@trustify-da/trustify-da-javascript-client 0.3.0-ea.8adb67b → 0.3.0-ea.8eab29b

package/dist/src/providers/marker_evaluator.js

@@ -0,0 +1,191 @@
+// PEP 508 environment marker evaluator.
+// Filters Python dependencies by platform/version markers so that e.g.
+// "pywin32 ; sys_platform == 'win32'" is excluded on Linux/macOS.
+// See https://peps.python.org/pep-0508/#environment-markers
+import os from 'node:os';
+import { getCustomPath, invokeCommand } from '../tools.js';
+let cachedPythonVersions = undefined;
+function getPythonVersions() {
+    if (cachedPythonVersions !== undefined) {
+        return cachedPythonVersions;
+    }
+    try {
+        let python = getCustomPath('python3');
+        let out = invokeCommand(python, ['-c', "import sys; v=sys.version_info; print(f'{v.major}.{v.minor} {v.major}.{v.minor}.{v.micro}')"], { timeout: 5000 }).toString().trim();
+        let [short, full] = out.split(' ');
+        cachedPythonVersions = { short, full };
+    }
+    catch {
+        cachedPythonVersions = null;
+    }
+    return cachedPythonVersions;
+}
+/**
+ * Maps Node.js/OS values to PEP 508 marker variables.
+ * Example: on Linux, sys_platform='linux', platform_system='Linux', os_name='posix'
+ * @returns {Record<string, string>}
+ */
+export function getEnvironmentMarkers() {
+    let platform = process.platform;
+    let systemMap = { win32: 'Windows', linux: 'Linux', darwin: 'Darwin' };
+    let machine = typeof os.machine === 'function' ? os.machine() : process.arch;
+    let pyVer = getPythonVersions();
+    return {
+        sys_platform: platform,
+        platform_system: systemMap[platform] || platform,
+        os_name: platform === 'win32' ? 'nt' : 'posix',
+        platform_machine: machine,
+        platform_release: os.release(),
+        platform_version: os.version?.() || '',
+        python_version: pyVer?.short || '',
+        python_full_version: pyVer?.full || '',
+        implementation_name: 'cpython',
+    };
+}
+function compareVersions(left, right) {
+    let lParts = left.split('.').map(Number);
+    let rParts = right.split('.').map(Number);
+    let len = Math.max(lParts.length, rParts.length);
+    for (let i = 0; i < len; i++) {
+        let l = lParts[i] || 0;
+        let r = rParts[i] || 0;
+        if (l < r) {
+            return -1;
+        }
+        if (l > r) {
+            return 1;
+        }
+    }
+    return 0;
+}
+// Evaluates a single comparison like sys_platform == 'win32' or python_version >= '3.8'.
+// Version-bearing variables (python_version, python_full_version) use numeric comparison;
+// all others use string equality. Returns false when the env value is missing.
+function evaluateComparison(variable, op, value, env) {
+    let envVal = env[variable];
+    if (envVal === undefined || envVal === '') {
+        return false;
+    }
+    let isVersion = variable.includes('version');
+    if (isVersion) {
+        let cmp = compareVersions(envVal, value);
+        switch (op) {
+            case '==': return cmp === 0;
+            case '!=': return cmp !== 0;
+            case '>=': return cmp >= 0;
+            case '<=': return cmp <= 0;
+            case '>': return cmp > 0;
+            case '<': return cmp < 0;
+            case '~=': {
+                let parts = value.split('.');
+                parts.pop();
+                let prefix = parts.join('.');
+                return envVal.startsWith(prefix) && cmp >= 0;
+            }
+            default: return true;
+        }
+    }
+    switch (op) {
+        case '==': return envVal === value;
+        case '!=': return envVal !== value;
+        case 'in': return value.includes(envVal);
+        case 'not in': return !value.includes(envVal);
+        default: return envVal === value;
+    }
+}
+// Parses a single marker comparison into {variable, op, value}.
+// Handles both normal and reversed forms:
+//   "sys_platform == 'linux'"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+//   "'linux' == sys_platform"  → { variable: 'sys_platform', op: '==', value: 'linux' }
+function parseAtom(expr) {
+    // Normal form: variable op 'value'
+    let m = expr.match(/^\s*([\w.]+)\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*["']([^"']*)["']\s*$/);
+    if (m) {
+        return { variable: m[1], op: m[2].replace(/\s+/g, ' '), value: m[3] };
+    }
+    // Reversed form: 'value' op variable — reverse directional operators
+    let mReverse = expr.match(/^\s*["']([^"']*)['"]\s*(~=|!=|==|>=|<=|>|<|not\s+in|in)\s*([\w.]+)\s*$/);
+    if (mReverse) {
+        let reverseOp = { '<': '>', '>': '<', '<=': '>=', '>=': '<=' };
+        let op = mReverse[2].replace(/\s+/g, ' ');
+        return { variable: mReverse[3], op: reverseOp[op] || op, value: mReverse[1] };
+    }
+    return null;
+}
+/**
+ * Evaluates a full PEP 508 marker expression against the current platform.
+ * Example: "sys_platform == 'win32' and python_version >= '3.8'" → false on Linux
+ * Empty/missing markers return true (unconditional dependency).
+ * @param {string} markerExpr
+ * @returns {boolean}
+ */
+export function evaluateMarker(markerExpr) {
+    if (!markerExpr || !markerExpr.trim()) {
+        return true;
+    }
+    let env = getEnvironmentMarkers();
+    return evaluateExpr(markerExpr.trim(), env);
+}
+function evaluateExpr(expr, env) {
+    let orParts = splitLogical(expr, ' or ');
+    if (orParts.length > 1) {
+        return orParts.some(part => evaluateExpr(part, env));
+    }
+    let andParts = splitLogical(expr, ' and ');
+    if (andParts.length > 1) {
+        return andParts.every(part => evaluateExpr(part, env));
+    }
+    let trimmed = expr.trim();
+    if (trimmed.startsWith('(') && trimmed.endsWith(')')) {
+        return evaluateExpr(trimmed.slice(1, -1), env);
+    }
+    let atom = parseAtom(trimmed);
+    if (!atom) {
+        return true;
+    }
+    return evaluateComparison(atom.variable, atom.op, atom.value, env);
+}
+// Splits an expression by " and " or " or " at the top level, skipping
+// separators inside parentheses or quoted strings.
+// Example: splitLogical("a == 'x' and (b == 'y' or c == 'z')", " and ")
+//        → ["a == 'x'", "(b == 'y' or c == 'z')"]
+function splitLogical(expr, sep) {
+    let parts = [];
+    let depth = 0;
+    let current = '';
+    let i = 0;
+    let quoteChar = null;
+    while (i < expr.length) {
+        let ch = expr[i];
+        if (quoteChar) {
+            if (ch === quoteChar) {
+                quoteChar = null;
+            }
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quoteChar = ch;
+            current += ch;
+            i++;
+            continue;
+        }
+        if (ch === '(') {
+            depth++;
+        }
+        if (ch === ')') {
+            depth--;
+        }
+        if (depth === 0 && expr.substring(i, i + sep.length) === sep) {
+            parts.push(current);
+            current = '';
+            i += sep.length;
+            continue;
+        }
+        current += ch;
+        i++;
+    }
+    parts.push(current);
+    return parts.filter(p => p.trim());
+}

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -15,7 +15,10 @@ export default class Yarn_berry_processor extends Yarn_processor {
      * @returns {string[]} Command arguments for listing dependencies
      */
     listCmdArgs(includeTransitive) {
-        return ['info', includeTransitive ? '--recursive' : '--all', '--json'];
+        // --all is needed to include workspace members in the output
+        return includeTransitive
+            ? ['info', '--recursive', '--all', '--json']
+            : ['info', '--all', '--json'];
     }
     /**
      * Returns the command arguments for updating the lock file
@@ -48,13 +51,15 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!depTree) {
             return new Map();
         }
-        return new Map(depTree.filter(dep => !this.#isRoot(dep.value)).map(dep => {
+        return new Map(depTree.filter(dep => !this.#isRoot(dep.value))
+            .map(dep => {
             const depName = dep.value;
             const idx = depName.lastIndexOf('@');
             const name = depName.substring(0, idx);
             const version = dep.children.Version;
             return [name, toPurl(purlType, name, version)];
-        }));
+        })
+            .filter(([name]) => this._manifest.dependencies.includes(name)));
     }
     /**
    * Checks if a dependency is the root package
@@ -66,7 +71,8 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!name) {
             return false;
         }
-        return name.endsWith("@workspace:.");
+        // Workspace members use paths like "member-a@workspace:packages/member-a", not just "@workspace:."
+        return name.startsWith(`${this._manifest.name}@workspace:`);
     }
     /**
    * Adds dependencies to the SBOM
@@ -77,14 +83,58 @@ export default class Yarn_berry_processor extends Yarn_processor {
         if (!depTree) {
             return;
         }
+        // Build index of nodes by their value for quick lookup
+        const nodeIndex = new Map();
+        depTree.forEach(n => nodeIndex.set(n.value, n));
+        // Determine the set of node values reachable from root via production deps
+        const prodDeps = new Set(this._manifest.dependencies);
+        const reachable = new Set();
+        const queue = [];
+        // Seed with root's production dependencies
+        const rootNode = depTree.find(n => this.#isRoot(n.value));
+        if (rootNode?.children?.Dependencies) {
+            for (const d of rootNode.children.Dependencies) {
+                const to = this.#purlFromLocator(d.locator);
+                if (to) {
+                    const fullName = to.namespace ? `${to.namespace}/${to.name}` : to.name;
+                    if (prodDeps.has(fullName)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // BFS to find all transitively reachable packages
+        while (queue.length > 0) {
+            const locator = queue.shift();
+            if (reachable.has(locator)) {
+                continue;
+            }
+            reachable.add(locator);
+            const node = nodeIndex.get(this.#nodeValueFromLocator(locator));
+            if (node?.children?.Dependencies) {
+                for (const d of node.children.Dependencies) {
+                    if (!reachable.has(d.locator)) {
+                        queue.push(d.locator);
+                    }
+                }
+            }
+        }
+        // Only emit edges for root and reachable nodes
         depTree.forEach(n => {
             const depName = n.value;
-            const from = this.#isRoot(depName) ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
+            const isRoot = this.#isRoot(depName);
+            if (!isRoot && !this.#isReachableNode(depName, reachable)) {
+                return;
+            }
+            const from = isRoot ? toPurlFromString(sbom.getRoot().purl) : this.#purlFromNode(depName, n);
             const deps = n.children?.Dependencies;
             if (!deps) {
                 return;
             }
             deps.forEach(d => {
+                if (!reachable.has(d.locator)) {
+                    return;
+                }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
                     sbom.addDependency(from, to);
@@ -92,6 +142,39 @@ export default class Yarn_berry_processor extends Yarn_processor {
             });
         });
     }
+    /**
+     * Converts a locator to the node value format used in yarn info output
+     * @param {string} locator - e.g. "express@npm:4.17.1"
+     * @returns {string} The node value, same as locator for non-virtual
+     * @private
+     */
+    #nodeValueFromLocator(locator) {
+        // Virtual locators: "@scope/name@virtual:hash#npm:version" → "@scope/name@npm:version"
+        const virtualMatch = Yarn_berry_processor.VIRTUAL_LOCATOR_PATTERN.exec(locator);
+        if (virtualMatch) {
+            return `${virtualMatch[1]}@npm:${virtualMatch[2]}`;
+        }
+        return locator;
+    }
+    /**
+     * Checks if a node is in the reachable set by matching its value against reachable locators
+     * @param {string} depName - The node value (e.g. "express@npm:4.17.1")
+     * @param {Set<string>} reachable - Set of reachable locators
+     * @returns {boolean}
+     * @private
+     */
+    #isReachableNode(depName, reachable) {
+        if (reachable.has(depName)) {
+            return true;
+        }
+        // Check if any reachable locator resolves to this node value
+        for (const locator of reachable) {
+            if (this.#nodeValueFromLocator(locator) === depName) {
+                return true;
+            }
+        }
+        return false;
+    }
     /**
    * Creates a PackageURL from a dependency locator
    * @param {string} locator - The dependency locator

package/dist/src/providers/python_controller.d.ts

@@ -1,4 +1,4 @@
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     /**
      * Constructor to create new python controller instance to interact with pip package manager
@@ -15,17 +15,24 @@ export default class Python_controller {
     realEnvironment: boolean;
     pathToRequirements: string;
     options: {};
+    parser: Promise<import("web-tree-sitter").Parser>;
+    requirementsQuery: Promise<import("web-tree-sitter").Query>;
+    pinnedVersionQuery: Promise<import("web-tree-sitter").Query>;
     prepareEnvironment(): void;
     /**
      *
      * @param {boolean} includeTransitive - whether to return include in returned object transitive dependencies or not
-     * @return {[DependencyEntry]}
+     * @return {Promise<[DependencyEntry]>}
      */
-    getDependencies(includeTransitive: boolean): [DependencyEntry];
+    getDependencies(includeTransitive: boolean): Promise<[DependencyEntry]>;
     #private;
 }
 export type DependencyEntry = {
     name: string;
     version: string;
     dependencies: DependencyEntry[];
+    hashes?: Array<{
+        alg: string;
+        content: string;
+    }>;
 };

package/dist/src/providers/python_controller.js

@@ -2,6 +2,7 @@ import fs from "node:fs";
 import path from 'node:path';
 import os, { EOL } from "os";
 import { environmentVariableIsPopulated, getCustom, invokeCommand } from "../tools.js";
+import { getParser, getRequirementQuery, getPinnedVersionQuery } from './requirements_parser.js';
 function getPipFreezeOutput() {
     try {
         return environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") ? new Buffer.from(process.env["TRUSTIFY_DA_PIP_FREEZE"], 'base64').toString('ascii') : invokeCommand(this.pathToPipBin, ['freeze', '--all']).toString();
@@ -18,7 +19,54 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
-/** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
+/** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
     pathToPipBin;
@@ -26,6 +74,9 @@ export default class Python_controller {
     realEnvironment;
     pathToRequirements;
     options;
+    parser;
+    requirementsQuery;
+    pinnedVersionQuery;
     /**
      * Constructor to create new python controller instance to interact with pip package manager
      * @param {boolean} realEnvironment - whether to use real environment supplied by client or to create virtual environment
@@ -41,6 +92,9 @@ export default class Python_controller {
         this.prepareEnvironment();
         this.pathToRequirements = pathToRequirements;
         this.options = options;
+        this.parser = getParser();
+        this.requirementsQuery = getRequirementQuery();
+        this.pinnedVersionQuery = getPinnedVersionQuery();
     }
     prepareEnvironment() {
         if (!this.realEnvironment) {
@@ -86,6 +140,24 @@ export default class Python_controller {
             }
         }
     }
+    /**
+     * Parse the requirements.txt file using tree-sitter and return structured requirement data.
+     * @return {Promise<{name: string, version: string|null, hasMarker: boolean}[]>}
+     */
+    async #parseRequirements() {
+        const content = fs.readFileSync(this.pathToRequirements).toString();
+        const tree = (await this.parser).parse(content);
+        return Promise.all((await this.requirementsQuery).matches(tree.rootNode).map(async (match) => {
+            const reqNode = match.captures.find(c => c.name === 'req').node;
+            const name = match.captures.find(c => c.name === 'name').node.text;
+            const versionMatches = (await this.pinnedVersionQuery).matches(reqNode);
+            const version = versionMatches.length > 0
+                ? versionMatches[0].captures.find(c => c.name === 'version').node.text
+                : null;
+            const hasMarker = reqNode.children.some(c => c.type === 'marker_spec');
+            return { name, version, hasMarker };
+        }));
+    }
     #decideIfWindowsOrLinuxPath(fileName) {
         if (os.platform() === "win32") {
             return fileName + ".exe";
@@ -97,9 +169,9 @@ export default class Python_controller {
     /**
      *
      * @param {boolean} includeTransitive - whether to return include in returned object transitive dependencies or not
-     * @return {[DependencyEntry]}
+     * @return {Promise<[DependencyEntry]>}
      */
-    getDependencies(includeTransitive) {
+    async getDependencies(includeTransitive) {
         let startingTime;
         let endingTime;
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
@@ -124,10 +196,10 @@ export default class Python_controller {
                 if (matchManifestVersions === "true") {
                     throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true can only work with MATCH_MANIFEST_VERSIONS=false");
                 }
-                this.#installingRequirementsOneByOne();
+                await this.#installingRequirementsOneByOne();
             }
         }
-        let dependencies = this.#getDependenciesImpl(includeTransitive);
+        let dependencies = await this.#getDependenciesImpl(includeTransitive);
         this.#cleanEnvironment();
         if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
             endingTime = new Date();
@@ -137,16 +209,14 @@ export default class Python_controller {
         }
         return dependencies;
     }
-    #installingRequirementsOneByOne() {
-        let requirementsContent = fs.readFileSync(this.pathToRequirements);
-        let requirementsRows = requirementsContent.toString().split(EOL);
-        requirementsRows.filter((line) => !line.trim().startsWith("#")).filter((line) => line.trim() !== "").forEach((dependency) => {
-            let dependencyName = getDependencyName(dependency);
+    async #installingRequirementsOneByOne() {
+        const requirements = await this.#parseRequirements();
+        requirements.forEach(({ name }) => {
             try {
-                invokeCommand(this.pathToPipBin, ['install', dependencyName]);
+                invokeCommand(this.pathToPipBin, ['install', name]);
             }
             catch (error) {
-                throw new Error(`Failed in best-effort installing ${dependencyName} in virtual python environment`, { cause: error });
+                throw new Error(`Failed in best-effort installing ${name} in virtual python environment`, { cause: error });
             }
         });
     }
@@ -163,34 +233,26 @@ export default class Python_controller {
             }
         }
     }
-    #getDependenciesImpl(includeTransitive) {
-        let dependencies = new Array();
+    async #getDependenciesImpl(includeTransitive) {
+        let dependencies = [];
         let usePipDepTree = getCustom("TRUSTIFY_DA_PIP_USE_DEP_TREE", "false", this.options);
-        let freezeOutput;
-        let lines;
-        let depNames;
-        let pipShowOutput;
         let allPipShowDeps;
         let pipDepTreeJsonArrayOutput;
         if (usePipDepTree !== "true") {
-            freezeOutput = getPipFreezeOutput.call(this);
-            lines = freezeOutput.split(EOL);
-            depNames = lines.map(line => getDependencyName(line));
+            const freezeOutput = getPipFreezeOutput.call(this);
+            const lines = freezeOutput.split(EOL);
+            const depNames = lines.map(line => getDependencyName(line));
+            const pipShowOutput = getPipShowOutput.call(this, depNames);
+            allPipShowDeps = pipShowOutput.split(EOL + "---" + EOL);
         }
         else {
             pipDepTreeJsonArrayOutput = getDependencyTreeJsonFromPipDepTree(this.pathToPipBin, this.pathToPythonBin);
         }
-        if (usePipDepTree !== "true") {
-            pipShowOutput = getPipShowOutput.call(this, depNames);
-            allPipShowDeps = pipShowOutput.split(EOL + "---" + EOL);
-        }
-        //debug
-        // pipShowOutput = "alternative pip show output goes here for debugging"
         let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "true", this.options);
-        let linesOfRequirements = fs.readFileSync(this.pathToRequirements).toString().split(EOL).filter((line) => !line.trim().startsWith("#")).map(line => line.trim());
+        let parsedRequirements = await this.#parseRequirements();
         let CachedEnvironmentDeps = {};
         if (usePipDepTree !== "true") {
-            allPipShowDeps.forEach((record) => {
+            allPipShowDeps.forEach(record => {
                 let dependencyName = getDependencyNameShow(record).toLowerCase();
                 CachedEnvironmentDeps[dependencyName] = record;
                 CachedEnvironmentDeps[dependencyName.replace("-", "_")] = record;
@@ -210,42 +272,31 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
-        linesOfRequirements.forEach((dep) => {
-            // if matchManifestVersions setting is turned on , then
-            if (matchManifestVersions === "true") {
-                let dependencyName;
-                let manifestVersion;
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
+        parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
+            if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
+                return;
+            }
+            if (matchManifestVersions === "true" && manifestVersion != null) {
                 let installedVersion;
-                let doubleEqualSignPosition;
-                if (dep.includes("==")) {
-                    doubleEqualSignPosition = dep.indexOf("==");
-                    manifestVersion = dep.substring(doubleEqualSignPosition + 2).trim();
-                    if (manifestVersion.includes("#")) {
-                        let hashCharIndex = manifestVersion.indexOf("#");
-                        manifestVersion = manifestVersion.substring(0, hashCharIndex);
+                if (CachedEnvironmentDeps[depName.toLowerCase()] !== undefined) {
+                    if (usePipDepTree !== "true") {
+                        installedVersion = getDependencyVersion(CachedEnvironmentDeps[depName.toLowerCase()]);
                     }
-                    dependencyName = getDependencyName(dep);
-                    // only compare between declared version in manifest to installed version , if the package is installed.
-                    if (CachedEnvironmentDeps[dependencyName.toLowerCase()] !== undefined) {
-                        if (usePipDepTree !== "true") {
-                            installedVersion = getDependencyVersion(CachedEnvironmentDeps[dependencyName.toLowerCase()]);
-                        }
-                        else {
-                            installedVersion = CachedEnvironmentDeps[dependencyName.toLowerCase()].version;
-                        }
+                    else {
+                        installedVersion = CachedEnvironmentDeps[depName.toLowerCase()].version;
                     }
-                    if (installedVersion) {
-                        if (manifestVersion.trim() !== installedVersion.trim()) {
-                            throw new Error(`Can't continue with analysis - versions mismatch for dependency name ${dependencyName} (manifest version=${manifestVersion}, installed version=${installedVersion}).If you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting MATCH_MANIFEST_VERSIONS=false`);
-                        }
+                }
+                if (installedVersion) {
+                    if (manifestVersion.trim() !== installedVersion.trim()) {
+                        throw new Error(`Can't continue with analysis - versions mismatch for dependency name ${depName} (manifest version=${manifestVersion}, installed version=${installedVersion}).If you want to allow version mismatch for analysis between installed and requested packages, set environment variable/setting MATCH_MANIFEST_VERSIONS=false`);
                     }
                 }
             }
-            let path = new Array();
-            let depName = getDependencyName(dep);
-            //array to track a path for each branch in the dependency tree
+            let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -325,8 +376,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -347,18 +399,22 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         version = record.version;
         directDeps = record.dependencies;
     }
-    let targetDeps = new Array();
+    let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
-        let depArray = new Array();
+        let depArray = [];
         // to avoid infinite loop, check if the dependency not already on current path, before going recursively resolving its dependencies.
         if (!path.includes(dep.toLowerCase())) {
             // send to recurrsion the path + the current dep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra