@trustify-da/trustify-da-javascript-client 0.3.0-ea.bbe2094 → 0.3.0-ea.be56bee

package/README.md

@@ -695,7 +695,7 @@ By default, The API algorithm will use native commands of PIP installer as data
 It's also possible to use the lightweight Python PIP utility [pipdeptree](https://pypi.org/project/pipdeptree/) as data source instead. In order to activate this, you need to set the environment variable/option `TRUSTIFY_DA_PIP_USE_DEP_TREE` to 'true'.
 
 #### Toggle Red Hat Trusted Content recommendations
-Both the HTML-based report and JSON response will by default contain recommendations for migrating to Red Hat-based Trusted Content repositories. This feature can be disabled by setting `TRUSTIFY_DA_RECOMMENDATIONS_ENABLED` to 'false' via environment variables or options.
+Both the HTML-based report and JSON response will by default contain recommendations for migrating to Red Hat-based Trusted Content repositories. This feature can be disabled by setting `TRUSTIFY_DA_RECOMMEND` to 'false' via environment variables or options.
 
 #### Additional CLI arguments
 For some ecosystems we support passing additional CLI arguments to the underlying tools. The following table outlines the supported ecosystems and the environment variable/option that configures this. Note that the arguments are expected to be in the format of a JSON array.

package/dist/package.json

@@ -35,32 +35,33 @@
         "config/**/*"
     ],
     "scripts": {
-        "lint": "eslint src test --ext js",
-        "lint:fix": "eslint src test --ext js --fix",
+        "lint": "eslint src test",
+        "lint:fix": "eslint src test --fix",
         "test": "c8 npm run tests",
         "tests": "mocha --config .mocharc.json",
         "tests:rep": "mocha --reporter-option maxDiffSize=0 --reporter json > unit-tests-result.json",
-        "pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm src/providers/tree-sitter-gomod.wasm",
+        "pretest": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm src/providers/tree-sitter-containerfile.wasm",
         "precompile": "rm -rf dist",
         "compile": "tsc -p tsconfig.json",
         "compile:dev": "tsc -p tsconfig.dev.json",
-        "postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm"
+        "postcompile": "cp node_modules/tree-sitter-requirements/tree-sitter-requirements.wasm dist/src/providers/tree-sitter-requirements.wasm && cp node_modules/tree-sitter-gomod/tree-sitter-gomod.wasm dist/src/providers/tree-sitter-gomod.wasm && cp node_modules/tree-sitter-containerfile/tree-sitter-containerfile.wasm dist/src/providers/tree-sitter-containerfile.wasm"
     },
     "dependencies": {
         "@babel/core": "^7.23.2",
-        "@cyclonedx/cyclonedx-library": "^6.13.0",
+        "@cyclonedx/cyclonedx-library": "^10.0.0",
         "eslint-import-resolver-typescript": "^4.4.4",
         "fast-glob": "^3.3.3",
         "fast-xml-parser": "^5.3.4",
         "help": "^3.0.2",
-        "https-proxy-agent": "^7.0.6",
+        "https-proxy-agent": "^9.0.0",
         "js-yaml": "^4.1.1",
         "jsonc-parser": "^3.3.1",
         "micromatch": "^4.0.8",
         "node-fetch": "^3.3.2",
-        "p-limit": "^4.0.0",
+        "p-limit": "^7.3.0",
         "packageurl-js": "~1.0.2",
         "smol-toml": "^1.6.0",
+        "tree-sitter-containerfile": "^0.8.1",
         "tree-sitter-gomod": "github:strum355/tree-sitter-go-mod#56326f2ad478892ace58ff247a97d492a3cbcdda",
         "tree-sitter-requirements": "github:Strum355/tree-sitter-requirements#d0261ee76b84253997fe70d7d397e78c006c3801",
         "web-tree-sitter": "^0.26.7",
@@ -68,23 +69,24 @@
     },
     "devDependencies": {
         "@babel/core": "^7.23.2",
-        "@trustify-da/trustify-da-api-model": "^2.0.7",
-        "@types/node": "^20.17.30",
+        "@eslint/js": "^10.0.0",
+        "@trustify-da/trustify-da-api-model": "^2.0.9",
+        "@types/node": "^25.9.1",
         "@types/which": "^3.0.4",
         "babel-plugin-rewire": "^1.2.0",
         "c8": "^11.0.0",
-        "chai": "^4.3.7",
-        "eslint": "^8.42.0",
+        "chai": "^6.2.2",
+        "eslint": "^10.4.1",
         "eslint-import-resolver-typescript": "^4.4.4",
-        "eslint-plugin-editorconfig": "^4.0.3",
-        "eslint-plugin-import": "^2.29.1",
+        "eslint-plugin-import-x": "^4.16.2",
         "esmock": "^2.6.2",
-        "mocha": "^10.2.0",
+        "globals": "^17.6.0",
+        "mocha": "^11.7.6",
         "msw": "^2.12.7",
-        "sinon": "^15.1.2",
-        "sinon-chai": "^3.7.0",
-        "typescript": "^5.1.3",
-        "which": "^5.0.0"
+        "sinon": "^22.0.0",
+        "sinon-chai": "^4.0.1",
+        "typescript": "^6.0.3",
+        "which": "^7.0.0"
     },
     "mocha": {
         "check-leaks": false,
@@ -112,12 +114,13 @@
         "reporter": [
             "html",
             "json",
+            "lcov",
             "text"
         ]
     },
-    "eslintIgnore": [
-        "index.js"
-    ],
+    "overrides": {
+        "tree-sitter": "0.22.4"
+    },
     "resolutions": {
         "@hapi/joi": "17.1.1"
     }

package/dist/src/analysis.d.ts

@@ -16,7 +16,7 @@ export default _default;
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  */
-declare function requestComponent(provider: import("./provider").Provider, manifest: string, url: string, opts?: import("index.js").Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function requestComponent(provider: any, manifest: string, url: string, opts?: any): Promise<any>;
 /**
  * Send a stack analysis request and get the report as 'text/html' or 'application/json'.
  * @param {import('./provider').Provider} provider - the provided data for constructing the request
@@ -26,7 +26,7 @@ declare function requestComponent(provider: import("./provider").Provider, manif
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {Promise<string|import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  */
-declare function requestStack(provider: import("./provider").Provider, manifest: string, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function requestStack(provider: any, manifest: string, url: string, html?: boolean, opts?: any): Promise<string | any>;
 /**
  * Send a batch stack analysis request for multiple manifests (SBOMs keyed by purl).
  * @param {Object.<string, object>} sbomByPurl - Map of root purl to CycloneDX SBOM object
@@ -36,9 +36,9 @@ declare function requestStack(provider: import("./provider").Provider, manifest:
  * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
  */
 declare function requestStackBatch(sbomByPurl: {
+    [x: string]: object;
+}, url: string, html?: boolean, opts?: any): Promise<string | {
     [x: string]: any;
-}, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
 }>;
 /**
  *
@@ -47,8 +47,8 @@ declare function requestStackBatch(sbomByPurl: {
  * @param {import("index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {Promise<string|Object.<string, import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>>}
  */
-declare function requestImages(imageRefs: Array<string>, url: string, html?: boolean, opts?: import("index.js").Options): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+declare function requestImages(imageRefs: Array<string>, url: string, html?: boolean, opts?: any): Promise<string | {
+    [x: string]: any;
 }>;
 /**
  *
@@ -56,4 +56,4 @@ declare function requestImages(imageRefs: Array<string>, url: string, html?: boo
  * @param {import("index.js").Options} [opts={}] - optional various options to pass headers for t he validateToken Request
  * @return {Promise<number>} return the HTTP status Code of the response from the validate token request.
  */
-declare function validateToken(url: any, opts?: import("index.js").Options): Promise<number>;
+declare function validateToken(url: any, opts?: any): Promise<number>;

package/dist/src/analysis.js

@@ -38,7 +38,7 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
         body: provided.content
     }, opts);
     const finalUrl = new URL(`${url}/api/v5/analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
+    if (getCustom('TRUSTIFY_DA_RECOMMEND', 'true', opts) === 'false') {
         finalUrl.searchParams.append('recommend', 'false');
     }
     let resp = await fetch(finalUrl, fetchOptions);
@@ -95,7 +95,7 @@ async function requestComponent(provider, manifest, url, opts = {}) {
         body: provided.content
     }, opts);
     const finalUrl = new URL(`${url}/api/v5/analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
+    if (getCustom('TRUSTIFY_DA_RECOMMEND', 'true', opts) === 'false') {
         finalUrl.searchParams.append('recommend', 'false');
     }
     let resp = await fetch(finalUrl, fetchOptions);
@@ -136,7 +136,7 @@ async function requestComponent(provider, manifest, url, opts = {}) {
  */
 async function requestStackBatch(sbomByPurl, url, html = false, opts = {}) {
     const finalUrl = new URL(`${url}/api/v5/batch-analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
+    if (getCustom('TRUSTIFY_DA_RECOMMEND', 'true', opts) === 'false') {
         finalUrl.searchParams.append('recommend', 'false');
     }
     const fetchOptions = addProxyAgent({
@@ -186,7 +186,7 @@ async function requestImages(imageRefs, url, html = false, opts = {}) {
         imageSboms[parsedImageRef.getPackageURL().toString()] = generateImageSBOM(parsedImageRef, opts);
     }
     const finalUrl = new URL(`${url}/api/v5/batch-analysis`);
-    if (opts['TRUSTIFY_DA_RECOMMENDATIONS_ENABLED'] === 'false') {
+    if (getCustom('TRUSTIFY_DA_RECOMMEND', 'true', opts) === 'false') {
         finalUrl.searchParams.append('recommend', 'false');
     }
     const fetchOptions = addProxyAgent({

package/dist/src/cyclone_dx_sbom.js

@@ -41,12 +41,20 @@ function getComponent(component, type, scope, licenses, hashes) {
     // Add licenses if provided (CycloneDX format). Callers must provide valid SPDX identifiers.
     if (licenses) {
         const licenseArray = Array.isArray(licenses) ? licenses : [licenses];
-        componentObject.licenses = licenseArray.map(lic => {
+        const validLicenses = licenseArray
+            .map(lic => {
             if (typeof lic === 'string') {
                 return { license: { id: lic } };
             }
-            return lic;
-        });
+            if (typeof lic === 'object' && lic !== null && ('license' in lic || 'expression' in lic)) {
+                return lic;
+            }
+            return null;
+        })
+            .filter(Boolean);
+        if (validLicenses.length > 0) {
+            componentObject.licenses = validLicenses;
+        }
     }
     // Add hashes if provided (CycloneDX 1.4 format).
     if (hashes && hashes.length > 0) {

package/dist/src/index.d.ts

@@ -53,7 +53,7 @@ export type Options = {
     TRUSTIFY_DA_PYTHON_PATH?: string | undefined;
     TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined;
     TRUSTIFY_DA_PYTHON3_PATH?: string | undefined;
-    TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined;
+    TRUSTIFY_DA_RECOMMEND?: string | undefined;
     TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined;
     TRUSTIFY_DA_SKOPEO_PATH?: string | undefined;
     TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined;
@@ -106,7 +106,7 @@ export type SbomResult = {
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error} if no matching provider, failed to get create content, or backend request failed
  */
-declare function componentAnalysis(manifest: string, opts?: Options): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function componentAnalysis(manifest: string, opts?: Options): Promise<any>;
 /**
  * @overload
  * @param {string} manifest
@@ -124,7 +124,7 @@ declare function stackAnalysis(manifest: string, html: true, opts?: Options | un
  * @returns {Promise<import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport>}
  * @throws {Error}
  */
-declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html: false, opts?: Options | undefined): Promise<any>;
 /**
  * Get stack analysis report for a manifest file.
  * @overload
@@ -135,7 +135,7 @@ declare function stackAnalysis(manifest: string, html: false, opts?: Options | u
  * @throws {Error} if manifest inaccessible, no matching provider, failed to get create content,
  * 		or backend request failed
  */
-declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport>;
+declare function stackAnalysis(manifest: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | any>;
 /**
  * @overload
  * @param {string} workspaceRoot
@@ -173,7 +173,7 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Op
     batchMetadata: true;
 }): Promise<{
     analysis: {
-        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+        [x: string]: any;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -188,7 +188,7 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts: Op
 declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (Options & {
     batchMetadata?: false;
 }) | undefined): Promise<{
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Get stack analysis for all workspace packages/crates (batch).
@@ -204,10 +204,10 @@ declare function stackAnalysisBatch(workspaceRoot: string, html: false, opts?: (
  * @throws {Error} if workspace root invalid, no manifests found, no packages pass validation, no SBOMs produced, or backend request failed. When `opts.batchMetadata` is set, `error.batchMetadata` may be set on thrown errors.
  */
 declare function stackAnalysisBatch(workspaceRoot: string, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 } | {
     analysis: string | {
-        [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+        [x: string]: any;
     };
     metadata: BatchAnalysisMetadata;
 }>;
@@ -229,7 +229,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: true, opts?: Opti
  * @throws {Error}
  */
 declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Options | undefined): Promise<{
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Get image analysis report for a set of OCI image references.
@@ -242,7 +242,7 @@ declare function imageAnalysis(imageRefs: Array<string>, html: false, opts?: Opt
  * 		or backend request failed
  */
 declare function imageAnalysis(imageRefs: Array<string>, html?: boolean | undefined, opts?: Options | undefined): Promise<string | {
-    [x: string]: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport;
+    [x: string]: any;
 }>;
 /**
  * Validates the Exhort token.

package/dist/src/index.js

@@ -39,7 +39,7 @@ export { discoverMavenModules, discoverGradleSubprojects, discoverGoWorkspaceMod
  * TRUSTIFY_DA_PYTHON_PATH?: string | undefined,
  * TRUSTIFY_DA_PYTHON_VIRTUAL_ENV?: string | undefined,
  * TRUSTIFY_DA_PYTHON3_PATH?: string | undefined,
- * TRUSTIFY_DA_RECOMMENDATIONS_ENABLED?: string | undefined,
+ * TRUSTIFY_DA_RECOMMEND?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_CONFIG_PATH?: string | undefined,
  * TRUSTIFY_DA_SKOPEO_PATH?: string | undefined,
  * TRUSTIFY_DA_SYFT_CONFIG_PATH?: string | undefined,
@@ -175,7 +175,9 @@ async function componentAnalysis(manifest, opts = {}) {
     fs.accessSync(manifest, fs.constants.R_OK);
     opts["manifest-type"] = path.basename(manifest);
     let provider = match(manifest, availableProviders, opts); // throws error if no matching provider
-    return await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    const result = await analysis.requestComponent(provider, manifest, theUrl, opts); // throws error request sending failed
+    result.packageManager = provider.packageManagerName();
+    return result;
 }
 /**
  * @overload

package/dist/src/license/index.d.ts

@@ -9,10 +9,10 @@
  * @param {import('@trustify-da/trustify-da-api-model/model/v5/AnalysisReport').AnalysisReport} [analysisResult] - analysis result that includes licenses array from backend
  * @returns {Promise<{ projectLicense: { manifest: Object|null, file: Object|null, mismatch: boolean }, incompatibleDependencies: Array<{ purl: string, licenses: string[], category?: string, reason: string }>, error?: string }>}
  */
-export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport): Promise<{
+export function runLicenseCheck(sbomContent: string, manifestPath: string, url: string, opts?: import("../index.js").Options, analysisResult?: any): Promise<{
     projectLicense: {
-        manifest: any | null;
-        file: any | null;
+        manifest: Object | null;
+        file: Object | null;
         mismatch: boolean;
     };
     incompatibleDependencies: Array<{

package/dist/src/license/index.js

@@ -85,11 +85,14 @@ export async function runLicenseCheck(sbomContent, manifestPath, url, opts = {},
             continue;
         const status = getCompatibility(projectCategory, entry.category);
         if (status === 'incompatible') {
+            const reason = entry.category?.toUpperCase() === 'UNKNOWN'
+                ? 'License not recognized as a standard SPDX identifier. Manual review recommended to verify compatibility.'
+                : 'Dependency license(s) are incompatible with the project license.';
             incompatibleDependencies.push({
                 purl,
                 licenses: entry.licenses,
                 category: entry.category,
-                reason: 'Dependency license(s) are incompatible with the project license.'
+                reason
             });
         }
     }

package/dist/src/license/license_utils.js

@@ -114,9 +114,12 @@ export function getCompatibility(projectCategory, dependencyCategory) {
     }
     const proj = projectCategory.toUpperCase();
     const dep = dependencyCategory.toUpperCase();
-    if (proj === 'UNKNOWN' || dep === 'UNKNOWN') {
+    if (proj === 'UNKNOWN') {
         return 'unknown';
     }
+    if (dep === 'UNKNOWN') {
+        return 'incompatible';
+    }
     const restrictiveness = {
         'PERMISSIVE': 1,
         'WEAK_COPYLEFT': 2,

package/dist/src/license/licenses_api.d.ts

@@ -6,7 +6,7 @@
  * @param {import('../index.js').Options} [opts={}] - options (proxy, token, TRUSTIFY_DA_BACKEND_URL, etc.)
  * @returns {Promise<Object|null>} License details or null if not found
  */
-export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<any | null>;
+export function getLicenseDetails(spdxId: string, opts?: import("../index.js").Options): Promise<Object | null>;
 /**
  * Normalize the LicensesResponse shape (array of LicenseProviderResult) into a map of purl -> license info.
  * Each provider result has { status, summary, packages } where packages is { [purl]: { concluded, evidence } }.
@@ -28,7 +28,7 @@ export function normalizeLicensesResponse(data: unknown, purls?: string[]): Map<
  * @param {string[]} [purls] - optional list of purls to restrict to
  * @returns {Map<string, { licenses: string[], category?: string }>}
  */
-export function licensesFromReport(analysisReport: import("@trustify-da/trustify-da-api-model/model/v5/AnalysisReport").AnalysisReport, purls?: string[]): Map<string, {
+export function licensesFromReport(analysisReport: any, purls?: string[]): Map<string, {
     licenses: string[];
     category?: string;
 }>;

package/dist/src/oci_image/images.d.ts

@@ -78,7 +78,7 @@ export class ImageRef {
      * @param {string} [platform]
      * @param {import("index.js").Options} [opts={}]
      */
-    constructor(image: string, platform?: string, opts?: import("index.js").Options);
+    constructor(image: string, platform?: string, opts?: any);
     /** @type {Image} */
     image: Image;
     /** @type {Platform} */

package/dist/src/oci_image/images.js

@@ -242,8 +242,22 @@ export class ImageRef {
     getPackageURL() {
         /** @type {Object.<string, string>} */
         const qualifiers = {};
-        const repositoryUrl = this.image.getNameWithoutTag();
+        let repositoryUrl = this.image.getNameWithoutTag();
         const simpleName = this.image.getSimpleName();
+        // Normalize Docker Hub image references so all forms produce the same PURL:
+        //   node         → docker.io/node
+        //   docker.io/library/node → docker.io/node
+        if (repositoryUrl != null) {
+            const lower = repositoryUrl.toLowerCase();
+            if (lower === simpleName.toLowerCase()) {
+                // Bare name (e.g. "node") — default to docker.io
+                repositoryUrl = `docker.io/${simpleName}`;
+            }
+            else if (lower.startsWith('docker.io/library/')) {
+                // Official image with library/ prefix — strip it
+                repositoryUrl = `docker.io/${lower.substring('docker.io/library/'.length)}`;
+            }
+        }
         if (repositoryUrl != null && repositoryUrl.toLowerCase() !== simpleName.toLowerCase()) {
             qualifiers[ImageRef.REPOSITORY_QUALIFIER] = repositoryUrl.toLowerCase();
         }

package/dist/src/oci_image/utils.d.ts

@@ -4,7 +4,7 @@
  * @param {import("../index.js").Options} [opts={}] - optional various options to pass along the application
  * @returns {{}}
  */
-export function generateImageSBOM(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {};
+export function generateImageSBOM(imageRef: any, opts?: import("../index.js").Options): {};
 /**
  *
  * @param {string} image
@@ -25,7 +25,7 @@ export function getImagePlatform(opts?: import("../index.js").Options): Platform
  * @returns {Object.<string, string>} - The image digests
  * @throws {Error} If the image info is invalid
  */
-export function getImageDigests(imageRef: import("./images").ImageRef, opts?: import("../index.js").Options): {
+export function getImageDigests(imageRef: any, opts?: import("../index.js").Options): {
     [x: string]: string;
 };
 export type SyftImageSource = {
@@ -34,9 +34,9 @@ export type SyftImageSource = {
     getVariant: () => string;
 };
 export type SyftImageSourceType = {
-    getOs: (arg0: any) => string;
-    getArch: (arg0: any) => string;
-    getVariant: (arg0: any) => string;
+    getOs: (arg0: Object) => string;
+    getArch: (arg0: Object) => string;
+    getVariant: (arg0: Object) => string;
 };
 import { ImageRef } from './images.js';
 import { Platform } from './platform.js';

package/dist/src/provider.d.ts

@@ -21,7 +21,7 @@ export function match(manifest: string, providers: [Provider], opts?: {
     TRUSTIFY_DA_WORKSPACE_DIR?: string;
 }): Provider;
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -34,8 +34,9 @@ export type Provided = {
 };
 export type Provider = {
     isSupported: (arg0: string) => boolean;
-    validateLockFile: (arg0: string, arg1: any) => void;
+    validateLockFile: (arg0: string, arg1: Object) => void;
     provideComponent: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
     provideStack: (arg0: string, arg1: {}) => Provided | Promise<Provided>;
-    readLicenseFromManifest: (arg0: string) => string | null;
+    readLicenseFromManifest: (arg0: string, arg1: Object | undefined) => string | null;
+    packageManagerName: () => string;
 };

package/dist/src/provider.js

@@ -7,13 +7,14 @@ import Javascript_bun from './providers/javascript_bun.js';
 import Javascript_npm from './providers/javascript_npm.js';
 import Javascript_pnpm from './providers/javascript_pnpm.js';
 import Javascript_yarn from './providers/javascript_yarn.js';
+import dockerfileProvider from './providers/oci_dockerfile.js';
 import pythonPipProvider from './providers/python_pip.js';
 import Python_pip_pyproject from './providers/python_pip_pyproject.js';
 import Python_poetry from './providers/python_poetry.js';
 import Python_uv from './providers/python_uv.js';
 import rustCargoProvider from './providers/rust_cargo.js';
 /** @typedef {{ecosystem: string, contentType: string, content: string}} Provided */
-/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string): string | null}} Provider */
+/** @typedef {{isSupported: function(string): boolean, validateLockFile: function(string, Object): void, provideComponent: function(string, {}): Provided | Promise<Provided>, provideStack: function(string, {}): Provided | Promise<Provided>, readLicenseFromManifest: function(string, Object=): string | null, packageManagerName: function(): string}} Provider */
 /**
  * MUST include all providers here.
  * @type {[Provider]}
@@ -31,7 +32,8 @@ export const availableProviders = [
     new Python_poetry(),
     new Python_uv(),
     new Python_pip_pyproject(),
-    rustCargoProvider
+    rustCargoProvider,
+    dockerfileProvider
 ];
 /**
  * Match a provider by manifest type only (no lock file check). Used for license reading.

package/dist/src/providers/base_java.d.ts

@@ -1,4 +1,4 @@
-export type ecosystem_maven = import("../provider").Provider;
+export type ecosystem_maven = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */
@@ -20,6 +20,11 @@ export default class Base_Java {
     CONFLICT_REGEX: RegExp;
     globalBinary: string;
     localWrapper: string;
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -28,6 +33,13 @@ export default class Base_Java {
      * @param {Sbom} sbom - The SBOM where the dependencies are being added
      */
     parseDependencyTree(src: string, srcDepth: number, lines: any[], sbom: Sbom): void;
+    /**
+     * Calculates how deep in the graph is the given line
+     * @param {string} line - line to calculate the depth from
+     * @returns {number} The calculated depth
+     * @protected
+     */
+    protected _getDepth(line: string): number;
     /**
      * Create a PackageURL from any line in a Text Graph dependency tree for a manifest path.
      * @param {string} line - line to parse from a dependencies.txt file
@@ -57,9 +69,8 @@ export default class Base_Java {
      * @returns string
      */
     selectToolBinary(manifestPath: string, opts: {}): string | null;
-    #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/base_java.js

@@ -25,6 +25,13 @@ export default class Base_Java {
         this.globalBinary = globalBinary;
         this.localWrapper = localWrapper;
     }
+    /**
+     * Returns the package manager name (e.g. mvn, gradle)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this.globalBinary;
+    }
     /**
      * Recursively populates the SBOM instance with the parsed graph
      * @param {string} src - Source dependency to start the calculations from
@@ -41,7 +48,7 @@ export default class Base_Java {
         }
         let index = 0;
         let target = lines[index];
-        let targetDepth = this.#getDepth(target);
+        let targetDepth = this._getDepth(target);
         while (targetDepth > srcDepth && index < lines.length) {
             if (targetDepth === srcDepth + 1) {
                 let from = this.parseDep(src);
@@ -54,22 +61,25 @@ export default class Base_Java {
                 }
             }
             else {
-                this.parseDependencyTree(lines[index - 1], this.#getDepth(lines[index - 1]), lines.slice(index), sbom);
+                this.parseDependencyTree(lines[index - 1], this._getDepth(lines[index - 1]), lines.slice(index), sbom);
             }
             target = lines[++index];
-            targetDepth = this.#getDepth(target);
+            targetDepth = this._getDepth(target);
         }
     }
     /**
      * Calculates how deep in the graph is the given line
      * @param {string} line - line to calculate the depth from
      * @returns {number} The calculated depth
-     * @private
+     * @protected
      */
-    #getDepth(line) {
-        if (line === undefined) {
+    _getDepth(line) {
+        if (!line || line.trim() === '') {
             return -1;
         }
+        if (line.match(/^\w/)) {
+            return 0;
+        }
         return ((line.indexOf('-') - 1) / 3) + 1;
     }
     /**