feat: tools as components (#1331)

fixes #1330 closes #1352 --------- Signed-off-by: Jan Kowalleck <[email protected]>
CycloneDX · Jan 23, 2025 · 72122e1 · 72122e1
1 parent 2f49370
commit 72122e1
Show file tree

Hide file tree

Showing 5 changed files with 2,756 additions and 2,175 deletions.
diff --git a/HISTORY.md b/HISTORY.md
@@ -6,9 +6,14 @@ All notable changes to this project will be documented in this file.
 
 <!-- unreleased changes go here -->
 
+* BREAKING Changes
+  * Emit `.metadata.tools` as components ([#1330] via [#1331])  
+    This affects only CycloneDX spec-version 1.5 and later.
 * Build
   * Use _TypeScript_ `v5.7.3` now, was `v5.6.3` (via [#1351])
 
+[#1330]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/issues/1330
+[#1331]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1331
 [#1351]: https://github.com/CycloneDX/cyclonedx-webpack-plugin/pull/1351
 
 ## 3.17.0 - 2025-01-10

diff --git a/package.json b/package.json
@@ -67,7 +67,7 @@
     "node": ">=14"
   },
   "dependencies": {
-    "@cyclonedx/cyclonedx-library": "^6.11.0",
+    "@cyclonedx/cyclonedx-library": "^7.0.0",
     "normalize-package-data": "^3||^4||^5||^6",
     "xmlbuilder2": "^3.0.2"
   },

diff --git a/src/plugin.ts b/src/plugin.ts
@@ -202,7 +202,6 @@ export class CycloneDxWebpackPlugin {
     const cdxExternalReferenceFactory = new CDX.Factories.FromNodePackageJson.ExternalReferenceFactory()
     const cdxLicenseFactory = new CDX.Factories.LicenseFactory()
     const cdxPurlFactory = new CDX.Factories.FromNodePackageJson.PackageUrlFactory('npm')
-    const cdxToolBuilder = new CDX.Builders.FromNodePackageJson.ToolBuilder(cdxExternalReferenceFactory)
     const cdxComponentBuilder = new CDX.Builders.FromNodePackageJson.ComponentBuilder(cdxExternalReferenceFactory, cdxLicenseFactory)
 
     const bom = new CDX.Models.Bom()
@@ -271,7 +270,7 @@ export class CycloneDxWebpackPlugin {
         thisLogger.log('generated components.')
 
         thisLogger.log('finalizing BOM...')
-        this.#finalizeBom(bom, cdxToolBuilder, cdxPurlFactory, logger.getChildLogger('BomFinalizer'))
+        this.#finalizeBom(bom, cdxComponentBuilder, cdxPurlFactory, logger.getChildLogger('BomFinalizer'))
         thisLogger.log('finalized BOM.')
       })
 
@@ -375,7 +374,7 @@ export class CycloneDxWebpackPlugin {
 
   #finalizeBom (
     bom: CDX.Models.Bom,
-    cdxToolBuilder: CDX.Builders.FromNodePackageJson.ToolBuilder,
+    cdxComponentBuilder: CDX.Builders.FromNodePackageJson.ComponentBuilder,
     cdxPurlFactory: CDX.Factories.FromNodePackageJson.PackageUrlFactory,
     logger: WebpackLogger
   ): void {
@@ -386,8 +385,8 @@ export class CycloneDxWebpackPlugin {
       ? undefined
       : new Date()
 
-    for (const tool of this.#makeTools(cdxToolBuilder, logger.getChildLogger('ToolMaker'))) {
-      bom.metadata.tools.add(tool)
+    for (const toolC of this.#makeToolCs(cdxComponentBuilder, logger.getChildLogger('ToolMaker'))) {
+      bom.metadata.tools.components.add(toolC)
     }
 
     if (bom.metadata.component !== undefined) {
@@ -397,8 +396,11 @@ export class CycloneDxWebpackPlugin {
     }
   }
 
-  * #makeTools (builder: CDX.Builders.FromNodePackageJson.ToolBuilder, logger: WebpackLogger): Generator<CDX.Models.Tool> {
-    const packageJsonPaths = [resolve(module.path, '..', 'package.json')]
+  * #makeToolCs (builder: CDX.Builders.FromNodePackageJson.ComponentBuilder, logger: WebpackLogger): Generator<CDX.Models.Component> {
+    const packageJsonPaths: Array<[string, CDX.Enums.ComponentType]> = [
+      // this plugin is an optional enhancement, not a standalone application -- use as `Library`
+      [resolve(module.path, '..', 'package.json'), CDX.Enums.ComponentType.Library]
+    ]
 
     const libs = [
       '@cyclonedx/cyclonedx-library'
@@ -410,18 +412,18 @@ export class CycloneDxWebpackPlugin {
       for (const nodeModulePath of nodeModulePaths) {
         const packageJsonPath = resolve(nodeModulePath, ...lib, 'package.json')
         if (existsSync(packageJsonPath)) {
-          packageJsonPaths.push(packageJsonPath)
+          packageJsonPaths.push([packageJsonPath, CDX.Enums.ComponentType.Library])
           continue libsLoop
         }
       }
     }
     /* eslint-enable no-labels */
 
-    for (const packageJsonPath of packageJsonPaths) {
+    for (const [packageJsonPath, cType] of packageJsonPaths) {
       logger.log('try to build new Tool from PkgPath', packageJsonPath)
       const packageJson: object = loadJsonFile(packageJsonPath) ?? {}
       normalizePackageJson(packageJson, w => { logger.debug('normalizePackageJson from PkgPath', packageJsonPath, 'caused:', w) })
-      const tool = builder.makeTool(packageJson)
+      const tool = builder.makeComponent(packageJson, cType)
       if (tool !== undefined) {
         yield tool
       }