@cdxgen/cdxgen 13.0.1 → 13.1.0

package/data/remediations.json

@@ -0,0 +1,1144 @@
+{
+  "jvm.maven.build-first": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Maven could not resolve dependencies; build the project before invoking cdxgen",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "java",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install java {{version}}",
+        "windows": "winget install --id EclipseAdoptium.Temurin.{{major}}.JDK"
+      },
+      {
+        "kind": "install",
+        "tool": "maven",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install maven {{version}}",
+        "windows": "winget install --id Apache.Maven"
+      },
+      {
+        "kind": "build",
+        "command": "{{mvn}} -q package -DskipTests"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001",
+        "BF-JVM-002"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.maven.manifest-fallback": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Maven build failed; only the direct dependencies declared in pom.xml were captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "java",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install java {{version}}",
+        "windows": "winget install --id EclipseAdoptium.Temurin.{{major}}.JDK"
+      },
+      {
+        "kind": "install",
+        "tool": "maven",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install maven {{version}}",
+        "windows": "winget install --id Apache.Maven"
+      },
+      {
+        "kind": "build",
+        "command": "{{mvn}} -q package -DskipTests"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001",
+        "BF-JVM-002"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.maven.tree-unparseable": {
+    "ecosystem": "java",
+    "kind": "command.failed",
+    "impact": "transitive-deps",
+    "title": "Maven dependency:tree JSON output could not be parsed",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "maven",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install maven {{version}}",
+        "windows": "winget install --id Apache.Maven"
+      },
+      {
+        "kind": "build",
+        "command": "{{mvn}} -q package -DskipTests"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001",
+        "BF-JVM-002"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.gradle.unresolved-config": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Gradle resolved no dependency configuration; project components carry no resolved dependencies",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "gradle",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install gradle {{version}}",
+        "windows": "winget install --id Gradle.Gradle"
+      },
+      {
+        "kind": "build",
+        "command": "{{gradle}} -q build"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001",
+        "BF-JVM-002"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.gradle.invocation-failed": {
+    "ecosystem": "java",
+    "kind": "command.failed",
+    "impact": "transitive-deps",
+    "title": "The gradle invocation failed outright; gradle produced no dependency evidence at all",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "java",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install java {{version}}",
+        "windows": "winget install --id EclipseAdoptium.Temurin.{{major}}.JDK"
+      },
+      {
+        "kind": "install",
+        "tool": "gradle",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install gradle {{version}}",
+        "windows": "winget install --id Gradle.Gradle"
+      },
+      {
+        "kind": "build",
+        "command": "{{gradle}} -q build"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-GEN-006"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.jar.heuristic": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "versions",
+    "title": "Components were inferred by scanning jar/war/ear files from disk",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{mvn}} -q package -DskipTests"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-003"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.sbt.project-discovery": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "components",
+    "title": "sbt project discovery fell back to the build-file heuristic",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "sbt",
+        "versionFrom": "expected",
+        "via": "sdkman",
+        "command": "sdk install sbt {{version}}",
+        "windows": "winget install --id sbt.sbt"
+      },
+      {
+        "kind": "build",
+        "command": "sbt -batch compile"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "jvm.sbt.no-lockfile": {
+    "ecosystem": "java",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "sbt build failed; a build.sbt.lock would keep the SBOM deterministic",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Enable sbt dependency locking so the build writes build.sbt.lock"
+      },
+      {
+        "kind": "build",
+        "command": "sbt -batch compile"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JVM-001"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
+  "js.no-lockfile": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "No JavaScript lockfile was found; the SBOM is non-deterministic",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "npm install --package-lock-only"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JS-001",
+        "BF-JS-002"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "js.git-dependency": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "integrity",
+    "title": "npm install may fetch git dependencies without integrity guarantees",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Re-run with the git command permitted for this trusted project by adding it to CDXGEN_ALLOWED_COMMANDS",
+        "windows": "The same CDXGEN_ALLOWED_COMMANDS variable applies on Windows"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.git-dependency"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "js.no-node-modules": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "node_modules is absent and no install was attempted",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "npm install"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-JS-001"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "js.lockfile-version": {
+    "ecosystem": "npm",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "package-lock.json could not be parsed with current npm semantics",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "npm",
+        "versionFrom": "latest",
+        "via": "npm",
+        "command": "npm install -g npm@latest",
+        "windows": "npm install -g npm@latest"
+      },
+      {
+        "kind": "build",
+        "command": "npm install --package-lock-only"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.lockfile-version"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "js.pnpm-lock-unparseable": {
+    "ecosystem": "npm",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "pnpm-lock.yaml could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "pnpm",
+        "versionFrom": "latest",
+        "via": "npm",
+        "command": "npm install -g pnpm@latest",
+        "windows": "npm install -g pnpm@latest"
+      },
+      {
+        "kind": "build",
+        "command": "pnpm install"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "js.pnpm-lock-unparseable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.lockfile-unparseable": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The python lock file could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{pythonManager}} lock"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "python.lockfile-unparseable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.pyproject-unparseable": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The pyproject.toml could not be parsed, so the workspace structure was not reconstructed",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Check the file with a TOML 1.0 validator. cdxgen's TOML parser predates TOML 1.0 and rejects arrays that mix inline tables with strings, which PEP 735 `dependency-groups` produce when they use `include-group`."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "python.pyproject-unparseable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.lockfile-unparseable.uv": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The uv lock file could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "uv",
+        "versionFrom": "latest",
+        "via": "pip",
+        "command": "pip install uv",
+        "windows": "pip install uv"
+      },
+      {
+        "kind": "build",
+        "command": "{{pythonManager}} lock"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "python.lockfile-unparseable.uv"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.lockfile-unparseable.poetry": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The poetry lock file could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "poetry",
+        "versionFrom": "latest",
+        "via": "pip",
+        "command": "pip install poetry",
+        "windows": "pip install poetry"
+      },
+      {
+        "kind": "build",
+        "command": "{{pythonManager}} lock --no-interaction"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "python.lockfile-unparseable.poetry"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.lockfile-unparseable.pdm": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The pdm lock file could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "pdm",
+        "versionFrom": "latest",
+        "via": "pip",
+        "command": "pip install pdm",
+        "windows": "pip install pdm"
+      },
+      {
+        "kind": "build",
+        "command": "{{pythonManager}} lock"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "python.lockfile-unparseable.pdm"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "python.lockfile-unparseable.pipenv": {
+    "ecosystem": "python",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The Pipfile.lock could not be parsed",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "pipenv",
+        "versionFrom": "latest",
+        "via": "pip",
+        "command": "pip install pipenv",
+        "windows": "pip install pipenv"
+      },
+      {
+        "kind": "build",
+        "command": "{{pythonManager}} lock"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "python.lockfile-unparseable.pipenv"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "clojure.lein.missing": {
+    "ecosystem": "clojure",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "lein is unavailable; project.clj was parsed manually",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "lein",
+        "versionFrom": "latest",
+        "via": "manual",
+        "command": "Install leiningen following https://codeberg.org/leiningen/leiningen#installation",
+        "windows": "Download the lein.bat script from the leiningen repository into a PATH directory"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "clojure.lein.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "clojure.cli.missing": {
+    "ecosystem": "clojure",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "clojure CLI is unavailable; deps.edn was parsed manually",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "clojure",
+        "versionFrom": "latest",
+        "via": "manual",
+        "command": "Install the Clojure CLI following https://clojure.org/guides/install_clojure",
+        "windows": null,
+        "windowsReason": "The Clojure CLI ships a separate Windows installer; prefer the cdxgen container image there"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "clojure.cli.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "swift.toolchain.missing": {
+    "ecosystem": "swift",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Swift toolchain could not resolve the package graph",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t swift /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t swift %cd%"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-SWIFT-001"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "swift.package-command": {
+    "ecosystem": "swift",
+    "kind": "command.failed",
+    "impact": "transitive-deps",
+    "title": "swift package resolve did not produce a Package.resolved file",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "swift package resolve"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "swift.package-command"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "dotnet.sdk.missing": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": ".NET SDK is not installed, so dotnet slices are degraded",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t csharp /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t csharp %cd%"
+      },
+      {
+        "kind": "install",
+        "tool": "dotnet",
+        "versionFrom": "expected",
+        "via": "manual",
+        "command": "Install the .NET SDK {{version}} from https://dotnet.microsoft.com/download",
+        "windows": "winget install --id Microsoft.DotNet.SDK.{{major}}"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dotnet.sdk.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "cocoa.pods.missing": {
+    "ecosystem": "cocoa",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "cocoapods is unavailable; the pod graph was not resolved",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t cocoa /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t cocoa %cd%"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "cocoa.pods.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "ruby.build-deps.missing": {
+    "ecosystem": "ruby",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "Building the required Ruby version needs development libraries",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t ruby /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t ruby %cd%"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "ruby.build-deps.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "ruby.version.unsupported-host": {
+    "ecosystem": "ruby",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The required Ruby version needs a specific base image to build",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t ruby /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t ruby %cd%"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "ruby.version.unsupported-host"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "go.toolchain.missing": {
+    "ecosystem": "go",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "The go toolchain could not be executed, so the module graph was not resolved",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t go /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t go %cd%"
+      },
+      {
+        "kind": "install",
+        "tool": "go",
+        "versionFrom": "latest",
+        "via": "manual",
+        "command": "Install Go following https://go.dev/dl/",
+        "windows": "winget install --id GoLang.Go"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "go.toolchain.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=go"
+  },
+  "go.mod-only-fallback": {
+    "ecosystem": "go",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "go.mod was parsed manually because the go toolchain could not resolve the module graph",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "go",
+        "versionFrom": "expected",
+        "via": "manual",
+        "command": "Install the Go version pinned in go.mod following https://go.dev/dl/",
+        "windows": "winget install --id GoLang.Go"
+      },
+      {
+        "kind": "build",
+        "command": "{{go}} mod download"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-GEN-001"
+      ],
+      "expectTier": "resolved"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=go"
+  },
+  "rust.toolchain.missing": {
+    "ecosystem": "rust",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "cargo could not be executed, so the lock file could not be generated",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "container",
+        "image": "ghcr.io/cyclonedx/cdxgen",
+        "command": "docker run --rm -v \"$PWD:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t rust /app",
+        "windows": "docker run --rm -v \"%cd%:/app\" -w /app ghcr.io/cyclonedx/cdxgen -t rust %cd%"
+      },
+      {
+        "kind": "install",
+        "tool": "rust",
+        "versionFrom": "latest",
+        "via": "manual",
+        "command": "Install rustup following https://rustup.rs",
+        "windows": "winget install --id Rustlang.Rustup"
+      },
+      {
+        "kind": "build",
+        "command": "{{cargo}} generate-lockfile"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "lockfile",
+      "eventsCleared": [
+        "rust.toolchain.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
+  },
+  "rust.cargo-lock-missing": {
+    "ecosystem": "rust",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "No Cargo.lock was found, so components carry the manifest's declared dependencies without locked versions",
+    "targetTier": "lockfile",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{cargo}} generate-lockfile"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-GEN-001",
+        "BF-RS-001"
+      ],
+      "expectTier": "lockfile"
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=rust"
+  },
+  "php.composer.missing": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "composer is unavailable, so composer.lock could not be generated",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "install",
+        "tool": "composer",
+        "versionFrom": "latest",
+        "via": "manual",
+        "command": "Install Composer following https://getcomposer.org/doc/00-intro.md",
+        "windows": "winget install --id Composer.Composer"
+      },
+      {
+        "kind": "build",
+        "command": "{{composer}} install --ignore-platform-reqs"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "php.composer.missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
+  "php.no-lockfile": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "No composer.lock was found or generated, so the Composer components could not be captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{composer}} install --ignore-platform-reqs"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "php.no-lockfile"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
+  "dart.pub-get-needed": {
+    "ecosystem": "dart",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "pubspec.yaml was parsed without pubspec.lock, so components carry version constraints instead of locked versions",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{dart}} pub get"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [
+        "BF-GEN-002"
+      ],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "dart.pub-get-needed"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=dart"
+  },
+  "elixir.deps-not-fetched": {
+    "ecosystem": "elixir",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "mix.exs was found without mix.lock, so the Hex dependencies were not captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{mix}} deps get"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "elixir.deps-not-fetched"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=elixir"
+  },
+  "haskell.freeze-missing": {
+    "ecosystem": "haskell",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "No cabal.project.freeze was found, so the Hackage package set was not captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "build",
+        "command": "{{cabal}} freeze"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "haskell.freeze-missing"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=haskell"
+  },
+  "binary.paths.inferred": {
+    "ecosystem": "generic",
+    "kind": "fallback.engaged",
+    "impact": "none",
+    "title": "Image config carried no PATH; binary directories were inferred from disk",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Rebuild the image with an explicit PATH in the image config so binary directories are read instead of inferred"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "binary.paths.inferred"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "policy.secure-mode": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "A policy restriction prevented command execution",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Set CDXGEN_ALLOWED_COMMANDS to the exact commands this project's build needs and re-run",
+        "windows": "The same CDXGEN_ALLOWED_COMMANDS variable applies on Windows"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.secure-mode"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "policy.host-blocked": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "licenses",
+    "title": "A remote host was blocked by the host allow-list",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Add the registry host that the run needed to CDXGEN_ALLOWED_HOSTS and re-run"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.host-blocked"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "policy.dry-run": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "none",
+    "title": "Dry-run mode short-circuited an action",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Re-run without the --dry-run option to generate the full BOM"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.dry-run"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "policy.offline": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "licenses",
+    "title": "A network request failed with a transport error",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Restore network access or point the registry environment variables at a reachable mirror, then re-run"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.offline"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  }
+}