get requirements.txt dependency tree = " + startingTime);
         }
+        let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
+        if (installBestEfforts === "true" && this.realEnvironment) {
+            throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true requires TRUSTIFY_DA_PYTHON_VIRTUAL_ENV=true");
+        }
         if (!this.realEnvironment) {
-            let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
             if (installBestEfforts === "false") {
                 try {
                     invokeCommand(this.pathToPipBin, ['install', '-r', this.pathToRequirements]);
@@ -224,7 +275,12 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
-        parsedRequirements.forEach(({ name: depName, version: manifestVersion }) => {
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
+        parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
+            if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
+                return;
+            }
             if (matchManifestVersions === "true" && manifestVersion != null) {
                 let installedVersion;
                 if (CachedEnvironmentDeps[depName.toLowerCase()] !== undefined) {
@@ -243,7 +299,7 @@ export default class Python_controller {
             }
             let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -323,8 +379,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -346,7 +403,11 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         directDeps = record.dependencies;
     }
     let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
         let depArray = [];
@@ -356,7 +417,7 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra

package/dist/src/providers/python_pip.d.ts

@@ -3,12 +3,18 @@ declare namespace _default {
     export { validateLockFile };
     export { provideComponent };
     export { provideStack };
+    export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
 export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };
 /**
  * @param {string} manifestName - the subject manifest name-type
@@ -33,3 +39,9 @@ declare function provideComponent(manifest: string, opts?: {}): Promise<Provided
  * @returns {Promise<Provided>}
  */
 declare function provideStack(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;