Tweaks to uv workspace

Signed-off-by: Prabhu Subramanian <[email protected]>
CycloneDX · Jan 6, 2025 · 7671644 · 7671644
1 parent 2141260
commit 7671644
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 6 deletions.
diff --git a/lib/helpers/utils.js b/lib/helpers/utils.js
@@ -4423,6 +4423,8 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
   let workspaceWarningShown = false;
   // Keep track of any workspace components to be added to the parent component
   const workspaceComponentMap = {};
+  const workspacePyProjMap = {};
+  const workspaceRefPyProjMap = {};
   const pkgParentMap = {};
   if (!lockData) {
     return { pkgList, dependenciesList };
@@ -4470,11 +4472,19 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
           if (wcompMap?.parentComponent) {
             workspaceComponentMap[wcompMap.parentComponent.name] =
               wcompMap.parentComponent;
+            workspacePyProjMap[wcompMap.parentComponent.name] = awpyproj;
+            if (wcompMap.parentComponent["bom-ref"]) {
+              workspaceRefPyProjMap[wcompMap.parentComponent["bom-ref"]] =
+                awpyproj;
+            }
             // uv.lock auto normalizes names containing underscores
             if (wcompMap.parentComponent.name.includes("_")) {
               workspaceComponentMap[
                 wcompMap.parentComponent.name.replaceAll("_", "-")
               ] = wcompMap.parentComponent;
+              workspacePyProjMap[
+                wcompMap.parentComponent.name.replaceAll("_", "-")
+              ] = awpyproj;
             }
           }
           const wparentComponentRef = wcompMap.parentComponent["bom-ref"];
@@ -4513,7 +4523,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       } else {
         if (!workspaceWarningShown) {
           console.log(
-            `Unable to identify the metadata for the workspace ${amember}. Check if the path specified in ${pyProjectFile} is valid.`,
+            `Unable to identify the metadata for the workspace ${amember}. Check if the path specified in ${workspacePyProjMap[amember] || pyProjectFile} is valid.`,
           );
         }
       }
@@ -4530,8 +4540,11 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       description: apkg.description || "",
       properties: [],
     };
-    if (pyProjectFile) {
-      pkg.properties.push({ name: "SrcFile", value: pyProjectFile });
+    if (pyProjectFile || workspacePyProjMap[apkg.name]) {
+      pkg.properties.push({
+        name: "SrcFile",
+        value: workspacePyProjMap[apkg.name] || pyProjectFile,
+      });
     }
     if (apkg.optional) {
       pkg.scope = "optional";
@@ -4543,7 +4556,10 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       });
     }
     if (apkg?.source) {
-      if (!apkg?.source?.registry?.startsWith("https://pypi.org/")) {
+      if (
+        apkg.source.registry &&
+        !apkg?.source?.registry?.startsWith("https://pypi.org/")
+      ) {
         pkg.properties.push({
           name: "cdx:pypi:registry",
           value: apkg.source.registry,
@@ -4552,7 +4568,7 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
       if (apkg?.source?.virtual) {
         pkg.properties.push({
           name: "cdx:pypi:virtual_path",
-          value: apkg.source.virtual,
+          value: workspacePyProjMap[apkg.name] || apkg.source.virtual,
         });
       }
       if (apkg?.source?.editable) {
@@ -4562,6 +4578,14 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
         });
       }
     }
+    // Is this component a module?
+    if (workspaceComponentMap[pkg.name]) {
+      pkg.properties.push({
+        name: "cdx:pyproject:is_workspace",
+        value: "true",
+      });
+      pkg.type = "application";
+    }
     const purlString = new PackageURL(
       "pypi",
       "",
@@ -4593,6 +4617,21 @@ export async function parsePyLockData(lockData, lockFile, pyProjectFile) {
         }),
       );
     }
+    // Track the workspace purls that had an explicit dependency on this package
+    if (pkgParentMap[pkg.name]) {
+      for (const workspaceRef of pkgParentMap[pkg.name]) {
+        pkg.properties.push({
+          name: "cdx:pyproject:workspaceRef",
+          value: workspaceRef,
+        });
+        if (workspaceRefPyProjMap[workspaceRef]) {
+          pkg.properties.push({
+            name: "cdx:pyproject:workspaceSrcFile",
+            value: workspaceRefPyProjMap[workspaceRef],
+          });
+        }
+      }
+    }
     if (lockTomlObj?.metadata?.files?.[pkg.name]?.length) {
       pkg.components = [];
       for (const afileObj of lockTomlObj.metadata.files[pkg.name]) {

diff --git a/types/lib/helpers/utils.d.ts.map b/types/lib/helpers/utils.d.ts.map