Skip to content

Add dependency graph info to BoM #244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ManjunathMS35 wants to merge 3 commits into from
Closed

Add dependency graph info to BoM #244

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
3485a2b
Add dependency graph info to BoM
ManjunathMS35 Jan 21, 2022
89b7744
Renamed fumction and constant
ManjunathMS35 Jan 21, 2022
97e61bc
Fixed bug
ManjunathMS35 Jan 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions model/Bom.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,9 @@ const CycloneDXObject = require('./CycloneDXObject')
const Metadata = require('./Metadata')
const Tool = require('./Tool')
const program = require('../package.json')
const Dependency = require('./Dependency')
const parsePackageJsonName = require('parse-packagejson-name')
const { PackageURL } = require('packageurl-js')

class Bom extends CycloneDXObject {
constructor (pkg, componentType, includeSerialNumber = true, includeLicenseText = true, lockfile) {
Expand All @@ -38,11 +41,47 @@ class Bom extends CycloneDXObject {
if (pkg) {
this._metadata = this.createMetadata(pkg, componentType)
this._components = this.listComponents(pkg, lockfile)
this._dependencies = this.listDependencies(pkg)
} else {
this._components = []
this._dependencies = []
}
}

listDependencies (pkg) {
const list = []
this.createDependency(pkg, list)
return list
}

createDependency (pkg, list) {
// read-installed with default options marks devDependencies as extraneous
// if a package is marked as extraneous, do not include it as a dependency
// if -d or --include-dev is specified then all dev dependencies are considered
if (pkg.extraneous) return
Comment thread
jkowalleck marked this conversation as resolved.
const ref = this.createPackageURL(pkg)
const deplist = []
if (pkg._dependencies && Object.keys(pkg._dependencies).length !== 0) {
Object.keys(pkg._dependencies)
.map(x => pkg.dependencies[x])
.filter(x => x !== undefined && typeof (x) !== 'string') // remove cycles
.map(x => deplist.push(new Dependency(this.createPackageURL(x), this.createDependency(x, list))))

@jkowalleck jkowalleck Jan 22, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❓
how do you handle, if this.createPackageURL() returns null? which is totally possible from the current algorithm used?

@ManjunathMS35 ManjunathMS35 Jan 25, 2022

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Its not handled yet and as I said in the previous comment, creation of BomReference class will solve this issue.

@jkowalleck jkowalleck Jan 30, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see #244 (comment)

list.push(new Dependency(ref, deplist))
}
return deplist
}

createPackageURL (pkg) {

@jkowalleck jkowalleck Jan 22, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

❗ there is code to crate a PURL already. see

cyclonedx-node-module/model/Component.js

Line 43 in b8f6940

if (this._name && this._version) { this._purl = new PackageURL('npm', this._group, this._name, this._version, null, null).toString() }

if you really want to use a PURL as the bom-ref's value, please incorporate the already existing PURL creation.
Reasons: if a bom-ref looks like a PURL, i would expect it to be the actual PURL of a Component, not a string that was crafted somehow else.

@ManjunathMS35 ManjunathMS35 Jan 25, 2022

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the reason I wanted to implement the BomReference class and make use of creation of PURL in both Component and Bom. Is it okay to do something like this?

@ManjunathMS35 ManjunathMS35 Jan 28, 2022

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jkowalleck Any suggestions on this?

@jkowalleck jkowalleck Jan 30, 2022

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see #244 (comment)

let purl = null
const pkgIdentifier = parsePackageJsonName(pkg.name)
let group = (pkgIdentifier.scope) ? pkgIdentifier.scope : undefined
if (group) group = '@' + group
const name = (pkgIdentifier.fullName) ? pkgIdentifier.fullName : undefined
const version = (pkg.version) ? pkg.version : undefined
if (name && version) { purl = new PackageURL('npm', group, name, version, null, null).toString() }
return purl
}

createMetadata (pkg, componentType) {
const metadata = new Metadata()
metadata.component = new Component(pkg, this.includeLicenseText)
Expand Down
Loading