[suyash-jai]

Summary

• Is the CycloneDX SBOM more complete than the CSV? Yes. Every Virtualization component in the CSV is also in the SBOM, except 24 names, and none of those is a real gap: they don't ship, are BOM POMs with no code, are listed under another name, or (javax.inject) are left out until password-vault-manager ships as its own package. The SBOM also lists over 500 components the CSV never had: transitive jars, and the npm packages compiled into the UI bundles, which the SBOM previously missed entirely.
• Does it include unshipped build dependencies? No. It is a scan of the .deb, so Java components are the jars the package ships. For the UIs, only package.json dependencies are listed, not devDependencies; the CSV does include devDependencies. Caveat: an npm runtime dependency is listed even if webpack leaves it out of the bundle.

What this PR changes

A package's browser UI ships as minified bundles that Syft cannot see into, so the virtualization SBOM listed no npm components. This adds catalog_npm_lockfiles(), which scans each shipped lock file's directory on its own (Syft separates runtime from dev dependencies only at the scan root) with licenses from SBOM_NPM_REGISTRY, and adds +javascript-package-cataloger,+sbom-cataloger to the main scan. Of the other 31 deep-scanned .debs of #13252, only delphix-rust-src changes (+2 components).

Jira: DLPX-100122. Sub-task of DLPX-100120 (epic CP-13455), delivered in three PRs:

• DLPX-100121 Document the Phase 4 evaluation of Syft-on-deb for delphix-virtualization and delphix-masking appliance-build#938 (DLPX-100121): the evaluation write-up (docs/specs/2026-10-26-sbom-phase4-evaluation.md)
• DLPX-100122 Catalog npm lock files and embedded CycloneDX documents in package SBOMs #422 (DLPX-100122): this PR
• delphix/dlpx-app-gate#5068 (DLPX-100123): ship the UI lock files and a list of copied libraries, generated from *.DESC.json, in delphix-virtualization

Details: the full CSV comparison

Compared with the CSV from stage0 pre-push #13252 (bom-internal-qa-aws.csv, product Virtualization). Before is #13252; after is #15738 with these changes.

	Before	After
virtualization components	415	1,256
npm components	0	841
CSV names not in the SBOM	133	24

The 24 names:

Names	Count	Why
spring-boot-starter-*	7	Not shipped
Maven BOM POMs (azure-sdk, grpc, jackson, netty)	4	No shipped code
grunt-angular-templates, npm-license-crawler	2	Build tools, not shipped
knockout-test, easymock	2	Test libraries, not shipped
jackson-dataformat-toml	1	No longer shipped (came with Flyway 9; develop is on Flyway 11)
okhttp, okio, jconnect, org.jacoco.agent, knockout, highstock-custom, karma-jasmine-old	7	Listed under another name at the CSV's version
javax.inject	1	Indirect dependency of password-vault-manager; left out until that ships as its own package

"Not shipped" was checked against the file list of the .deb and of every .war in it. less.js 3.9.0 is in bom.csv but dropped from the per-variant CSVs, apparently because the Ubuntu pager is also called less; it ships in dxcore.war and is now listed. Against bom.csv the CSV-only names are the same 24.

Third-party code that ships but is in neither the CSV nor the SBOM (jqTree, jquery.smooth-scroll, jasmine-jquery, rsync, PostgreSQL xlogdump, inih, jsmn, fonts, angular-mocks, angular-i18n, Glyphicons) is left to DLPX-100126.

🤖 Generated with Claude Code