cve-differential/lib/distro.js

/**
 * Distribution detection from SPDX SBOM package PURLs.
 */

function detectDistro(spdxInput) {
  if (!spdxInput) return null;

  let data = spdxInput;
  if (typeof spdxInput === 'string' || Buffer.isBuffer(spdxInput)) {
    try {
      data = JSON.parse(spdxInput.toString('utf8'));
    } catch {
      return null;
    }
  }

  if (!data || typeof data !== 'object' || !Array.isArray(data.packages)) {
    return null;
  }

  for (const pkg of data.packages) {
    if (!pkg || !Array.isArray(pkg.externalRefs)) continue;
    for (const ref of pkg.externalRefs) {
      if (ref && ref.referenceType === 'purl' && typeof ref.referenceLocator === 'string') {
        const purl = ref.referenceLocator;
        const nameMatch = purl.match(/[?&]os_name=([^&]+)/);
        const verMatch = purl.match(/[?&]os_version=([^&]+)/);
        if (nameMatch && verMatch) {
          const osName = decodeURIComponent(nameMatch[1]);
          const osVer = decodeURIComponent(verMatch[1]);
          return `${osName}/${osVer}`;
        }
      }
    }
  }

  return null;
}

module.exports = {
  detectDistro,
};