@trustify-da/trustify-da-javascript-client 0.3.0-ea.bbe2094 → 0.3.0-ea.bdaadb2

package/dist/src/providers/oci_dockerfile.js

@@ -0,0 +1,177 @@
+import fs from 'node:fs';
+import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js';
+import { getArgQuery, getFromQuery, getParser } from './containerfile_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci'; } };
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
+/**
+ * @type {string} ecosystem identifier for OCI image packages
+ * @private
+ */
+const ecosystem = 'oci';
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+function isSupported(manifestName) {
+    return /^(Dockerfile|Containerfile)(\..+)?$/.test(manifestName);
+}
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+function validateLockFile() { return true; }
+/**
+ * Check whether a syntax node contains any expansion (variable substitution) children.
+ * @param {import('web-tree-sitter').SyntaxNode} node
+ * @returns {boolean}
+ * @private
+ */
+function containsExpansion(node) {
+    if (node.type === 'expansion') {
+        return true;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        if (containsExpansion(node.child(i))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+    if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+        return text.slice(1, -1);
+    }
+    return text;
+}
+/**
+ * Collect ARG key-value pairs from the Dockerfile AST.
+ * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
+ * @param {import('web-tree-sitter').Tree} tree the parsed Dockerfile tree
+ * @param {import('web-tree-sitter').Query} argQuery the tree-sitter query for arg_instruction nodes
+ * @returns {Map<string, string>} map of ARG names to their default values
+ * @private
+ */
+function collectArgs(tree, argQuery) {
+    const args = new Map();
+    for (const match of argQuery.matches(tree.rootNode)) {
+        const name = match.captures.find(c => c.name === 'name')?.node.text;
+        const defaultValue = match.captures.find(c => c.name === 'default')?.node.text;
+        if (name && defaultValue) {
+            args.set(name, stripQuotes(defaultValue));
+        }
+    }
+    return args;
+}
+/**
+ * Resolve ARG substitutions in an image spec text using the collected ARG map.
+ * Replaces ${VAR} and $VAR patterns with their ARG default values.
+ * @param {string} text the image spec text potentially containing variable references
+ * @param {Map<string, string>} args map of ARG names to their default values
+ * @returns {string|null} the resolved text, or null if any variable could not be resolved
+ * @private
+ */
+function resolveArgs(text, args) {
+    let resolved = text;
+    let hasUnresolved = false;
+    resolved = resolved.replace(/\$\{([^}]+)\}|\$([A-Za-z_]\w*)/g, (_match, braced, plain) => {
+        const key = braced || plain;
+        if (args.has(key)) {
+            return args.get(key);
+        }
+        hasUnresolved = true;
+        return _match;
+    });
+    return hasUnresolved ? null : resolved;
+}
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
+ */
+export async function parseAllFromImages(manifestContent) {
+    const [parser, fromQuery, argQuery] = await Promise.all([getParser(), getFromQuery(), getArgQuery()]);
+    const tree = parser.parse(manifestContent);
+    const matches = fromQuery.matches(tree.rootNode);
+    if (matches.length === 0) {
+        throw new Error('No FROM line found in Dockerfile');
+    }
+    const args = collectArgs(tree, argQuery);
+    const images = [];
+    for (const match of matches) {
+        const imageSpec = match.captures.find(c => c.name === 'image').node;
+        if (containsExpansion(imageSpec)) {
+            const resolved = resolveArgs(imageSpec.text, args);
+            if (resolved != null) {
+                images.push(resolved);
+            }
+            continue;
+        }
+        images.push(imageSpec.text);
+    }
+    if (images.length === 0) {
+        throw new Error('Dockerfile uses ARG substitution in all FROM lines — cannot resolve variable references');
+    }
+    return images;
+}
+/**
+ * Generate image SBOMs for all FROM instructions in a Dockerfile manifest using syft.
+ * Returns a batch result with a purl-to-SBOM map suitable for the batch-analysis endpoint.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string, batch: boolean}>}
+ * @private
+ */
+async function getImageSBOM(manifest, opts = {}) {
+    const manifestContent = fs.readFileSync(manifest, 'utf-8');
+    const images = await parseAllFromImages(manifestContent);
+    const sbomByPurl = {};
+    for (const image of images) {
+        const imageRef = parseImageRef(image, opts);
+        const purl = imageRef.getPackageURL().toString();
+        if (purl in sbomByPurl)
+            continue;
+        sbomByPurl[purl] = generateImageSBOM(imageRef, opts);
+    }
+    return {
+        ecosystem,
+        content: JSON.stringify(sbomByPurl),
+        contentType: 'application/vnd.cyclonedx+json',
+        batch: true
+    };
+}
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideComponent(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideStack(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+function readLicenseFromManifest() { return null; }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -29,13 +29,17 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_berry_processor.js

@@ -78,8 +78,9 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree) {
             return;
         }
@@ -137,7 +138,7 @@ export default class Yarn_berry_processor extends Yarn_processor {
                 }
                 const to = this.#purlFromLocator(d.locator);
                 if (to) {
-                    sbom.addDependency(from, to);
+                    sbom.addDependency(from, to, undefined, hashesForPurl(to));
                 }
             });
         });

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -25,13 +25,17 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object, hashesForPurl?: (arg0: PackageURL) => (Array<{
+        alg: string;
+        content: string;
+    }> | undefined)): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.js

@@ -50,8 +50,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} [hashesForPurl] - Resolves lock-file hashes for a purl
    */
-    addDependenciesToSbom(sbom, depTree) {
+    addDependenciesToSbom(sbom, depTree, hashesForPurl = () => undefined) {
         if (!depTree?.data?.trees) {
             return;
         }
@@ -60,12 +61,12 @@ export default class Yarn_classic_processor extends Yarn_processor {
         depTree.data.trees.forEach(n => {
             const dep = new NodeMetaData(n);
             if (this._manifest.dependencies.includes(dep.name)) {
-                sbom.addDependency(rootPurl, dep.purl);
+                sbom.addDependency(rootPurl, dep.purl, undefined, hashesForPurl(dep.purl));
             }
             purls.set(dep.name, dep.purl);
         });
         depTree.data.trees.forEach(n => {
-            this.#addChildrenToSbom(sbom, n, purls);
+            this.#addChildrenToSbom(sbom, n, purls, hashesForPurl);
         });
     }
     /**
@@ -73,9 +74,10 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} node - The current dependency node
    * @param {Map<string, PackageURL>} purls - Map of dependency names to their PackageURL objects
+   * @param {function(PackageURL): (Array<{alg: string, content: string}>|undefined)} hashesForPurl - Resolves lock-file hashes for a purl
    * @private
    */
-    #addChildrenToSbom(sbom, node, purls) {
+    #addChildrenToSbom(sbom, node, purls, hashesForPurl) {
         const dep = new NodeMetaData(node);
         const children = node.children ? node.children : [];
         children.forEach(c => {
@@ -83,9 +85,9 @@ export default class Yarn_classic_processor extends Yarn_processor {
             const from = dep.shadow ? purls.get(dep.name) : dep.purl;
             const to = child.shadow ? purls.get(child.name) : child.purl;
             if (from && to) {
-                sbom.addDependency(from, to);
+                sbom.addDependency(from, to, undefined, hashesForPurl(to));
             }
-            this.#addChildrenToSbom(sbom, c, purls);
+            this.#addChildrenToSbom(sbom, c, purls, hashesForPurl);
         });
     }
 }

package/dist/src/providers/python_controller.js

@@ -19,6 +19,53 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
@@ -131,8 +178,11 @@ export default class Python_controller {
             startingTime = new Date();
             console.log("Starting time to get requirements.txt dependency tree = " + startingTime);
         }
+        let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
+        if (installBestEfforts === "true" && this.realEnvironment) {
+            throw new Error("Conflicting settings, TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS=true requires TRUSTIFY_DA_PYTHON_VIRTUAL_ENV=true");
+        }
         if (!this.realEnvironment) {
-            let installBestEfforts = getCustom("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "false", this.options);
             if (installBestEfforts === "false") {
                 try {
                     invokeCommand(this.pathToPipBin, ['install', '-r', this.pathToRequirements]);
@@ -225,6 +275,8 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
         parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
             if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
                 return;
@@ -247,7 +299,7 @@ export default class Python_controller {
             }
             let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -327,8 +379,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -350,7 +403,11 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         directDeps = record.dependencies;
     }
     let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
         let depArray = [];
@@ -360,7 +417,7 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra

package/dist/src/providers/python_pip.d.ts

@@ -4,6 +4,7 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
 export type DependencyEntry = {

package/dist/src/providers/python_pip.js

@@ -5,7 +5,7 @@ import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
 import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'pip'; } };
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'

package/dist/src/providers/python_poetry.d.ts

@@ -1,4 +1,5 @@
 export default class Python_poetry extends Base_pyproject {
+    _verifyPoetryAccessible(poetryBin: any): void;
     /**
      * @param {string} manifestDir
      * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -6,7 +7,7 @@ export default class Python_poetry extends Base_pyproject {
      * @param {Object} opts
      * @returns {Promise<{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}>}
      */
-    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts: any): Promise<{
+    _getDependencyData(manifestDir: string, _workspaceDir: string, parsed: object, opts: Object): Promise<{
         directDeps: string[];
         graph: Map<string, {
             name: string;
@@ -18,17 +19,17 @@ export default class Python_poetry extends Base_pyproject {
      * Get poetry show --tree output.
      * @param {string} manifestDir
      * @param {boolean} hasDevGroup
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir: string, hasDevGroup: boolean, opts: any): string;
+    _getPoetryShowTreeOutput(manifestDir: string, hasDevGroup: boolean, poetryBin: string): string;
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir: string, opts: any): string;
+    _getPoetryShowAllOutput(manifestDir: string, poetryBin: string): string;
     /**
      * Parse poetry show --all output into a version map.
      * Lines look like: "name         (!) 1.2.3  Description text..."
@@ -46,29 +47,51 @@ export default class Python_poetry extends Base_pyproject {
      *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
      * @param {string|null} lockDir
      * @param {object} parsed - parsed pyproject.toml
-     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}}
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
      */
     _extractMarkerData(lockDir: string | null, parsed: object): {
         directMarkers: Map<string, string>;
         transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
     };
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files?: Array<{
+        file: string;
+        hash: string;
+    }>): string | null;
     /**
      * Parse poetry show --tree output into a dependency graph structure.
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}} markerData
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
     _parsePoetryTree(treeOutput: string, versionMap: Map<string, string>, markerData: {
         directMarkers: Map<string, string>;
         transitiveMarkers: Map<string, Map<string, string>>;
+        hashMap: Map<string, Array<{
+            alg: string;
+            content: string;
+        }>>;
     }): {
         directDeps: string[];
         graph: Map<string, {
             name: string;
             version: string;
             children: string[];
+            hashes?: Array<{
+                alg: string;
+                content: string;
+            }>;
         }>;
     };
 }

package/dist/src/providers/python_poetry.js

@@ -32,6 +32,17 @@ export default class Python_poetry extends Base_pyproject {
     _cmdName() {
         return 'poetry';
     }
+    _verifyPoetryAccessible(poetryBin) {
+        try {
+            invokeCommand(poetryBin, ['--version']);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                throw new Error(`poetry is not accessible at "${poetryBin}"`, { cause: error });
+            }
+            throw new Error('failed to check for poetry binary', { cause: error });
+        }
+    }
     /**
      * @param {string} manifestDir
      * @param {string} _workspaceDir - unused (poetry has no workspace support)
@@ -41,9 +52,15 @@ export default class Python_poetry extends Base_pyproject {
      */
     // eslint-disable-next-line no-unused-vars
     async _getDependencyData(manifestDir, _workspaceDir, parsed, opts) {
+        let poetryBin = getCustomPath('poetry', opts);
+        let envBypass = environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')
+            && environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL');
+        if (!envBypass) {
+            this._verifyPoetryAccessible(poetryBin);
+        }
         let hasDevGroup = !!(parsed.tool?.poetry?.group?.dev || parsed.tool?.poetry?.['dev-dependencies']);
-        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts);
-        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, opts);
+        let treeOutput = this._getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin);
+        let showAllOutput = this._getPoetryShowAllOutput(manifestDir, poetryBin);
         let versionMap = this._parsePoetryShowAll(showAllOutput);
         let lockDir = this._findLockFileDir(manifestDir, opts);
         let markerData = this._extractMarkerData(lockDir, parsed);
@@ -53,14 +70,13 @@ export default class Python_poetry extends Base_pyproject {
      * Get poetry show --tree output.
      * @param {string} manifestDir
      * @param {boolean} hasDevGroup
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowTreeOutput(manifestDir, hasDevGroup, opts) {
+    _getPoetryShowTreeOutput(manifestDir, hasDevGroup, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_TREE')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_TREE'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
         let args = ['show', '--tree', '--no-ansi'];
         if (hasDevGroup) {
             args.push('--without', 'dev');
@@ -70,14 +86,13 @@ export default class Python_poetry extends Base_pyproject {
     /**
      * Get poetry show --all output (flat list with resolved versions).
      * @param {string} manifestDir
-     * @param {Object} opts
+     * @param {string} poetryBin
      * @returns {string}
      */
-    _getPoetryShowAllOutput(manifestDir, opts) {
+    _getPoetryShowAllOutput(manifestDir, poetryBin) {
         if (environmentVariableIsPopulated('TRUSTIFY_DA_POETRY_SHOW_ALL')) {
             return Buffer.from(process.env['TRUSTIFY_DA_POETRY_SHOW_ALL'], 'base64').toString('utf-8');
         }
-        let poetryBin = getCustomPath('poetry', opts);
         return invokeCommand(poetryBin, ['show', '--no-ansi', '--all'], { cwd: manifestDir }).toString();
     }
     /**
@@ -111,11 +126,12 @@ export default class Python_poetry extends Base_pyproject {
      *   → transitiveMarkers['click']['colorama'] = "sys_platform == 'win32'"
      * @param {string|null} lockDir
      * @param {object} parsed - parsed pyproject.toml
-     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}}
+     * @returns {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}}
      */
     _extractMarkerData(lockDir, parsed) {
         let directMarkers = new Map();
         let transitiveMarkers = new Map();
+        let hashMap = new Map();
         // Extract markers from PEP 621 dependency strings: "name[extras]>=ver ; marker"
         let deps = parsed.project?.dependencies || [];
         for (let dep of deps) {
@@ -142,18 +158,40 @@ export default class Python_poetry extends Base_pyproject {
                             transitiveMarkers.get(pkgKey).set(this._canonicalize(depName), markers);
                         }
                     }
+                    let sha256Hex = this._extractSha256FromFiles(pkg.files);
+                    if (sha256Hex) {
+                        hashMap.set(pkgKey, [{ alg: "SHA-256", content: sha256Hex }]);
+                    }
                 }
             }
         }
-        return { directMarkers, transitiveMarkers };
+        return { directMarkers, transitiveMarkers, hashMap };
+    }
+    /**
+     * Extract a SHA-256 hex digest from poetry.lock files array.
+     * Prefers the sdist (.tar.gz) hash; falls back to the first wheel hash.
+     * @param {Array<{file: string, hash: string}>} [files]
+     * @returns {string|null}
+     */
+    _extractSha256FromFiles(files) {
+        if (!Array.isArray(files) || files.length === 0) {
+            return null;
+        }
+        let sdist = files.find(f => f.file.endsWith('.tar.gz'));
+        let entry = sdist || files[0];
+        let hash = entry.hash;
+        if (hash && hash.startsWith('sha256:')) {
+            return hash.slice(7);
+        }
+        return null;
     }
     /**
      * Parse poetry show --tree output into a dependency graph structure.
      *
      * @param {string} treeOutput
      * @param {Map<string, string>} versionMap - canonical name -> resolved version
-     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>}} markerData
-     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[]}>}}
+     * @param {{directMarkers: Map<string, string>, transitiveMarkers: Map<string, Map<string, string>>, hashMap: Map<string, Array<{alg: string, content: string}>>}} markerData
+     * @returns {{directDeps: string[], graph: Map<string, {name: string, version: string, children: string[], hashes?: Array<{alg: string, content: string}>}>}}
      */
     _parsePoetryTree(treeOutput, versionMap, markerData) {
         let lines = treeOutput.split(/\r?\n/);
@@ -179,7 +217,12 @@ export default class Python_poetry extends Base_pyproject {
                 }
                 directDeps.push(key);
                 if (!graph.has(key)) {
-                    graph.set(key, { name, version, children: [] });
+                    let entry = { name, version, children: [] };
+                    let hashes = markerData.hashMap.get(key);
+                    if (hashes) {
+                        entry.hashes = hashes;
+                    }
+                    graph.set(key, entry);
                 }
                 currentDirectDep = key;
                 stack = [{ key, depth: -1 }];
@@ -223,7 +266,12 @@ export default class Python_poetry extends Base_pyproject {
                 throw new Error(`poetry: package '${depName}' has no resolved version`);
             }
             if (!graph.has(depKey)) {
-                graph.set(depKey, { name: depName, version, children: [] });
+                let entry = { name: depName, version, children: [] };
+                let hashes = markerData.hashMap.get(depKey);
+                if (hashes) {
+                    entry.hashes = hashes;
+                }
+                graph.set(depKey, entry);
             }
             if (parentKey) {
                 let parentEntry = graph.get(parentKey);