WIP: Feature/swift evidence

ci/Dockerfile

@@ -13,8 +13,8 @@ LABEL maintainer="cyclonedx" \
 
 ARG SWIFT_SIGNING_KEY=52BB7E3DE28A71BE22EC05FFEF80A866B47A981F
 ARG SWIFT_PLATFORM=ubi9
-ARG SWIFT_BRANCH=swift-6.0-release
-ARG SWIFT_VERSION=swift-6.0-RELEASE
+ARG SWIFT_BRANCH=swift-6.0.1-release
+ARG SWIFT_VERSION=swift-6.0.1-RELEASE
 ARG SWIFT_WEBROOT=https://download.swift.org
 ARG JAVA_VERSION=23-tem
 ARG SBT_VERSION=1.10.2
@@ -23,6 +23,7 @@ ARG GRADLE_VERSION=8.10
 ARG GO_VERSION=1.23.1
 ARG NODE_VERSION=22.9.0
 ARG PYTHON_VERSION=3.12
+ARG SOURCEKITTEN_VERSION=0.36.0
 
 ENV GOPATH=/opt/app-root/go \
     JAVA_VERSION=$JAVA_VERSION \
@@ -112,6 +113,14 @@ RUN set -e; \
     && chmod +x /usr/bin/swift \
     && rm -rf "$GNUPGHOME" swift.tar.gz.sig swift.tar.gz \
     && swift --version \
+    && mkdir -p /opt/kitten \
+    && curl -L https://github.com/jpsim/SourceKitten/releases/download/${SOURCEKITTEN_VERSION}/SourceKitten-${SOURCEKITTEN_VERSION}.tar.gz -o /opt/kitten/SourceKitten.tar.gz \
+    && cd /opt/kitten/ && tar -xvf SourceKitten.tar.gz \
+    && cd /opt/kitten/SourceKitten-${SOURCEKITTEN_VERSION} \
+    && swift build -c release \
+    && cp /opt/kitten/SourceKitten-${SOURCEKITTEN_VERSION}/.build/release/sourcekitten /usr/local/bin/sourcekitten \
+    && cd /root && rm -rf /opt/kitten \
+    && sourcekitten --help \
     && microdnf install -y epel-release \
     && mkdir -p ${ANDROID_HOME}/cmdline-tools \
     && curl -L https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o ${ANDROID_HOME}/cmdline-tools/android_tools.zip \
@@ -154,4 +163,4 @@ RUN set -e; \
     && rm -rf /var/cache/yum /root/.cache/pypoetry \
     && microdnf clean all
 
-ENTRYPOINT ["node", "/opt/cdxgen/bin/cdxgen.js"]
+ENTRYPOINT ["node", "/opt/cdxgen/bin/cdxgen.js"]

ci/Dockerfile-bun

@@ -13,8 +13,8 @@ LABEL maintainer="cyclonedx" \
 
 ARG SWIFT_SIGNING_KEY=52BB7E3DE28A71BE22EC05FFEF80A866B47A981F
 ARG SWIFT_PLATFORM=ubi9
-ARG SWIFT_BRANCH=swift-6.0-release
-ARG SWIFT_VERSION=swift-6.0-RELEASE
+ARG SWIFT_BRANCH=swift-6.0.1-release
+ARG SWIFT_VERSION=swift-6.0.1-RELEASE
 ARG SWIFT_WEBROOT=https://download.swift.org
 ARG JAVA_VERSION=23-tem
 ARG SBT_VERSION=1.10.2

ci/Dockerfile-deno

@@ -13,15 +13,16 @@ LABEL maintainer="cyclonedx" \
 
 ARG SWIFT_SIGNING_KEY=52BB7E3DE28A71BE22EC05FFEF80A866B47A981F
 ARG SWIFT_PLATFORM=ubi9
-ARG SWIFT_BRANCH=swift-6.0-release
-ARG SWIFT_VERSION=swift-6.0-RELEASE
+ARG SWIFT_BRANCH=swift-6.0.1-release
+ARG SWIFT_VERSION=swift-6.0.1-RELEASE
 ARG SWIFT_WEBROOT=https://download.swift.org
 ARG JAVA_VERSION=23-tem
 ARG SBT_VERSION=1.10.2
 ARG MAVEN_VERSION=3.9.9
 ARG GRADLE_VERSION=8.10
 ARG GO_VERSION=1.23.1
 ARG PYTHON_VERSION=3.12
+ARG SOURCEKITTEN_VERSION=0.36.0
 
 ENV GOPATH=/opt/app-root/go \
     JAVA_VERSION=$JAVA_VERSION \
@@ -110,6 +111,14 @@ RUN set -e; \
     && chmod +x /usr/bin/swift \
     && rm -rf "$GNUPGHOME" swift.tar.gz.sig swift.tar.gz \
     && swift --version \
+    && mkdir -p /opt/kitten \
+    && curl -L https://github.com/jpsim/SourceKitten/releases/download/${SOURCEKITTEN_VERSION}/SourceKitten-${SOURCEKITTEN_VERSION}.tar.gz -o /opt/kitten/SourceKitten.tar.gz \
+    && cd /opt/kitten/ && tar -xvf SourceKitten.tar.gz \
+    && cd /opt/kitten/SourceKitten-${SOURCEKITTEN_VERSION} \
+    && swift build -c release \
+    && cp /opt/kitten/SourceKitten-${SOURCEKITTEN_VERSION}/.build/release/sourcekitten /usr/local/bin/sourcekitten \
+    && cd /root && rm -rf /opt/kitten \
+    && sourcekitten --help \
     && microdnf install -y epel-release \
     && mkdir -p ${ANDROID_HOME}/cmdline-tools \
     && curl -L https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip -o ${ANDROID_HOME}/cmdline-tools/android_tools.zip \

lib/cli/index.js

@@ -27,6 +27,7 @@ import {
   getOriginUrl,
   gitTreeHashes,
   listFiles,
+  runSwiftCommand,
 } from "../helpers/envcontext.js";
 import {
   CARGO_CMD,
@@ -3158,7 +3159,7 @@ export async function createGoBom(path, options) {
   } catch (err) {
     maybeBinary = false;
   }
-  if (maybeBinary || options.lifecycle === "post-build") {
+  if (maybeBinary || options?.lifecycle?.includes("post-build")) {
     return createBinaryBom(path, options);
   }
 
@@ -3558,7 +3559,7 @@ export async function createRustBom(path, options) {
   } catch (err) {
     maybeBinary = false;
   }
-  if (maybeBinary || options.lifecycle === "post-build") {
+  if (maybeBinary || options?.lifecycle?.includes("post-build")) {
     return createBinaryBom(path, options);
   }
 
@@ -4342,19 +4343,24 @@ export async function createSwiftBom(path, options) {
         continue;
       }
       let treeData = undefined;
+      let packageArgs = ["package", "show-dependencies", "--format", "json"];
+      let swiftCommand = SWIFT_CMD;
+      if (swiftCommand.startsWith("xcrun")) {
+        swiftCommand = "xcrun";
+        packageArgs = ["swift"].concat(packageArgs);
+      }
       if (DEBUG_MODE) {
-        console.log("Executing 'swift package show-dependencies' in", basePath);
+        console.log(
+          `Executing '${swiftCommand} ${packageArgs.join(" ")}' in`,
+          basePath,
+        );
       }
-      const result = spawnSync(
-        SWIFT_CMD,
-        ["package", "show-dependencies", "--format", "json"],
-        {
-          cwd: basePath,
-          encoding: "utf-8",
-          timeout: TIMEOUT_MS,
-          maxBuffer: MAX_BUFFER,
-        },
-      );
+      const result = spawnSync(swiftCommand, packageArgs, {
+        cwd: basePath,
+        encoding: "utf-8",
+        timeout: TIMEOUT_MS,
+        maxBuffer: MAX_BUFFER,
+      });
       if (result.status === 0 && result.stdout) {
         completedPath.push(basePath);
         treeData = Buffer.from(result.stdout).toString();
@@ -4974,7 +4980,7 @@ export async function createCsharpBom(path, options) {
   let manifestFiles = [];
   let pkgData = undefined;
   let dependencies = [];
-  if (options.lifecycle === "post-build") {
+  if (options?.lifecycle?.includes("post-build")) {
     return createBinaryBom(path, options);
   }
   let parentComponent = createDefaultParentComponent(path, "nuget", options);

lib/evinser/swiftsem.js

@@ -0,0 +1,53 @@
+// Swift entity kinds
+// https://github.com/swiftlang/swift/blob/main/tools/SourceKit/docs/SwiftSupport.txt
+const SWIFT_ENTITY_KINDS = {
+  IMPORT_CLANG: "source.lang.swift.import.module.clang",
+  IMPORT_SWIFT: "source.lang.swift.import.module.swift",
+  IMPORT_SOURCE: "source.lang.swift.import.sourcefile",
+  DECL_EXTN_STRUCT: "source.lang.swift.decl.extension.struct",
+  DECL_EXTN_CLASS: "source.lang.swift.decl.extension.class",
+  DECL_EXTN_ENUM: "source.lang.swift.decl.extension.enum",
+  DECL_FREE: "source.lang.swift.decl.function.free",
+  REF_FREE: "source.lang.swift.ref.function.free",
+  DECL_METHOD_INSTANCE: "source.lang.swift.decl.function.method.instance",
+  REF_METHOD_INSTANCE: "source.lang.swift.ref.function.method.instance",
+  DECL_METHOD_STATIC: "source.lang.swift.decl.function.method.static",
+  REF_METHOD_STATIC: "source.lang.swift.ref.function.method.static",
+  DECL_CONSTRUCTOR: "source.lang.swift.decl.function.constructor",
+  REF_CONSTRUCTOR: "source.lang.swift.ref.function.constructor",
+  DECL_DESTRUCTOR: "source.lang.swift.decl.function.destructor",
+  REF_DESTRUCTOR: "source.lang.swift.ref.function.destructor",
+  DECL_OPERATOR: "source.lang.swift.decl.function.operator",
+  REF_OPERATOR: "source.lang.swift.ref.function.operator",
+  DECL_SUBSCRIPT: "source.lang.swift.decl.function.subscript",
+  REF_SUBSCRIPT: "source.lang.swift.ref.function.subscript",
+  DECL_GETTER: "source.lang.swift.decl.function.accessor.getter",
+  REF_GETTER: "source.lang.swift.ref.function.accessor.getter",
+  DECL_SETTER: "source.lang.swift.decl.function.accessor.setter",
+  REF_SETTER: "source.lang.swift.ref.function.accessor.setter",
+  DECL_CLASS: "source.lang.swift.decl.class",
+  REF_CLASS: "source.lang.swift.ref.class",
+  DECL_STRUCT: "source.lang.swift.decl.struct",
+  REF_STRUCT: "source.lang.swift.ref.struct",
+  DECL_ENUM: "source.lang.swift.decl.enum",
+  REF_ENUM: "source.lang.swift.ref.enum",
+  DECL_ENUM_ELEMENT: "source.lang.swift.decl.enumelement",
+  REF_ENUM_ELEMENT: "source.lang.swift.ref.enumelement",
+  DECL_PROTOCOL: "source.lang.swift.decl.protocol",
+  REF_PROTOCOL: "source.lang.swift.ref.protocol",
+  DECL_TYPE_ALIAS: "source.lang.swift.decl.typealias",
+  REF_TYPE_ALIAS: "source.lang.swift.ref.typealias",
+  DECL_VAR_GLOBAL: "source.lang.swift.decl.var.global",
+  REF_VAR_GLOBAL: "source.lang.swift.ref.var.global",
+  DECL_VAR_INSTANCE: "source.lang.swift.decl.var.instance",
+  REF_VAR_INSTANCE: "source.lang.swift.ref.var.instance",
+  DECL_VAR_STATIC: "source.lang.swift.decl.var.static",
+  REF_VAR_STATIC: "source.lang.swift.ref.var.static",
+  DECL_VAR_LOCAL: "source.lang.swift.decl.var.local",
+  REF_VAR_LOCAL: "source.lang.swift.ref.var.local",
+};
+for (const key of Object.keys(SWIFT_ENTITY_KINDS)) {
+  if (key.toUpperCase() === key) {
+    SWIFT_ENTITY_KINDS[SWIFT_ENTITY_KINDS[key]] = key;
+  }
+}

lib/helpers/envcontext.js

@@ -10,9 +10,12 @@ import {
   DOTNET_CMD,
   GCC_CMD,
   GO_CMD,
+  MAX_BUFFER,
   NODE_CMD,
   NPM_CMD,
   RUSTC_CMD,
+  SWIFT_CMD,
+  TIMEOUT_MS,
   getJavaCommand,
   getPythonCommand,
   isWin,
@@ -21,13 +24,13 @@ import {
 export const GIT_COMMAND = process.env.GIT_CMD || "git";
 
 // sdkman tool aliases
-export const SDKMAN_TOOL_ALIASES = {
-  java8: "8.0.422-tem",
-  java11: "11.0.24-tem",
-  java17: "17.0.12-tem",
-  java21: "21.0.4-tem",
-  java22: "22.0.2-tem",
-  java23: "23-tem",
+export const SDKMAN_JAVA_TOOL_ALIASES = {
+  java8: process.env.JAVA8_TOOL || "8.0.422-tem",
+  java11: process.env.JAVA11_TOOL || "11.0.24-tem",
+  java17: process.env.JAVA17_TOOL || "17.0.12-tem",
+  java21: process.env.JAVA21_TOOL || "21.0.4-tem",
+  java22: process.env.JAVA22_TOOL || "22.0.2-tem",
+  java23: process.env.JAVA23_TOOL || "23-tem",
 };
 
 /**
@@ -286,6 +289,34 @@ export function collectGoInfo(dir) {
   return undefined;
 }
 
+/**
+ * Collect swift version
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing swift details
+ */
+export function collectSwiftInfo(dir) {
+  const versionDesc = getCommandOutput(SWIFT_CMD, dir, ["--version"]);
+  if (versionDesc) {
+    return {
+      type: "platform",
+      name: "swift",
+      version: versionDesc.trim(),
+    };
+  }
+  return undefined;
+}
+
+/**
+ * Method to run a swift command
+ *
+ * @param {string} dir Working directory
+ * @returns Object containing swift details
+ */
+export function runSwiftCommand(dir, args) {
+  return getCommandOutput(SWIFT_CMD, dir, args);
+}
+
 export function collectEnvInfo(dir) {
   const infoComponents = [];
   let cmp = collectJavaInfo(dir);
@@ -328,10 +359,21 @@ export function collectEnvInfo(dir) {
  * @returns String output from the command or undefined in case of error
  */
 const getCommandOutput = (cmd, dir, args) => {
-  const result = spawnSync(cmd, args, {
+  let commandToUse = cmd;
+  // If the command includes space, automatically move it to the front of the args.
+  if (cmd?.trim().includes(" ")) {
+    const tmpA = cmd.split(" ");
+    commandToUse = tmpA.shift();
+    if (args?.length && tmpA.length) {
+      args = tmpA.concat(args);
+    }
+  }
+  const result = spawnSync(commandToUse, args, {
     cwd: dir,
     encoding: "utf-8",
     shell: isWin,
+    timeout: TIMEOUT_MS,
+    maxBuffer: MAX_BUFFER,
   });
   if (result.status !== 0 || result.error) {
     return undefined;
@@ -431,6 +473,7 @@ export function installSdkmanTool(toolType, toolName) {
       {
         encoding: "utf-8",
         shell: process.env.SHELL || true,
+        timeout: TIMEOUT_MS,
       },
     );
     if (DEBUG_MODE) {
@@ -521,6 +564,7 @@ export function getNvmToolDirectory(toolName) {
     {
       encoding: "utf-8",
       shell: process.env.SHELL || true,
+      timeout: TIMEOUT_MS,
     },
   );
   if (DEBUG_MODE) {
@@ -555,6 +599,7 @@ export function getOrInstallNvmTool(toolVersion) {
       {
         encoding: "utf-8",
         shell: process.env.SHELL || true,
+        timeout: TIMEOUT_MS,
       },
     );
 
@@ -585,5 +630,5 @@ export function getOrInstallNvmTool(toolVersion) {
  * Retrieve sdkman tool full name
  */
 function getSdkmanToolFullname(toolName) {
-  return SDKMAN_TOOL_ALIASES[toolName] || toolName;
+  return SDKMAN_JAVA_TOOL_ALIASES[toolName] || toolName;
 }

lib/helpers/envcontext.test.js

@@ -9,6 +9,7 @@ import {
   collectNodeInfo,
   collectPythonInfo,
   collectRustInfo,
+  collectSwiftInfo,
   getBranch,
   getNvmToolDirectory,
   getOrInstallNvmTool,
@@ -34,12 +35,13 @@ test("tools tests", () => {
   expect(collectGccInfo()).toBeDefined();
   expect(collectRustInfo()).toBeDefined();
   expect(collectGoInfo()).toBeDefined();
+  expect(collectSwiftInfo()).toBeDefined();
 });
 
 test("sdkman tests", () => {
   if (process.env?.SDKMAN_VERSION) {
     expect(isSdkmanAvailable()).toBeTruthy();
-    expect(isSdkmanToolAvailable("java", "22.0.1-tem")).toBeTruthy();
+    expect(isSdkmanToolAvailable("java", "23-tem")).toBeTruthy();
   }
 });
 

lib/helpers/utils.js

@@ -224,10 +224,10 @@ if (process.env.LEIN_CMD) {
   LEIN_CMD = process.env.LEIN_CMD;
 }
 
-export let SWIFT_CMD = "swift";
-if (process.env.SWIFT_CMD) {
-  SWIFT_CMD = process.env.SWIFT_CMD;
-}
+// On a mac, use xcrun
+// xcrun: Find and execute the named command line tool from the active developer directory
+export const SWIFT_CMD =
+  process.env.SWIFT_CMD || isMac ? "xcrun swift" : "swift";
 
 // Python components that can be excluded
 export const PYTHON_EXCLUDED_COMPONENTS = [
@@ -398,6 +398,13 @@ export function hasAnyProjectType(projectTypes, options, defaultStatus = true) {
   ) {
     return defaultStatus;
   }
+  // Convert string project types to an array
+  if (
+    projectTypes &&
+    (typeof projectTypes === "string" || projectTypes instanceof String)
+  ) {
+    projectTypes = projectTypes.split(",");
+  }
   // If only exclude type is specified, then do not allow oci type
   if (
     (projectTypes?.length === 1 || !defaultStatus) &&