#291 feat: vcs url for gopkg (#1505)

* #291 feat: vcs url for gopkg Signed-off-by: Anton Baryshnikov <[email protected]> * add getGoPkgUrl + tests for gopkg with FETCH_LICENSE=1 Signed-off-by: Anton Baryshnikov <[email protected]> * Typo fix Signed-off-by: Anton Baryshnikov <[email protected]> --------- Signed-off-by: Anton Baryshnikov <[email protected]>
CycloneDX · Dec 24, 2024 · 4b2c943 · 4b2c943
1 parent 59e97b7
commit 4b2c943
Show file tree

Hide file tree

Showing 5 changed files with 499 additions and 14 deletions.
diff --git a/docs/ENV.md b/docs/ENV.md
@@ -66,3 +66,4 @@ The following environment variables are available to configure the bom generatio
 | SWIFT_COMPILER_ARGS             | Full compiler arguments string to use for semantic analysis. Eg: -sdk <path> -F <path> -Xcc -I <path>                                                                                                                                                                                                                               |
 | SWIFT_SDK_ARGS                  | Swift sdk arguments. Eg: -sdk <path>                                                                                                                                                                                                                                                                                                |
 | SWIFT_COMPILER_EXTRA_ARGS       | Extra compiler arguments to add to the auto-detected string. Eg: -suppress-warnings -track-system-dependencies                                                                                                                                                                                                                      |
+| GO_FETCH_VCS                   | Set this variable to `true` or `1` to fetch vcs url from pkg.go.dev. For golang                                                                                                                                                                                                                                   |
diff --git a/lib/helpers/utils.js b/lib/helpers/utils.js
@@ -142,6 +142,12 @@ export function shouldFetchLicense() {
   );
 }
 
+export function shouldFetchVCS() {
+  return (
+    process.env.GO_FETCH_VCS && ["true", "1"].includes(process.env.GO_FETCH_VCS)
+  );
+}
+
 // Whether license information should be fetched
 export const FETCH_LICENSE = shouldFetchLicense();
 
@@ -4956,18 +4962,13 @@ export async function getRepoLicense(repoUrl, repoMetadata) {
  */
 export async function getGoPkgLicense(repoMetadata) {
   const group = repoMetadata.group;
-  const name = repoMetadata.name;
-  let pkgUrlPrefix = process.env.GO_PKG_URL || "https://pkg.go.dev/";
-  if (group && group !== "." && group !== name) {
-    pkgUrlPrefix = `${pkgUrlPrefix + group}/`;
-  }
-  pkgUrlPrefix = `${pkgUrlPrefix + name}?tab=licenses`;
+  const pkgUrl = `${getGoPkgUrl(repoMetadata)}?tab=licenses`;
   // Check the metadata cache first
-  if (metadata_cache[pkgUrlPrefix]) {
-    return metadata_cache[pkgUrlPrefix];
+  if (metadata_cache[pkgUrl]) {
+    return metadata_cache[pkgUrl];
   }
   try {
-    const res = await cdxgenAgent.get(pkgUrlPrefix);
+    const res = await cdxgenAgent.get(pkgUrl);
     if (res?.body) {
       const $ = load(res.body);
       let licenses = $("#LICENSE > h2").text().trim();
@@ -4988,11 +4989,11 @@ export async function getGoPkgLicense(repoMetadata) {
           } else {
             alicense.id = id.trim();
           }
-          alicense["url"] = pkgUrlPrefix;
+          alicense["url"] = pkgUrl;
           licList.push(alicense);
         }
       }
-      metadata_cache[pkgUrlPrefix] = licList;
+      metadata_cache[pkgUrl] = licList;
       return licList;
     }
   } catch (err) {
@@ -5004,6 +5005,35 @@ export async function getGoPkgLicense(repoMetadata) {
   return undefined;
 }
 
+/**
+ * Method to get go pkg vcs url from go.dev site.
+ *
+ * @param {String} group Package group
+ * @param {String} name Package name
+ */
+async function getGoPkgVCSUrl(group, name) {
+  const fullName = getGoPkgFullName(group, name);
+  if (fullName.startsWith("github.com") || fullName.startsWith("gitlab.com")) {
+    return `https://${fullName}`;
+  }
+  const pkgUrl = getGoPkgUrl({ fullName });
+  if (metadata_cache[pkgUrl]) {
+    return metadata_cache[pkgUrl];
+  }
+  try {
+    const res = await cdxgenAgent.get(pkgUrl);
+    if (res?.body) {
+      const $ = load(res.body);
+      const vcs = $("div.UnitMeta-repo").children("a").attr("href");
+      metadata_cache[pkgUrl] = vcs;
+      return vcs;
+    }
+  } catch (err) {
+    return undefined;
+  }
+  return undefined;
+}
+
 export async function getGoPkgComponent(group, name, version, hash) {
   let license = undefined;
   if (shouldFetchLicense()) {
@@ -5021,7 +5051,11 @@ export async function getGoPkgComponent(group, name, version, hash) {
   const purlString = new PackageURL("golang", group, name, version)
     .toString()
     .replace(/%2F/g, "/");
-  return {
+  let vcs = undefined;
+  if (shouldFetchVCS()) {
+    vcs = await getGoPkgVCSUrl(group, name);
+  }
+  const packageInfo = {
     group: group,
     name: name,
     version: version,
@@ -5030,6 +5064,33 @@ export async function getGoPkgComponent(group, name, version, hash) {
     purl: purlString,
     "bom-ref": decodeURIComponent(purlString),
   };
+  if (vcs) {
+    packageInfo.externalReferences = [{ type: "vcs", url: vcs }];
+  }
+  return packageInfo;
+}
+
+/**
+ * Method to get go pkg url (go.dev site).
+ *
+ * @param {Object} pkgMetadata pkg metadata
+ */
+function getGoPkgUrl(pkgMetadata) {
+  const pkgUrlPrefix = process.env.GO_PKG_URL || "https://pkg.go.dev/";
+  const fullName =
+    pkgMetadata.fullName ||
+    getGoPkgFullName(pkgMetadata.group, pkgMetadata.name);
+  return pkgUrlPrefix + fullName;
+}
+
+/**
+ * Method to get go pkg full name.
+ *
+ * @param {String} group Package group
+ * @param {String} name Package name
+ */
+function getGoPkgFullName(group, name) {
+  return group && group !== "." && group !== name ? `${group}/${name}` : name;
 }
 
 /**