@trustify-da/trustify-da-javascript-client 0.3.0-ea.a783c26 → 0.3.0-ea.ab5949f
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/package.json +19 -20
- package/dist/src/analysis.d.ts +7 -7
- package/dist/src/cyclone_dx_sbom.d.ts +7 -1
- package/dist/src/cyclone_dx_sbom.js +29 -8
- package/dist/src/index.d.ts +69 -10
- package/dist/src/index.js +73 -6
- package/dist/src/license/index.d.ts +3 -3
- package/dist/src/license/index.js +4 -1
- package/dist/src/license/license_utils.js +4 -1
- package/dist/src/license/licenses_api.d.ts +2 -2
- package/dist/src/oci_image/images.d.ts +1 -1
- package/dist/src/oci_image/utils.d.ts +5 -5
- package/dist/src/provider.d.ts +4 -3
- package/dist/src/provider.js +3 -1
- package/dist/src/providers/base_java.d.ts +14 -12
- package/dist/src/providers/base_java.js +18 -44
- package/dist/src/providers/base_javascript.d.ts +20 -9
- package/dist/src/providers/base_javascript.js +10 -3
- package/dist/src/providers/base_pyproject.d.ts +15 -6
- package/dist/src/providers/base_pyproject.js +12 -4
- package/dist/src/providers/golang_gomodules.d.ts +11 -1
- package/dist/src/providers/golang_gomodules.js +65 -8
- package/dist/src/providers/java_gradle.d.ts +19 -0
- package/dist/src/providers/java_gradle.js +116 -2
- package/dist/src/providers/java_gradle_groovy.d.ts +1 -1
- package/dist/src/providers/java_gradle_kotlin.d.ts +1 -1
- package/dist/src/providers/java_maven.d.ts +10 -2
- package/dist/src/providers/java_maven.js +165 -1
- package/dist/src/providers/javascript_bun.d.ts +10 -0
- package/dist/src/providers/javascript_bun.js +100 -0
- package/dist/src/providers/javascript_npm.d.ts +6 -1
- package/dist/src/providers/javascript_pnpm.js +6 -2
- package/dist/src/providers/marker_evaluator.d.ts +14 -0
- package/dist/src/providers/marker_evaluator.js +191 -0
- package/dist/src/providers/processors/yarn_berry_processor.d.ts +2 -2
- package/dist/src/providers/processors/yarn_classic_processor.d.ts +2 -2
- package/dist/src/providers/python_controller.d.ts +5 -1
- package/dist/src/providers/python_controller.js +58 -4
- package/dist/src/providers/python_pip.d.ts +5 -0
- package/dist/src/providers/python_pip.js +5 -5
- package/dist/src/providers/python_pip_pyproject.js +3 -1
- package/dist/src/providers/python_poetry.d.ts +63 -8
- package/dist/src/providers/python_poetry.js +132 -21
- package/dist/src/providers/python_uv.d.ts +20 -1
- package/dist/src/providers/python_uv.js +122 -2
- package/dist/src/providers/rust_cargo.d.ts +6 -2
- package/dist/src/providers/rust_cargo.js +31 -4
- package/dist/src/sbom.d.ts +7 -1
- package/dist/src/sbom.js +4 -2
- package/dist/src/tools.d.ts +28 -2
- package/dist/src/tools.js +58 -0
- package/dist/src/workspace.d.ts +9 -0
- package/dist/src/workspace.js +1 -1
- package/package.json +20 -21
package/dist/src/provider.js
CHANGED
|
@@ -3,6 +3,7 @@ import golangGomodulesProvider from './providers/golang_gomodules.js';
|
|
|
3
3
|
import Java_gradle_groovy from "./providers/java_gradle_groovy.js";
|
|
4
4
|
import Java_gradle_kotlin from "./providers/java_gradle_kotlin.js";
|
|
5
5
|
import Java_maven from "./providers/java_maven.js";
|
|
6
|
+
import Javascript_bun from './providers/javascript_bun.js';
|
|
6
7
|
import Javascript_npm from './providers/javascript_npm.js';
|
|
7
8
|
import Javascript_pnpm from './providers/javascript_pnpm.js';
|
|
8
9
|
import Javascript_yarn from './providers/javascript_yarn.js';
|
|
@@ -12,7 +13,7 @@ import Python_poetry from './providers/python_poetry.js';
|
|
|
12
13
|
import Python_uv from './providers/python_uv.js';
|
|
13
14
|
import rustCargoProvider from './providers/rust_cargo.js';
|
|
14
15
|
/** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
|
|
15
|
-
/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
|
|
16
|
+
/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
|
|
16
17
|
/**
|
|
17
18
|
* MUST include all providers here.
|
|
18
19
|
* @type {[Provider]}
|
|
@@ -21,6 +22,7 @@ export const availableProviders = [
|
|
|
21
22
|
new Java_maven(),
|
|
22
23
|
new Java_gradle_groovy(),
|
|
23
24
|
new Java_gradle_kotlin(),
|
|
25
|
+
new Javascript_bun(),
|
|
24
26
|
new Javascript_pnpm(),
|
|
25
27
|
new Javascript_yarn(),
|
|
26
28
|
new Javascript_npm(),
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export type ecosystem_maven =
|
|
1
|
+
export type ecosystem_maven = any;
|
|
2
2
|
/** @typedef {import('../provider').Provider} */
|
|
3
3
|
/** @typedef {import('../provider').Provided} Provided */
|
|
4
4
|
/** @typedef {{name: string, version: string}} Package */
|
|
@@ -20,6 +20,11 @@ export default class Base_Java {
|
|
|
20
20
|
CONFLICT_REGEX: RegExp;
|
|
21
21
|
globalBinary: string;
|
|
22
22
|
localWrapper: string;
|
|
23
|
+
/**
|
|
24
|
+
* Returns the package manager name (e.g. mvn, gradle)
|
|
25
|
+
* @returns {string}
|
|
26
|
+
*/
|
|
27
|
+
packageManagerName(): string;
|
|
23
28
|
/**
|
|
24
29
|
* Recursively populates the SBOM instance with the parsed graph
|
|
25
30
|
* @param {string} src - Source dependency to start the calculations from
|
|
@@ -28,6 +33,13 @@ export default class Base_Java {
|
|
|
28
33
|
* @param {Sbom} sbom - The SBOM where the dependencies are being added
|
|
29
34
|
*/
|
|
30
35
|
parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
|
|
36
|
+
/**
|
|
37
|
+
* Calculates how deep in the graph is the given line
|
|
38
|
+
* @param {string} line - line to calculate the depth from
|
|
39
|
+
* @returns {number} The calculated depth
|
|
40
|
+
* @protected
|
|
41
|
+
*/
|
|
42
|
+
protected _getDepth(line: string): number;
|
|
31
43
|
/**
|
|
32
44
|
* Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
|
|
33
45
|
* @param {string} line - line to parse from a dependencies.txt file
|
|
@@ -57,18 +69,8 @@ export default class Base_Java {
|
|
|
57
69
|
* @returns string
|
|
58
70
|
*/
|
|
59
71
|
selectToolBinary(manifestPath: string, opts: {}): string | null;
|
|
60
|
-
/**
|
|
61
|
-
*
|
|
62
|
-
* @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
|
|
63
|
-
* @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
|
|
64
|
-
* to the root of the drive the manifest is on (assumes absolute path is given)
|
|
65
|
-
* @returns {string|undefined}
|
|
66
|
-
*/
|
|
67
|
-
traverseForWrapper(startingManifest: string, repoRoot?: string): string | undefined;
|
|
68
|
-
normalizePath(thePath: any): string;
|
|
69
|
-
#private;
|
|
70
72
|
}
|
|
71
|
-
export type Provided =
|
|
73
|
+
export type Provided = any;
|
|
72
74
|
export type Package = {
|
|
73
75
|
name: string;
|
|
74
76
|
version: string;
|
|
@@ -1,7 +1,6 @@
|
|
|
1
|
-
import fs from 'node:fs';
|
|
2
1
|
import path from 'node:path';
|
|
3
2
|
import { PackageURL } from 'packageurl-js';
|
|
4
|
-
import { getCustomPath,
|
|
3
|
+
import { getCustomPath, getWrapperPreference, invokeCommand, traverseForWrapper } from "../tools.js";
|
|
5
4
|
/** @typedef {import('../provider').Provider} */
|
|
6
5
|
/** @typedef {import('../provider').Provided} Provided */
|
|
7
6
|
/** @typedef {{name: string, version: string}} Package */
|
|
@@ -26,6 +25,13 @@ export default class Base_Java {
|
|
|
26
25
|
this.globalBinary = globalBinary;
|
|
27
26
|
this.localWrapper = localWrapper;
|
|
28
27
|
}
|
|
28
|
+
/**
|
|
29
|
+
* Returns the package manager name (e.g. mvn, gradle)
|
|
30
|
+
* @returns {string}
|
|
31
|
+
*/
|
|
32
|
+
packageManagerName() {
|
|
33
|
+
return this.globalBinary;
|
|
34
|
+
}
|
|
29
35
|
/**
|
|
30
36
|
* Recursively populates the SBOM instance with the parsed graph
|
|
31
37
|
* @param {string} src - Source dependency to start the calculations from
|
|
@@ -42,7 +48,7 @@ export default class Base_Java {
|
|
|
42
48
|
}
|
|
43
49
|
let index = 0;
|
|
44
50
|
let target = lines[index];
|
|
45
|
-
let targetDepth = this
|
|
51
|
+
let targetDepth = this._getDepth(target);
|
|
46
52
|
while (targetDepth > srcDepth && index < lines.length) {
|
|
47
53
|
if (targetDepth === srcDepth + 1) {
|
|
48
54
|
let from = this.parseDep(src);
|
|
@@ -55,22 +61,25 @@ export default class Base_Java {
|
|
|
55
61
|
}
|
|
56
62
|
}
|
|
57
63
|
else {
|
|
58
|
-
this.parseDependencyTree(lines[index - 1], this
|
|
64
|
+
this.parseDependencyTree(lines[index - 1], this._getDepth(lines[index - 1]), lines.slice(index), sbom);
|
|
59
65
|
}
|
|
60
66
|
target = lines[++index];
|
|
61
|
-
targetDepth = this
|
|
67
|
+
targetDepth = this._getDepth(target);
|
|
62
68
|
}
|
|
63
69
|
}
|
|
64
70
|
/**
|
|
65
71
|
* Calculates how deep in the graph is the given line
|
|
66
72
|
* @param {string} line - line to calculate the depth from
|
|
67
73
|
* @returns {number} The calculated depth
|
|
68
|
-
* @
|
|
74
|
+
* @protected
|
|
69
75
|
*/
|
|
70
|
-
|
|
71
|
-
if (line ===
|
|
76
|
+
_getDepth(line) {
|
|
77
|
+
if (!line || line.trim() === '') {
|
|
72
78
|
return -1;
|
|
73
79
|
}
|
|
80
|
+
if (line.match(/^\w/)) {
|
|
81
|
+
return 0;
|
|
82
|
+
}
|
|
74
83
|
return ((line.indexOf('-') - 1) / 3) + 1;
|
|
75
84
|
}
|
|
76
85
|
/**
|
|
@@ -131,7 +140,7 @@ export default class Base_Java {
|
|
|
131
140
|
const toolPath = getCustomPath(this.globalBinary, opts);
|
|
132
141
|
const useWrapper = getWrapperPreference(this.globalBinary, opts);
|
|
133
142
|
if (useWrapper) {
|
|
134
|
-
const wrapper = this.
|
|
143
|
+
const wrapper = traverseForWrapper(manifestDir, this.localWrapper);
|
|
135
144
|
if (wrapper !== undefined) {
|
|
136
145
|
try {
|
|
137
146
|
this._invokeCommand(wrapper, ['--version'], { cwd: manifestDir });
|
|
@@ -156,39 +165,4 @@ export default class Base_Java {
|
|
|
156
165
|
}
|
|
157
166
|
return toolPath;
|
|
158
167
|
}
|
|
159
|
-
/**
|
|
160
|
-
*
|
|
161
|
-
* @param {string} startingManifest - the path of the manifest from which to start searching for the wrapper
|
|
162
|
-
* @param {string} repoRoot - the root of the repository at which point to stop searching for mvnw, derived via git if unset and then fallsback
|
|
163
|
-
* to the root of the drive the manifest is on (assumes absolute path is given)
|
|
164
|
-
* @returns {string|undefined}
|
|
165
|
-
*/
|
|
166
|
-
traverseForWrapper(startingManifest, repoRoot = undefined) {
|
|
167
|
-
const normalizedManifest = this.normalizePath(startingManifest);
|
|
168
|
-
const currentDir = this.normalizePath(path.dirname(normalizedManifest));
|
|
169
|
-
repoRoot = repoRoot || getGitRootDir(currentDir) || path.parse(normalizedManifest).root;
|
|
170
|
-
const wrapperPath = path.join(currentDir, this.localWrapper);
|
|
171
|
-
try {
|
|
172
|
-
fs.accessSync(wrapperPath, fs.constants.X_OK);
|
|
173
|
-
return wrapperPath;
|
|
174
|
-
}
|
|
175
|
-
catch (error) {
|
|
176
|
-
if (error.code === 'ENOENT') {
|
|
177
|
-
const rootDir = path.parse(currentDir).root;
|
|
178
|
-
if (currentDir === repoRoot || currentDir === rootDir) {
|
|
179
|
-
return undefined;
|
|
180
|
-
}
|
|
181
|
-
const parentDir = path.dirname(currentDir);
|
|
182
|
-
if (parentDir === currentDir || parentDir === rootDir) {
|
|
183
|
-
return undefined;
|
|
184
|
-
}
|
|
185
|
-
return this.traverseForWrapper(path.join(parentDir, path.basename(normalizedManifest)), repoRoot);
|
|
186
|
-
}
|
|
187
|
-
throw new Error(`failure searching for ${this.localWrapper}`, { cause: error });
|
|
188
|
-
}
|
|
189
|
-
}
|
|
190
|
-
normalizePath(thePath) {
|
|
191
|
-
const normalized = path.resolve(thePath).normalize();
|
|
192
|
-
return process.platform === 'win32' ? normalized.toLowerCase() : normalized;
|
|
193
|
-
}
|
|
194
168
|
}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export type purlType =
|
|
1
|
+
export type purlType = any;
|
|
2
2
|
/** @typedef {import('../provider').Provider} */
|
|
3
3
|
/** @typedef {import('../provider').Provided} Provided */
|
|
4
4
|
/**
|
|
@@ -19,7 +19,7 @@ export default class Base_javascript {
|
|
|
19
19
|
* @param {Object} opts - Configuration options for the provider
|
|
20
20
|
* @protected
|
|
21
21
|
*/
|
|
22
|
-
protected _setUp(manifestPath: string, opts:
|
|
22
|
+
protected _setUp(manifestPath: string, opts: Object): void;
|
|
23
23
|
/**
|
|
24
24
|
* Gets the current manifest object
|
|
25
25
|
* @returns {Manifest} The manifest object
|
|
@@ -47,6 +47,11 @@ export default class Base_javascript {
|
|
|
47
47
|
*/
|
|
48
48
|
protected _cmdName(): string;
|
|
49
49
|
/**
|
|
50
|
+
* Returns the package manager name (e.g. npm, yarn, pnpm, bun)
|
|
51
|
+
* @returns {string} The package manager name
|
|
52
|
+
*/
|
|
53
|
+
packageManagerName(): string;
|
|
54
|
+
/**
|
|
50
55
|
* Returns the command arguments for listing dependencies
|
|
51
56
|
* @returns {Array<string>} The command arguments
|
|
52
57
|
* @abstract
|
|
@@ -86,21 +91,21 @@ export default class Base_javascript {
|
|
|
86
91
|
* @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
|
|
87
92
|
* @returns {boolean} True if the lock file exists
|
|
88
93
|
*/
|
|
89
|
-
validateLockFile(manifestDir: string, opts?:
|
|
94
|
+
validateLockFile(manifestDir: string, opts?: Object): boolean;
|
|
90
95
|
/**
|
|
91
96
|
* Provides content and content type for stack analysis
|
|
92
97
|
* @param {string} manifestPath - The manifest path or name
|
|
93
98
|
* @param {Object} [opts={}] - Optional configuration options
|
|
94
99
|
* @returns {Provided} The provided data for stack analysis
|
|
95
100
|
*/
|
|
96
|
-
provideStack(manifestPath: string, opts?:
|
|
101
|
+
provideStack(manifestPath: string, opts?: Object): Provided;
|
|
97
102
|
/**
|
|
98
103
|
* Provides content and content type for component analysis
|
|
99
104
|
* @param {string} manifestPath - Path to package.json for component report
|
|
100
105
|
* @param {Object} [opts={}] - Optional configuration options
|
|
101
106
|
* @returns {Provided} The provided data for component analysis
|
|
102
107
|
*/
|
|
103
|
-
provideComponent(manifestPath: string, opts?:
|
|
108
|
+
provideComponent(manifestPath: string, opts?: Object): Provided;
|
|
104
109
|
/**
|
|
105
110
|
* Read license from manifest (package.json). Reused by npm, pnpm, yarn.
|
|
106
111
|
* @param {string} manifestPath - path to package.json
|
|
@@ -114,21 +119,21 @@ export default class Base_javascript {
|
|
|
114
119
|
* @returns {Object} The dependency tree
|
|
115
120
|
* @protected
|
|
116
121
|
*/
|
|
117
|
-
protected _buildDependencyTree(includeTransitive: boolean, opts?:
|
|
122
|
+
protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
|
|
118
123
|
/**
|
|
119
124
|
* Recursively builds the Sbom from the JSON that npm listing returns
|
|
120
125
|
* @param {Sbom} sbom - The SBOM object to add dependencies to
|
|
121
126
|
* @param {Object} depTree - The current dependency tree
|
|
122
127
|
* @protected
|
|
123
128
|
*/
|
|
124
|
-
protected _addDependenciesToSbom(sbom: Sbom, depTree:
|
|
129
|
+
protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
|
|
125
130
|
/**
|
|
126
131
|
* Extracts root dependencies from the dependency tree
|
|
127
132
|
* @param {Object} depTree - The dependency tree object
|
|
128
133
|
* @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
|
|
129
134
|
* @protected
|
|
130
135
|
*/
|
|
131
|
-
protected _getRootDependencies(depTree:
|
|
136
|
+
protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
|
|
132
137
|
/**
|
|
133
138
|
* Gets the version of the package manager
|
|
134
139
|
* @returns {string} The version string of the package manager
|
|
@@ -136,6 +141,12 @@ export default class Base_javascript {
|
|
|
136
141
|
*/
|
|
137
142
|
protected _version(): string;
|
|
138
143
|
/**
|
|
144
|
+
* Creates or updates the lock file for the package manager
|
|
145
|
+
* @param {string} manifestDir - Directory containing the manifest file
|
|
146
|
+
* @protected
|
|
147
|
+
*/
|
|
148
|
+
protected _createLockFile(manifestDir: string): void;
|
|
149
|
+
/**
|
|
139
150
|
* Parses the dependency tree output
|
|
140
151
|
* @param {string} output - The output to parse
|
|
141
152
|
* @returns {string} The parsed output
|
|
@@ -144,6 +155,6 @@ export default class Base_javascript {
|
|
|
144
155
|
protected _parseDepTreeOutput(output: string): string;
|
|
145
156
|
#private;
|
|
146
157
|
}
|
|
147
|
-
export type Provided =
|
|
158
|
+
export type Provided = any;
|
|
148
159
|
import Manifest from './manifest.js';
|
|
149
160
|
import Sbom from '../sbom.js';
|
|
@@ -71,6 +71,13 @@ export default class Base_javascript {
|
|
|
71
71
|
throw new TypeError("_cmdName must be implemented");
|
|
72
72
|
}
|
|
73
73
|
/**
|
|
74
|
+
* Returns the package manager name (e.g. npm, yarn, pnpm, bun)
|
|
75
|
+
* @returns {string} The package manager name
|
|
76
|
+
*/
|
|
77
|
+
packageManagerName() {
|
|
78
|
+
return this._cmdName();
|
|
79
|
+
}
|
|
80
|
+
/**
|
|
74
81
|
* Returns the command arguments for listing dependencies
|
|
75
82
|
* @returns {Array<string>} The command arguments
|
|
76
83
|
* @abstract
|
|
@@ -217,7 +224,7 @@ export default class Base_javascript {
|
|
|
217
224
|
this._version();
|
|
218
225
|
const manifestDir = path.dirname(this.#manifest.manifestPath);
|
|
219
226
|
const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
|
|
220
|
-
this
|
|
227
|
+
this._createLockFile(cmdDir);
|
|
221
228
|
let output = this.#executeListCmd(includeTransitive, cmdDir);
|
|
222
229
|
output = this._parseDepTreeOutput(output);
|
|
223
230
|
return JSON.parse(output);
|
|
@@ -363,9 +370,9 @@ export default class Base_javascript {
|
|
|
363
370
|
/**
|
|
364
371
|
* Creates or updates the lock file for the package manager
|
|
365
372
|
* @param {string} manifestDir - Directory containing the manifest file
|
|
366
|
-
* @
|
|
373
|
+
* @protected
|
|
367
374
|
*/
|
|
368
|
-
|
|
375
|
+
_createLockFile(manifestDir) {
|
|
369
376
|
const originalDir = process.cwd();
|
|
370
377
|
const isWindows = os.platform() === 'win32';
|
|
371
378
|
if (isWindows) {
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
/** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
|
|
1
|
+
/** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
|
|
2
2
|
/** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
|
|
3
3
|
/** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
|
|
4
4
|
/** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
|
|
@@ -13,7 +13,7 @@ export default class Base_pyproject {
|
|
|
13
13
|
* @param {Object} [opts={}]
|
|
14
14
|
* @returns {boolean}
|
|
15
15
|
*/
|
|
16
|
-
validateLockFile(manifestDir: string, opts?:
|
|
16
|
+
validateLockFile(manifestDir: string, opts?: Object): boolean;
|
|
17
17
|
/**
|
|
18
18
|
* Walk up from manifestDir to find the directory containing the lock file.
|
|
19
19
|
* Follows the same pattern as Base_javascript._findLockFileDir().
|
|
@@ -22,7 +22,7 @@ export default class Base_pyproject {
|
|
|
22
22
|
* @returns {string|null}
|
|
23
23
|
* @protected
|
|
24
24
|
*/
|
|
25
|
-
protected _findLockFileDir(manifestDir: string, opts?:
|
|
25
|
+
protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
|
|
26
26
|
/**
|
|
27
27
|
* Detect workspace root boundaries.
|
|
28
28
|
* Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
|
|
@@ -44,13 +44,13 @@ export default class Base_pyproject {
|
|
|
44
44
|
* @param {Object} [opts={}]
|
|
45
45
|
* @returns {Promise<Provided>}
|
|
46
46
|
*/
|
|
47
|
-
provideStack(manifest: string, opts?:
|
|
47
|
+
provideStack(manifest: string, opts?: Object): Promise<Provided>;
|
|
48
48
|
/**
|
|
49
49
|
* @param {string} manifest - path to pyproject.toml
|
|
50
50
|
* @param {Object} [opts={}]
|
|
51
51
|
* @returns {Promise<Provided>}
|
|
52
52
|
*/
|
|
53
|
-
provideComponent(manifest: string, opts?:
|
|
53
|
+
provideComponent(manifest: string, opts?: Object): Promise<Provided>;
|
|
54
54
|
/**
|
|
55
55
|
* @returns {string}
|
|
56
56
|
* @protected
|
|
@@ -61,6 +61,11 @@ export default class Base_pyproject {
|
|
|
61
61
|
* @protected
|
|
62
62
|
*/
|
|
63
63
|
protected _cmdName(): string;
|
|
64
|
+
/**
|
|
65
|
+
* Returns the package manager name (e.g. pip, poetry, uv)
|
|
66
|
+
* @returns {string}
|
|
67
|
+
*/
|
|
68
|
+
packageManagerName(): string;
|
|
64
69
|
/**
|
|
65
70
|
* Resolve dependencies using the tool-specific command and parser.
|
|
66
71
|
*
|
|
@@ -72,7 +77,7 @@ export default class Base_pyproject {
|
|
|
72
77
|
* @returns {Promise<DependencyData>}
|
|
73
78
|
* @protected
|
|
74
79
|
*/
|
|
75
|
-
protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts:
|
|
80
|
+
protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
|
|
76
81
|
/**
|
|
77
82
|
* Canonicalize a Python package name per PEP 503.
|
|
78
83
|
* @param {string} name
|
|
@@ -131,6 +136,10 @@ export type GraphEntry = {
|
|
|
131
136
|
name: string;
|
|
132
137
|
version: string;
|
|
133
138
|
children: string[];
|
|
139
|
+
hashes?: Array<{
|
|
140
|
+
alg: string;
|
|
141
|
+
content: string;
|
|
142
|
+
}>;
|
|
134
143
|
};
|
|
135
144
|
export type DepTreeEntry = {
|
|
136
145
|
name: string;
|
|
@@ -7,9 +7,10 @@ import Sbom from '../sbom.js';
|
|
|
7
7
|
import { getCustom } from '../tools.js';
|
|
8
8
|
const ecosystem = 'pip';
|
|
9
9
|
const IGNORE_MARKERS = ['exhortignore', 'trustify-da-ignore'];
|
|
10
|
+
const NO_SCOPE = undefined;
|
|
10
11
|
const DEFAULT_ROOT_NAME = 'default-pip-root';
|
|
11
12
|
const DEFAULT_ROOT_VERSION = '0.0.0';
|
|
12
|
-
/** @typedef {{name: string, version: string, children: string[]}} GraphEntry */
|
|
13
|
+
/** @typedef {{name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}} GraphEntry */
|
|
13
14
|
/** @typedef {{name: string, version: string, dependencies: DepTreeEntry[]}} DepTreeEntry */
|
|
14
15
|
/** @typedef {{directDeps: string[], graph: Map<string, GraphEntry>}} DependencyData */
|
|
15
16
|
/** @typedef {{ecosystem: string, content: string, contentType: string}} Provided */
|
|
@@ -144,6 +145,13 @@ export default class Base_pyproject {
|
|
|
144
145
|
_cmdName() {
|
|
145
146
|
throw new TypeError('_cmdName must be implemented');
|
|
146
147
|
}
|
|
148
|
+
/**
|
|
149
|
+
* Returns the package manager name (e.g. pip, poetry, uv)
|
|
150
|
+
* @returns {string}
|
|
151
|
+
*/
|
|
152
|
+
packageManagerName() {
|
|
153
|
+
return this._cmdName();
|
|
154
|
+
}
|
|
147
155
|
/**
|
|
148
156
|
* Resolve dependencies using the tool-specific command and parser.
|
|
149
157
|
*
|
|
@@ -281,7 +289,7 @@ export default class Base_pyproject {
|
|
|
281
289
|
continue;
|
|
282
290
|
}
|
|
283
291
|
let entry = graph.get(key);
|
|
284
|
-
sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version));
|
|
292
|
+
sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
|
|
285
293
|
}
|
|
286
294
|
for (let [key, entry] of graph) {
|
|
287
295
|
if (!reachable.has(key)) {
|
|
@@ -293,7 +301,7 @@ export default class Base_pyproject {
|
|
|
293
301
|
continue;
|
|
294
302
|
}
|
|
295
303
|
let childEntry = graph.get(child);
|
|
296
|
-
sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version));
|
|
304
|
+
sbom.addDependency(parentPurl, this._toPurl(childEntry.name, childEntry.version), NO_SCOPE, childEntry.hashes);
|
|
297
305
|
}
|
|
298
306
|
}
|
|
299
307
|
}
|
|
@@ -306,7 +314,7 @@ export default class Base_pyproject {
|
|
|
306
314
|
if (!entry) {
|
|
307
315
|
continue;
|
|
308
316
|
}
|
|
309
|
-
sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version));
|
|
317
|
+
sbom.addDependency(rootPurl, this._toPurl(entry.name, entry.version), NO_SCOPE, entry.hashes);
|
|
310
318
|
}
|
|
311
319
|
}
|
|
312
320
|
return sbom.getAsJsonString(opts);
|
|
@@ -1,12 +1,22 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Discover all go.mod manifest paths in a Go workspace.
|
|
3
|
+
* Uses `go work edit -json` to get workspace members.
|
|
4
|
+
*
|
|
5
|
+
* @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
|
|
6
|
+
* @param {import('../index.js').Options} [opts={}]
|
|
7
|
+
* @returns {Promise<string[]>} Paths to go.mod files (absolute)
|
|
8
|
+
*/
|
|
9
|
+
export function discoverGoWorkspaceModules(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
|
|
1
10
|
declare namespace _default {
|
|
2
11
|
export { isSupported };
|
|
3
12
|
export { validateLockFile };
|
|
4
13
|
export { provideComponent };
|
|
5
14
|
export { provideStack };
|
|
6
15
|
export { readLicenseFromManifest };
|
|
16
|
+
export function packageManagerName(): string;
|
|
7
17
|
}
|
|
8
18
|
export default _default;
|
|
9
|
-
export type Provided =
|
|
19
|
+
export type Provided = any;
|
|
10
20
|
export type Package = {
|
|
11
21
|
name: string;
|
|
12
22
|
version: string;
|
|
@@ -4,8 +4,9 @@ import { PackageURL } from 'packageurl-js';
|
|
|
4
4
|
import { readLicenseFile } from '../license/license_utils.js';
|
|
5
5
|
import Sbom from '../sbom.js';
|
|
6
6
|
import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
|
|
7
|
+
import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
|
|
7
8
|
import { getParser, getRequireQuery } from './gomod_parser.js';
|
|
8
|
-
export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
|
|
9
|
+
export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
|
|
9
10
|
/** @typedef {import('../provider').Provider} */
|
|
10
11
|
/** @typedef {import('../provider').Provided} Provided */
|
|
11
12
|
/** @typedef {{name: string, version: string}} Package */
|
|
@@ -328,13 +329,7 @@ function getFinalPackagesVersionsForModule(rows, manifestPath, goBin) {
|
|
|
328
329
|
catch (error) {
|
|
329
330
|
throw new Error('failed to list all modules', { cause: error });
|
|
330
331
|
}
|
|
331
|
-
let finalVersionModules =
|
|
332
|
-
finalVersionsForAllModules.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
|
|
333
|
-
.filter(string => string.trim().split(" ").length === 2)
|
|
334
|
-
.forEach((dependency) => {
|
|
335
|
-
let dep = dependency.split(" ");
|
|
336
|
-
finalVersionModules[dep[0]] = dep[1];
|
|
337
|
-
});
|
|
332
|
+
let finalVersionModules = parseModuleVersions(finalVersionsForAllModules);
|
|
338
333
|
let finalVersionModulesArray = new Array();
|
|
339
334
|
rows.filter(string => string.trim() !== "").forEach(module => {
|
|
340
335
|
let child = getChildVertexFromEdge(module);
|
|
@@ -395,7 +390,69 @@ function getVersionOfPackage(fullPackage) {
|
|
|
395
390
|
let parts = fullPackage.split("@");
|
|
396
391
|
return parts.length > 1 ? parts[1] : undefined;
|
|
397
392
|
}
|
|
393
|
+
function parseModuleVersions(goListOutput) {
|
|
394
|
+
let modules = {};
|
|
395
|
+
goListOutput.split(getLineSeparatorGolang()).filter(string => string.trim() !== "")
|
|
396
|
+
.forEach((line) => {
|
|
397
|
+
let parts = line.trim().split(" ");
|
|
398
|
+
if (parts.length === 2) {
|
|
399
|
+
modules[parts[0]] = parts[1];
|
|
400
|
+
}
|
|
401
|
+
else if (parts.length >= 4 && parts[2] === "=>") {
|
|
402
|
+
modules[parts[0]] = parts[parts.length - 1];
|
|
403
|
+
}
|
|
404
|
+
});
|
|
405
|
+
return modules;
|
|
406
|
+
}
|
|
398
407
|
function getLineSeparatorGolang() {
|
|
399
408
|
let reg = /\n|\r\n/;
|
|
400
409
|
return reg;
|
|
401
410
|
}
|
|
411
|
+
/**
|
|
412
|
+
* Discover all go.mod manifest paths in a Go workspace.
|
|
413
|
+
* Uses `go work edit -json` to get workspace members.
|
|
414
|
+
*
|
|
415
|
+
* @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain go.work)
|
|
416
|
+
* @param {import('../index.js').Options} [opts={}]
|
|
417
|
+
* @returns {Promise<string[]>} Paths to go.mod files (absolute)
|
|
418
|
+
*/
|
|
419
|
+
export async function discoverGoWorkspaceModules(workspaceRoot, opts = {}) {
|
|
420
|
+
const root = path.resolve(workspaceRoot);
|
|
421
|
+
const goWork = path.join(root, 'go.work');
|
|
422
|
+
if (!fs.existsSync(goWork)) {
|
|
423
|
+
return [];
|
|
424
|
+
}
|
|
425
|
+
const goBin = getCustomPath('go', opts);
|
|
426
|
+
let output;
|
|
427
|
+
try {
|
|
428
|
+
output = invokeCommand(goBin, ['work', 'edit', '-json', goWork], { cwd: root });
|
|
429
|
+
}
|
|
430
|
+
catch {
|
|
431
|
+
return [];
|
|
432
|
+
}
|
|
433
|
+
let workspace;
|
|
434
|
+
try {
|
|
435
|
+
workspace = JSON.parse(output.toString().trim());
|
|
436
|
+
}
|
|
437
|
+
catch {
|
|
438
|
+
return [];
|
|
439
|
+
}
|
|
440
|
+
const useEntries = workspace.Use || [];
|
|
441
|
+
if (useEntries.length === 0) {
|
|
442
|
+
return [];
|
|
443
|
+
}
|
|
444
|
+
const manifestPaths = [];
|
|
445
|
+
for (const entry of useEntries) {
|
|
446
|
+
const diskPath = entry.DiskPath;
|
|
447
|
+
if (!diskPath) {
|
|
448
|
+
continue;
|
|
449
|
+
}
|
|
450
|
+
const moduleDir = path.resolve(root, diskPath);
|
|
451
|
+
const goMod = path.join(moduleDir, 'go.mod');
|
|
452
|
+
if (fs.existsSync(goMod)) {
|
|
453
|
+
manifestPaths.push(goMod);
|
|
454
|
+
}
|
|
455
|
+
}
|
|
456
|
+
const ignorePatterns = resolveWorkspaceDiscoveryIgnore(opts);
|
|
457
|
+
return filterManifestPathsByDiscoveryIgnore(manifestPaths, root, ignorePatterns);
|
|
458
|
+
}
|
|
@@ -1,3 +1,22 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Discover all build.gradle[.kts] manifest paths in a Gradle multi-project build.
|
|
3
|
+
* Uses a custom init script to get structured project listing.
|
|
4
|
+
*
|
|
5
|
+
* @param {string} workspaceRoot - Absolute or relative path to workspace root (must contain settings.gradle[.kts])
|
|
6
|
+
* @param {import('../index.js').Options} [opts={}]
|
|
7
|
+
* @returns {Promise<string[]>} Paths to build.gradle[.kts] files (absolute)
|
|
8
|
+
*/
|
|
9
|
+
export function discoverGradleSubprojects(workspaceRoot: string, opts?: import("../index.js").Options): Promise<string[]>;
|
|
10
|
+
/**
|
|
11
|
+
* Parse the structured output from the Gradle init script.
|
|
12
|
+
*
|
|
13
|
+
* @param {string} raw - Raw stdout from gradle
|
|
14
|
+
* @returns {{ path: string, dir: string }[]}
|
|
15
|
+
*/
|
|
16
|
+
export function parseGradleInitScriptOutput(raw: string): {
|
|
17
|
+
path: string;
|
|
18
|
+
dir: string;
|
|
19
|
+
}[];
|
|
1
20
|
/**
|
|
2
21
|
* This class provides common functionality for Groovy and Kotlin DSL files.
|
|
3
22
|
*/
|