@trustify-da/trustify-da-javascript-client 0.3.0-ea.bbe2094 → 0.3.0-ea.be56bee

package/dist/src/providers/base_javascript.d.ts

@@ -1,4 +1,4 @@
-export type purlType = import("../provider").Provider;
+export type purlType = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -19,7 +19,7 @@ export default class Base_javascript {
    * @param {Object} opts - Configuration options for the provider
    * @protected
    */
-    protected _setUp(manifestPath: string, opts: any): void;
+    protected _setUp(manifestPath: string, opts: Object): void;
     /**
      * Gets the current manifest object
      * @returns {Manifest} The manifest object
@@ -47,6 +47,11 @@ export default class Base_javascript {
    */
     protected _cmdName(): string;
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName(): string;
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -86,21 +91,21 @@ export default class Base_javascript {
    * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for stack analysis
    */
-    provideStack(manifestPath: string, opts?: any): Provided;
+    provideStack(manifestPath: string, opts?: Object): Provided;
     /**
    * Provides content and content type for component analysis
    * @param {string} manifestPath - Path to package.json for component report
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for component analysis
    */
-    provideComponent(manifestPath: string, opts?: any): Provided;
+    provideComponent(manifestPath: string, opts?: Object): Provided;
     /**
      * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
      * @param {string} manifestPath - path to package.json
@@ -114,21 +119,21 @@ export default class Base_javascript {
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean, opts?: any): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The current dependency tree
    * @protected
    */
-    protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     /**
    * Extracts root dependencies from the dependency tree
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    * @protected
    */
-    protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
+    protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Gets the version of the package manager
    * @returns {string} The version string of the package manager
@@ -150,6 +155,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';

package/dist/src/providers/base_javascript.js

@@ -71,6 +71,13 @@ export default class Base_javascript {
         throw new TypeError("_cmdName must be implemented");
     }
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName() {
+        return this._cmdName();
+    }
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract

package/dist/src/providers/base_pyproject.d.ts

@@ -13,7 +13,7 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {boolean}
      */
-    validateLockFile(manifestDir: string, opts?: any): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
      * Walk up from manifestDir to find the directory containing the lock file.
      * Follows the same pattern as Base_javascript._findLockFileDir().
@@ -22,7 +22,7 @@ export default class Base_pyproject {
      * @returns {string|null}
      * @protected
      */
-    protected _findLockFileDir(manifestDir: string, opts?: any): string | null;
+    protected _findLockFileDir(manifestDir: string, opts?: Object): string | null;
     /**
      * Detect workspace root boundaries.
      * Currently only uv has native workspace support ([tool.uv.workspace] in pyproject.toml).
@@ -44,13 +44,13 @@ export default class Base_pyproject {
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideStack(manifest: string, opts?: any): Promise<Provided>;
+    provideStack(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @param {string} manifest - path to pyproject.toml
      * @param {Object} [opts={}]
      * @returns {Promise<Provided>}
      */
-    provideComponent(manifest: string, opts?: any): Promise<Provided>;
+    provideComponent(manifest: string, opts?: Object): Promise<Provided>;
     /**
      * @returns {string}
      * @protected
@@ -61,6 +61,11 @@ export default class Base_pyproject {
      * @protected
      */
     protected _cmdName(): string;
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName(): string;
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *
@@ -72,7 +77,7 @@ export default class Base_pyproject {
      * @returns {Promise<DependencyData>}
      * @protected
      */
-    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: any): Promise<DependencyData>;
+    protected _getDependencyData(manifestDir: string, workspaceDir: string, parsed: object, opts: Object): Promise<DependencyData>;
     /**
      * Canonicalize a Python package name per PEP 503.
      * @param {string} name

package/dist/src/providers/base_pyproject.js

@@ -145,6 +145,13 @@ export default class Base_pyproject {
     _cmdName() {
         throw new TypeError('_cmdName must be implemented');
     }
+    /**
+     * Returns the package manager name (e.g. pip, poetry, uv)
+     * @returns {string}
+     */
+    packageManagerName() {
+        return this._cmdName();
+    }
     /**
      * Resolve dependencies using the tool-specific command and parser.
      *

package/dist/src/providers/containerfile_parser.d.ts

@@ -0,0 +1,4 @@
+export function getParser(): Promise<Parser>;
+export function getFromQuery(): Promise<Query>;
+import { Parser } from 'web-tree-sitter';
+import { Query } from 'web-tree-sitter';

package/dist/src/providers/containerfile_parser.js

@@ -0,0 +1,16 @@
+import { readFile } from 'node:fs/promises';
+import { Language, Parser, Query } from 'web-tree-sitter';
+const wasmUrl = new URL('./tree-sitter-containerfile.wasm', import.meta.url);
+async function init() {
+    await Parser.init();
+    const wasmBytes = new Uint8Array(await readFile(wasmUrl));
+    return await Language.load(wasmBytes);
+}
+export async function getParser() {
+    const language = await init();
+    return new Parser().setLanguage(language);
+}
+export async function getFromQuery() {
+    const language = await init();
+    return new Query(language, '(from_instruction (image_spec) @image)');
+}

package/dist/src/providers/golang_gomodules.d.ts

@@ -13,9 +13,10 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/golang_gomodules.js

@@ -6,7 +6,7 @@ import Sbom from '../sbom.js';
 import { getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import { filterManifestPathsByDiscoveryIgnore, resolveWorkspaceDiscoveryIgnore } from '../workspace.js';
 import { getParser, getRequireQuery } from './gomod_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'go'; } };
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /** @typedef {{name: string, version: string}} Package */

package/dist/src/providers/java_gradle_groovy.d.ts

@@ -3,5 +3,5 @@ export default class Java_gradle_groovy extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): any;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_gradle_kotlin.d.ts

@@ -7,5 +7,5 @@ export default class Java_gradle_kotlin extends Java_gradle {
     _parseAliasForLibsNotation(alias: any): any;
     _extractDepToBeIgnored(dep: any): string | null;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Java_gradle from './java_gradle.js';

package/dist/src/providers/java_maven.d.ts

@@ -51,8 +51,8 @@ export default class Java_maven extends Base_java {
     createSbomFileFromTextFormat(textGraphList: string, ignoredDeps: [string], opts: any, manifestPath: string): string;
     #private;
 }
-export type Java_maven = import("../provider").Provider;
-export type Provided = import("../provider").Provided;
+export type Java_maven = any;
+export type Provided = any;
 export type Package = {
     name: string;
     version: string;

package/dist/src/providers/java_maven.js

@@ -181,6 +181,7 @@ export default class Java_maven extends Base_java {
         /** @type [Dependency] */
         let dependencies = this.#getDependencies(tmpEffectivePom)
             .filter(d => !this.#dependencyIn(d, ignored));
+        dependencies = this.#resolveVersionRanges(dependencies, manifestPath, opts);
         let sbom = new Sbom();
         let rootDependency = this.#getRootFromPom(tmpEffectivePom, manifestPath);
         let purlRoot = this.toPurl(rootDependency.groupId, rootDependency.artifactId, rootDependency.version);
@@ -289,6 +290,77 @@ export default class Java_maven extends Base_java {
     #dependencyIn(dep, deps) {
         return deps.filter(d => dep.artifactId === d.artifactId && dep.groupId === d.groupId && dep.scope === d.scope).length > 0;
     }
+    /**
+     * Returns true if the given version string is a Maven version range
+     * (starts with '[' or '(').
+     * @param {string} version
+     * @returns {boolean}
+     * @private
+     */
+    #isVersionRange(version) {
+        return typeof version === 'string' && (version.startsWith('[') || version.startsWith('('));
+    }
+    /**
+     * Resolves Maven version ranges in the given dependency list by running
+     * maven-dependency-plugin:tree and reading the concrete versions it selects.
+     * If no dependency uses a version range, returns the list unchanged.
+     * @param {Dependency[]} dependencies
+     * @param {string} manifestPath
+     * @param {object} opts
+     * @returns {Dependency[]}
+     * @private
+     */
+    #resolveVersionRanges(dependencies, manifestPath, opts = {}) {
+        // short-circuit if no dependency has a version range
+        if (!dependencies.some(dep => this.#isVersionRange(dep.version))) {
+            return dependencies;
+        }
+        const mvn = this.selectToolBinary(manifestPath, opts);
+        const mvnArgs = JSON.parse(getCustom('TRUSTIFY_DA_MVN_ARGS', '[]', opts));
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'trustify_da_range_'));
+        const tmpDepTree = path.join(tmpDir, 'mvn_deptree_ranges.txt');
+        try {
+            this._invokeCommand(mvn, [
+                '-q',
+                'org.apache.maven.plugins:maven-dependency-plugin:3.6.0:tree',
+                '-Dscope=compile',
+                '-DoutputType=text',
+                `-DoutputFile=${tmpDepTree}`,
+                ...mvnArgs
+            ], { cwd: path.dirname(manifestPath) });
+            const content = fs.readFileSync(tmpDepTree);
+            const lines = content.toString().split(EOL).filter(l => l.trim() !== '');
+            // Build a map of groupId:artifactId -> resolved version from depth-1 entries
+            /** @type {Map<string, string>} */
+            const resolvedVersions = new Map();
+            for (const line of lines) {
+                if (this._getDepth(line) === 1) {
+                    const purl = this.parseDep(line);
+                    resolvedVersions.set(`${purl.namespace}:${purl.name}`, purl.version);
+                }
+            }
+            // Replace version ranges with resolved concrete versions
+            return dependencies.map(dep => {
+                if (this.#isVersionRange(dep.version)) {
+                    const key = `${dep.groupId}:${dep.artifactId}`;
+                    const resolved = resolvedVersions.get(key);
+                    if (resolved) {
+                        return { ...dep, version: resolved };
+                    }
+                }
+                return dep;
+            });
+        }
+        catch (error) {
+            if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {
+                console.error("Failed to resolve Maven version ranges: " + error.message);
+            }
+            return dependencies;
+        }
+        finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    }
 }
 const DEFAULT_MAVEN_DISCOVERY_IGNORE = [
     '**/target/**',

package/dist/src/providers/javascript_npm.d.ts

@@ -1,5 +1,10 @@
 export default class Javascript_npm extends Base_javascript {
     _listCmdArgs(includeTransitive: any): string[];
-    _buildDependencyTree(includeTransitive: any, opts?: {}): any;
+    _buildDependencyTree(includeTransitive: any, opts?: {}): Object | {
+        name: any;
+        version: any;
+        dependencies: any;
+        optionalDependencies: any;
+    };
 }
 import Base_javascript from './base_javascript.js';

package/dist/src/providers/oci_dockerfile.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Parse the last FROM instruction from a Dockerfile using tree-sitter to extract the base image reference.
+ * In multi-stage builds, the last FROM represents the final stage.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string>} the image reference from the last FROM instruction
+ * @throws {Error} when no FROM instruction is found or when ARG substitution is used
+ */
+export function parseFromImage(manifestContent: string): Promise<string>;
+declare namespace _default {
+    export { isSupported };
+    export { validateLockFile };
+    export { provideComponent };
+    export { provideStack };
+    export { readLicenseFromManifest };
+    export function packageManagerName(): string;
+}
+export default _default;
+export type Provided = any;
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+declare function isSupported(manifestName: string): boolean;
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+declare function validateLockFile(): boolean;
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+declare function provideComponent(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+declare function provideStack(manifest: string, opts?: {}): Promise<Provided>;
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+declare function readLicenseFromManifest(): null;

package/dist/src/providers/oci_dockerfile.js

@@ -0,0 +1,104 @@
+import fs from 'node:fs';
+import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js';
+import { getFromQuery, getParser } from './containerfile_parser.js';
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci'; } };
+/** @typedef {import('../provider').Provider} */
+/** @typedef {import('../provider').Provided} Provided */
+/**
+ * @type {string} ecosystem identifier for OCI image packages
+ * @private
+ */
+const ecosystem = 'oci';
+/**
+ * Check if the given manifest name is a Dockerfile or Containerfile.
+ * Supports dot-suffixed variants such as Dockerfile.dev or Containerfile.prod.
+ * @param {string} manifestName the manifest file name to check
+ * @returns {boolean} true if the manifest is a Dockerfile or Containerfile
+ */
+function isSupported(manifestName) {
+    return /^(Dockerfile|Containerfile)(\..+)?$/.test(manifestName);
+}
+/**
+ * Dockerfiles have no lock file, so validation always passes.
+ * @returns {boolean} always true
+ */
+function validateLockFile() { return true; }
+/**
+ * Check whether a syntax node contains any expansion (variable substitution) children.
+ * @param {import('web-tree-sitter').SyntaxNode} node
+ * @returns {boolean}
+ * @private
+ */
+function containsExpansion(node) {
+    if (node.type === 'expansion') {
+        return true;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        if (containsExpansion(node.child(i))) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Parse the last FROM instruction from a Dockerfile using tree-sitter to extract the base image reference.
+ * In multi-stage builds, the last FROM represents the final stage.
+ * @param {string} manifestContent the content of the Dockerfile
+ * @returns {Promise<string>} the image reference from the last FROM instruction
+ * @throws {Error} when no FROM instruction is found or when ARG substitution is used
+ */
+export async function parseFromImage(manifestContent) {
+    const [parser, fromQuery] = await Promise.all([getParser(), getFromQuery()]);
+    const tree = parser.parse(manifestContent);
+    const matches = fromQuery.matches(tree.rootNode);
+    if (matches.length === 0) {
+        throw new Error('No FROM line found in Dockerfile');
+    }
+    const lastMatch = matches[matches.length - 1];
+    const imageSpec = lastMatch.captures.find(c => c.name === 'image').node;
+    if (containsExpansion(imageSpec)) {
+        throw new Error('Dockerfile uses ARG substitution in FROM line — cannot resolve variable references');
+    }
+    return imageSpec.text;
+}
+/**
+ * Generate an image SBOM from a Dockerfile manifest using syft.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string}>}
+ * @private
+ */
+async function getImageSBOM(manifest, opts = {}) {
+    const manifestContent = fs.readFileSync(manifest, 'utf-8');
+    const image = await parseFromImage(manifestContent);
+    const imageRef = parseImageRef(image, opts);
+    const sbom = generateImageSBOM(imageRef, opts);
+    return {
+        ecosystem,
+        content: JSON.stringify(sbom),
+        contentType: 'application/vnd.cyclonedx+json'
+    };
+}
+/**
+ * Provide content and content type for Dockerfile component analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideComponent(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Provide content and content type for Dockerfile stack analysis.
+ * @param {string} manifest path to the Dockerfile
+ * @param {{}} [opts={}] optional various options to pass along the application
+ * @returns {Promise<Provided>}
+ */
+async function provideStack(manifest, opts = {}) {
+    return getImageSBOM(manifest, opts);
+}
+/**
+ * Dockerfiles contain no license information.
+ * @returns {null} always null
+ */
+function readLicenseFromManifest() { return null; }

package/dist/src/providers/processors/yarn_berry_processor.d.ts

@@ -29,13 +29,13 @@ export default class Yarn_berry_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/processors/yarn_classic_processor.d.ts

@@ -25,13 +25,13 @@ export default class Yarn_classic_processor extends Yarn_processor {
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    */
-    getRootDependencies(depTree: any): Map<string, PackageURL>;
+    getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Adds dependencies to the SBOM
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The dependency tree object
    */
-    addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     #private;
 }
 import Yarn_processor from "./yarn_processor.js";

package/dist/src/providers/python_controller.js

@@ -19,6 +19,53 @@ function getPipShowOutput(depNames) {
         throw new Error('fail invoking \'pip show\' to fetch metadata for all installed packages in environment', { cause: error });
     }
 }
+/**
+ * Get pip inspect output from env var override or by invoking pip inspect.
+ * Returns null if pip inspect is unavailable (pip < 22.2) or if freeze/show
+ * env vars are set without an inspect override (to avoid inconsistent data).
+ * @return {string|null} pip inspect JSON output, or null on failure
+ */
+function getPipInspectOutput() {
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_INSPECT")) {
+        return new Buffer.from(process.env["TRUSTIFY_DA_PIP_INSPECT"], 'base64').toString('ascii');
+    }
+    if (environmentVariableIsPopulated("TRUSTIFY_DA_PIP_FREEZE") || environmentVariableIsPopulated("TRUSTIFY_DA_PIP_SHOW")) {
+        return null;
+    }
+    try {
+        return invokeCommand(this.pathToPipBin, ['inspect']).toString();
+    }
+    catch (error) {
+        console.warn('pip inspect is not available (requires pip 22.2+), SBOM will be generated without hashes');
+        return null;
+    }
+}
+/**
+ * Parse pip inspect JSON output and build a hash lookup map.
+ * @param {string|null} inspectOutput - raw pip inspect JSON string
+ * @return {Map<string, Array<{alg: string, content: string}>>} map of lowercase package name to hashes
+ */
+function parsePipInspectHashes(inspectOutput) {
+    if (!inspectOutput) {
+        return new Map();
+    }
+    try {
+        let inspectData = JSON.parse(inspectOutput);
+        let hashMap = new Map();
+        for (let pkg of (inspectData.installed || [])) {
+            let name = pkg.metadata?.name;
+            let sha256 = pkg.download_info?.archive_info?.hashes?.sha256;
+            if (name && sha256) {
+                hashMap.set(name.toLowerCase(), [{ alg: "SHA-256", content: sha256 }]);
+            }
+        }
+        return hashMap;
+    }
+    catch (error) {
+        console.warn('Failed to parse pip inspect output, SBOM will be generated without hashes');
+        return new Map();
+    }
+}
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 export default class Python_controller {
     pythonEnvDir;
@@ -225,6 +272,8 @@ export default class Python_controller {
                 CachedEnvironmentDeps[packageName.replace("_", "-")] = pipDepTreeEntryForCache;
             });
         }
+        const inspectOutput = getPipInspectOutput.call(this);
+        const hashMap = parsePipInspectHashes(inspectOutput);
         parsedRequirements.forEach(({ name: depName, version: manifestVersion, hasMarker }) => {
             if (hasMarker && CachedEnvironmentDeps[depName.toLowerCase()] === undefined) {
                 return;
@@ -247,7 +296,7 @@ export default class Python_controller {
             }
             let path = [];
             path.push(depName.toLowerCase());
-            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree);
+            bringAllDependencies(dependencies, depName, CachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap);
         });
         dependencies.sort((dep1, dep2) => {
             const DEP1 = dep1.name.toLowerCase();
@@ -327,8 +376,9 @@ function getDepsList(record) {
  * @param includeTransitive
  * @param usePipDepTree
  * @param {[string]}path array representing the path of the current branch in dependency tree, starting with a root dependency - that is - a given dependency in requirements.txt
+ * @param {Map<string, Array<{alg: string, content: string}>>} hashMap - map of lowercase package name to hashes
  */
-function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree) {
+function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDeps, includeTransitive, path, usePipDepTree, hashMap) {
     if (dependencyName?.trim() === "") {
         return;
     }
@@ -350,7 +400,11 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
         directDeps = record.dependencies;
     }
     let targetDeps = [];
+    let hashes = hashMap?.get(depName.toLowerCase());
     let entry = { "name": depName, "version": version, "dependencies": [] };
+    if (hashes) {
+        entry.hashes = hashes;
+    }
     dependencies.push(entry);
     directDeps.forEach((dep) => {
         let depArray = [];
@@ -360,7 +414,7 @@ function bringAllDependencies(dependencies, dependencyName, cachedEnvironmentDep
             depArray.push(dep.toLowerCase());
             if (includeTransitive) {
                 // send to recurrsion the array of all deps in path + the current dependency name which is not on the path.
-                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree);
+                bringAllDependencies(targetDeps, dep, cachedEnvironmentDeps, includeTransitive, path.concat(depArray), usePipDepTree, hashMap);
             }
         }
         // sort ra

package/dist/src/providers/python_pip.d.ts

@@ -4,6 +4,7 @@ declare namespace _default {
     export { provideComponent };
     export { provideStack };
     export { readLicenseFromManifest };
+    export function packageManagerName(): string;
 }
 export default _default;
 export type DependencyEntry = {

package/dist/src/providers/python_pip.js

@@ -5,7 +5,7 @@ import Sbom from '../sbom.js';
 import { environmentVariableIsPopulated, getCustom, getCustomPath, invokeCommand } from "../tools.js";
 import Python_controller from './python_controller.js';
 import { getParser, getIgnoreQuery, getPinnedVersionQuery } from './requirements_parser.js';
-export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest };
+export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'pip'; } };
 /** @typedef {{name: string, version: string, dependencies: DependencyEntry[], hashes?: Array<{alg: string, content: string}>}} DependencyEntry */
 /**
  * @type {string} ecosystem for python-pip is 'pip'