provenant/parsers/nuget/
packages_lock.rs

1// SPDX-FileCopyrightText: nexB Inc. and others
2// SPDX-FileCopyrightText: Provenant contributors
3// SPDX-License-Identifier: Apache-2.0
4// Derived from ScanCode Toolkit (Apache-2.0); modified. See NOTICE.
5
6use std::path::Path;
7
8use crate::models::{DatasourceId, Dependency, PackageData, PackageType};
9use crate::parser_warn as warn;
10use packageurl::PackageUrl;
11
12use super::super::PackageParser;
13use super::super::utils::{capped_iteration_limit, read_file_to_string};
14use super::default_package_data;
15
16pub struct PackagesLockParser;
17
18impl PackageParser for PackagesLockParser {
19    const PACKAGE_TYPE: PackageType = PackageType::Nuget;
20
21    fn is_match(path: &Path) -> bool {
22        path.file_name()
23            .and_then(|name| name.to_str())
24            .is_some_and(|name| name.ends_with("packages.lock.json"))
25    }
26
27    fn extract_packages(path: &Path) -> Vec<PackageData> {
28        let content = match read_file_to_string(path, None) {
29            Ok(c) => c,
30            Err(e) => {
31                warn!("Failed to read packages.lock.json at {:?}: {}", path, e);
32                return vec![default_package_data(Some(DatasourceId::NugetPackagesLock))];
33            }
34        };
35
36        let parsed: serde_json::Value = match serde_json::from_str(&content) {
37            Ok(v) => v,
38            Err(e) => {
39                warn!("Failed to parse packages.lock.json at {:?}: {}", path, e);
40                return vec![default_package_data(Some(DatasourceId::NugetPackagesLock))];
41            }
42        };
43
44        let mut dependencies = Vec::new();
45
46        if let Some(deps_obj) = parsed.get("dependencies").and_then(|v| v.as_object()) {
47            let framework_limit = capped_iteration_limit(
48                deps_obj.len(),
49                "nuget packages.lock.json: target frameworks",
50            );
51            for (target_framework, packages) in deps_obj.iter().take(framework_limit) {
52                if let Some(packages_obj) = packages.as_object() {
53                    let package_limit = capped_iteration_limit(
54                        packages_obj.len(),
55                        "nuget packages.lock.json: framework packages",
56                    );
57                    for (package_name, package_info) in packages_obj.iter().take(package_limit) {
58                        if let Some(info_obj) = package_info.as_object() {
59                            let version = info_obj
60                                .get("resolved")
61                                .and_then(|v| v.as_str())
62                                .map(|s| s.to_string());
63
64                            let requested = info_obj
65                                .get("requested")
66                                .and_then(|v| v.as_str())
67                                .map(|s| s.to_string());
68
69                            let package_type = info_obj.get("type").and_then(|v| v.as_str());
70
71                            let is_direct = match package_type {
72                                Some("Direct") => Some(true),
73                                Some("Transitive") => Some(false),
74                                _ => None,
75                            };
76
77                            let purl = version.as_ref().and_then(|v| {
78                                PackageUrl::new("nuget", package_name).ok().map(|mut p| {
79                                    let _ = p.with_version(v);
80                                    p.to_string()
81                                })
82                            });
83
84                            let mut extra_data = serde_json::Map::new();
85                            extra_data.insert(
86                                "target_framework".to_string(),
87                                serde_json::Value::String(target_framework.clone()),
88                            );
89
90                            if let Some(content_hash) =
91                                info_obj.get("contentHash").and_then(|v| v.as_str())
92                            {
93                                extra_data.insert(
94                                    "content_hash".to_string(),
95                                    serde_json::Value::String(content_hash.to_string()),
96                                );
97                            }
98
99                            dependencies.push(Dependency {
100                                purl,
101                                extracted_requirement: requested.or(version),
102                                scope: Some(target_framework.clone()),
103                                is_runtime: Some(true),
104                                is_optional: Some(false),
105                                is_pinned: Some(true),
106                                is_direct,
107                                resolved_package: None,
108                                extra_data: if extra_data.is_empty() {
109                                    None
110                                } else {
111                                    Some(extra_data.into_iter().collect())
112                                },
113                            });
114                        }
115                    }
116                }
117            }
118        }
119
120        vec![PackageData {
121            datasource_id: Some(DatasourceId::NugetPackagesLock),
122            package_type: Some(Self::PACKAGE_TYPE),
123            dependencies,
124            ..default_package_data(Some(DatasourceId::NugetPackagesLock))
125        }]
126    }
127
128    fn metadata() -> Vec<super::super::metadata::ParserMetadata> {
129        vec![super::super::metadata::ParserMetadata {
130            description: ".NET packages.lock.json lockfile",
131            file_patterns: &["**/packages.lock.json"],
132            package_type: "nuget",
133            primary_language: "C#",
134            documentation_url: Some(
135                "https://learn.microsoft.com/en-us/nuget/consume-packages/package-references-in-project-files#locking-dependencies",
136            ),
137        }]
138    }
139}
provenant/parsers/nuget/packages_lock.rs

provenant/parsers/nuget/
packages_lock.rs
