@cyclonedx/cdxgen
Version:
Creates CycloneDX Software Bill of Materials (SBOM) from source or container image
1,462 lines • 52.5 kB
TypeScript
/**
* Safely check if a file path exists without crashing due to a lack of permissions
*
* @param {String} filePath File path
* @Boolean True if the path exists. False otherwise
*/
export function safeExistsSync(filePath: string): boolean;
/**
* Safely create a directory without crashing due to a lack of permissions
*
* @param {String} filePath File path
* @param options {Options} mkdir options
* @Boolean True if the path exists. False otherwise
*/
export function safeMkdirSync(filePath: string, options: Options): string;
export function shouldFetchLicense(): boolean;
export function shouldFetchVCS(): boolean;
export function getJavaCommand(): string;
export function getPythonCommand(): string;
/**
* Method to check if a given feature flag is enabled.
*
* @param {Object} cliOptions CLI options
* @param {String} feature Feature flag
*
* @returns {Boolean} True if the feature is enabled
*/
export function isFeatureEnabled(cliOptions: any, feature: string): boolean;
/**
* Method to check if the given project types are allowed by checking against include and exclude types passed from the CLI arguments.
*
* @param {Array} projectTypes project types to check
* @param {Object} options CLI options
* @param {Boolean} defaultStatus Default return value if there are no types provided
*/
export function hasAnyProjectType(projectTypes: any[], options: any, defaultStatus?: boolean): any;
/**
* Convenient method to check if the given package manager is allowed.
*
* @param {String} name Package manager name
* @param {Array} conflictingManagers List of package managers
* @param {Object} options CLI options
*
* @returns {Boolean} True if the package manager is allowed
*/
export function isPackageManagerAllowed(name: string, conflictingManagers: any[], options: any): boolean;
/**
* Method to get files matching a pattern
*
* @param {string} dirPath Root directory for search
* @param {string} pattern Glob pattern (eg: *.gradle)
* @param {Object} options CLI options
*/
export function getAllFiles(dirPath: string, pattern: string, options?: any): string[];
/**
* Method to get files matching a pattern
*
* @param {string} dirPath Root directory for search
* @param {string} pattern Glob pattern (eg: *.gradle)
* @param {Array} ignoreList Directory patterns to ignore
*/
export function getAllFilesWithIgnore(dirPath: string, pattern: string, ignoreList: any[]): string[];
/**
* Return the current timestamp in YYYY-MM-DDTHH:MM:SSZ format.
*
* @returns {string} ISO formatted timestamp, without milliseconds.
*/
export function getTimestamp(): string;
export function getTmpDir(): any;
/**
* Method to determine if a license is a valid SPDX license expression
*
* @param {string} license License string
* @returns {boolean} true if the license is a valid SPDX license expression
* @see https://spdx.dev/learn/handling-license-info/
**/
export function isSpdxLicenseExpression(license: string): boolean;
/**
* Convert the array of licenses to a CycloneDX 1.5 compliant license array.
* This should return an array containing:
* - one or more SPDX license if no expression is present
* - the license of the expression if one expression is present
* - a unified conditional 'OR' license expression if more than one expression is present
*
* @param {Array} licenses Array of licenses
* @returns {Array} CycloneDX 1.5 compliant license array
*/
export function adjustLicenseInformation(licenses: any[]): any[];
/**
* Performs a lookup + validation of the license specified in the
* package. If the license is a valid SPDX license ID, set the 'id'
* and url of the license object, otherwise, set the 'name' of the license
* object.
*/
export function getLicenses(pkg: any): any[];
/**
* Method to retrieve known license by known-licenses.json
*
* @param {String} licenseUrl Repository url
* @param {String} pkg Bom ref
* @return {Object} Objetct with SPDX license id or license name
*/
export function getKnownLicense(licenseUrl: string, pkg: string): any;
/**
* Tries to find a file containing the license text based on commonly
* used naming and content types. If a candidate file is found, add
* the text to the license text object and stop.
*/
export function addLicenseText(pkg: any, l: any, licenseContent: any): void;
/**
* Read the file from the given path to the license text object and includes
* content-type attribute, if not default. Returns the license text object.
*/
export function readLicenseText(licenseFilepath: any, licenseContentType: any): {
content: string;
};
export function getSwiftPackageMetadata(pkgList: any): Promise<any[]>;
/**
* Method to retrieve metadata for npm packages by querying npmjs
*
* @param {Array} pkgList Package list
*/
export function getNpmMetadata(pkgList: any[]): Promise<any[]>;
/**
* Parse nodejs package json file
*
* @param {string} pkgJsonFile package.json file
* @param {boolean} simple Return a simpler representation of the component by skipping extended attributes and license fetch.
*/
export function parsePkgJson(pkgJsonFile: string, simple?: boolean): Promise<any[]>;
/**
* Parse nodejs package lock file
*
* @param {string} pkgLockFile package-lock.json file
* @param {object} options Command line options
*/
export function parsePkgLock(pkgLockFile: string, options?: object): Promise<{
pkgList: any;
dependenciesList: any;
}>;
/**
* Given a lock file this method would return an Object with the identity as the key and parsed name and value
* eg: "@actions/core@^1.2.6", "@actions/core@^1.6.0":
* version "1.6.0"
* would result in two entries
*
* @param {string} lockData Yarn Lockfile data
*/
export function yarnLockToIdentMap(lockData: string): {};
/**
* Parse nodejs yarn lock file
*
* @param {string} yarnLockFile yarn.lock file
*/
export function parseYarnLock(yarnLockFile: string): Promise<{
pkgList: any[];
dependenciesList: any[];
}>;
/**
* Parse nodejs shrinkwrap deps file
*
* @param {string} swFile shrinkwrap-deps.json file
*/
export function parseNodeShrinkwrap(swFile: string): Promise<any[]>;
/**
* Parse pnpm workspace file
*
* @param {string} workspaceFile pnpm-workspace.yaml
* @returns {object} Object containing packages and catalogs
*/
export function parsePnpmWorkspace(workspaceFile: string): object;
/**
* Parse nodejs pnpm lock file
*
* @param {string} pnpmLock pnpm-lock.yaml file
* @param {Object} parentComponent parent component
* @param {Array[String]} workspacePackages Workspace packages
* @param {Object} workspaceSrcFiles Workspace package.json files
* @param {Object} workspaceCatalogs Workspace catalogs
* @param {Object} workspaceDirectDeps Direct dependencies of each workspace
* @param {Object} depsWorkspaceRefs Workspace references for each dependency
*/
export function parsePnpmLock(pnpmLock: string, parentComponent?: any, workspacePackages?: any, workspaceSrcFiles?: any, _workspaceCatalogs?: {}, _workspaceDirectDeps?: {}, depsWorkspaceRefs?: any): Promise<{
pkgList?: undefined;
dependenciesList?: undefined;
parentSubComponents?: undefined;
} | {
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
parentSubComponents: {
group: any;
name: any;
version: any;
type: string;
purl: string;
"bom-ref": string;
}[];
}>;
/**
* Parse bower json file
*
* @param {string} bowerJsonFile bower.json file
*/
export function parseBowerJson(bowerJsonFile: string): Promise<any[]>;
/**
* Parse minified js file
*
* @param {string} minJsFile min.js file
*/
export function parseMinJs(minJsFile: string): Promise<any[]>;
/**
* Parse pom file
*
* @param {string} pomFile pom file to parse
* @returns {Object} Object containing pom properties, modules, and array of dependencies
*/
export function parsePom(pomFile: string): any;
/**
* Parse maven tree output
* @param {string} rawOutput Raw string output
* @param {string} pomFile .pom file for evidence
*
* @returns {Object} Object containing packages and dependencies
*/
export function parseMavenTree(rawOutput: string, pomFile: string): any;
/**
* Parse mill dependencies from file
*
* @param {string} module name of the module
* @param {map} dependencies the parsed dependencies
* @param {map} relations a map containing all relations
* @param {string} millRootPath root of the project
*
* @returns the bom-ref of the module
*/
export function parseMillDependency(module: string, dependencies: map, relations: map, millRootPath: string): any;
/**
* Parse gradle dependencies output
* @param {string} rawOutput Raw string output
* @param {string} rootProjectName Root project name
* @param {map} gradleModules Cache with all gradle modules that have already been read
* @param {string} gradleRootPath Root path where Gradle is to be run when getting module information
*/
export function parseGradleDep(rawOutput: string, rootProjectName?: string, gradleModules?: map, gradleRootPath?: string): Promise<{
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
} | {
pkgList?: undefined;
dependenciesList?: undefined;
}>;
/**
* Parse clojure cli dependencies output
* @param {string} rawOutput Raw string output
*/
export function parseCljDep(rawOutput: string): any[];
/**
* Parse lein dependency tree output
* @param {string} rawOutput Raw string output
*/
export function parseLeinDep(rawOutput: string): any;
export function parseLeinMap(node: any, keys_cache: any, deps: any): any;
/**
* Parse gradle projects output
*
* @param {string} rawOutput Raw string output
*/
export function parseGradleProjects(rawOutput: string): {
rootProject: string;
projects: any[];
};
/**
* Parse gradle properties output
*
* @param {string} rawOutput Raw string output
* @param {string} gradleModuleName The name (or 'path') of the module as seen from the root of the project
*/
export function parseGradleProperties(rawOutput: string, gradleModuleName?: string): {
rootProject: string;
projects: any[];
metadata: {
group: string;
version: string;
properties: any[];
};
};
/**
* Execute gradle properties command using multi-threading and return parsed output
*
* @param {string} dir Directory to execute the command
* @param {array} allProjectsStr List of all sub-projects (including the preceding `:`)
* @param {array} extraArgs List of extra arguments to use when calling gradle
*
* @returns {string} The combined output for all subprojects of the Gradle properties task
*/
export function executeParallelGradleProperties(dir: string, allProjectsStr: any[], extraArgs?: any[]): string;
/**
* Parse bazel action graph output
* @param {string} rawOutput Raw string output
*/
export function parseBazelActionGraph(rawOutput: string): any[];
/**
* Parse bazel skyframe state output
* @param {string} rawOutput Raw string output
*/
export function parseBazelSkyframe(rawOutput: string): any[];
/**
* Parse bazel BUILD file
* @param {string} rawOutput Raw string output
*/
export function parseBazelBuild(rawOutput: string): any[];
/**
* Parse dependencies in Key:Value format
*/
export function parseKVDep(rawOutput: any): any[];
/**
* Method to find the spdx license id from name
*
* @param {string} name License full name
*/
export function findLicenseId(name: string): any;
/**
* Method to guess the spdx license id from license contents
*
* @param {string} content License file contents
*/
export function guessLicenseId(content: string): any;
/**
* Method to retrieve metadata for maven packages by querying maven central
*
* @param {Array} pkgList Package list
* @param {Object} jarNSMapping Jar Namespace mapping object
* @param {Boolean} force Force fetching of license
*
* @returns {Array} Updated package list
*/
export function getMvnMetadata(pkgList: any[], jarNSMapping?: any, force?: boolean): any[];
/**
* Method to compose URL of pom.xml
*
* @param {String} urlPrefix
* @param {String} group
* @param {String} name
* @param {String} version
*
* @return {String} fullUrl
*/
export function composePomXmlUrl({ urlPrefix, group, name, version }: string): string;
/**
* Method to fetch pom.xml data and parse it to JSON
*
* @param {String} urlPrefix
* @param {String} group
* @param {String} name
* @param {String} version
*
* @return {Object|undefined}
*/
export function fetchPomXmlAsJson({ urlPrefix, group, name, version }: string): any | undefined;
/**
* Method to fetch pom.xml data
*
* @param {String} urlPrefix
* @param {String} group
* @param {String} name
* @param {String} version
*
* @return {Promise<String>}
*/
export function fetchPomXml({ urlPrefix, group, name, version }: string): Promise<string>;
/**
* Method extract single or multiple license entries that might appear in pom.xml
*
* @param {Object|Array} license
*/
export function parseLicenseEntryOrArrayFromPomXml(license: any | any[]): any[];
/**
* Method to parse pom.xml in search of a comment containing license text
*
* @param {String} urlPrefix
* @param {String} group
* @param {String} name
* @param {String} version
*
* @return {Promise<String>} License ID
*/
export function extractLicenseCommentFromPomXml({ urlPrefix, group, name, version, }: string): Promise<string>;
/**
* Method to parse python requires_dist attribute found in pypi setup.py
*
* @param {String} dist_string string
*/
export function parsePyRequiresDist(dist_string: string): {
name: string;
version: string;
};
/**
* Method to mimic pip version solver using node-semver
*
* @param {Array} versionsList List of version numbers available
* @param {*} versionSpecifiers pip version specifier
*/
export function guessPypiMatchingVersion(versionsList: any[], versionSpecifiers: any): any;
/**
* Method to retrieve metadata for python packages by querying pypi
*
* @param {Array} pkgList Package list
* @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
*/
export function getPyMetadata(pkgList: any[], fetchDepsInfo: boolean): Promise<any[]>;
/**
* Method to parse bdist_wheel metadata
*
* @param {Object} mData bdist_wheel metadata
*/
export function parseBdistMetadata(mData: any): {}[];
/**
* Method to parse pipfile.lock data
*
* @param {Object} lockData JSON data from Pipfile.lock
*/
export function parsePiplockData(lockData: any): Promise<any[]>;
/**
* Method to parse python pyproject.toml file
*
* @param {string} tomlFile pyproject.toml file
* @returns {Object} Object with parent component, root dependencies, and metadata.
*/
export function parsePyProjectTomlFile(tomlFile: string): any;
/**
* Method to parse python lock files such as poetry.lock, pdm.lock, uv.lock.
*
* @param {Object} lockData JSON data from poetry.lock, pdm.lock, or uv.lock file
* @param {string} lockFile Lock file name for evidence
* @param {string} pyProjectFile pyproject.toml file
*/
export function parsePyLockData(lockData: any, lockFile: string, pyProjectFile: string): Promise<{
pkgList: any[];
dependenciesList: any[];
parentComponent?: undefined;
rootList?: undefined;
workspaceWarningShown?: undefined;
} | {
parentComponent: any;
pkgList: any[];
rootList: {
name: any;
version: any;
description: any;
properties: any[];
}[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
workspaceWarningShown: boolean;
}>;
/**
* Method to parse requirements.txt data. This must be replaced with atom parsedeps.
*
* @param {Object} reqData Requirements.txt data
* @param {Boolean} fetchDepsInfo Fetch dependencies info from pypi
*/
export function parseReqFile(reqData: any, fetchDepsInfo: boolean): Promise<any[]>;
/**
* Method to find python modules by parsing the imports and then checking with PyPI to obtain the latest version
*
* @param {string} src directory
* @param {Array} epkgList Existing package list
* @param {Object} options CLI options
* @returns List of packages
*/
export function getPyModules(src: string, epkgList: any[], options: any): Promise<{
allImports: {};
pkgList: any;
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
modList: any;
}>;
/**
* Method to parse setup.py data
*
* @param {Object} setupPyData Contents of setup.py
*/
export function parseSetupPyFile(setupPyData: any): Promise<any[]>;
/**
* Method to parse pixi.lock data
*
* @param {String} pixiLockFileName pixi.lock file name
* @param {String} path File path
*/
export function parsePixiLockFile(pixiLockFileName: string, path: string): {
pkgList: any;
formulationList: any[];
rootList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
frozen: boolean;
};
/**
* Method to parse pixi.toml file
*
* @param {String} pixiToml
*/
export function parsePixiTomlFile(pixiToml: string): {
description: any;
name: any;
version: any;
homepage: any;
repository: any;
};
/**
* Method to construct a GitHub API url for the given repo metadata
* @param {Object} repoMetadata Repo metadata with group and name
* @return {String|undefined} github api url (or undefined - if not enough data)
*/
export function repoMetadataToGitHubApiUrl(repoMetadata: any): string | undefined;
/**
* Method to run cli command `pixi install`
*
*
*/
export function generatePixiLockFile(_path: any): void;
/**
* Method to split GitHub url into its parts
* @param {String} repoUrl Repository url
* @return {[String]} parts from url
*/
export function getGithubUrlParts(repoUrl: string): [string];
/**
* Method to construct GitHub api url from repo metadata or one of multiple formats of repo URLs
* @param {String} repoUrl Repository url
* @param {Object} repoMetadata Object containing group and package name strings
* @return {String|undefined} github api url (or undefined - if not a GitHub repo)
*/
export function toGitHubApiUrl(repoUrl: string, repoMetadata: any): string | undefined;
/**
* Method to retrieve repo license by querying github api
*
* @param {String} repoUrl Repository url
* @param {Object} repoMetadata Object containing group and package name strings
* @return {Promise<String>} SPDX license id
*/
export function getRepoLicense(repoUrl: string, repoMetadata: any): Promise<string>;
/**
* Method to get go pkg license from go.dev site.
*
* @param {Object} repoMetadata Repo metadata
*/
export function getGoPkgLicense(repoMetadata: any): Promise<any>;
export function getGoPkgComponent(group: any, name: any, version: any, hash: any): Promise<{
group: any;
name: any;
version: any;
_integrity: any;
license: any;
purl: string;
"bom-ref": string;
}>;
/**
* Method to parse go.mod files
*
* @param {String} goModData Contents of go.mod file
* @param {Object} gosumMap Data from go.sum files
*
* @returns {Object} Object containing parent component, rootList and packages list
*/
export function parseGoModData(goModData: string, gosumMap: any): any;
export function parseGoModulesTxt(txtFile: any, gosumMap: any): Promise<any[]>;
/**
* Parse go list output
*
* @param {string} rawOutput Output from go list invocation
* @param {Object} gosumMap go.sum data
* @returns Object with parent component and List of packages
*/
export function parseGoListDep(rawOutput: string, gosumMap: any): Promise<{
parentComponent: {};
pkgList: {
group: any;
name: any;
version: any;
_integrity: any;
license: any;
purl: string;
"bom-ref": string;
}[];
}>;
/**
* Parse go mod graph
*
* @param {string} rawOutput Output from go mod graph invocation
* @param {string} goModFile go.mod file
* @param {Object} gosumMap Hashes from gosum for lookups
* @param {Array} epkgList Existing package list
* @param {Object} parentComponent Current parent component
*
* @returns Object containing List of packages and dependencies
*/
export function parseGoModGraph(rawOutput: string, goModFile: string, gosumMap: any, epkgList?: any[], parentComponent?: any): Promise<{
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
parentComponent: any;
rootList: any;
}>;
/**
* Parse go mod why output
* @param {string} rawOutput Output from go mod why
* @returns package name or none
*/
export function parseGoModWhy(rawOutput: string): any;
/**
* Parse go sum data
* @param {string} gosumData Content of go.sum
* @returns package list
*/
export function parseGosumData(gosumData: string): Promise<any[]>;
export function parseGopkgData(gopkgData: any): Promise<any[]>;
export function parseGoVersionData(buildInfoData: any): Promise<any[]>;
/**
* Method to query rubygems api for gems details
*
* @param {Array} pkgList List of packages with metadata
*/
export function getRubyGemsMetadata(pkgList: any[]): Promise<any[]>;
/**
* Utility method to convert a gem package name to a CamelCased module name. Low accuracy.
*
* @param name Package name
*/
export function toGemModuleNames(name: any): string[];
/**
* Collect all namespaces for a given gem present at the given gemHome
*
* @param {String} rubyCommand Ruby command to use if bundle is not available
* @param {String} bundleCommand Bundle command to use
* @param {String} gemHome Value to use as GEM_HOME env variable
* @param {String} gemName Name of the gem
* @param {String} filePath File path to the directory containing the Gemfile or .bundle directory
*
* @returns {Array<string>} List of module names
*/
export function collectGemModuleNames(rubyCommand: string, bundleCommand: string, gemHome: string, gemName: string, filePath: string): Array<string>;
/**
* Method to parse Gemspec file contents
*
* @param {string} gemspecData Gemspec data
* @param {string} gemspecFile File name for evidence.
*/
export function parseGemspecData(gemspecData: string, gemspecFile: string): Promise<any[]>;
/**
* Method to parse Gemfile.lock
*
* @param {object} gemLockData Gemfile.lock data
* @param {string} lockFile Lock file
*/
export function parseGemfileLockData(gemLockData: object, lockFile: string): Promise<any[] | {
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
rootList: any[];
}>;
/**
* Method to retrieve metadata for rust packages by querying crates
*
* @param {Array} pkgList Package list
*/
export function getCratesMetadata(pkgList: any[]): Promise<any[]>;
/**
* Method to retrieve metadata for dart packages by querying pub.dev
*
* @param {Array} pkgList Package list
*/
export function getDartMetadata(pkgList: any[]): Promise<any[]>;
/**
* Method to parse cargo.toml data
*
* The component described by a [package] section will be put at the front of
* the list, regardless of if [package] appears before or after
* [dependencies]. Found dependencies will be placed at the back of the
* list.
*
* The Cargo documentation specifies that the [package] section should appear
* first as a convention, but it is not enforced.
* https://doc.rust-lang.org/stable/style-guide/cargo.html#formatting-conventions
*
* @param {String} cargoTomlFile cargo.toml file
* @param {boolean} simple Return a simpler representation of the component by skipping extended attributes and license fetch.
* @param {Object} pkgFilesMap Object with package name and list of files
*
* @returns {Array} Package list
*/
export function parseCargoTomlData(cargoTomlFile: string, simple?: boolean, pkgFilesMap?: any): any[];
/**
* Parse a Cargo.lock file to find components within the Rust project.
*
* @param {String} cargoLockFile A path to a Cargo.lock file. The Cargo.lock-file path may be used as information for extended attributes, such as manifest based evidence.
* @param {boolean} simple Return a simpler representation of the component by skipping extended attributes and license fetch.
* @param {Object} pkgFilesMap Object with package name and list of files
*
* @returns {Array} A list of the project's components as described by the Cargo.lock-file.
*/
export function parseCargoData(cargoLockFile: string, simple?: boolean, pkgFilesMap?: any): any[];
export function parseCargoDependencyData(cargoLockData: any): any[];
export function parseCargoAuditableData(cargoData: any): Promise<any[]>;
/**
* Method to parse pubspec.lock files.
*
* @param pubLockData Contents of lock data
* @param lockFile Filename for setting evidence
*
* @returns {Object}
*/
export function parsePubLockData(pubLockData: any, lockFile: any): any;
export function parsePubYamlData(pubYamlData: any): any[];
export function parseHelmYamlData(helmData: any): any[];
export function recurseImageNameLookup(keyValueObj: any, pkgList: any, imgList: any): any;
export function parseContainerFile(fileContents: any): {
image: any;
}[];
export function parseBitbucketPipelinesFile(fileContents: any): {
image: any;
}[];
export function parseContainerSpecData(dcData: any): any[];
export function identifyFlow(processingObj: any): string;
export function parsePrivadoFile(f: any): any[];
export function parseOpenapiSpecData(oaData: any): any[];
export function parseCabalData(cabalData: any): any[];
export function parseMixLockData(mixData: any): any[];
export function parseGitHubWorkflowData(ghwData: any): any[];
export function parseCloudBuildData(cbwData: any): any[];
export function mapConanPkgRefToPurlStringAndNameAndVersion(conanPkgRef: any): any[];
export function parseConanLockData(conanLockData: any): any[];
export function parseConanData(conanData: any): any[];
export function parseLeiningenData(leinData: any): any[];
export function parseEdnData(rawEdnData: any): any[];
/**
* Method to parse .nupkg files
*
* @param {String} nupkgFile .nupkg file
* @returns {Object} Object containing package list and dependencies
*/
export function parseNupkg(nupkgFile: string): any;
/**
* Method to parse .nuspec files
*
* @param {String} nupkgFile .nupkg file
* @param {String} nuspecData Raw nuspec data
* @returns {Object} Object containing package list and dependencies
*/
export function parseNuspecData(nupkgFile: string, nuspecData: string): any;
export function parseCsPkgData(pkgData: any, pkgFile: any): any[];
/**
* Method to parse .csproj like xml files
*
* @param {String} csProjData Raw data
* @param {String} projFile File name
* @param {Object} pkgNameVersions Package name - version map object
*
* @returns {Object} Containing parent component, package, and dependencies
*/
export function parseCsProjData(csProjData: string, projFile: string, pkgNameVersions?: any): any;
export function parseCsProjAssetsData(csProjData: any, assetsJsonFile: any): {
pkgList: any[];
dependenciesList: any[];
};
export function parseCsPkgLockData(csLockData: any, pkgLockFile: any): {
pkgList: any[];
dependenciesList: any[];
rootList: any[];
};
export function parsePaketLockData(paketLockData: any, pkgLockFile: any): {
pkgList: any[];
dependenciesList: any[];
};
/**
* Parse composer.json file
*
* @param {string} composerJsonFile composer.json file
*
* @returns {Object} Object with rootRequires and parent component
*/
export function parseComposerJson(composerJsonFile: string): any;
/**
* Parse composer lock file
*
* @param {string} pkgLockFile composer.lock file
* @param {array} rootRequires require section from composer.json
*/
export function parseComposerLock(pkgLockFile: string, rootRequires: any[]): any[] | {
pkgList: {
group: string;
name: string;
purl: string;
"bom-ref": string;
version: any;
repository: any;
license: any;
description: any;
scope: string;
properties: {
name: string;
value: string;
}[];
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: string;
}[];
};
};
}[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
rootList: {
group: string;
name: string;
purl: string;
"bom-ref": string;
version: any;
repository: any;
license: any;
description: any;
scope: string;
properties: {
name: string;
value: string;
}[];
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: string;
}[];
};
};
}[];
};
export function parseSbtTree(sbtTreeFile: any): {
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
};
/**
* Parse sbt lock file
*
* @param {string} pkgLockFile build.sbt.lock file
*/
export function parseSbtLock(pkgLockFile: string): {
group: any;
name: any;
version: any;
_integrity: string;
scope: string;
properties: {
name: string;
value: string;
}[];
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: string;
}[];
};
};
}[];
/**
* Method to execute dpkg --listfiles to determine the files provided by a given package
*
* @param {string} pkgName deb package name
* @returns
*/
export function executeDpkgList(pkgName: string): string[];
/**
* Method to execute dnf repoquery to determine the files provided by a given package
*
* @param {string} pkgName deb package name
* @returns
*/
export function executeRpmList(pkgName: string): string[];
/**
* Method to execute apk -L info to determine the files provided by a given package
*
* @param {string} pkgName deb package name
* @returns
*/
export function executeApkList(pkgName: string): string[];
/**
* Method to execute alpm -Ql to determine the files provided by a given package
*
* @param {string} pkgName deb package name
* @returns
*/
export function executeAlpmList(pkgName: string): string[];
/**
* Method to execute equery files to determine the files provided by a given package
*
* @param {string} pkgName deb package name
* @returns
*/
export function executeEqueryList(pkgName: string): string[];
/**
* Convert OS query results
*
* @param {string} queryCategory Query category
* @param {Object} queryObj Query Object from the queries.json configuration
* @param {Array} results Query Results
* @param {Boolean} enhance Optionally enhance results by invoking additional package manager commands
*/
export function convertOSQueryResults(queryCategory: string, queryObj: any, results: any[], enhance?: boolean): {
name: any;
group: string;
version: any;
description: any;
publisher: any;
"bom-ref": string;
purl: string;
scope: any;
type: any;
}[];
/**
* Parse swift dependency tree output json object
*
* @param {Array} pkgList Package list
* @param {Array} dependenciesList Dependencies
* @param {string} jsonObject Swift dependencies json object
* @param {string} pkgFile Package.swift file
*/
export function parseSwiftJsonTreeObject(pkgList: any[], dependenciesList: any[], jsonObject: string, pkgFile: string): string;
/**
* Parse swift dependency tree output
* @param {string} rawOutput Swift dependencies json output
* @param {string} pkgFile Package.swift file
*/
export function parseSwiftJsonTree(rawOutput: string, pkgFile: string): {
rootList?: undefined;
pkgList?: undefined;
dependenciesList?: undefined;
} | {
rootList: any[];
pkgList: any[];
dependenciesList: any[];
};
/**
* Parse swift package resolved file
* @param {string} resolvedFile Package.resolved file
*/
export function parseSwiftResolved(resolvedFile: string): {
name: string;
group: string;
version: string;
purl: string;
"bom-ref": string;
properties: {
name: string;
value: string;
}[];
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: string;
}[];
};
};
}[];
/**
* Collect maven dependencies
*
* @param {string} mavenCmd Maven command to use
* @param {string} basePath Path to the maven project
* @param {boolean} cleanup Remove temporary directories
* @param {boolean} includeCacheDir Include maven and gradle cache directories
*/
export function collectMvnDependencies(mavenCmd: string, basePath: string, cleanup?: boolean, includeCacheDir?: boolean): Promise<{}>;
export function collectGradleDependencies(_gradleCmd: any, _basePath: any, _cleanup?: boolean, _includeCacheDir?: boolean): Promise<{}>;
/**
* Method to collect class names from all jars in a directory
*
* @param {string} jarPath Path containing jars
* @param {object} pomPathMap Map containing jar to pom names. Required to successfully parse gradle cache.
*
* @return object containing jar name and class list
*/
export function collectJarNS(jarPath: string, pomPathMap?: object): Promise<{}>;
export function convertJarNSToPackages(jarNSMapping: any): {
name: any;
group: any;
version: any;
description: any;
purl: string;
"bom-ref": string;
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: any;
}[];
};
};
properties: {
name: string;
value: any;
}[];
}[];
/**
* Deprecated function to parse pom.xml. Use parsePom instead.
*
* @deprecated
* @param pomXmlData XML contents
* @returns {Object} Parent component data
*/
export function parsePomXml(pomXmlData: any): any;
export function parseJarManifest(jarMetadata: any): {};
export function parsePomProperties(pomProperties: any): {};
export function encodeForPurl(s: any): any;
/**
* Method to get pom properties from maven directory
*
* @param {string} mavenDir Path to maven directory
*
* @return array with pom properties
*/
export function getPomPropertiesFromMavenDir(mavenDir: string): {};
/**
* Computes the checksum for a file path using the given hash algorithm
*
* @param {string} hashName name of hash algorithm
* @param {string} path path to file
* @returns {Promise<String>} hex value of hash
*/
export function checksumFile(hashName: string, path: string): Promise<string>;
/**
* Computes multiple checksum for a file path using the given hash algorithms
*
* @param {Array[String]} algorithms Array of algorithms
* @param {string} path path to file
* @returns {Promise<Object>} hashes object
*/
export function multiChecksumFile(algorithms: any, path: string): Promise<any>;
/**
* Method to extract a war or ear file
*
* @param {string} jarFile Path to jar file
* @param {string} tempDir Temporary directory to use for extraction
* @param {object} jarNSMapping Jar class names mapping object
*
* @return pkgList Package list
*/
export function extractJarArchive(jarFile: string, tempDir: string, jarNSMapping?: object): Promise<any[]>;
/**
* Determine the version of SBT used in compilation of this project.
* By default it looks into a standard SBT location i.e.
* <path-project>/project/build.properties
* Returns `null` if the version cannot be determined.
*
* @param {string} projectPath Path to the SBT project
*/
export function determineSbtVersion(projectPath: string): any;
/**
* Adds a new plugin to the SBT project by amending its plugins list.
* Only recommended for SBT < 1.2.0 or otherwise use `addPluginSbtFile`
* parameter.
* The change manipulates the existing plugins' file by creating a copy of it
* and returning a path where it is moved to.
* Once the SBT task is complete one must always call `cleanupPlugin` to remove
* the modifications made in place.
*
* @param {string} projectPath Path to the SBT project
* @param {string} plugin Name of the plugin to add
*/
export function addPlugin(projectPath: string, plugin: string): string;
/**
* Cleans up modifications to the project's plugins' file made by the
* `addPlugin` function.
*
* @param {string} projectPath Path to the SBT project
* @param {string} originalPluginsFile Location of the original plugins file, if any
*/
export function cleanupPlugin(projectPath: string, originalPluginsFile: string): boolean;
/**
* Returns a default location of the plugins file.
*
* @param {string} projectPath Path to the SBT project
*/
export function sbtPluginsPath(projectPath: string): string;
/**
* Method to read a single file entry from a zip file
*
* @param {string} zipFile Zip file to read
* @param {string} filePattern File pattern
* @param {string} contentEncoding Encoding. Defaults to utf-8
*
* @returns File contents
*/
export function readZipEntry(zipFile: string, filePattern: string, contentEncoding?: string): Promise<any>;
/**
* Method to get the classes and relevant sources in a jar file
*
* @param {string} jarFile Jar file to read
*
* @returns List of classes and sources matching certain known patterns
*/
export function getJarClasses(jarFile: string): Promise<any[]>;
/**
* Method to return the gradle command to use.
*
* @param {string} srcPath Path to look for gradlew wrapper
* @param {string|null} rootPath Root directory to look for gradlew wrapper
*/
export function getGradleCommand(srcPath: string, rootPath: string | null): string;
/**
* Method to return the mill command to use.
*
* @param {string} srcPath Path to look for mill wrapper
*/
export function getMillCommand(srcPath: string): string;
/**
* Method to combine the general gradle arguments, the sub-commands and the sub-commands' arguments in the correct way
*
* @param {string[]} gradleArguments The general gradle arguments, which must only be added once
* @param {string[]} gradleSubCommands The sub-commands that are to be executed by gradle
* @param {string[]} gradleSubCommandArguments The arguments specific to the sub-command(s), which much be added PER sub-command
* @param {int} gradleCommandLength The length of the full gradle-command
*
* @returns {string[]} Array of arrays of arguments to be added to the gradle command
*/
export function buildGradleCommandArguments(gradleArguments: string[], gradleSubCommands: string[], gradleSubCommandArguments: string[], gradleCommandLength: int): string[];
/**
* Method to split the output produced by Gradle using parallel processing by project
*
* @param {string} rawOutput Full output produced by Gradle using parallel processing
* @param {string[]} relevantTasks The list of gradle tasks whose output need to be considered.
* @returns {map} Map with subProject names as keys and corresponding dependency task outputs as values.
*/
export function splitOutputByGradleProjects(rawOutput: string, relevantTasks: string[]): map;
/**
* Parse the contents of a 'Podfile.lock'
*
* @param {Object} podfileLock The content of the podfile.lock as an Object
* @param {String} projectPath The path to the project root
* @returns {Map} Map of all dependencies with their direct dependencies
*/
export function parsePodfileLock(podfileLock: any, projectPath: string): Map<any, any>;
/**
* Parse all targets and their direct dependencies from the 'Podfile'
*
* @param {Object} target A JSON-object representing a target
* @param {Map} allDependencies The map containing all parsed direct dependencies for a target
* @param {String} [prefix=undefined] Prefix to add to the targets name
*/
export function parsePodfileTargets(target: any, allDependencies: Map<any, any>, prefix?: string): void;
/**
* Parse a single line representing a dependency
*
* @param {String} dependencyLine The line that should be parsed as a dependency
* @param {boolean} [parseVersion=true] Include parsing the version of the dependency
* @returns {Object} Object representing a dependency
*/
export function parseCocoaDependency(dependencyLine: string, parseVersion?: boolean): any;
/**
* Execute the 'pod'-command with parameters
*
* @param {String[]} parameters The parameters for the command
* @param {String} path The path where the command should be executed
* @param {Object} options CLI options
* @returns {Object} The result of running the command
*/
export function executePodCommand(parameters: string[], path: string, options: any): any;
/**
* Method that handles object creation for cocoa pods.
*
* @param {Object} dependency The dependency that is to be transformed into an SBOM object
* @param {Object} options CLI options
* @param {String} [type="library"] The type of Object to create
* @returns {Object} An object representing the pod in SBOM-format
*/
export function buildObjectForCocoaPod(dependency: any, options: any, type?: string): any;
/**
* Method that handles object creation for gradle modules.
*
* @param {string} name The simple name of the module
* @param {object} metadata Object with all other parsed data for the gradle module
* @returns {object} An object representing the gradle module in SBOM-format
*/
export function buildObjectForGradleModule(name: string, metadata: object): object;
/**
* Method to return the maven command to use.
*
* @param {string} srcPath Path to look for maven wrapper
* @param {string} rootPath Root directory to look for maven wrapper
*/
export function getMavenCommand(srcPath: string, rootPath: string): string;
/**
* Retrieves the atom command by referring to various environment variables
*/
export function getAtomCommand(): any;
export function executeAtom(src: any, args: any, extra_env?: {}): boolean;
/**
* Find the imported modules in the application with atom parsedeps command
*
* @param {string} src
* @param {string} language
* @param {string} methodology
* @param {string} slicesFile
* @returns List of imported modules
*/
export function findAppModules(src: string, language: string, methodology?: string, slicesFile?: string): any;
/**
* Create uv.lock file with uv sync command.
*
* @param {string} basePath Path
* @param {Object} options CLI options
*/
export function createUVLock(basePath: string, options: any): void;
/**
* Execute pip freeze by creating a virtual env in a temp directory and construct the dependency tree
*
* @param {string} basePath Base path
* @param {string} reqOrSetupFile Requirements or setup.py file
* @param {string} tempVenvDir Temp venv dir
* @param {Object} parentComponent Parent component
*
* @returns List of packages from the virtual env
*/
export function getPipFrozenTree(basePath: string, reqOrSetupFile: string, tempVenvDir: string, parentComponent: any): {
pkgList: {
name: any;
version: any;
purl: string;
type: string;
"bom-ref": string;
scope: string;
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: any;
}[];
};
};
properties: {
name: string;
value: string;
}[];
}[];
formulationList: {
name: any;
version: any;
purl: string;
type: string;
"bom-ref": string;
scope: string;
evidence: {
identity: {
field: string;
confidence: number;
methods: {
technique: string;
confidence: number;
value: any;
}[];
};
};
properties: {
name: string;
value: string;
}[];
}[];
rootList: {
name: any;
version: any;
purl: string;
"bom-ref": string;
}[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
frozen: boolean;
};
/**
* The problem: pip installation can fail for a number of reasons such as missing OS dependencies and devel packages.
* When it fails, we don't get any dependency tree. As a workaroud, this method would attempt to install one package at a time to the same virtual environment and then attempts to obtain a dependency tree.
* Such a tree could be incorrect or quite approximate, but some users might still find it useful to know the names of the indirect dependencies.
*
* @param {string} basePath Base path
* @param {Array} pkgList Existing package list
* @param {string} tempVenvDir Temp venv dir
* @param {Object} parentComponent Parent component
*
* @returns List of packages from the virtual env
*/
export function getPipTreeForPackages(basePath: string, pkgList: any[], tempVenvDir: string, parentComponent: any): {
failedPkgList?: undefined;
rootList?: undefined;
dependenciesList?: undefined;
} | {
failedPkgList: any[];
rootList: {
name: any;
version: any;
purl: string;
"bom-ref": string;
}[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
};
export function parsePackageJsonName(name: any): {
scope: any;
fullName: string;
projectName: string;
moduleName: string;
};
/**
* Method to add occurrence evidence for components based on import statements. Currently useful for js
*
* @param {array} pkgList List of package
* @param {object} allImports Import statements object with package name as key and an object with file and location details
* @param {object} allExports Exported modules if available from node_modules
* @param {Boolean} deep Deep mode
*/
export function addEvidenceForImports(pkgList: any[], allImports: object, allExports: object, deep: boolean): Promise<any[]>;
export function componentSorter(a: any, b: any): any;
export function parseCmakeDotFile(dotFile: any, pkgType: any, options?: {}): {
parentComponent: {};
pkgList: any[];
dependenciesList: {
ref: string;
dependsOn: any[];
}[];
};
export function parseCmakeLikeFile(cmakeListFile: any, pkgType: any, options?: {}): {
parentComponent: {};
pkgList: any[];
};
export function getOSPackageForFile(afile: any, osPkgsList: any): any;
/**
* Method to find c/c++ modules by collecting usages with atom
*
* @param {string} src directory
* @param {object} options Command line options
* @param {array} osPkgsList Array of OS pacakges represented as components
* @param {array} epkgList Existing packages list
*/
export function getCppModules(src: string, options: object, osPkgsList: any[], epkgList: any[]): {
parentComponent: {};
pkgList: any[];
dependenciesList: {
ref: any;
dependsOn: any[];
}[];
};
/**
* NOT IMPLEMENTED YET.
* A future method to locate a generic package given some name and properties
*
* @param {object} apkg Package to locate
* @returns Located project with precise purl or the original unmodified input.
*/
export function locateGenericPackage(apkg: object): any;
export function parseCUsageSlice(sliceData: any): {};
/**
* Method to retrieve metadata for nuget packages
*
* @param {Array} pkgList Package list
* @param {Array} dependencies Dependencies
*/
export function getNugetMetadata(pkgList: any[], dependencies?: any[]): Promise<{
pkgList: any[];
dependencies: any[];
}>;
export function addEvidenceForDotnet(pkgList: any, slicesFile: any): any;
/**
* Function to parse the .d make files
*
* @param {String} dfile .d file path
*
* @returns {Object} pkgFilesMap Object with package name and list of files
*/
export function parseMakeDFile(dfile: string): any;
/**
* Function to validate an externalReference URL for conforming to the JSON schema or bomLink
* https://github.com/CycloneDX/cyclonedx-core-java/blob/75575318b268dda9e2a290761d7db11b4f414255/src/main/resources/bom-1.5.schema.json#L1140
* https://datatracker.ietf.org/doc/html/rfc3987#section-2.2
* https://cyclonedx.org/capabilities/bomlink/
*
* @param {String} iri IRI to validate
*
* @returns {Boolean} Flag indicating whether the supplied URL is valid or not
*
*/
export function isValidIriReference(iri: string): boolean;
/**
* Method to check if a given dependency tree is partial or not.
*
* @param {Array} dependencies List of dependencies
* @param {Number} componentsCount Number of components
* @returns {Boolean} True if the dependency tree lacks any non-root parents without children. False otherwise.
*/
export function isPartialTree(dependencies: any[], componentsCount?: number): boolean;
/**
* Re-compute and set the scope based on the dependency tree
*
* @param {Array} pkgList List of components
* @param {Array} dependencies List of dependencies
*
* @returns {Array} Updated list
*/
export function recomputeScope(pkgList: any[], dependencies: any[]): any[];
/**
* Function to parse a list of environment variables to identify the paths containing executable binaries
*
* @param envValues {Array[String]} Environment variables list
* @returns {Array[String]} Binary Paths identified from the environment variables
*/
export function extractPathEnv(envValues: any): any;
/**
* Collect all executable files from the given list of binary paths
*
* @param basePath Base directory
* @param binPaths {Array[String]} Paths containing potential