|
| 1 | +/* eslint-disable no-console */ |
| 2 | + |
| 3 | +import { existsSync, promises as fs } from 'node:fs' |
| 4 | +import path from 'node:path' |
| 5 | +import { fileURLToPath } from 'node:url' |
| 6 | + |
| 7 | +import chalk from 'chalk' |
| 8 | +import { $ } from 'execa' |
| 9 | +import yargsParse from 'yargs-parser' |
| 10 | + |
| 11 | +const __dirname = path.dirname(fileURLToPath(import.meta.url)) |
| 12 | + |
| 13 | +const { |
| 14 | + SBOM_SIGN_ALGORITHM, // Algorithm. Example: RS512 |
| 15 | + SBOM_SIGN_PRIVATE_KEY, // Location to the RSA private key |
| 16 | + SBOM_SIGN_PUBLIC_KEY // Optional. Location to the RSA public key |
| 17 | +} = process.env |
| 18 | + |
| 19 | +const toLower = (/** @type {string} */ arg) => arg.toLowerCase() |
| 20 | +const arrayToLower = (/** @type {string[]} */ arg) => arg.map(toLower) |
| 21 | + |
| 22 | +const execaConfig = { |
| 23 | + env: { NODE_ENV: '' }, |
| 24 | + localDir: path.join(__dirname, 'node_modules'), |
| 25 | +} |
| 26 | + |
| 27 | +const nodejsPlatformTypes = [ |
| 28 | + 'javascript', |
| 29 | + 'js', |
| 30 | + 'nodejs', |
| 31 | + 'npm', |
| 32 | + 'pnpm', |
| 33 | + 'ts', |
| 34 | + 'tsx', |
| 35 | + 'typescript' |
| 36 | +] |
| 37 | + |
| 38 | +const yargsConfig = { |
| 39 | + configuration: { |
| 40 | + 'camel-case-expansion': false, |
| 41 | + 'strip-aliased': true, |
| 42 | + 'parse-numbers': false, |
| 43 | + 'populate--': true, |
| 44 | + 'unknown-options-as-args': true |
| 45 | + }, |
| 46 | + coerce: { |
| 47 | + author: arrayToLower, |
| 48 | + filter: arrayToLower, |
| 49 | + only: arrayToLower, |
| 50 | + profile: toLower, |
| 51 | + standard: arrayToLower, |
| 52 | + type: toLower |
| 53 | + }, |
| 54 | + default: { |
| 55 | + //author: ['OWASP Foundation'], |
| 56 | + //'auto-compositions': true, |
| 57 | + //babel: true, |
| 58 | + //evidence: false, |
| 59 | + //'include-crypto': false, |
| 60 | + //'include-formulation': false, |
| 61 | + //'install-deps': true, |
| 62 | + //output: 'bom.json', |
| 63 | + //profile: 'generic', |
| 64 | + //'project-version': '', |
| 65 | + //recurse: true, |
| 66 | + //'server-host': '127.0.0.1', |
| 67 | + //'server-port': '9090', |
| 68 | + //'spec-version': '1.5', |
| 69 | + type: 'js', |
| 70 | + //validate: true, |
| 71 | + }, |
| 72 | + alias: { |
| 73 | + help: ['h'], |
| 74 | + output: ['o'], |
| 75 | + print: ['p'], |
| 76 | + recurse: ['r'], |
| 77 | + 'resolve-class': ['c'], |
| 78 | + type: ['t'], |
| 79 | + version: ['v'], |
| 80 | + }, |
| 81 | + array: [ |
| 82 | + { key: 'author', type: 'string' }, |
| 83 | + { key: 'exclude', type: 'string' }, |
| 84 | + { key: 'filter', type: 'string' }, |
| 85 | + { key: 'only', type: 'string' }, |
| 86 | + { key: 'standard', type: 'string' } |
| 87 | + ], |
| 88 | + boolean: [ |
| 89 | + 'auto-compositions', |
| 90 | + 'babel', |
| 91 | + 'deep', |
| 92 | + 'evidence', |
| 93 | + 'fail-on-error', |
| 94 | + 'generate-key-and-sign', |
| 95 | + 'help', |
| 96 | + 'include-formulation', |
| 97 | + 'include-crypto', |
| 98 | + 'install-deps', |
| 99 | + 'print', |
| 100 | + 'required-only', |
| 101 | + 'server', |
| 102 | + 'validate', |
| 103 | + 'version', |
| 104 | + ], |
| 105 | + string: [ |
| 106 | + 'api-key', |
| 107 | + 'output', |
| 108 | + 'parent-project-id', |
| 109 | + 'profile', |
| 110 | + 'project-group', |
| 111 | + 'project-name', |
| 112 | + 'project-version', |
| 113 | + 'project-id', |
| 114 | + 'server-host', |
| 115 | + 'server-port', |
| 116 | + 'server-url', |
| 117 | + 'spec-version', |
| 118 | + ] |
| 119 | +} |
| 120 | + |
| 121 | +/** |
| 122 | + * |
| 123 | + * @param {{ [key: string]: boolean | null | number | string | (string | number)[]}} argv |
| 124 | + * @returns {string[]} |
| 125 | + */ |
| 126 | +function argvToArray (/** @type {any} */ argv) { |
| 127 | + if (argv['help']) return ['--help'] |
| 128 | + const result = [] |
| 129 | + for (const { 0: key, 1: value } of Object.entries(argv)) { |
| 130 | + if (key === '_' || key === '--') continue |
| 131 | + if (key === 'babel' || key === 'install-deps' || key === 'validate') { |
| 132 | + // cdxgen documents no-babel, no-install-deps, and no-validate flags so |
| 133 | + // use them when relevant. |
| 134 | + result.push(`--${value ? key : `no-${key}`}`) |
| 135 | + } else if (value === true) { |
| 136 | + result.push(`--${key}`) |
| 137 | + } else if (typeof value === 'string') { |
| 138 | + result.push(`--${key}=${value}`) |
| 139 | + } else if (Array.isArray(value)) { |
| 140 | + result.push(`--${key}`, ...value.map(String)) |
| 141 | + } |
| 142 | + } |
| 143 | + if (argv['--']) { |
| 144 | + result.push('--', ...argv['--']) |
| 145 | + } |
| 146 | + return result |
| 147 | +} |
| 148 | + |
| 149 | +/** @type {import('../../utils/meow-with-subcommands.js').CliSubcommand} */ |
| 150 | +export const cyclonedx = { |
| 151 | + description: 'Create an SBOM with CycloneDX generator (cdxgen)', |
| 152 | + async run (argv_) { |
| 153 | + const /** @type {any} */ yargv = { |
| 154 | + __proto__: null, |
| 155 | + // @ts-ignore |
| 156 | + ...yargsParse(argv_, yargsConfig) |
| 157 | + } |
| 158 | + |
| 159 | + const /** @type {string[]} */ unknown = yargv._ |
| 160 | + const { length: unknownLength } = unknown |
| 161 | + if (unknownLength) { |
| 162 | + console.error(`Unknown argument${unknownLength > 1 ? 's' : ''}: ${yargv._.join(', ')}`) |
| 163 | + process.exitCode = 1 |
| 164 | + return |
| 165 | + } |
| 166 | + |
| 167 | + let cleanupPackageLock = false |
| 168 | + if ( |
| 169 | + yargv.type !== 'yarn' && |
| 170 | + nodejsPlatformTypes.includes(yargv.type) && |
| 171 | + existsSync('./yarn.lock') |
| 172 | + ) { |
| 173 | + if (existsSync('./package-lock.json')) { |
| 174 | + yargv.type = 'npm' |
| 175 | + } else { |
| 176 | + // Use synp to create a package-lock.json from the yarn.lock, |
| 177 | + // based on the node_modules folder, for a more accurate SBOM. |
| 178 | + try { |
| 179 | + await $(execaConfig)`synp --source-file ./yarn.lock` |
| 180 | + yargv.type = 'npm' |
| 181 | + cleanupPackageLock = true |
| 182 | + } catch {} |
| 183 | + } |
| 184 | + } |
| 185 | + |
| 186 | + if (yargv.output === undefined) { |
| 187 | + yargv.output = 'socket-cyclonedx.json' |
| 188 | + } |
| 189 | + |
| 190 | + await $({ |
| 191 | + ...execaConfig, |
| 192 | + env: { |
| 193 | + NODE_ENV: '', |
| 194 | + SBOM_SIGN_ALGORITHM, |
| 195 | + SBOM_SIGN_PRIVATE_KEY, |
| 196 | + SBOM_SIGN_PUBLIC_KEY |
| 197 | + }, |
| 198 | + stdout: 'inherit' |
| 199 | + })`cdxgen ${argvToArray(yargv)}` |
| 200 | + |
| 201 | + if (cleanupPackageLock) { |
| 202 | + try { |
| 203 | + await fs.unlink('./package-lock.json') |
| 204 | + } catch {} |
| 205 | + } |
| 206 | + const fullOutputPath = path.join(process.cwd(), yargv.output) |
| 207 | + if (existsSync(fullOutputPath)) { |
| 208 | + console.log(chalk.cyanBright(`${yargv.output} created!`)) |
| 209 | + } |
| 210 | + } |
| 211 | +} |
0 commit comments