From feb079157bdd513a1523fd19b12cd289b6e79348 Mon Sep 17 00:00:00 2001 From: Ruben Romero Montes Date: Wed, 30 Apr 2025 10:22:02 +0200 Subject: [PATCH 1/3] feat: add yarn support Signed-off-by: Ruben Romero Montes --- README.md | 8 +- src/cyclone_dx_sbom.js | 70 +- src/index.js | 3 - src/provider.js | 11 +- src/providers/base_java.js | 2 +- src/providers/base_javascript.js | 321 +- src/providers/golang_gomodules.js | 7 +- src/providers/java_maven.js | 3 +- src/providers/javascript_npm.js | 16 +- src/providers/javascript_pnpm.js | 17 +- src/providers/javascript_yarn.js | 53 + src/providers/manifest.js | 50 + .../processors/yarn_berry_processor.js | 145 + .../processors/yarn_classic_processor.js | 125 + src/providers/processors/yarn_processor.js | 27 + src/providers/python_pip.js | 12 +- src/sbom.js | 2 +- src/tools.js | 29 + test/it/end-to-end.js | 4 + .../yarn-berry/.yarn/install-state.gz | Bin 0 -> 218246 bytes test/it/test_manifests/yarn-berry/.yarnrc.yml | 1 + .../it/test_manifests/yarn-berry/package.json | 33 + test/it/test_manifests/yarn-berry/yarn.lock | 2741 +++++++++ .../test_manifests/yarn-classic/package.json | 30 + test/it/test_manifests/yarn-classic/yarn.lock | 1447 +++++ test/providers/javascript.test.js | 171 +- .../yarn-berry/with_lock_file/package.json | 12 + .../yarn-berry/with_lock_file/yarn.lock | 12 + .../without_lock_file}/package.json | 0 .../with_lock_file}/package.json | 0 .../with_lock_file/yarn.lock | 0 .../without_lock_file/package.json | 11 + .../component_expected_sbom.json | 0 .../component_expected_sbom.json | 8 + .../component_stack.json | 56 - .../component_expected_sbom.json | 140 - .../listing_component.json | 5 + .../package.json | 1 + .../component_expected_sbom.json | 140 - .../component_stack.json | 56 - .../stack_expected_sbom.json | 5062 ++++++++--------- .../listing_component.json | 5 + .../package.json | 3 +- .../listing_component.json | 518 ++ .../listing_stack.json | 3815 +++++++++++++ .../package.json | 33 + .../stack_expected_sbom.json | 3811 +++++++++++++ .../yarn.lock | 2725 +++++++++ .../listing_component.json | 518 ++ .../listing_stack.json | 3151 ++++++++++ .../package.json | 30 + .../stack_expected_sbom.json | 3165 +++++++++++ .../yarn.lock | 1087 ++++ .../listing_component.json | 1037 ++++ .../listing_stack.json | 2341 ++++++++ .../package.json | 33 + .../stack_expected_sbom.json | 2050 +++++++ .../yarn.lock | 1094 ++++ .../listing_component.json | 1037 ++++ .../listing_stack.json | 2341 ++++++++ .../package.json | 30 + .../stack_expected_sbom.json | 2073 +++++++ .../yarn.lock | 1094 ++++ 63 files changed, 39699 insertions(+), 3123 deletions(-) create mode 100644 src/providers/javascript_yarn.js create mode 100644 src/providers/manifest.js create mode 100644 src/providers/processors/yarn_berry_processor.js create mode 100644 src/providers/processors/yarn_classic_processor.js create mode 100644 src/providers/processors/yarn_processor.js create mode 100644 test/it/test_manifests/yarn-berry/.yarn/install-state.gz create mode 100644 test/it/test_manifests/yarn-berry/.yarnrc.yml create mode 100644 test/it/test_manifests/yarn-berry/package.json create mode 100644 test/it/test_manifests/yarn-berry/yarn.lock create mode 100644 test/it/test_manifests/yarn-classic/package.json create mode 100644 test/it/test_manifests/yarn-classic/yarn.lock create mode 100644 test/providers/provider_manifests/yarn-berry/with_lock_file/package.json create mode 100644 test/providers/provider_manifests/yarn-berry/with_lock_file/yarn.lock rename test/providers/provider_manifests/{yarn/with_lock_file => yarn-berry/without_lock_file}/package.json (100%) rename test/providers/provider_manifests/{yarn/without_lock_file => yarn-classic/with_lock_file}/package.json (100%) rename test/providers/provider_manifests/{yarn => yarn-classic}/with_lock_file/yarn.lock (100%) create mode 100644 test/providers/provider_manifests/yarn-classic/without_lock_file/package.json rename test/providers/tst_manifests/{npm => js-common}/package_json_deps_with_exhortignore_object/component_expected_sbom.json (100%) rename test/providers/tst_manifests/{pnpm => js-common}/package_json_deps_without_exhortignore_object/component_expected_sbom.json (94%) delete mode 100644 test/providers/tst_manifests/npm/package_json_deps_with_exhortignore_object/component_stack.json delete mode 100644 test/providers/tst_manifests/npm/package_json_deps_without_exhortignore_object/component_expected_sbom.json delete mode 100644 test/providers/tst_manifests/pnpm/package_json_deps_with_exhortignore_object/component_expected_sbom.json delete mode 100644 test/providers/tst_manifests/pnpm/package_json_deps_with_exhortignore_object/component_stack.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object/listing_component.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object/listing_stack.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object/package.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object/stack_expected_sbom.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_with_exhortignore_object/yarn.lock create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object/listing_component.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object/listing_stack.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object/package.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object/stack_expected_sbom.json create mode 100644 test/providers/tst_manifests/yarn-berry/package_json_deps_without_exhortignore_object/yarn.lock create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object/listing_component.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object/listing_stack.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object/package.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object/stack_expected_sbom.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_with_exhortignore_object/yarn.lock create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object/listing_component.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object/listing_stack.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object/package.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object/stack_expected_sbom.json create mode 100644 test/providers/tst_manifests/yarn-classic/package_json_deps_without_exhortignore_object/yarn.lock diff --git a/README.md b/README.md index ca357e4..db2c52c 100644 --- a/README.md +++ b/README.md @@ -153,6 +153,7 @@ $ exhort-javascript-api component /path/to/pom.xml
  • Java - Maven
  • JavaScript - Npm
  • JavaScript - pnpm
  • +
  • JavaScript - Yarn Classic / Yarn Berry
  • Golang - Go Modules
  • Python - pip Installer
  • Gradle (Groovy and Kotlin DSL) - Gradle Installation
  • @@ -179,7 +180,7 @@ Excluding a package from any analysis can be achieved by marking the package for