1use std::collections::HashMap;
32use std::path::Path;
33
34use crate::parser_warn as warn;
35use crate::parsers::utils::{MAX_ITERATION_COUNT, read_file_to_string, truncate_field};
36use regex::Regex;
37use yaml_serde::Value;
38
39use crate::models::{DatasourceId, Dependency, PackageData, PackageType, Sha256Digest};
40
41use super::PackageParser;
42use super::license_normalization::{
43 DeclaredLicenseMatchMetadata, build_declared_license_data_from_pair,
44 normalize_spdx_declared_license,
45};
46
47fn default_package_data(datasource_id: Option<DatasourceId>) -> PackageData {
48 PackageData {
49 package_type: Some(CondaMetaYamlParser::PACKAGE_TYPE),
50 datasource_id,
51 ..Default::default()
52 }
53}
54
55fn is_conda_recipe_yaml_path(path: &Path) -> bool {
56 let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
57 return false;
58 };
59 if name != "recipe.yaml" && name != "recipe.yml" {
60 return false;
61 }
62 path.parent()
63 .and_then(|parent| parent.file_name())
64 .and_then(|name| name.to_str())
65 .is_some_and(|name| name == "recipe")
66}
67
68pub(crate) fn build_purl(
70 package_type: &str,
71 namespace: Option<&str>,
72 name: &str,
73 version: Option<&str>,
74 _qualifiers: Option<&str>,
75 _subpath: Option<&str>,
76 _extras: Option<&str>,
77) -> Option<String> {
78 let purl = match package_type {
79 "conda" => {
80 if let Some(ns) = namespace {
81 match version {
82 Some(v) => format!("pkg:conda/{}/{}@{}", ns, name, v),
83 None => format!("pkg:conda/{}/{}", ns, name),
84 }
85 } else {
86 match version {
87 Some(v) => format!("pkg:conda/{}@{}", name, v),
88 None => format!("pkg:conda/{}", name),
89 }
90 }
91 }
92 "pypi" => match version {
93 Some(v) => format!("pkg:pypi/{}@{}", name, v),
94 None => format!("pkg:pypi/{}", name),
95 },
96 _ => format!("pkg:{}/{}", package_type, name),
97 };
98 Some(purl)
99}
100
101fn build_conda_package_purl(name: Option<&str>, version: Option<&str>) -> Option<String> {
102 let name = name?;
103 build_purl("conda", None, name, version, None, None, None)
104}
105
106fn yaml_value_to_string(value: &Value) -> Option<String> {
107 match value {
108 Value::String(s) => Some(truncate_field(s.clone())),
109 Value::Number(n) => Some(truncate_field(n.to_string())),
110 Value::Bool(b) => Some(truncate_field(b.to_string())),
111 _ => None,
112 }
113}
114
115fn extract_jinja_statement(trimmed_line: &str) -> Option<&str> {
116 if !trimmed_line.starts_with("{%") {
117 return None;
118 }
119
120 let end = trimmed_line.find("%}")?;
121 Some(trimmed_line[2..end].trim())
122}
123
124fn extract_conda_requirement_name(req: &str) -> Option<String> {
125 let req = req.trim();
126 if req.is_empty() {
127 return None;
128 }
129
130 let req_without_ns = req.rsplit_once("::").map(|(_, rest)| rest).unwrap_or(req);
131
132 let name = req_without_ns
133 .split_whitespace()
134 .next()
135 .unwrap_or(req_without_ns)
136 .split(['=', '<', '>', '!', '~'])
137 .next()
138 .unwrap_or(req_without_ns)
139 .trim();
140
141 if name.is_empty() {
142 None
143 } else {
144 Some(truncate_field(name.to_string()))
145 }
146}
147
148pub struct CondaMetaYamlParser;
154
155impl PackageParser for CondaMetaYamlParser {
156 const PACKAGE_TYPE: PackageType = PackageType::Conda;
157
158 fn is_match(path: &Path) -> bool {
159 path.file_name()
161 .is_some_and(|name| name == "meta.yaml" || name == "meta.yml")
162 || is_conda_recipe_yaml_path(path)
163 }
164
165 fn extract_packages(path: &Path) -> Vec<PackageData> {
166 let contents = match read_file_to_string(path, None) {
167 Ok(c) => c,
168 Err(e) => {
169 warn!("Failed to read {}: {}", path.display(), e);
170 return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
171 }
172 };
173
174 if is_conda_recipe_yaml_path(path) {
175 let yaml: Value = match yaml_serde::from_str(&contents) {
176 Ok(y) => y,
177 Err(e) => {
178 warn!("Failed to parse YAML in {}: {}", path.display(), e);
179 return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
180 }
181 };
182
183 if !looks_like_conda_recipe_yaml(&yaml) {
184 return Vec::new();
185 }
186
187 return vec![parse_conda_recipe_yaml(&yaml)];
188 }
189
190 let variables = extract_jinja2_variables(&contents);
192 let processed_yaml = apply_jinja2_substitutions(&contents, &variables);
193
194 let yaml: Value = match yaml_serde::from_str(&processed_yaml) {
196 Ok(y) => y,
197 Err(e) => {
198 warn!("Failed to parse YAML in {}: {}", path.display(), e);
199 return vec![default_package_data(Some(DatasourceId::CondaMetaYaml))];
200 }
201 };
202
203 let package_element = yaml.get("package").and_then(|v| v.as_mapping());
204 let name = package_element
205 .and_then(|p| p.get("name"))
206 .and_then(yaml_value_to_string);
207
208 let version = package_element
209 .and_then(|p| p.get("version"))
210 .and_then(yaml_value_to_string);
211
212 let source = yaml.get("source").and_then(|v| v.as_mapping());
213 let download_url = source
214 .and_then(|s| s.get("url"))
215 .and_then(|v| v.as_str())
216 .map(|s| truncate_field(s.to_string()));
217
218 let sha256 = source
219 .and_then(|s| s.get("sha256"))
220 .and_then(|v| v.as_str())
221 .and_then(|s| Sha256Digest::from_hex(s).ok());
222
223 let about = yaml.get("about").and_then(|v| v.as_mapping());
224 let homepage_url = about
225 .and_then(|a| a.get("home"))
226 .and_then(|v| v.as_str())
227 .map(|s| truncate_field(s.to_string()));
228
229 let extracted_license_statement = about
230 .and_then(|a| a.get("license"))
231 .and_then(|v| v.as_str())
232 .map(|s| truncate_field(s.to_string()));
233 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
234 normalize_conda_declared_license(extracted_license_statement.as_deref());
235
236 let description = about
237 .and_then(|a| a.get("summary"))
238 .and_then(|v| v.as_str())
239 .map(|s| truncate_field(s.to_string()));
240
241 let vcs_url = about
242 .and_then(|a| a.get("dev_url"))
243 .and_then(|v| v.as_str())
244 .map(|s| truncate_field(s.to_string()));
245 let license_file = about
246 .and_then(|a| a.get("license_file"))
247 .and_then(|v| v.as_str())
248 .map(str::trim)
249 .filter(|value| !value.is_empty())
250 .map(|s| truncate_field(s.to_string()));
251
252 let mut dependencies = Vec::new();
254 let mut extra_data: HashMap<String, serde_json::Value> = HashMap::new();
255
256 if let Some(requirements) = yaml.get("requirements").and_then(|v| v.as_mapping()) {
257 for (scope_key, reqs_value) in requirements {
258 let scope = scope_key.as_str().unwrap_or("unknown");
259 if let Some(reqs) = reqs_value.as_sequence() {
260 for req in reqs.iter().take(MAX_ITERATION_COUNT) {
261 if let Some(req_str) = req.as_str()
262 && let Some(dep) = parse_conda_requirement(req_str, scope)
263 {
264 if extract_conda_requirement_name(req_str)
266 .is_some_and(|n| n == "pip" || n == "python")
267 {
268 if let Some(arr) = extra_data
269 .entry(scope.to_string())
270 .or_insert_with(|| serde_json::Value::Array(vec![]))
271 .as_array_mut()
272 {
273 arr.push(serde_json::Value::String(truncate_field(
274 req_str.to_string(),
275 )))
276 }
277 } else {
278 dependencies.push(dep);
279 }
280 }
281 }
282 }
283 }
284 }
285
286 let mut pkg = default_package_data(Some(DatasourceId::CondaMetaYaml));
287 pkg.package_type = Some(Self::PACKAGE_TYPE);
288 pkg.datasource_id = Some(DatasourceId::CondaMetaYaml);
289 pkg.name = name;
290 pkg.version = version;
291 pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
292 pkg.download_url = download_url;
293 pkg.homepage_url = homepage_url;
294 pkg.declared_license_expression = declared_license_expression.map(truncate_field);
295 pkg.declared_license_expression_spdx = declared_license_expression_spdx.map(truncate_field);
296 pkg.license_detections = license_detections;
297 pkg.extracted_license_statement = extracted_license_statement.map(truncate_field);
298 pkg.description = description;
299 pkg.vcs_url = vcs_url;
300 pkg.sha256 = sha256;
301 pkg.dependencies = dependencies;
302 if let Some(license_file) = license_file {
303 extra_data.insert(
304 "license_file".to_string(),
305 serde_json::Value::String(license_file),
306 );
307 }
308 if !extra_data.is_empty() {
309 pkg.extra_data = Some(extra_data);
310 }
311 vec![pkg]
312 }
313}
314
315fn looks_like_conda_recipe_yaml(yaml: &Value) -> bool {
316 yaml.get("schema_version")
317 .and_then(|value| value.as_u64())
318 .is_some_and(|value| value == 1)
319 && (yaml
320 .get("package")
321 .and_then(|value| value.as_mapping())
322 .is_some()
323 || yaml
324 .get("recipe")
325 .and_then(|value| value.as_mapping())
326 .is_some())
327}
328
329fn parse_conda_recipe_yaml(yaml: &Value) -> PackageData {
330 let context = extract_recipe_yaml_context(yaml);
331 let package = yaml
332 .get("package")
333 .or_else(|| yaml.get("recipe"))
334 .and_then(|value| value.as_mapping());
335 let source = yaml.get("source").and_then(|value| value.as_mapping());
336 let about = yaml.get("about").and_then(|value| value.as_mapping());
337
338 let name = package
339 .and_then(|pkg| pkg.get("name"))
340 .and_then(|value| recipe_yaml_value_to_string(value, &context));
341 let version = package
342 .and_then(|pkg| pkg.get("version"))
343 .and_then(|value| recipe_yaml_value_to_string(value, &context));
344
345 let download_url = source
346 .and_then(|src| src.get("url"))
347 .and_then(|value| recipe_yaml_value_to_string(value, &context));
348 let sha256 = source
349 .and_then(|src| src.get("sha256"))
350 .and_then(|value| recipe_yaml_value_to_string(value, &context))
351 .and_then(|value| Sha256Digest::from_hex(&value).ok());
352
353 let extracted_license_statement = about
354 .and_then(|section| section.get("license"))
355 .and_then(|value| recipe_yaml_value_to_string(value, &context));
356 let (declared_license_expression, declared_license_expression_spdx, license_detections) =
357 normalize_conda_declared_license(extracted_license_statement.as_deref());
358
359 let description = about
360 .and_then(|section| section.get("summary"))
361 .and_then(|value| recipe_yaml_value_to_string(value, &context));
362 let homepage_url = about
363 .and_then(|section| section.get("homepage").or_else(|| section.get("home")))
364 .and_then(|value| recipe_yaml_value_to_string(value, &context));
365 let vcs_url = about
366 .and_then(|section| {
367 section
368 .get("repository")
369 .or_else(|| section.get("dev_url"))
370 .or_else(|| section.get("repository_url"))
371 })
372 .and_then(|value| recipe_yaml_value_to_string(value, &context));
373 let documentation_url = about
374 .and_then(|section| section.get("documentation"))
375 .and_then(|value| recipe_yaml_value_to_string(value, &context));
376 let license_file = about
377 .and_then(|section| section.get("license_file"))
378 .and_then(|value| recipe_yaml_value_to_string(value, &context));
379
380 let mut dependencies = Vec::new();
381 let mut extra_data: HashMap<String, serde_json::Value> = HashMap::new();
382 if let Some(requirements) = yaml
383 .get("requirements")
384 .and_then(|value| value.as_mapping())
385 {
386 for (scope_key, reqs_value) in requirements {
387 let Some(scope) = scope_key.as_str() else {
388 continue;
389 };
390 let recipe_requirements = extract_recipe_yaml_requirement_strings(reqs_value, &context);
391 if recipe_requirements.is_empty() {
392 continue;
393 }
394
395 for req in &recipe_requirements {
396 if extract_conda_requirement_name(req)
397 .is_some_and(|name| name == "pip" || name == "python")
398 {
399 if let Some(arr) = extra_data
400 .entry(scope.to_string())
401 .or_insert_with(|| serde_json::Value::Array(vec![]))
402 .as_array_mut()
403 {
404 arr.push(serde_json::Value::String(truncate_field(req.clone())));
405 }
406 continue;
407 }
408
409 if let Some(dep) = parse_conda_requirement(req, scope) {
410 dependencies.push(dep);
411 }
412 }
413 }
414 }
415
416 if let Some(documentation_url) = documentation_url {
417 extra_data.insert(
418 "documentation".to_string(),
419 serde_json::Value::String(documentation_url),
420 );
421 }
422 if let Some(license_file) = license_file {
423 extra_data.insert(
424 "license_file".to_string(),
425 serde_json::Value::String(license_file),
426 );
427 }
428 extra_data.insert("schema_version".to_string(), serde_json::json!(1));
429
430 let mut pkg = default_package_data(Some(DatasourceId::CondaMetaYaml));
431 pkg.package_type = Some(CondaMetaYamlParser::PACKAGE_TYPE);
432 pkg.datasource_id = Some(DatasourceId::CondaMetaYaml);
433 pkg.name = name;
434 pkg.version = version;
435 pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
436 pkg.download_url = download_url;
437 pkg.homepage_url = homepage_url;
438 pkg.declared_license_expression = declared_license_expression.map(truncate_field);
439 pkg.declared_license_expression_spdx = declared_license_expression_spdx.map(truncate_field);
440 pkg.license_detections = license_detections;
441 pkg.extracted_license_statement = extracted_license_statement.map(truncate_field);
442 pkg.description = description;
443 pkg.vcs_url = vcs_url;
444 pkg.sha256 = sha256;
445 pkg.dependencies = dependencies;
446 pkg.extra_data = Some(extra_data);
447 pkg
448}
449
450fn extract_recipe_yaml_context(yaml: &Value) -> HashMap<String, String> {
451 let mut context = HashMap::new();
452 let Some(context_mapping) = yaml.get("context").and_then(|value| value.as_mapping()) else {
453 return context;
454 };
455
456 for (key, value) in context_mapping {
457 let Some(key) = key.as_str() else {
458 continue;
459 };
460 if let Some(value) = yaml_value_to_string(value) {
461 context.insert(truncate_field(key.to_string()), truncate_field(value));
462 }
463 }
464
465 context
466}
467
468fn recipe_yaml_value_to_string(value: &Value, context: &HashMap<String, String>) -> Option<String> {
469 let value = yaml_value_to_string(value)?;
470 Some(resolve_recipe_yaml_expressions(&value, context))
471}
472
473fn resolve_recipe_yaml_expressions(value: &str, context: &HashMap<String, String>) -> String {
474 let Some(re) = Regex::new(r#"\$\{\{\s*([A-Za-z_][A-Za-z0-9_]*)\s*\}\}"#).ok() else {
475 return truncate_field(value.to_string());
476 };
477
478 let resolved = re.replace_all(value, |caps: ®ex::Captures| {
479 context
480 .get(&caps[1])
481 .cloned()
482 .unwrap_or_else(|| caps[0].to_string())
483 });
484 truncate_field(resolved.into_owned())
485}
486
487fn extract_recipe_yaml_requirement_strings(
488 value: &Value,
489 context: &HashMap<String, String>,
490) -> Vec<String> {
491 let mut requirements = Vec::new();
492 collect_recipe_yaml_requirement_strings(value, context, &mut requirements);
493 requirements
494}
495
496fn collect_recipe_yaml_requirement_strings(
497 value: &Value,
498 context: &HashMap<String, String>,
499 requirements: &mut Vec<String>,
500) {
501 if let Some(req) = value.as_str() {
502 let resolved = resolve_recipe_yaml_expressions(req, context);
503 if should_keep_recipe_yaml_requirement(&resolved) {
504 requirements.push(resolved);
505 }
506 return;
507 }
508
509 if let Some(items) = value.as_sequence() {
510 for item in items.iter().take(MAX_ITERATION_COUNT) {
511 collect_recipe_yaml_requirement_strings(item, context, requirements);
512 }
513 return;
514 }
515
516 if let Some(mapping) = value.as_mapping() {
517 if let Some(then_value) = mapping.get("then") {
518 collect_recipe_yaml_requirement_strings(then_value, context, requirements);
519 }
520 if let Some(else_value) = mapping.get("else") {
521 collect_recipe_yaml_requirement_strings(else_value, context, requirements);
522 }
523 }
524}
525
526fn should_keep_recipe_yaml_requirement(req: &str) -> bool {
527 let trimmed = req.trim();
528 if trimmed.is_empty() {
529 return false;
530 }
531
532 !(trimmed.contains("${{")
533 || trimmed.contains("compiler('")
534 || trimmed.contains("compiler(\"")
535 || trimmed.contains("pin_subpackage(")
536 || trimmed.contains("pin_compatible(")
537 || trimmed.contains("stdlib('")
538 || trimmed.contains("stdlib(\""))
539}
540
541fn normalize_conda_declared_license(
542 statement: Option<&str>,
543) -> (
544 Option<String>,
545 Option<String>,
546 Vec<crate::models::LicenseDetection>,
547) {
548 match statement.map(str::trim).filter(|value| !value.is_empty()) {
549 Some("Apache Software") => build_declared_license_data_from_pair(
550 "apache-2.0",
551 "Apache-2.0",
552 DeclaredLicenseMatchMetadata::single_line("Apache Software"),
553 ),
554 Some("BSD-3-Clause") => build_declared_license_data_from_pair(
555 "bsd-new",
556 "BSD-3-Clause",
557 DeclaredLicenseMatchMetadata::single_line("BSD-3-Clause"),
558 ),
559 other => normalize_spdx_declared_license(other),
560 }
561}
562
563pub struct CondaEnvironmentYmlParser;
568
569impl PackageParser for CondaEnvironmentYmlParser {
570 const PACKAGE_TYPE: PackageType = PackageType::Conda;
571
572 fn is_match(path: &Path) -> bool {
573 if let Some(name) = path.file_name().and_then(|n| n.to_str()) {
575 let lower = name.to_lowercase();
576 (lower.contains("conda") || lower.contains("env") || lower.contains("environment"))
577 && (lower.ends_with(".yaml") || lower.ends_with(".yml"))
578 } else {
579 false
580 }
581 }
582
583 fn extract_packages(path: &Path) -> Vec<PackageData> {
584 let contents = match read_file_to_string(path, None) {
585 Ok(c) => c,
586 Err(e) => {
587 warn!("Failed to read {}: {}", path.display(), e);
588 return vec![default_package_data(Some(DatasourceId::CondaYaml))];
589 }
590 };
591
592 let yaml: Value = match yaml_serde::from_str(&contents) {
593 Ok(y) => y,
594 Err(e) => {
595 warn!("Failed to parse YAML in {}: {}", path.display(), e);
596 return vec![default_package_data(Some(DatasourceId::CondaYaml))];
597 }
598 };
599
600 if !looks_like_conda_environment_yaml(&yaml) {
601 return Vec::new();
602 }
603
604 let name = yaml
605 .get("name")
606 .and_then(|v| v.as_str())
607 .map(|s| truncate_field(s.to_string()));
608
609 let dependencies = extract_environment_dependencies(&yaml);
610
611 let mut extra_data = HashMap::new();
612 if let Some(channels) = yaml.get("channels").and_then(|v| v.as_sequence()) {
613 let channels_vec: Vec<String> = channels
614 .iter()
615 .filter_map(|c| c.as_str().map(|s| truncate_field(s.to_string())))
616 .collect();
617 if !channels_vec.is_empty() {
618 extra_data.insert("channels".to_string(), serde_json::json!(channels_vec));
619 }
620 }
621
622 let mut pkg = default_package_data(Some(DatasourceId::CondaYaml));
624 pkg.package_type = Some(Self::PACKAGE_TYPE);
625 pkg.datasource_id = Some(DatasourceId::CondaYaml);
626 pkg.name = name;
627 pkg.purl = build_conda_package_purl(pkg.name.as_deref(), pkg.version.as_deref());
628 pkg.primary_language = Some(truncate_field("Python".to_string()));
629 pkg.dependencies = dependencies;
630 pkg.is_private = true;
631 if !extra_data.is_empty() {
632 pkg.extra_data = Some(extra_data);
633 }
634 vec![pkg]
635 }
636}
637
638fn looks_like_conda_environment_yaml(yaml: &Value) -> bool {
639 let has_dependencies = yaml
640 .get("dependencies")
641 .and_then(|value| value.as_sequence())
642 .is_some_and(|items| !items.is_empty());
643 let has_channels = yaml
644 .get("channels")
645 .and_then(|value| value.as_sequence())
646 .is_some_and(|items| !items.is_empty());
647 let has_prefix = yaml
648 .get("prefix")
649 .and_then(|value| value.as_str())
650 .is_some_and(|value| !value.trim().is_empty());
651
652 has_dependencies || has_channels || has_prefix
653}
654
655pub fn extract_jinja2_variables(content: &str) -> HashMap<String, String> {
663 let mut variables = HashMap::new();
664
665 for line in content.lines().take(MAX_ITERATION_COUNT) {
666 let trimmed = line.trim();
667 if let Some(inner) = extract_jinja_statement(trimmed)
668 && let Some(inner) = inner.strip_prefix("set").map(str::trim)
669 && let Some((key, value)) = inner.split_once('=')
670 {
671 let key = key.trim();
672 let value = value.trim().trim_matches('"').trim_matches('\'');
673 variables.insert(
674 truncate_field(key.to_string()),
675 truncate_field(value.to_string()),
676 );
677 }
678 }
679
680 variables
681}
682
683pub fn apply_jinja2_substitutions(content: &str, variables: &HashMap<String, String>) -> String {
689 let mut result = Vec::new();
690
691 for line in content.lines() {
692 let trimmed = line.trim();
693
694 if extract_jinja_statement(trimmed).is_some() {
695 continue;
696 }
697
698 let mut processed_line = line.to_string();
699
700 if line.contains("{{") && line.contains("}}") {
702 for (var_name, var_value) in variables {
703 let pattern_lower = format!("{{{{ {}|lower }}}}", var_name);
705 if processed_line.contains(&pattern_lower) {
706 processed_line =
707 processed_line.replace(&pattern_lower, &var_value.to_lowercase());
708 }
709
710 let pattern_normal = format!("{{{{ {} }}}}", var_name);
712 processed_line = processed_line.replace(&pattern_normal, var_value);
713 }
714 }
715
716 if processed_line.contains("{{") {
718 continue;
719 }
720
721 result.push(processed_line);
722 }
723
724 quote_plain_numeric_version_scalars(&result.join("\n"))
725}
726
727fn quote_plain_numeric_version_scalars(content: &str) -> String {
728 let Some(version_re) =
729 Regex::new(r#"^(\s*(?:-\s*)?version:\s*)([0-9]+(?:\.[0-9]+)+)(\s*)$"#).ok()
730 else {
731 return content.to_string();
732 };
733
734 content
735 .lines()
736 .map(|line| {
737 version_re
738 .replace(line, |caps: ®ex::Captures| {
739 format!(r#"{}"{}"{}"#, &caps[1], &caps[2], &caps[3])
740 })
741 .into_owned()
742 })
743 .collect::<Vec<_>>()
744 .join("\n")
745}
746
747pub fn parse_conda_requirement(req: &str, scope: &str) -> Option<Dependency> {
755 let req = req.trim();
756
757 let (namespace, channel_url, req_without_ns) = parse_conda_channel_prefix(req);
759
760 let (name_part, version_constraint) =
762 if let Some((name, constraint)) = req_without_ns.split_once(' ') {
763 (name.trim(), Some(constraint.trim()))
764 } else {
765 (req_without_ns, None)
766 };
767
768 let (name, version, is_pinned, extracted_requirement) = if name_part.contains('=') {
770 let parts: Vec<&str> = name_part.splitn(2, '=').collect();
771 let n = parts[0].trim();
772 let v = if parts.len() > 1 {
773 let parsed = parts[1].trim();
774 if parsed.is_empty() {
775 None
776 } else {
777 Some(truncate_field(parsed.to_string()))
778 }
779 } else {
780 None
781 };
782 let req = v
783 .as_ref()
784 .map(|ver| format!("={}", ver))
785 .unwrap_or_default();
786 (n, v, true, Some(truncate_field(req)))
787 } else if let Some(constraint) = version_constraint {
788 let version_opt = if constraint.starts_with("==") {
789 Some(truncate_field(
790 constraint.trim_start_matches("==").trim().to_string(),
791 ))
792 } else {
793 None
794 };
795 (
796 name_part.trim(),
797 version_opt,
798 false,
799 Some(truncate_field(constraint.to_string())),
800 )
801 } else {
802 (name_part.trim(), None, false, Some(String::new()))
803 };
804
805 let purl = build_purl(
807 "conda",
808 namespace,
809 name,
810 version.as_deref(),
811 None,
812 None,
813 None,
814 );
815
816 let (is_runtime, is_optional) = match scope {
818 "run" => (true, false),
819 _ => (false, true), };
821
822 let mut extra_data = HashMap::new();
823 if let Some(namespace) = namespace {
824 extra_data.insert(
825 "channel".to_string(),
826 serde_json::json!(truncate_field(namespace.to_string())),
827 );
828 }
829 if let Some(channel_url) = channel_url {
830 extra_data.insert(
831 "channel_url".to_string(),
832 serde_json::json!(truncate_field(channel_url.to_string())),
833 );
834 }
835
836 Some(Dependency {
837 purl,
838 extracted_requirement,
839 scope: Some(truncate_field(scope.to_string())),
840 is_runtime: Some(is_runtime),
841 is_optional: Some(is_optional),
842 is_pinned: Some(is_pinned),
843 is_direct: Some(true),
844 resolved_package: None,
845 extra_data: (!extra_data.is_empty()).then_some(extra_data),
846 })
847}
848
849fn extract_environment_dependencies(yaml: &Value) -> Vec<Dependency> {
850 let dependencies = match yaml.get("dependencies").and_then(|v| v.as_sequence()) {
851 Some(d) => d,
852 None => return Vec::new(),
853 };
854
855 let mut deps = Vec::new();
856 for dep_value in dependencies.iter().take(MAX_ITERATION_COUNT) {
857 if let Some(dep_str) = dep_value.as_str() {
858 if let Some(dep) = parse_environment_string_dependency(dep_str) {
859 deps.push(dep);
860 }
861 } else if let Some(pip_deps) = dep_value.get("pip").and_then(|v| v.as_sequence()) {
862 deps.extend(extract_pip_dependencies(pip_deps));
863 }
864 }
865 deps
866}
867
868fn parse_environment_string_dependency(dep_str: &str) -> Option<Dependency> {
869 let (namespace, channel_url, dep_without_ns) = parse_conda_channel_prefix(dep_str);
870 create_conda_dependency(namespace, channel_url, dep_without_ns, "dependencies")
871}
872
873fn parse_conda_exact_requirement(req_no_space: &str) -> (Option<String>, Option<String>) {
874 let exact = req_no_space
875 .strip_prefix("==")
876 .or_else(|| req_no_space.strip_prefix('='));
877
878 let Some(exact) = exact else {
879 return (None, None);
880 };
881
882 if exact.is_empty() {
883 return (None, None);
884 }
885
886 match exact.split_once('=') {
887 Some((version, build_string)) if !version.is_empty() => (
888 Some(truncate_field(version.to_string())),
889 (!build_string.is_empty()).then(|| truncate_field(build_string.to_string())),
890 ),
891 _ => (Some(truncate_field(exact.to_string())), None),
892 }
893}
894
895fn parse_conda_channel_prefix(dep_str: &str) -> (Option<&str>, Option<&str>, &str) {
896 if let Some((ns, rest)) = dep_str.rsplit_once("::") {
897 if ns.contains('/') || ns.contains(':') {
898 (None, Some(ns), rest)
899 } else {
900 (Some(ns), None, rest)
901 }
902 } else {
903 (None, None, dep_str)
904 }
905}
906
907fn create_conda_dependency(
908 namespace: Option<&str>,
909 channel_url: Option<&str>,
910 dep_without_ns: &str,
911 scope: &str,
912) -> Option<Dependency> {
913 let dep = dep_without_ns.trim();
914 let name_re = match Regex::new(r"^([A-Za-z0-9_.\-]+)") {
915 Ok(re) => re,
916 Err(_) => return None,
917 };
918
919 let caps = name_re.captures(dep)?;
920 let name_match = caps.get(1)?;
921 let name = name_match.as_str().trim();
922 let rest = dep[name_match.end()..].trim();
923
924 let (version, build_string, is_pinned, extracted_requirement) = if rest.is_empty() {
925 (None, None, false, Some(String::new()))
926 } else {
927 let req_no_space = rest.replace(' ', "");
928 let is_exact = req_no_space.starts_with("=") || req_no_space.starts_with("==");
929 let (parsed_version, parsed_build_string) = if is_exact {
930 parse_conda_exact_requirement(&req_no_space)
931 } else {
932 (None, None)
933 };
934
935 (
936 parsed_version,
937 parsed_build_string,
938 is_exact,
939 Some(truncate_field(rest.to_string())),
940 )
941 };
942
943 if name == "pip" || name == "python" {
944 return None;
945 }
946
947 let purl = build_purl(
948 "conda",
949 namespace,
950 name,
951 version.as_deref(),
952 None,
953 None,
954 None,
955 );
956 let mut extra_data = HashMap::new();
957 if let Some(namespace) = namespace {
958 extra_data.insert(
959 "channel".to_string(),
960 serde_json::json!(truncate_field(namespace.to_string())),
961 );
962 }
963 if let Some(channel_url) = channel_url {
964 extra_data.insert(
965 "channel_url".to_string(),
966 serde_json::json!(truncate_field(channel_url.to_string())),
967 );
968 }
969 if let Some(build_string) = build_string {
970 extra_data.insert("build_string".to_string(), serde_json::json!(build_string));
971 }
972
973 Some(Dependency {
974 purl,
975 extracted_requirement,
976 scope: Some(truncate_field(scope.to_string())),
977 is_runtime: Some(true),
978 is_optional: Some(false),
979 is_pinned: Some(is_pinned),
980 is_direct: Some(true),
981 resolved_package: None,
982 extra_data: (!extra_data.is_empty()).then_some(extra_data),
983 })
984}
985
986fn extract_pip_dependencies(pip_deps: &[Value]) -> Vec<Dependency> {
987 pip_deps
988 .iter()
989 .take(MAX_ITERATION_COUNT)
990 .filter_map(|pip_dep| {
991 if let Some(pip_req_str) = pip_dep.as_str()
992 && let Ok(parsed_req) = pip_req_str.parse::<pep508_rs::Requirement>()
993 {
994 create_pip_dependency(parsed_req, "dependencies", Some(pip_req_str))
995 } else {
996 None
997 }
998 })
999 .collect()
1000}
1001
1002fn create_pip_dependency(
1003 parsed_req: pep508_rs::Requirement,
1004 scope: &str,
1005 raw_requirement: Option<&str>,
1006) -> Option<Dependency> {
1007 let name = truncate_field(parsed_req.name.to_string());
1008
1009 if name == "pip" || name == "python" {
1010 return None;
1011 }
1012
1013 let specs = parsed_req.version_or_url.as_ref().map(|v| match v {
1014 pep508_rs::VersionOrUrl::VersionSpecifier(spec) => truncate_field(spec.to_string()),
1015 pep508_rs::VersionOrUrl::Url(url) => truncate_field(url.to_string()),
1016 });
1017
1018 let extracted_requirement = if let Some(raw) = raw_requirement {
1019 let raw = raw.trim();
1020 let suffix = raw.strip_prefix(&name).unwrap_or(raw).trim().to_string();
1021 Some(truncate_field(suffix))
1022 } else {
1023 Some(truncate_field(specs.clone().unwrap_or_default()))
1024 };
1025
1026 let version = specs.as_ref().and_then(|spec_str| {
1027 if spec_str.starts_with("==") {
1028 Some(truncate_field(
1029 spec_str.trim_start_matches("==").to_string(),
1030 ))
1031 } else {
1032 None
1033 }
1034 });
1035
1036 let is_pinned = specs.as_ref().map(|s| s.contains("==")).unwrap_or(false);
1037 let purl = build_purl("pypi", None, &name, version.as_deref(), None, None, None);
1038
1039 Some(Dependency {
1040 purl,
1041 extracted_requirement,
1042 scope: Some(truncate_field(scope.to_string())),
1043 is_runtime: Some(true),
1044 is_optional: Some(false),
1045 is_pinned: Some(is_pinned),
1046 is_direct: Some(true),
1047 resolved_package: None,
1048 extra_data: None,
1049 })
1050}
1051
1052crate::register_parser!(
1053 "Conda package manifest and environment file",
1054 &[
1055 "**/meta.yaml",
1056 "**/meta.yml",
1057 "**/recipe/recipe.yaml",
1058 "**/recipe/recipe.yml",
1059 "**/environment.yml",
1060 "**/environment.yaml",
1061 "**/env.yaml",
1062 "**/env.yml",
1063 "**/conda.yaml",
1064 "**/conda.yml",
1065 "**/*conda*.yaml",
1066 "**/*conda*.yml",
1067 "**/*env*.yaml",
1068 "**/*env*.yml",
1069 "**/*environment*.yaml",
1070 "**/*environment*.yml"
1071 ],
1072 "conda",
1073 "Python",
1074 Some("https://docs.conda.io/"),
1075);