@trustify-da/trustify-da-javascript-client 0.3.0-ea.8adb67b → 0.3.0-ea.9988076

package/dist/src/providers/python_pip.js

@@ -1,10 +1,11 @@
 import fs from 'node:fs';
-import { EOL } from 'os';
 import { PackageURL } from 'packageurl-js';
+import { readLicenseFile } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack };
+import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[]}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'
@@ -18,6 +19,13 @@ const ecosystem = 'pip';
 function isSupported(manifestName) {
     return 'requirements.txt' === manifestName;
 }
+/**
+ * Python requirements.txt has no standard license field
+ * @param {string} manifestPath - path to requirements.txt
+ * @returns {string|null}
+ */
+// eslint-disable-next-line no-unused-vars
+function readLicenseFromManifest(manifestPath) { return readLicenseFile(manifestPath); }
 /**
  * @param {string} manifestDir - the directory where the manifest lies
  */
@@ -26,12 +34,12 @@ function validateLockFile() { return true; }
  * Provide content and content type for python-pip stack analysis.
  * @param {string} manifest - the manifest path or name
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-function provideStack(manifest, opts = {}) {
+async function provideStack(manifest, opts = {}) {
     return {
         ecosystem,
-        content: createSbomStackAnalysis(manifest, opts),
+        content: await createSbomStackAnalysis(manifest, opts),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
@@ -39,12 +47,12 @@ function provideStack(manifest, opts = {}) {
  * Provide content and content type for python-pip component analysis.
  * @param {string} manifest - path to requirements.txt for component report
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {Provided}
+ * @returns {Promise<Provided>}
  */
-function provideComponent(manifest, opts = {}) {
+async function provideComponent(manifest, opts = {}) {
     return {
         ecosystem,
-        content: getSbomForComponentAnalysis(manifest, opts),
+        content: await getSbomForComponentAnalysis(manifest, opts),
         contentType: 'application/vnd.cyclonedx+json'
     };
 }
@@ -66,49 +74,34 @@ function addAllDependencies(source, dep, sbom) {
 }
 /**
  *
- * @param nameVersion
- * @return {string}
- */
-function splitToNameVersion(nameVersion) {
-    let result = [];
-    if (nameVersion.includes("==")) {
-        return nameVersion.split("==");
-    }
-    const regex = /[^\w\s-_]/g;
-    let endIndex = nameVersion.search(regex);
-    if (endIndex === -1) {
-        return [nameVersion.trim()];
-    }
-    result.push(nameVersion.substring(0, endIndex).trim());
-    return result;
-}
-/**
- *
- * @param {string} requirementTxtContent
+ * @param {string} manifest - path to requirements.txt
  * @return {PackageURL []}
  */
-function getIgnoredDependencies(requirementTxtContent) {
-    let requirementsLines = requirementTxtContent.split(EOL);
-    return requirementsLines
-        .filter(line => line.includes("#exhortignore") || line.includes("# exhortignore"))
-        .map((line) => line.substring(0, line.indexOf("#")).trim())
-        .map((name) => {
-        let nameVersion = splitToNameVersion(name);
-        if (nameVersion.length === 2) {
-            return toPurl(nameVersion[0], nameVersion[1]);
-        }
-        return toPurl(nameVersion[0], undefined);
+async function getIgnoredDependencies(manifest) {
+    const [parser, ignoreQuery, pinnedVersionQuery] = await Promise.all([
+        getParser(), getIgnoreQuery(), getPinnedVersionQuery()
+    ]);
+    const content = fs.readFileSync(manifest).toString();
+    const tree = parser.parse(content);
+    return ignoreQuery.matches(tree.rootNode).map(match => {
+        const reqNode = match.captures.find(c => c.name === 'req').node;
+        const name = match.captures.find(c => c.name === 'name').node.text;
+        const versionMatches = pinnedVersionQuery.matches(reqNode);
+        const version = versionMatches.length > 0
+            ? versionMatches[0].captures.find(c => c.name === 'version').node.text
+            : undefined;
+        return toPurl(name, version);
     });
 }
 /**
  *
- * @param {string} requirementTxtContent content of requirments.txt in string
+ * @param {string} manifest - path to requirements.txt
  * @param {Sbom} sbom object to filter out from it exhortignore dependencies.
  * @param {{Object}} opts - various options and settings for the application
  * @private
  */
-function handleIgnoredDependencies(requirementTxtContent, sbom, opts = {}) {
-    let ignoredDeps = getIgnoredDependencies(requirementTxtContent);
+async function handleIgnoredDependencies(manifest, sbom, opts = {}) {
+    let ignoredDeps = await getIgnoredDependencies(manifest);
     let matchManifestVersions = getCustom("MATCH_MANIFEST_VERSIONS", "true", opts);
     if (matchManifestVersions === "true") {
         const ignoredDepsVersion = ignoredDeps.filter(dep => dep.version !== undefined);
@@ -172,22 +165,22 @@ const DEFAULT_PIP_ROOT_COMPONENT_VERSION = "0.0.0";
  * Create sbom json string out of a manifest path for stack analysis.
  * @param {string} manifest - path for requirements.txt
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {string} the sbom json string content
+ * @returns {Promise<string>} the sbom json string content
  * @private
  */
-function createSbomStackAnalysis(manifest, opts = {}) {
+async function createSbomStackAnalysis(manifest, opts = {}) {
     let binaries = {};
     let createVirtualPythonEnv = handlePythonEnvironment(binaries, opts);
     let pythonController = new Python_controller(createVirtualPythonEnv === "false", binaries.pip, binaries.python, manifest, opts);
-    let dependencies = pythonController.getDependencies(true);
+    let dependencies = await pythonController.getDependencies(true);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
         addAllDependencies(rootPurl, dep, sbom);
     });
-    let requirementTxtContent = fs.readFileSync(manifest).toString();
-    handleIgnoredDependencies(requirementTxtContent, sbom, opts);
+    await handleIgnoredDependencies(manifest, sbom, opts);
     // In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
     // sbom.removeRootComponent()
     return sbom.getAsJsonString(opts);
@@ -196,22 +189,22 @@ function createSbomStackAnalysis(manifest, opts = {}) {
  * Create a sbom json string out of a manifest content for component analysis
  * @param {string} manifest - path to requirements.txt
  * @param {{}} [opts={}] - optional various options to pass along the application
- * @returns {string} the sbom json string content
+ * @returns {Promise<string>} the sbom json string content
  * @private
  */
-function getSbomForComponentAnalysis(manifest, opts = {}) {
+async function getSbomForComponentAnalysis(manifest, opts = {}) {
     let binaries = {};
     let createVirtualPythonEnv = handlePythonEnvironment(binaries, opts);
     let pythonController = new Python_controller(createVirtualPythonEnv === "false", binaries.pip, binaries.python, manifest, opts);
-    let dependencies = pythonController.getDependencies(false);
+    let dependencies = await pythonController.getDependencies(false);
     let sbom = new Sbom();
     const rootPurl = toPurl(DEFAULT_PIP_ROOT_COMPONENT_NAME, DEFAULT_PIP_ROOT_COMPONENT_VERSION);
-    sbom.addRoot(rootPurl);
+    const license = readLicenseFromManifest(manifest);
+    sbom.addRoot(rootPurl, license);
     dependencies.forEach(dep => {
         sbom.addDependency(rootPurl, toPurl(dep.name, dep.version));
     });
-    let requirementTxtContent = fs.readFileSync(manifest).toString();
-    handleIgnoredDependencies(requirementTxtContent, sbom, opts);
+    await handleIgnoredDependencies(manifest, sbom, opts);
     // In python there is no root component, then we must remove the dummy root we added, so the sbom json will be accepted by the DA backend
     // sbom.removeRootComponent()
     return sbom.getAsJsonString(opts);

package/dist/src/providers/requirements_parser.d.ts

@@ -0,0 +1,6 @@
+export function getParser(): Promise<Parser>;
+export function getRequirementQuery(): Promise<Query>;
+export function getIgnoreQuery(): Promise<Query>;
+export function getPinnedVersionQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/requirements_parser.js

@@ -0,0 +1,24 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-requirements.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getRequirementQuery() {
+    const language = await init();
+    return new Query(language, '(requirement (package) @name) @req');
+}
+export async function getIgnoreQuery() {
+    const language = await init();
+    return new Query(language, '((requirement (package) @name) @req . (comment) @comment (#match? @comment "^#[\\t ]*exhortignore"))');
+}
+export async function getPinnedVersionQuery() {
+    const language = await init();
+    return new Query(language, '(version_spec (version_cmp) @cmp (version) @version (#eq? @cmp "=="))');
+}

package/dist/src/providers/rust_cargo.d.ts

@@ -0,0 +1,47 @@
+declare namespace _default {
+    export { isSupported };
+    export { validateLockFile };
+    export { provideComponent };
+    export { provideStack };
+    export { readLicenseFromManifest };
+}
+export default _default;
+export type Provided = import("../provider").Provided;
+/**
+ * @param {string} manifestName - the subject manifest name-type
+ * @returns {boolean} - return true if `Cargo.toml` is the manifest name-type
+ */
+declare function isSupported(manifestName: string): boolean;
+/**
+ * Validates that Cargo.lock exists in the manifest directory or in a parent
+ * workspace root directory.  In Cargo workspaces the lock file always lives at
+ * the workspace root, so when a member crate's Cargo.toml is provided we walk
+ * up the directory tree looking for Cargo.lock (stopping when we find a
+ * Cargo.toml that contains a [workspace] section, or when we reach the
+ * filesystem root).
+ * @param {string} manifestDir - the directory where the manifest lies
+ * @returns {boolean} true if Cargo.lock is found
+ */
+declare function validateLockFile(manifestDir: string): boolean;
+/**
+ * Provide content and content type for Cargo component analysis.
+ * @param {string} manifest - path to Cargo.toml for component report
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideComponent(manifest: string, opts?: {}): Provided;
+/**
+ * Provide content and content type for Cargo stack analysis.
+ * @param {string} manifest - the manifest path
+ * @param {{}} [opts={}] - optional various options to pass along the application
+ * @returns {Provided}
+ */
+declare function provideStack(manifest: string, opts?: {}): Provided;
+/**
+ * Read project license from Cargo.toml, with fallback to LICENSE file.
+ * Supports the `license` field under `[package]` (single crate / workspace
+ * with root) and under `[workspace.package]` (virtual workspaces).
+ * @param {string} manifestPath - path to Cargo.toml
+ * @returns {string|null} SPDX identifier or null
+ */
+declare function readLicenseFromManifest(manifestPath: string): string | null;