FileMgr

✏️ /opt/alt/alt-nodejs20/root/usr/lib/node_modules/npm/lib/utils/sbom-cyclonedx.js

✕ Tutup

const crypto = require('node:crypto')
const normalizeData = require('normalize-package-data')
const parseLicense = require('spdx-expression-parse')
const npa = require('npm-package-arg')
const ssri = require('ssri')

const CYCLONEDX_SCHEMA = 'http://cyclonedx.org/schema/bom-1.5.schema.json'
const CYCLONEDX_FORMAT = 'CycloneDX'
const CYCLONEDX_SCHEMA_VERSION = '1.5'

const PROP_PATH = 'cdx:npm:package:path'
const PROP_BUNDLED = 'cdx:npm:package:bundled'
const PROP_DEVELOPMENT = 'cdx:npm:package:development'
const PROP_EXTRANEOUS = 'cdx:npm:package:extraneous'
const PROP_PRIVATE = 'cdx:npm:package:private'

const REF_VCS = 'vcs'
const REF_WEBSITE = 'website'
const REF_ISSUE_TRACKER = 'issue-tracker'
const REF_DISTRIBUTION = 'distribution'

const ALGO_MAP = {
  sha1: 'SHA-1',
  sha256: 'SHA-256',
  sha384: 'SHA-384',
  sha512: 'SHA-512',
}

const cyclonedxOutput = ({ npm, nodes, packageType, packageLockOnly }) => {
  const rootNode = nodes.find(node => node.isRoot)
  const childNodes = nodes.filter(node => !node.isRoot && !node.isLink)
  const uuid = crypto.randomUUID()

const deps = []
  const seen = new Set()
  for (let node of nodes) {
    if (node.isLink) {
      node = node.target
    }

if (seen.has(node)) {
      continue
    }
    seen.add(node)
    deps.push(toCyclonedxDependency(node, nodes))
  }

const bom = {
    $schema: CYCLONEDX_SCHEMA,
    bomFormat: CYCLONEDX_FORMAT,
    specVersion: CYCLONEDX_SCHEMA_VERSION,
    serialNumber: `urn:uuid:${uuid}`,
    version: 1,
    metadata: {
      timestamp: new Date().toISOString(),
      lifecycles: [
        { phase: packageLockOnly ? 'pre-build' : 'build' },
      ],
      tools: [
        {
          vendor: 'npm',
          name: 'cli',
          version: npm.version,
        },
      ],
      component: toCyclonedxItem(rootNode, { packageType }),
    },
    components: childNodes.map(toCyclonedxItem),
    dependencies: deps,
  }

return bom
}

const toCyclonedxItem = (node, { packageType }) => {
  packageType = packageType || 'library'

// Calculate purl from package spec
  let spec = npa(node.pkgid)
  spec = (spec.type === 'alias') ? spec.subSpec : spec
  const purl = npa.toPurl(spec) + (isGitNode(node) ? `?vcs_url=${node.resolved}` : '')

if (node.package) {
    normalizeData(node.package)
  }

let parsedLicense
  try {
    let license = node.package?.license
    if (license) {
      if (typeof license === 'object') {
        license = license.type
      }
    }

parsedLicense = parseLicense(license)
  } catch (err) {
    parsedLicense = null
  }

const component = {
    'bom-ref': toCyclonedxID(node),
    type: packageType,
    name: node.name,
    version: node.version,
    scope: (node.optional || node.devOptional) ? 'optional' : 'required',
    author: (typeof node.package?.author === 'object')
      ? node.package.author.name
      : (node.package?.author || undefined),
    description: node.package?.description || undefined,
    purl: purl,
    properties: [{
      name: PROP_PATH,
      value: node.location,
    }],
    externalReferences: [],
  }

if (node.integrity) {
    const integrity = ssri.parse(node.integrity, { single: true })
    component.hashes = [{
      alg: ALGO_MAP[integrity.algorithm] || /* istanbul ignore next */ 'SHA-512',
      content: integrity.hexDigest(),
    }]
  }

if (node.dev === true) {
    component.properties.push(prop(PROP_DEVELOPMENT))
  }

if (node.package?.private === true) {
    component.properties.push(prop(PROP_PRIVATE))
  }

if (node.extraneous === true) {
    component.properties.push(prop(PROP_EXTRANEOUS))
  }

if (node.inBundle === true) {
    component.properties.push(prop(PROP_BUNDLED))
  }

if (!node.isLink && node.resolved) {
    component.externalReferences.push(extRef(REF_DISTRIBUTION, node.resolved))
  }

if (node.package?.repository?.url) {
    component.externalReferences.push(extRef(REF_VCS, node.package.repository.url))
  }

if (node.package?.homepage) {
    component.externalReferences.push(extRef(REF_WEBSITE, node.package.homepage))
  }

if (node.package?.bugs?.url) {
    component.externalReferences.push(extRef(REF_ISSUE_TRACKER, node.package.bugs.url))
  }

// If license is a single SPDX license, use the license field
  if (parsedLicense?.license) {
    component.licenses = [{ license: { id: parsedLicense.license } }]
    // If license is a conjunction, use the expression field
  } else if (parsedLicense?.conjunction) {
    component.licenses = [{ expression: node.package.license }]
  }

return component
}

const toCyclonedxDependency = (node, nodes) => {
  return {
    ref: toCyclonedxID(node),
    dependsOn: [...node.edgesOut.values()]
      // Filter out edges that are linking to nodes not in the list
      .filter(edge => nodes.find(n => n === edge.to))
      .map(edge => toCyclonedxID(edge.to))
      .filter(id => id),
  }
}

const toCyclonedxID = (node) => `${node.packageName}@${node.version}`

const prop = (name) => ({ name, value: 'true' })

const extRef = (type, url) => ({ type, url })

const isGitNode = (node) => {
  if (!node.resolved) {
    return
  }

try {
    const { type } = npa(node.resolved)
    return type === 'git' || type === 'hosted'
  } catch (err) {
    /* istanbul ignore next */
    return false
  }
}

module.exports = { cyclonedxOutput }

Batal

⬅ lib 34 item

Nama	Tipe	Ukuran	Diubah	Perm	Aksi
📜 audit-error.js	js	1 KB	09/04/26 23:11	0644	✏️ ⬇
📜 auth.js	js	3.2 KB	09/04/26 23:11	0644	✏️ ⬇
📜 cmd-list.js	js	2.9 KB	09/04/26 23:11	0644	✏️ ⬇
📄 completion.fish	fish	1.6 KB	09/04/26 23:11	0644	✏️ ⬇
⚙️ completion.sh	sh	1.9 KB	09/04/26 23:11	0755	✏️ ⬇
📜 did-you-mean.js	js	1.2 KB	09/04/26 23:11	0644	✏️ ⬇
📜 display.js	js	15.4 KB	09/04/26 23:11	0644	✏️ ⬇
📜 error-message.js	js	14.6 KB	09/04/26 23:11	0644	✏️ ⬇
📜 explain-dep.js	js	3 KB	09/04/26 23:11	0644	✏️ ⬇
📜 explain-eresolve.js	js	2.6 KB	09/04/26 23:11	0644	✏️ ⬇
📜 format-bytes.js	js	629 B	09/04/26 23:11	0644	✏️ ⬇
📜 format-search-stream.js	js	4.7 KB	09/04/26 23:11	0644	✏️ ⬇
📜 format.js	js	1.9 KB	09/04/26 23:11	0644	✏️ ⬇
📜 get-identity.js	js	802 B	09/04/26 23:11	0644	✏️ ⬇
📜 get-workspaces.js	js	1.7 KB	09/04/26 23:11	0644	✏️ ⬇
📜 installed-deep.js	js	1.1 KB	09/04/26 23:11	0644	✏️ ⬇
📜 installed-shallow.js	js	583 B	09/04/26 23:11	0644	✏️ ⬇
📜 is-windows.js	js	177 B	09/04/26 23:11	0644	✏️ ⬇
📜 log-file.js	js	7.8 KB	09/04/26 23:11	0644	✏️ ⬇
📜 npm-usage.js	js	2 KB	09/04/26 23:11	0644	✏️ ⬇
📜 open-url.js	js	2.4 KB	09/04/26 23:11	0644	✏️ ⬇
📜 output-error.js	js	767 B	09/04/26 23:11	0644	✏️ ⬇
📜 ping.js	js	252 B	09/04/26 23:11	0644	✏️ ⬇
📜 queryable.js	js	9.6 KB	09/04/26 23:11	0644	✏️ ⬇
📜 read-user-info.js	js	1.9 KB	09/04/26 23:11	0644	✏️ ⬇
📜 reify-finish.js	js	886 B	09/04/26 23:11	0644	✏️ ⬇
📜 reify-output.js	js	5.7 KB	09/04/26 23:11	0644	✏️ ⬇
📜 sbom-cyclonedx.js	js	5.2 KB	09/04/26 23:11	0644	✏️ ⬇
📜 sbom-spdx.js	js	4.6 KB	09/04/26 23:11	0644	✏️ ⬇
📜 tar.js	js	3.5 KB	09/04/26 23:11	0644	✏️ ⬇
📜 timers.js	js	2.1 KB	09/04/26 23:11	0644	✏️ ⬇
📜 update-workspaces.js	js	1013 B	09/04/26 23:11	0644	✏️ ⬇
📜 validate-lockfile.js	js	1023 B	09/04/26 23:11	0644	✏️ ⬇
📜 verify-signatures.js	js	11.9 KB	09/04/26 23:11	0644	✏️ ⬇

✏️ Rename

🔑 Ubah Permission