forked from CycloneDX/cdxgen
-
Notifications
You must be signed in to change notification settings - Fork 1
/
sbt-utils.js
295 lines (264 loc) · 10 KB
/
sbt-utils.js
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
const fs = require("fs");
const os = require("os");
const pathLib = require("path");
const propertiesReader = require("properties-reader");
const semver = require("semver");
const { spawnSync } = require("child_process");
const utils = require("./utils");
const ADD_SBT_PLUGIN='addSbtPlugin("net.virtual-void" % "sbt-dependency-graph" % "0.10.0-RC1")';
const DISCLAIMER=`
// This file has been automatically generated by https://github.com/ShiftLeftSecurity/cdxgen and should be automatically deleted on cdxgen exit
`;
const ENABLE_SBT_PLUGIN='addDependencyTreePlugin';
const EOL = "\n";
const commonPluginContent = function(pluginName) {
return `
import sbt.AutoPlugin
import sbt._
import Keys._
import complete.DefaultParsers._
import java.io.{BufferedWriter, FileWriter}
import java.nio.file.Paths
object ShiftLeftDependencyListPlugin extends AutoPlugin {
override def requires = ${pluginName}
override def trigger = allRequirements
object autoImport {
// This task is supposed to be called like this:
// customShiftLeftListDependencies path_to_existing_dir
// path_to_existing_dir can be either absolute path or a path relative to build root
// As a result of running this task a files subproject1.out, subproject2.out and so on will be created in path_to_existing_dir
val customShiftLeftListDependencies = inputKey[Unit]("Shiftleft-specific list dependencies")
}
import autoImport._
override lazy val projectSettings = Seq(
customShiftLeftListDependencies := {
val outDir = (Space ~ StringBasic).map(s => Paths.get(s._2)).parsed
val filename = name.value + ".out"
val outAbsPath = outDir.resolve(filename)
val writer = new BufferedWriter(new FileWriter(outAbsPath.toString))
val res = (Compile / dependencyList / asString).value
writer.write(res)
writer.close()
}
)
}
`
};
const pluginStringForNonBuiltin = `
${DISCLAIMER}
import net.virtualvoid.sbt.graph.DependencyGraphPlugin.autoImport.asString
import net.virtualvoid.sbt.graph.DependencyGraphPlugin.autoImport.dependencyList
${commonPluginContent('net.virtualvoid.sbt.graph.DependencyGraphPlugin')}
`;
const pluginStringForBuiltin = `
${DISCLAIMER}
import sbt.plugins.MiniDependencyTreeKeys.asString
import sbt.plugins.DependencyTreePlugin.autoImport.dependencyList
${commonPluginContent('sbt.plugins.DependencyTreePlugin')}
`;
/**
* Parse sbt lock file
*
* @param {string} pkgLockFile build.sbt.lock file
*/
const parseSbtLock = function (pkgLockFile) {
const pkgList = [];
if (fs.existsSync(pkgLockFile)) {
lockData = JSON.parse(fs.readFileSync(pkgLockFile, "utf8"));
if (lockData && lockData.dependencies) {
for (let i in lockData.dependencies) {
const pkg = lockData.dependencies[i];
const artifacts = pkg.artifacts || undefined;
let integrity = "";
if (artifacts && artifacts.length) {
integrity = artifacts[0].hash.replace("sha1:", "sha1-");
}
let compScope = undefined;
if (pkg.configurations) {
if (pkg.configurations.includes("runtime")) {
compScope = "required";
} else {
compScope = "optional";
}
}
pkgList.push({
group: pkg.org,
name: pkg.name,
version: pkg.version,
_integrity: integrity,
scope: compScope,
});
}
}
}
return pkgList;
};
exports.parseSbtLock = parseSbtLock;
/**
* Determine the version of SBT used in compilation of this project.
* By default it looks into a standard SBT location i.e.
* <path-project>/project/build.properties
* Returns `null` if the version cannot be determined.
*
* @param {string} projectPath Path to the SBT project
*/
const determineSbtVersion = function (projectPath) {
const buildPropFile = pathLib.join(projectPath, "project", "build.properties");
if (fs.existsSync(buildPropFile)) {
let properties = propertiesReader(buildPropFile);
let property = properties.get("sbt.version");
if (property != null && semver.valid(property)) {
return property;
}
}
return null;
};
exports.determineSbtVersion = determineSbtVersion;
/**
* Adds a new plugin to the SBT project by amending its plugins list.
* Only recommended for SBT < 1.2.0 or otherwise use `addPluginSbtFile`
* parameter.
* The change manipulates the existing plugins' file by creating a copy of it
* and returning a path where it is moved to.
* Once the SBT task is complete one must always call `cleanupPlugin` to remove
* the modifications made in place.
*
* @param {string} projectPath Path to the SBT project
* @param {string} plugin Name of the plugin to add
*/
const addPlugin = function (projectPath, plugin, resourcesManager) {
function uniqueFilename(attempt) {
const proposedName = pathLib.join(projectPath, 'project', `shiftleft-enable-plugin${attempt}.sbt`);
if (!fs.existsSync(proposedName)) {
return proposedName;
} else {
return uniqueFilename(attempt + 1);
}
}
const pluginFileName = uniqueFilename(0);
resourcesManager.cleanUpFileOnShutdown(pluginFileName);
fs.writeFileSync(pluginFileName, plugin);
return pluginFileName;
};
const addCustomPlugin = function(projectPath, content, resourcesManager) {
function uniqueFilename(attempt) {
const proposedName = pathLib.join(projectPath, 'project', `shiftleft-custom-plugin${attempt}.scala`);
if (!fs.existsSync(proposedName)) {
return proposedName;
} else {
return uniqueFilename(attempt + 1);
}
}
const customPluginFileName = uniqueFilename(0);
resourcesManager.cleanUpFileOnShutdown(customPluginFileName);
fs.writeFileSync(customPluginFileName, content);
return customPluginFileName;
}
/**
* Parse dependencies in Key:Value format
*/
const parseKVDep = function (rawOutput) {
if (typeof rawOutput === "string") {
const deps = [];
rawOutput.split(EOL).forEach((l) => {
const tmpA = l.split(":");
if (tmpA.length === 3) {
deps.push({
group: tmpA[0],
name: tmpA[1],
version: tmpA[2],
qualifiers: { type: "jar" },
});
} else if (tmpA.length === 2) {
deps.push({
group: "",
name: tmpA[0],
version: tmpA[1],
qualifiers: { type: "jar" },
});
}
});
return deps;
}
return [];
};
exports.parseKVDep = parseKVDep;
const sbtInvoker = function (debugMode, path, resourcesManager) {
let SBT_CMD = process.env.SBT_CMD || "sbt";
let sbtVersion = determineSbtVersion(path);
if (debugMode) {
console.log("Detected sbt version: " + sbtVersion);
}
const standalonePluginFileSupported = standalonePluginFile(sbtVersion);
let enablePluginString = isDependencyTreeBuiltIn(sbtVersion) ? ENABLE_SBT_PLUGIN : ADD_SBT_PLUGIN;
let pluginFileInTempDir = resourcesManager.tmpFile('shiftleft-enable-plugin.sbt');
if (standalonePluginFileSupported) {
fs.writeFileSync(pluginFileInTempDir, enablePluginString);
}
return {
invokeDependencyList: function(commandPrefix, basePath, timeoutMs) {
let dependencyListCmd;
const outDir = resourcesManager.createTmpSubDir('sbt-list-dependencies-out');
if (commandPrefix !== '') {
dependencyListCmd = `"${commandPrefix}customShiftLeftListDependencies ${outDir}"`;
} else {
dependencyListCmd = `"customShiftLeftListDependencies ${outDir}"`;
}
let customPluginContent = isDependencyTreeBuiltIn(sbtVersion) ? pluginStringForBuiltin : pluginStringForNonBuiltin;
addCustomPlugin(basePath, customPluginContent, resourcesManager);
if (standalonePluginFileSupported) {
sbtArgs = [`-addPluginSbtFile=${pluginFileInTempDir}`, dependencyListCmd];
} else {
// write to a new shiftleft-cdxgen-plugins0.sbt file
addPlugin(basePath, enablePluginString, resourcesManager);
sbtArgs = [dependencyListCmd];
}
outputAsStr = '';
console.log(`Executing ${SBT_CMD} ${sbtArgs} in ${basePath}`);
// Note that the command has to be invoked with `shell: true` to properly execute sbt
const result = spawnSync(
SBT_CMD,
sbtArgs,
{ cwd: basePath, shell: true, encoding: "utf-8", timeout: timeoutMs }
);
if (result.status == 1 || result.error) {
console.error(result.stdout, result.stderr);
utils.debug(`1. Check if scala and sbt is installed and available in PATH. Only scala 2.10 + sbt 0.13.6+ and 2.12 + sbt 1.0+ is supported for now.`);
utils.debug(`2. Check if the plugin net.virtual-void:sbt-dependency-graph 0.10.0-RC1 can be used in the environment`);
} else {
utils.debug(result.stdout);
}
fs.readdirSync(outDir).forEach(f => {
const file = pathLib.join(outDir, f)
try {
outputAsStr += fs.readFileSync(file, { encoding: "utf-8" });
// Files we merge don't have trailing EOL so if we don't put it manually we would end up with 2 entries at a single line
outputAsStr += EOL;
} catch(error) {
utils.debug(`Reading ${file} failed. Continuing anyway...`)
}
});
return outputAsStr;
}
}
}
exports.sbtInvoker = sbtInvoker;
/**
*
* @param {string} sbtVersion SBT version, might be null
* @returns {boolean} true if SBT version has sbt-dependency-graph built-in
*/
const isDependencyTreeBuiltIn = function(sbtVersion) {
// Introduced in https://www.scala-sbt.org/1.x/docs/sbt-1.4-Release-Notes.html#sbt-dependency-graph+is+in-sourced
return sbtVersion != null && semver.gte(sbtVersion, "1.4.0");
}
/**
*
* @param {string} sbtVersion SBT version, might be null
* @returns {boolean} true if SBT version supports addPluginSbtFile
*/
const standalonePluginFile = function (sbtVersion) {
// Introduced in 1.2.0 https://www.scala-sbt.org/1.x/docs/sbt-1.2-Release-Notes.html#addPluginSbtFile+command,
// however working properly for real only since 1.3.4: https://github.com/sbt/sbt/releases/tag/v1.3.4
return sbtVersion != null && semver.gte(sbtVersion, "1.3.4");
}