[BUG] buildID is cut from version

[chrsch-dev]

Describe the bug

If a projects version contains also build metadata (e.g "version": "1.0.0-123+456" following the semver definition) the build metadata part +456 is omitted in the purl that is put in the generated sbom. I would expect the build metadata to also be part of the version in the purl.

To Reproduce

Create a package.json file like this one:

{
  "name": "sbomtest",
  "version": "1.0.0-123+456",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "devDependencies": {
    "@cyclonedx/cyclonedx-npm": "^1.9.0"
  }
}

run npm pkg get version which will return "1.0.0-123+456" as expected.

Then generate the sbom npx cyclonedx-npm --output-file sbom.json
This will generate a sbom like this (note: I removed irrelevant parts)

{
  "$schema": "http://cyclonedx.org/schema/bom-1.4.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "version": 1,
  "serialNumber": "urn:uuid:b368281e-6ad1-4f66-87ef-9e3cf5ed8cc2",
  "metadata": {
    "timestamp": "2023-03-10T09:24:29.674Z",
    "component": {
      "type": "application",
      "name": "sbomtest",
      "version": "1.0.0-123",
      "bom-ref": "sbomtest@1.0.0-123+456",
      "purl": "pkg:npm/sbomtest@1.0.0-123"
    }
  }
}

As you can see for the bom-ref the version part is as expected but the purl property misses the build metadata.

Expected behavior

The purl in the sbom should be "purl": "pkg:npm/sbomtest@1.0.0-123+456"

Environment

• @cyclonedx/cyclonedx-npm version: 1.9.0
• NPM version: 8.19.1
• Node version: v18.9.0
• OS: macOS Ventura

[jkowalleck]

the version is "cleaned" for some reason.
need to check if/why this is done. probably an issue with normalize-package-data.

---

PS/research results:

background: this tool utilizes normalize-package-data to clean up some malformed package-json data.

1.normalize-package-data - https://github.com/npm/normalize-package-data/blob/cb13a34f17f0874c1c56d741b6448621efb2bcce/lib/fixer.js#L207
2. utilizes semver - https://github.com/npm/node-semver/blob/da08e01cd96f9d70a8b4fbc7dc3f69eef930f67a/functions/clean.js#L4
3. which drops parts of the version -- https://github.com/npm/node-semver/blob/da08e01cd96f9d70a8b4fbc7dc3f69eef930f67a/classes/semver.js#L8-L77

[jkowalleck]

@chrsch-dev could you create a reproducible setup including a package.lock file?

[jkowalleck]

checked, and found the unexpected behavior to be caused by normalize-package-data.

• Need to check why they are doing this and if it can be overridden. -- see [BUG] buildID is cut from version #551 (comment)
• implement a fix -- fix: prevent version modifications #597
• have a regression test in place

[chrsch-dev]

Ok, do you still need a reproducible setup? I could provide you a simple project.

[jkowalleck]

Ok, do you still need a reproducible setup? I could provide you a simple project.

Yeas, please, @chrsch-dev .
I want to use it for shaping a regression test, so that the bug you found is solved for good.

[chrsch-dev]

Here you can find the example project: https://github.com/chrsch-dev/cyclonedx-purl-version-bug

[jkowalleck]

TODO:

1. take the example data set and put it into https://github.com/CycloneDX/cyclonedx-node-npm/tree/main/demo
2. generate the output from npm ls over all versions via https://github.com/CycloneDX/cyclonedx-node-npm/actions/workflows/npm-ls_demo-results.yml

• run: https://github.com/CycloneDX/cyclonedx-node-npm/actions/runs/4556195314
• result: TBD

4. compare if the output of all npm versions is as expected -- does NPM drop the builID from the version???

• npm6 will still cut the buidID
• npm7,8 are keeping the version as is

6. put the updated demo data into https://github.com/CycloneDX/cyclonedx-node-npm/tree/main/tests/_data/npm-ls_demo-results
7. apply the fix from fix: prevent version modifications #597
8. generate the test results in a npm ls --package-lock-only way
9. review the test results -> the +456 must be included

[chrsch-dev]

When will this be available/published?