[container] Temp directories are no longer cleared

[prabhu]

My laptop ran out of disk space. Noticed that the temp directories are not getting cleared for certain scan types any more. While I can't remember the original commit, I remember removing the clean up code to make createMultiXBom work (A method that needs to be rewritten!)

In particular the following temp directory patterns are not getting removed cleanly.

/tmp/docker-images-*
/tmp/jar-deps-*
/tmp/cdxgen-venv-*

To resolve this, we need to create a parent temp directory (or accept one via cli args), and pass this to the individual methods via options. This way, the directory can be consistently removed in postgen.

[youhaveme9]

@prabhu
Can you please explain a little bit more what to be done here?
Like how do we perform cleanup by creating a parent directory?

[prabhu]

Sure. You can set the environment variable TEMP or TMP prior to invoking cdxgen and then remove them upon completion.

mkdir -p /tmp/foo
export TEMP=/tmp/foo
cdxgen ...
rm -rf /tmp/foo

[youhaveme9]

Thanks for the clarification @prabhu

So, before invoking cdxgen we set the TEMP environment variable and pass to every function that is currently creating a directory under system default /tmp directory using

const tempDir = mkdirSync(join(process.env.TEMP, "jar-deps-"));

and after the scan completion we can invoke a clean up function which can be done using

rmSync(process.env.TEMP, { recursive: true, force: true });

is it correct?

[prabhu]

Are you asking as a user or interested in contributing a PR? To contribute a feature, we can do the following.

1. Create a getTmpDir method which returns process.env.CDXGEN_TEMP_DIR || tmpdir()
2. Replace all use of tmpdir() and fs.tmpdir()
3. Document the environment variable under ENV.md
4. Update the cdxgenGPT knowledge file (I can do this)

Sounds interesting?

[youhaveme9]

I'm interested to contribute
This is helpful
Thanks