@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/rules/golem-go.yaml

@@ -0,0 +1,229 @@
+# Go Evinse and Golem Rules
+# Categories: golem-security, golem-performance, golem-compliance
+# Evaluates actionable cdx:golem:* properties emitted by evinse -l go when golem is available.
+
+- id: GOLEM-SEC-001
+  name: "Runtime Go dependency has a high-severity semantic security signal"
+  description: "Golem mapped a high or critical security-sensitive Go API signal to a component that appears in runtime usage evidence"
+  severity: medium
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        $prop($, 'cdx:golem:securitySignalSeverity') = 'high'
+        or $prop($, 'cdx:golem:securitySignalSeverity') = 'critical'
+      )
+      and (
+        $prop($, 'cdx:golem:usageScopes') = null
+        or $listContains($prop($, 'cdx:golem:usageScopes'), 'runtime')
+      )
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Runtime Go component '{{ name }}' has Golem security signal '{{ $prop($, 'cdx:golem:securitySignalCategory') }}' with severity '{{ $prop($, 'cdx:golem:securitySignalSeverity') }}'"
+  mitigation: "Inspect the component's occurrence and call-stack evidence. Confirm whether the API use is reachable in production code, whether configuration is safe, and whether a safer library or API should replace it"
+  evidence: |
+    {
+      "category": $prop($, 'cdx:golem:securitySignalCategory'),
+      "severity": $prop($, 'cdx:golem:securitySignalSeverity'),
+      "usageScopes": $prop($, 'cdx:golem:usageScopes'),
+      "evidenceKinds": $prop($, 'cdx:golem:occurrenceEvidenceKinds')
+    }
+
+- id: GOLEM-SEC-002
+  name: "Go crypto material flows into a crypto sink"
+  description: "Golem data-flow found a crypto-related source-to-sink path, such as user input, environment, or parameter data reaching a cryptographic operation"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:golem:cryptoDataFlow') = 'true'
+      or $number($firstNonEmpty($prop($, 'cdx:golem:cryptoDataFlowCount'), '0')) > 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' has crypto data-flow evidence: {{ $prop($, 'cdx:golem:cryptoDataFlowCategories') }}"
+  mitigation: "Review the source and sink locations, taint kinds, and call-stack frames. Verify key provenance, entropy, sanitization, secret handling, and whether the algorithm or protocol use is appropriate for production"
+  evidence: |
+    {
+      "categories": $prop($, 'cdx:golem:cryptoDataFlowCategories'),
+      "ruleId": $prop($, 'cdx:golem:cryptoDataFlowRuleId'),
+      "taintKinds": $prop($, 'cdx:golem:cryptoDataFlowTaintKinds'),
+      "count": $prop($, 'cdx:golem:cryptoDataFlowCount')
+    }
+
+- id: GOLEM-SEC-003
+  name: "Go component has a cryptographic finding"
+  description: "Golem reported a crypto-specific finding, such as weak algorithm use, insecure TLS configuration, or suspicious crypto material handling"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:golem:cryptoFinding') != null
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' has crypto finding '{{ $prop($, 'cdx:golem:cryptoFinding') }}' with severity '{{ $prop($, 'cdx:golem:cryptoFindingSeverity') }}'"
+  mitigation: "Inspect the crypto asset, operation, and occurrence evidence. Replace weak algorithms, remove insecure TLS settings, and ensure keys, nonces, salts, and certificates are generated and stored through approved mechanisms"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity'),
+      "algorithm": $prop($, 'cdx:golem:cryptoAlgorithm'),
+      "operationType": $prop($, 'cdx:golem:cryptoOperationType')
+    }
+
+- id: GOLEM-SEC-004
+  name: "Go module uses a local replacement in analyzed source"
+  description: "Golem observed a local Go module replacement, which can make builds non-hermetic and bypass normal module provenance review"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:golem:localReplacement') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' is affected by a local replacement in the analyzed module graph"
+  mitigation: "Use a published immutable module version for release builds, or vendor the exact source with explicit provenance, review approval, and reproducibility evidence"
+  evidence: |
+    {
+      "replacementModule": $prop($, 'cdx:golem:replacementModule'),
+      "modulePath": $prop($, 'cdx:golem:modulePath'),
+      "vendored": $prop($, 'cdx:golem:vendored')
+    }
+
+- id: GOLEM-PERF-001
+  name: "Go project crosses a native code boundary"
+  description: "Golem observed cgo, assembly, native object, or related native sidecar evidence that can change build reproducibility, review scope, and platform risk"
+  severity: low
+  category: golem-performance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      $number($firstNonEmpty($prop($, 'cdx:golem:nativeArtifactCount'), '0')) > 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "component": name }
+  message: "Go project '{{ name }}' includes native artifacts: {{ $prop($, 'cdx:golem:nativeArtifactKinds') }}"
+  mitigation: "Review cgo, assembly, and native object provenance. Verify supported architectures, compiler/linker flags, reproducible build steps, and whether native code needs separate security review or signing"
+  evidence: |
+    {
+      "nativeArtifactCount": $prop($, 'cdx:golem:nativeArtifactCount'),
+      "nativeArtifactKinds": $prop($, 'cdx:golem:nativeArtifactKinds')
+    }
+
+- id: GOLEM-PERF-002
+  name: "Go project relies on generated or embedded build inputs"
+  description: "Golem observed go:generate, go:embed, or generated-file evidence that should be reviewed for reproducibility and release completeness"
+  severity: low
+  category: golem-performance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      $number($firstNonEmpty($prop($, 'cdx:golem:goGenerateCount'), '0')) > 0
+      or $number($firstNonEmpty($prop($, 'cdx:golem:goEmbedCount'), '0')) > 0
+      or $number($firstNonEmpty($prop($, 'cdx:golem:generatedFileCount'), '0')) > 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "component": name }
+  message: "Go project '{{ name }}' has generated or embedded build inputs: generate={{ $prop($, 'cdx:golem:goGenerateCount') }}, embed={{ $prop($, 'cdx:golem:goEmbedCount') }}, generatedFiles={{ $prop($, 'cdx:golem:generatedFileCount') }}"
+  mitigation: "Confirm generated files are reproducible and reviewed, go:generate commands are not required at release time unless explicitly controlled, and embedded assets are covered by license and secret-scanning review"
+  evidence: |
+    {
+      "goGenerateCount": $prop($, 'cdx:golem:goGenerateCount'),
+      "goEmbedCount": $prop($, 'cdx:golem:goEmbedCount'),
+      "generatedFileCount": $prop($, 'cdx:golem:generatedFileCount'),
+      "generatorKinds": $prop($, 'cdx:golem:generatorKinds')
+    }
+
+- id: GOLEM-PERF-003
+  name: "Go data-flow evidence was truncated or sanitized"
+  description: "Golem reported data-flow truncation or sanitization, which means some source-to-sink evidence may be incomplete in the enriched BOM"
+  severity: low
+  category: golem-performance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      $prop($, 'cdx:golem:dataFlowTruncated') = 'true'
+      or $prop($, 'cdx:golem:dataFlowTruncationReasons') != null
+      or $number($firstNonEmpty($prop($, 'cdx:golem:dataFlowSanitizedSliceCount'), '0')) > 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "component": name }
+  message: "Go data-flow evidence for '{{ name }}' was truncated or sanitized"
+  mitigation: "For high-assurance review, rerun with narrower --golem-patterns, a focused --golem-dataflow mode such as crypto, larger slice/trace limits, or more memory. Treat a clean result as coverage-limited until truncation is resolved"
+  evidence: |
+    {
+      "dataFlowTruncated": $prop($, 'cdx:golem:dataFlowTruncated'),
+      "dataFlowTruncationReasons": $prop($, 'cdx:golem:dataFlowTruncationReasons'),
+      "dataFlowSanitizedSliceCount": $prop($, 'cdx:golem:dataFlowSanitizedSliceCount'),
+      "dataFlowSliceCount": $prop($, 'cdx:golem:dataFlowSliceCount')
+    }
+
+- id: GOLEM-COMP-001
+  name: "Go module appears private or workspace-local"
+  description: "Private or workspace-local Go module candidates require internal provenance, access-control, and retention review because public registry metadata may be unavailable"
+  severity: low
+  category: golem-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:golem:privateModuleCandidate') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' appears to be a private module candidate"
+  mitigation: "Confirm the module is covered by internal source retention, license review, vulnerability intake, and release provenance controls. Ensure private module names are not shared externally unless approved"
+  evidence: |
+    {
+      "modulePath": $prop($, 'cdx:golem:modulePath'),
+      "goVersion": $prop($, 'cdx:golem:goVersion'),
+      "usageScopes": $prop($, 'cdx:golem:usageScopes')
+    }
+
+- id: GOLEM-COMP-002
+  name: "Vendored Go module lacks license-file evidence"
+  description: "Vendored Go modules should preserve license files or equivalent license evidence for redistribution and audit readiness"
+  severity: medium
+  category: golem-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:golem:vendored') = 'true'
+      and $number($firstNonEmpty($prop($, 'cdx:golem:licenseFileCount'), '0')) = 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Vendored Go component '{{ name }}' does not carry Golem license-file evidence"
+  mitigation: "Keep upstream license files with vendored modules or document the equivalent license source in the release evidence bundle. Re-run Go Evinse after correcting the vendor tree"
+  evidence: |
+    {
+      "vendored": $prop($, 'cdx:golem:vendored'),
+      "licenseFileCount": $prop($, 'cdx:golem:licenseFileCount'),
+      "licenseFiles": $prop($, 'cdx:golem:licenseFiles')
+    }
+
+- id: GOLEM-COMP-003
+  name: "Go module graph uses exclude directives"
+  description: "Go exclude directives alter dependency resolution and can hide why a version was intentionally blocked or replaced"
+  severity: low
+  category: golem-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      $number($firstNonEmpty($prop($, 'cdx:golem:goModExcludeCount'), '0')) > 0
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "component": name }
+  message: "Go project '{{ name }}' uses {{ $prop($, 'cdx:golem:goModExcludeCount') }} go.mod exclude directive(s)"
+  mitigation: "Document why each excluded module version is blocked, verify the selected replacement version is safe and supported, and ensure release builds use the reviewed go.mod/go.sum pair"
+  evidence: |
+    {
+      "goModExcludeCount": $prop($, 'cdx:golem:goModExcludeCount'),
+      "excludeModule": $prop($, 'cdx:golem:excludeModule')
+    }

package/data/rules/hbom-compliance.yaml

@@ -0,0 +1,325 @@
+# HBOM Compliance and Governance Rules
+# Category: hbom-compliance
+# Evaluates hardware inventory completeness, redaction posture, and governance-ready evidence.
+
+- id: HBC-001
+  name: "HBOM inventory lacks firmware or board provenance"
+  description: "Incomplete firmware or board provenance weakens auditability for hardware refresh, attestation, and patch-governance workflows."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "CM-8 System Component Inventory"
+      - "SI-7 Software, Firmware, and Information Integrity"
+    cis-controls-v8:
+      - "1.1 Establish and Maintain Detailed Enterprise Asset Inventory"
+  condition: |
+    metadata.component[
+      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+      and $count(
+        $$.components[
+          $prop($, 'cdx:hbom:hardwareClass') = 'board'
+          and (
+            $hasProp($, 'cdx:hbom:boardVendor')
+            or $hasProp($, 'cdx:hbom:boardName')
+            or $hasProp($, 'cdx:hbom:biosVendor')
+            or $hasProp($, 'cdx:hbom:biosVersion')
+            or $hasProp($, 'cdx:hbom:firmwareDate')
+          )
+        ]
+      ) = 0
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' lacks board or firmware provenance fields needed for governance review"
+  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available."
+  evidence: |
+    {
+      "platform": $prop($, 'cdx:hbom:platform'),
+      "architecture": $prop($, 'cdx:hbom:architecture'),
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "boardComponentCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'board'])
+    }
+
+- id: HBC-002
+  name: "Managed asset identity is incomplete"
+  description: "HBOMs used for fleet governance should capture stable host identity fields such as model, platform, and serial or asset identifiers."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "CM-8 System Component Inventory"
+    cis-controls-v8:
+      - "1.1 Establish and Maintain Detailed Enterprise Asset Inventory"
+    iso-27001:
+      - "A.5.9 Inventory of information and other associated assets"
+  condition: |
+    metadata.component[
+      type = 'device'
+      and (
+        $hasProp($, 'cdx:hbom:platform') = false
+        or $hasProp($, 'cdx:hbom:architecture') = false
+        or (
+          $hasProp($, 'cdx:hbom:serialNumber') = false
+          and $hasProp($, 'cdx:hbom:platformUuid') = false
+          and $hasProp($, 'cdx:hbom:assetTag') = false
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM metadata for '{{ name }}' is missing stable asset identity fields required for governance workflows"
+  mitigation: "Capture platform, architecture, and at least one durable host identifier (serial, platform UUID, or asset tag) so the device can be reconciled with CMDB and lifecycle systems."
+  evidence: |
+    {
+      "platform": $prop($, 'cdx:hbom:platform'),
+      "architecture": $prop($, 'cdx:hbom:architecture'),
+      "serialNumber": $prop($, 'cdx:hbom:serialNumber'),
+      "platformUuid": $prop($, 'cdx:hbom:platformUuid'),
+      "assetTag": $prop($, 'cdx:hbom:assetTag')
+    }
+
+- id: HBC-003
+  name: "HBOM collector evidence is incomplete"
+  description: "Governance review is weaker when the BOM omits the collector command evidence used to derive the hardware inventory."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      type = 'device'
+      and (
+        $hasProp($$, 'cdx:hbom:evidence:commandCount') = false
+        or $number($firstNonEmpty($prop($$, 'cdx:hbom:evidence:commandCount'), '0')) = 0
+        or $hasProp($$, 'cdx:hbom:evidence:command') = false
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' is missing collector command evidence needed for reproducible review"
+  mitigation: "Retain command-evidence metadata in the distributed BOM, or attach equivalent collection provenance so reviewers can understand how the hardware inventory was derived."
+  evidence: |
+    {
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "commandCount": $prop(bom, 'cdx:hbom:evidence:commandCount'),
+      "commandEvidence": $prop(bom, 'cdx:hbom:evidence:command')
+    }
+
+- id: HBC-004
+  name: "Storage inventory lacks encryption posture evidence"
+  description: "Storage volumes without explicit encryption posture make it difficult to prove compliance with device and media protection requirements."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-28 Protection of Information at Rest"
+      - "CM-8 System Component Inventory"
+  condition: |
+    metadata.component[
+      type = 'device'
+      and $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'storage-volume']) > 0
+      and $count(
+        $$.components[
+          $prop($, 'cdx:hbom:hardwareClass') = 'storage-volume'
+          and (
+            $hasProp($, 'cdx:hbom:isEncrypted')
+            or $hasProp($, 'cdx:hbom:fileVault')
+          )
+        ]
+      ) = 0
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' includes storage volumes but no explicit encryption posture evidence"
+  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified."
+  evidence: |
+    {
+      "storageVolumeCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'storage-volume']),
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "platform": $prop($, 'cdx:hbom:platform')
+    }
+
+- id: HBC-005
+  name: "HBOM uses non-redacted identifier policy"
+  description: "HBOMs intended for broad distribution should avoid a non-redacted identifier policy unless raw identifiers are explicitly required by the receiving workflow."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      type = 'device'
+      and $hasProp($, 'cdx:hbom:identifierPolicy')
+      and $not($startsWith($lowercase($safeStr($prop($, 'cdx:hbom:identifierPolicy'))), 'redacted'))
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' uses identifier policy '{{ $prop($, 'cdx:hbom:identifierPolicy') }}' instead of a redacted posture"
+  mitigation: "Default distributed HBOMs to redacted identifiers and keep raw hardware identity values confined to internal asset-governance workflows with a documented need-to-know."
+  evidence: |
+    {
+      "identifierPolicy": $prop($, 'cdx:hbom:identifierPolicy'),
+      "serialNumber": $prop($, 'cdx:hbom:serialNumber'),
+      "platformUuid": $prop($, 'cdx:hbom:platformUuid')
+    }
+
+- id: HBC-006
+  name: "HBOM collector is missing optional enrichment commands"
+  description: "Missing native utilities reduce the hardware evidence available to governance, assurance, and troubleshooting workflows."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      type = 'device'
+      and $number($firstNonEmpty($prop($$, 'cdx:hbom:analysis:missingCommandCount'), '0')) > 0
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' reported missing native enrichment commands"
+  mitigation: "Install the reported utilities on the target host and rerun the HBOM collection so the inventory includes the richer structured hardware evidence those commands provide."
+  evidence: |
+    {
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "missingCommandCount": $prop(bom, 'cdx:hbom:analysis:missingCommandCount'),
+      "missingCommands": $propList(bom, 'cdx:hbom:analysis:missingCommands'),
+      "diagnosticIssues": $propList(bom, 'cdx:hbom:analysis:diagnosticIssues')
+    }
+
+- id: HBC-007
+  name: "HBOM collector hit permission-denied enrichments"
+  description: "Permission-sensitive enrichments that fail during collection often leave firmware, graphics, or SMBIOS evidence incomplete until the host is rerun with the documented privileged mode."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "CM-8 System Component Inventory"
+      - "SI-7 Software, Firmware, and Information Integrity"
+  condition: |
+    metadata.component[
+      type = 'device'
+      and $number($firstNonEmpty($prop($$, 'cdx:hbom:analysis:permissionDeniedCount'), '0')) > 0
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require a rerun with --privileged"
+  mitigation: "Where policy allows, rerun HBOM collection with --privileged so cdx-hbom can use the documented non-interactive sudo path for permission-sensitive Linux enrichments."
+  evidence: |
+    {
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "permissionDeniedCount": $prop(bom, 'cdx:hbom:analysis:permissionDeniedCount'),
+      "permissionDeniedCommands": $propList(bom, 'cdx:hbom:analysis:permissionDeniedCommands'),
+      "requiresPrivileged": $prop(bom, 'cdx:hbom:analysis:requiresPrivileged')
+    }
+
+- id: HBC-008
+  name: "HBOM collector is missing firmware-management enrichment"
+  description: "Without fwupd-derived metadata, governance teams lose update-protocol, firmware GUID, and device lifecycle context that is useful for firmware assurance and remediation planning."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "CM-8 System Component Inventory"
+      - "SI-7 Software, Firmware, and Information Integrity"
+  condition: |
+    metadata.component[
+      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+      and $listContains($propList($$, 'cdx:hbom:analysis:missingCommandIds'), 'fwupdmgr-devices-json')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' is missing firmware-management enrichment because fwupdmgr was unavailable"
+  mitigation: "Install fwupd on the target host and rerun the collection so the BOM can capture protocol, flags, GUIDs, and related firmware-management properties where supported."
+  evidence: |
+    {
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "missingCommandIds": $propList(bom, 'cdx:hbom:analysis:missingCommandIds'),
+      "missingCommands": $propList(bom, 'cdx:hbom:analysis:missingCommands'),
+      "installHintCount": $prop(bom, 'cdx:hbom:analysis:installHintCount')
+    }
+
+- id: HBC-009
+  name: "HBOM board and BIOS provenance was blocked by permissions"
+  description: "When dmidecode-backed firmware and board enrichment is blocked, the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "CM-8 System Component Inventory"
+      - "SI-7 Software, Firmware, and Information Integrity"
+  condition: |
+    metadata.component[
+      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+      and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because dmidecode enrichment was blocked"
+  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data."
+  evidence: |
+    {
+      "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
+      "permissionDeniedIds": $propList(bom, 'cdx:hbom:analysis:permissionDeniedIds'),
+      "permissionDeniedCommands": $propList(bom, 'cdx:hbom:analysis:permissionDeniedCommands'),
+      "boardComponentCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'board'])
+    }
+
+- id: HBC-010
+  name: "HBOM display and DRM evidence is incomplete"
+  description: "Missing EDID decoding or blocked DRM enrichment reduces the fidelity of display, connector, and content-protection metadata used during workstation and kiosk governance reviews."
+  severity: medium
+  category: hbom-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[
+      $count(
+        $$.components[
+          $prop($, 'cdx:hbom:hardwareClass') = 'display-connector'
+          or $prop($, 'cdx:hbom:hardwareClass') = 'display-adapter'
+        ]
+      ) > 0
+      and (
+        $listContains($propList($$, 'cdx:hbom:analysis:missingCommandIds'), 'edid-decode')
+        or $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'drm-info-json')
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "HBOM for '{{ name }}' includes display hardware but the richer DRM or EDID evidence is incomplete"
+  mitigation: "Install edid-decode where available and, if policy permits, rerun with --privileged so the collector can capture connector, mode, and content-protection metadata for Linux displays."
+  evidence: |
+    {
+      "displayComponentCount": $count(
+        $$.components[
+          $prop($, 'cdx:hbom:hardwareClass') = 'display-connector'
+          or $prop($, 'cdx:hbom:hardwareClass') = 'display-adapter'
+        ]
+      ),
+      "missingCommandIds": $propList(bom, 'cdx:hbom:analysis:missingCommandIds'),
+      "permissionDeniedIds": $propList(bom, 'cdx:hbom:analysis:permissionDeniedIds')
+    }