/** * Distribution detection from SPDX SBOM package PURLs. */ function detectDistro(spdxInput) { if (!spdxInput) return null; let data = spdxInput; if (typeof spdxInput === 'string' || Buffer.isBuffer(spdxInput)) { try { data = JSON.parse(spdxInput.toString('utf8')); } catch { return null; } } if (!data || typeof data !== 'object' || !Array.isArray(data.packages)) { return null; } for (const pkg of data.packages) { if (!pkg || !Array.isArray(pkg.externalRefs)) continue; for (const ref of pkg.externalRefs) { if (ref && ref.referenceType === 'purl' && typeof ref.referenceLocator === 'string') { const purl = ref.referenceLocator; const nameMatch = purl.match(/[?&]os_name=([^&]+)/); const verMatch = purl.match(/[?&]os_version=([^&]+)/); if (nameMatch && verMatch) { const osName = decodeURIComponent(nameMatch[1]); const osVer = decodeURIComponent(verMatch[1]); return `${osName}/${osVer}`; } } } } return null; } module.exports = { detectDistro, };