@cdxgen/cdxgen 13.2.0 → 13.3.0

package/README.md

@@ -41,7 +41,7 @@ Supported output document formats:
 | **Build engineers**   | Grade how completely the SBOM captured the project, and get ranked fixes when the build environment degraded it      | `cdxgen --profile introspect --introspect-fail-below 70 -o bom.json .`     | [Build Introspection](docs/INTROSPECTION.md), [Fidelity loop skill](.agents/skills/sbom-fidelity-loop/SKILL.md) |
 | **SOC analysts**      | Build OBOM inventories for live hosts and triage runtime posture issues                                              | `obom -o obom.json --deep --bom-audit --bom-audit-categories obom-runtime` | [OBOM lessons](docs/OBOM_LESSONS.md), [Server Usage][docs-server]                                               |
 | **Compliance teams**  | Validate BOM quality, check SCVS/CRA posture, and export SPDX deliverables                                           | `cdx-validate -i bom.json --benchmark scvs-l2,cra`                         | [cdx-validate](docs/CDX_VALIDATE.md), [cdx-convert](docs/CDX_CONVERT.md), [Permissions][docs-permissions]       |
-| **Security Teams**    | Dynamically trace executions to capture cryptographic activities, CBOM properties, software components, and services | `tracebom --cbom-output cbom.json -- npm test`                             | [Threat Model](docs/THREAT_MODEL.md)                                                                            |
+| **Security Teams**    | Dynamically trace executions to capture cryptographic activities, CBOM properties, software components, and services | `tracebom --cmd "npm test" --trace-crypto -o cbom.json`                    | [Threat Model](docs/THREAT_MODEL.md)                                                                            |
 
 ### Role-based quick starts
 
@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.2.0"
+VERSION="v13.3.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.2.0"
+VERSION="v13.3.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.2.0"
+$Version = "v13.3.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.2.0 \
+      gh release download v13.3.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -391,7 +391,7 @@ import { createBom, submitBom } from "npm:@cdxgen/cdxgen@^13";
 | Generate a BOM from the current repository                 | `cdxgen -o bom.json .`                                                                                      | [CLI Usage][docs-cli]                           |
 | Generate a BOM from a git URL                              | `cdxgen -o bom.json https://github.com/example/project.git`                                                 | [CLI Usage][docs-cli]                           |
 | Generate a BOM from a package URL                          | `cdxgen -o bom.json "pkg:npm/lodash@4.17.21"`                                                               | [CLI Usage][docs-cli]                           |
-| Generate a dynamically traced CBOM for an application      | `tracebom --cbom-output cbom.json -- npm test`                                                              | [Threat Model](docs/THREAT_MODEL.md)            |
+| Generate a dynamically traced CBOM for an application      | `tracebom --cmd "npm test" --trace-crypto -o cbom.json`                                                     | [Threat Model](docs/THREAT_MODEL.md)            |
 | Generate and audit an AI-BOM from the current repository   | `cdxgen -r --include-formulation -o aibom.json --bom-audit --bom-audit-categories ai-bom .`                 | [AI-BOM Guide](docs/AI_BOM.md)                  |
 | Scan a container image                                     | `cdxgen ghcr.io/owasp-dep-scan/depscan:nightly -o bom.json -t docker`                                       | [Server Usage][docs-server]                     |
 | Audit a generated BOM for built-in supply-chain findings   | `cdxgen -o bom.json --bom-audit .`                                                                          | [BOM Audit](docs/BOM_AUDIT.md)                  |
@@ -683,6 +683,17 @@ systemctl --user start podman.socket
 podman system service -t 0 &
 ```
 
+### WSL Containers (wslc) on Windows
+
+On Windows, Docker Desktop is optional when [WSL Containers][wsl-containers-docs] is available. cdxgen automatically uses the `wslc` CLI (included with WSL 2.9.3 or higher) to pull, inspect, and export images whenever the docker CLI is not installed, so image scans such as the below work with just WSL:
+
+```shell
+wsl --update
+cdxgen alpine:latest -t oci -o bom.json
+```
+
+Set `DOCKER_CMD=wslc` to prefer wslc even when a docker CLI is installed. See [Generating container SBOM on Windows](./ADVANCED.md#generating-container-sbom-on-windows) for requirements, including the nested virtualization needed when Windows itself runs inside a VM.
+
 ## Generate OBOM for a live system
 
 You can use the `obom` command to generate an OBOM for a live system or a VM for compliance and vulnerability management purposes. Linux, Windows, and macOS are supported in this mode, though some macOS tables require elevated privileges and Full Disk Access.
@@ -732,12 +743,16 @@ cdxgen features a best-in-class, native **JSON Signature Format (JSF)** implemen
 
 To enable automatic signing during BOM generation, set the following environment variables:
 
-- `SBOM_SIGN_ALGORITHM`: JSF Algorithm. Examples: `RS512`, `ES256`, `Ed25519`, `HS256`
-- `SBOM_SIGN_PRIVATE_KEY`: Location of the private key (PEM format)
-- `SBOM_SIGN_PUBLIC_KEY`: Optional. Location of the public key
+- `SBOM_SIGN_ALGORITHM`: JSF Algorithm. Examples: `RS512`, `ES256`, `Ed25519`, `HS256`. It must match the key type.
+- `SBOM_SIGN_PRIVATE_KEY`: Location of the private key (PEM format), or of the shared secret for `HS256`, `HS384`, and `HS512`
+- `SBOM_SIGN_PUBLIC_KEY`: Optional. Location of the public key to embed. It must belong to the private key.
 - `SBOM_SIGN_MODE`: Optional. Signature mode (`replace`, `signers`, `chain`). Default is `replace`.
 
-To quickly generate test public/private key pairs and sign your first BOM, you can run cdxgen with the `--generate-key-and-sign` argument.
+To quickly generate a test key pair for `SBOM_SIGN_ALGORITHM` and sign your first BOM, you can run cdxgen with the `--generate-key-and-sign` argument.
+
+When signing is configured (`SBOM_SIGN_ALGORITHM` plus a private key), cdxgen signs the BOM it writes, prints, or submits to Dependency-Track, and exits with status 1 if it cannot sign it, including when the key file is missing. A private key without `SBOM_SIGN_ALGORITHM` leaves the BOM unsigned and prints a warning; set `SBOM_SIGN_ALGORITHM=none` to opt out explicitly.
+
+BOMs signed with cdxgen 13.2.0 or earlier must be re-signed with the current `cdx-sign` before they verify. See [cdx-sign](docs/CDX_SIGN.md#re-signing-boms-from-earlier-releases).
 
 ### Advanced Signing with `cdx-sign`
 
@@ -785,7 +800,7 @@ pnpm dlx @cdxgen/cdxgen cdx-sign -i bom.json -k private.key
 
 ## Automatic usage detection
 
-For node.js projects, lock files are parsed initially, so the SBOM would include all dependencies, including dev ones. An AST parser powered by babel-parser is then used to detect packages that are imported and used by non-test code. Such imported packages would automatically set their scope property to `required` in the resulting SBOM. You can turn off this analysis by passing the argument `--no-babel`. Scope property would then be set based on the `dev` attribute in the lock file.
+For node.js projects, lock files are parsed initially, so the SBOM would include all dependencies, including dev ones. An AST parser powered by babel-parser is then used to detect packages that are imported and used by non-test code. Such imported packages would automatically set their scope property to `required` in the resulting SBOM. A package with no observed usage keeps the scope from the lock file, since packages loaded from configuration, bundler entrypoints, stylesheets, or plugins are invisible to import analysis. A package imported only for its TypeScript types is scoped `excluded`, and a package that only such packages depend on is scoped `optional`. You can turn off this analysis by passing the argument `--no-babel`. Scope property would then be set based on the `dev` attribute in the lock file.
 
 Single-file component frameworks are handled natively by this analysis: `.vue` and `.svelte` templates are segmented position-preservingly so script imports recover with correct file and line evidence. For Svelte and SvelteKit, framework usage signals are additionally collected — SvelteKit virtual modules such as `$app/stores` are attributed to `@sveltejs/kit`, `$lib/*` imports resolve through `kit.alias`, `svelte.config.js` adapters and preprocessors, CSS preprocessor packages implied by `<style lang="...">` blocks together with their `@use`/`@import` package references, npm script executables such as `svelte-kit sync` and `svelte-check`, and rune usage (`$state`, `$derived`, ...) which marks `svelte` required even in components that never import it. This works in every installation; when the optional `@appthreat/atom-parsetools` package is present, template expressions also contribute usage occurrences.
 
@@ -793,7 +808,7 @@ This attribute can be later used for various purposes. For example, [dep-scan][d
 
 With the argument `--required-only`, you can limit the SBOM only to include packages with the scope "required", commonly called production or non-dev dependencies. Combine with `--no-babel` to limit this list to only non-dev dependencies based on the `dev` attribute being false in the lock files.
 
-For go, `go mod why` command is used to identify required packages. For php, composer lock file is parsed to distinguish required (packages) from optional (packages-dev).
+For go, `go list -deps` lists the modules the project's packages import, and a module is scoped `required` when go.mod requires it directly and `optional` when the requirement is `// indirect`. With `USE_GOSUM=true`, `go mod why` scopes each go.sum module instead: `required` when the main module needs it, and `optional` when go reports that it does not. If `go mod why` fails, no module is scoped `optional`. For php, composer lock file is parsed to distinguish required (packages) from optional (packages-dev).
 
 ## Automatic services detection
 
@@ -981,4 +996,5 @@ Copy the below block to your markdown files to show your ❤️ for cdxgen.
 [npmjs-cdxgen-v12]: https://www.npmjs.com/package/@cyclonedx/cdxgen
 [podman-github-rootless]: https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md
 [podman-github-remote]: https://github.com/containers/podman/blob/master/docs/tutorials/mac_win_client.md
+[wsl-containers-docs]: https://learn.microsoft.com/en-us/windows/wsl/wsl-container
 [swh-cdxgen]: https://archive.softwareheritage.org/browse/origin/?origin_url=https://github.com/cdxgen/cdxgen

package/bin/cdxgen.js

@@ -72,7 +72,11 @@ import {
   setDryRunMode,
   shouldRunPredictiveBomAudit,
 } from "../lib/ecosystems/utils.js";
-import { signBom, verifyBom } from "../lib/helpers/bomSigner.js";
+import {
+  generateSigningKeyPair,
+  signBom,
+  verifyBom,
+} from "../lib/helpers/bomSigner.js";
 import {
   createOutputPlan,
   getOutputDirectory,
@@ -81,7 +85,6 @@ import {
   DEFAULT_CDX_SPEC_VERSION,
   getSupportedCycloneDxComponentTypes,
   isCycloneDxBom,
-  isCycloneDxComponentTypeEnabled,
   normalizeCycloneDxComponentTypeFilter,
   toCycloneDxSpecVersionString,
 } from "../lib/inventory/bomUtils.js";
@@ -164,6 +167,11 @@ for (const configPattern of PROJECT_CONFIG_FILENAMES) {
         `Config file '${configPath}' sets '${foundKey}'. Verify this is intentional.`,
       );
     }
+    for (const propertyName of sanitized.reservedProperties) {
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' sets the metadata property '${propertyName}', whose namespace cdxgen reserves for its own findings. Ignoring it. Pass the property with --metadata-property if this is intentional.\x1b[0m`,
+      );
+    }
   } catch (_e) {
     console.log("Invalid config file", configPath);
   }
@@ -252,6 +260,16 @@ const args = _yargs
     description:
       "Perform deep searches for components. Useful while scanning C/C++ apps, live OS and oci images.",
   })
+  .option("cmake-cache", {
+    type: "string",
+    description:
+      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup under build/, out/ and cmake-build-*/.",
+  })
+  .option("compile-commands", {
+    type: "string",
+    description:
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+  })
   .option("git-branch", {
     description: "Git branch to clone when the source is a git URL or purl",
     type: "string",
@@ -399,7 +417,7 @@ const args = _yargs
   .option("generate-key-and-sign", {
     type: "boolean",
     description:
-      "Generate an RSA public/private key pair and then sign the generated SBOM using JSON Web Signatures.",
+      "Generate a public/private key pair for SBOM_SIGN_ALGORITHM (RS512 by default) and then sign the generated SBOM using the JSON Signature Format (JSF).",
   })
   .option("server", {
     type: "boolean",
@@ -565,6 +583,11 @@ const args = _yargs
     default: false,
     description: "Disable default ignore lists during scanning.",
   })
+  .option("caxa-app-dir", {
+    type: "string",
+    description:
+      "Directory of the app a caxa binary extracts. With -t caxa, also records the native tools, the vendored PHP, Ruby and Java packages, and the npm integrity hashes found there.",
+  })
   .option("export-proto", {
     type: "boolean",
     default: false,
@@ -605,6 +628,12 @@ const args = _yargs
     default: false,
     description: "Synthesize custom LicenseRef IDs for unresolved licenses.",
   })
+  .option("metadata-property", {
+    description:
+      "Custom property to add to the BOM metadata, as name=value. Repeat the flag for several properties. Combined with the properties of the CDXGEN_METADATA_PROPERTIES environment variable and of a config file.",
+    nargs: 1,
+    type: "array",
+  })
   .option("standard", {
     description:
       "The list of standards which may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to.",
@@ -1047,6 +1076,7 @@ const { options, warnings: phase3Warnings } = buildOptionsFromArgs(args, {
   userSetSpecVersion,
   isDryRun,
   isSecureMode,
+  projectConfig: config,
 });
 // Exit status reserved for the introspection CI gate: the BOM was generated
 // and written, but its introspection score missed the configured threshold.
@@ -1410,6 +1440,8 @@ const checkPermissions = (filePath, options) => {
   return true;
 };
 
+let warnedAboutSigningAlgorithm = false;
+
 const needsBomSigning = ({ generateKeyAndSign }) =>
   generateKeyAndSign ||
   (() => {
@@ -1427,11 +1459,19 @@ const needsBomSigning = ({ generateKeyAndSign }) =>
         sensitive: true,
       },
     );
-    return (
-      sbomSignAlgorithm &&
-      sbomSignAlgorithm !== "none" &&
-      ((sbomSignPrivateKey && safeExistsSync(sbomSignPrivateKey)) ||
-        sbomSignPrivateKeyBase64)
+    const keyConfigured = Boolean(
+      sbomSignPrivateKey || sbomSignPrivateKeyBase64,
+    );
+    if (keyConfigured && !sbomSignAlgorithm && !warnedAboutSigningAlgorithm) {
+      warnedAboutSigningAlgorithm = true;
+      console.warn(
+        "SBOM_SIGN_PRIVATE_KEY is set without SBOM_SIGN_ALGORITHM, so the BOM is not signed. Set SBOM_SIGN_ALGORITHM (for example RS512) to sign it, or SBOM_SIGN_ALGORITHM=none to silence this warning.",
+      );
+    }
+    // A configured key file that is missing counts as a signing request, so
+    // that signing fails loudly instead of being skipped.
+    return Boolean(
+      sbomSignAlgorithm && sbomSignAlgorithm !== "none" && keyConfigured,
     );
   })();
 
@@ -1440,28 +1480,20 @@ const stringifyJson = (jsonPayload, jsonPretty) =>
     ? jsonPayload
     : JSON.stringify(jsonPayload, null, jsonPretty ? 2 : null);
 
-const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
-  const jsonPayload = stringifyJson(bomJson, options.jsonPretty);
-  safeWriteSync(jsonFile, jsonPayload);
-  if (jsonFile.endsWith("bom.json")) {
-    thoughtLog(
-      `Let's save the file to "${jsonFile}". Should I suggest the '.cdx.json' file extension for better semantics?`,
-    );
-  } else {
-    thoughtLog(`Let's save the file to "${jsonFile}".`);
-  }
-  if (!jsonPayload || !needsBomSigning(options)) {
-    return jsonPayload;
-  }
-  if (isDryRun) {
-    recordActivity({
-      kind: "sign",
-      reason: "Dry run mode skips BOM signing and key generation.",
-      status: "blocked",
-      target: jsonFile,
-    });
-    return jsonPayload;
-  }
+const SIGNING_HINT =
+  "Check that the private key is in PEM format and that SBOM_SIGN_ALGORITHM matches its key type.";
+
+/**
+ * Signs a CycloneDX payload with the configured or generated key.
+ *
+ * @param {string} jsonPayload Serialized CycloneDX BOM
+ * @param {string|undefined} keyDir Directory for --generate-key-and-sign keys
+ * @param {string} target Output the signed BOM is written to (for the activity log)
+ * @param {Object} options CLI options
+ * @returns {Object} Signed BOM
+ * @throws {Error} When signing was requested but cannot be completed
+ */
+const signCycloneDxPayload = (jsonPayload, keyDir, target, options) => {
   const sbomSignAlgorithm = readEnvironmentVariable("SBOM_SIGN_ALGORITHM");
   const sbomSignPrivateKey = readEnvironmentVariable("SBOM_SIGN_PRIVATE_KEY", {
     sensitive: true,
@@ -1476,29 +1508,20 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   const sbomSignPublicKeyBase64 = readEnvironmentVariable(
     "SBOM_SIGN_PUBLIC_KEY_BASE64",
   );
-  let alg = sbomSignAlgorithm || "RS512";
-  if (alg.includes("none")) {
-    alg = "RS512";
-  }
+  const alg = sbomSignAlgorithm || "RS512";
   let privateKeyToUse;
   let jwkPublicKey;
   let publicKeyFile;
   if (options.generateKeyAndSign) {
-    const jdirName = dirname(jsonFile);
-    publicKeyFile = join(jdirName, "public.key");
-    const privateKeyFile = join(jdirName, "private.key");
-    const privateKeyB64File = join(jdirName, "private.key.base64");
-    const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
-      modulusLength: 4096,
-      publicKeyEncoding: {
-        type: "spki",
-        format: "pem",
-      },
-      privateKeyEncoding: {
-        type: "pkcs8",
-        format: "pem",
-      },
-    });
+    if (!keyDir) {
+      throw new Error(
+        "--generate-key-and-sign needs a file output (-o) to write the generated keys next to.",
+      );
+    }
+    publicKeyFile = join(keyDir, "public.key");
+    const privateKeyFile = join(keyDir, "private.key");
+    const privateKeyB64File = join(keyDir, "private.key.base64");
+    const { privateKey, publicKey } = generateSigningKeyPair(alg);
     safeWriteSync(publicKeyFile, publicKey);
     safeWriteSync(privateKeyFile, privateKey);
     safeWriteSync(
@@ -1515,69 +1538,129 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     jwkPublicKey = crypto.createPublicKey(publicKey).export({ format: "jwk" });
   } else {
     if (sbomSignPrivateKey) {
+      if (!safeExistsSync(sbomSignPrivateKey)) {
+        throw new Error(
+          `The SBOM_SIGN_PRIVATE_KEY file '${sbomSignPrivateKey}' was not found.`,
+        );
+      }
       recordSensitiveFileRead(sbomSignPrivateKey, {
         label: "SBOM signing private key",
       });
-      privateKeyToUse = fs.readFileSync(sbomSignPrivateKey, "utf8");
+      privateKeyToUse = fs.readFileSync(sbomSignPrivateKey);
     } else if (sbomSignPrivateKeyBase64) {
-      privateKeyToUse = Buffer.from(
-        sbomSignPrivateKeyBase64,
-        "base64",
-      ).toString("utf8");
+      privateKeyToUse = Buffer.from(sbomSignPrivateKeyBase64, "base64");
     }
     if (sbomSignPublicKey && safeExistsSync(sbomSignPublicKey)) {
       jwkPublicKey = crypto
         .createPublicKey(fs.readFileSync(sbomSignPublicKey, "utf8"))
         .export({ format: "jwk" });
     } else if (sbomSignPublicKeyBase64) {
-      jwkPublicKey = Buffer.from(sbomSignPublicKeyBase64, "base64").toString(
-        "utf8",
+      jwkPublicKey = crypto
+        .createPublicKey(Buffer.from(sbomSignPublicKeyBase64, "base64"))
+        .export({ format: "jwk" });
+    }
+  }
+  thoughtLog(`Signing the BOM for "${target}".`);
+  const signedBom = signBom(JSON.parse(jsonPayload), {
+    privateKey: privateKeyToUse,
+    algorithm: alg,
+    publicKeyJwk: jwkPublicKey,
+    mode: readEnvironmentVariable("SBOM_SIGN_MODE") || "replace",
+    signComponents: true,
+    signServices: true,
+    signAnnotations: true,
+  });
+  if (publicKeyFile) {
+    if (!verifyBom(signedBom, fs.readFileSync(publicKeyFile, "utf8"))) {
+      throw new Error(
+        `The new signature does not verify with ${publicKeyFile}.`,
       );
     }
+    console.log(
+      "SBOM signature is verifiable natively with the public key and the algorithm",
+      publicKeyFile,
+      alg,
+    );
+  }
+  recordActivity({
+    kind: "sign",
+    status: "completed",
+    target,
+  });
+  return signedBom;
+};
+
+/**
+ * Signs the BOM for an output when signing is configured. A failure is
+ * recorded and returned so that the caller can stop with a non-zero exit
+ * instead of publishing an unsigned BOM.
+ *
+ * @returns {{ bomJson: Object, jsonPayload: string, signingError?: Error }}
+ */
+const signForOutput = (bomJson, jsonPayload, keyDir, target, options) => {
+  if (!jsonPayload || !needsBomSigning(options)) {
+    return { bomJson, jsonPayload };
+  }
+  if (isDryRun) {
+    recordActivity({
+      kind: "sign",
+      reason: "Dry run mode skips BOM signing and key generation.",
+      status: "blocked",
+      target,
+    });
+    return { bomJson, jsonPayload };
   }
   try {
-    const bomJsonUnsignedObj = JSON.parse(jsonPayload);
-    const signOptions = {
-      privateKey: privateKeyToUse,
-      algorithm: alg,
-      publicKeyJwk: jwkPublicKey,
-      mode: readEnvironmentVariable("SBOM_SIGN_MODE") || "replace",
-      signComponents: true,
-      signServices: true,
-      signAnnotations: true,
+    const signedBom = signCycloneDxPayload(
+      jsonPayload,
+      keyDir,
+      target,
+      options,
+    );
+    return {
+      bomJson: signedBom,
+      jsonPayload: JSON.stringify(
+        signedBom,
+        null,
+        options.jsonPretty ? 2 : null,
+      ),
     };
-    thoughtLog(`Signing the BOM file "${jsonFile}".`);
+  } catch (err) {
     recordActivity({
       kind: "sign",
-      status: "completed",
-      target: jsonFile,
+      reason: err.message,
+      status: "failed",
+      target,
     });
-    const signedBom = signBom(bomJsonUnsignedObj, signOptions);
-    safeWriteSync(
-      jsonFile,
-      JSON.stringify(signedBom, null, options.jsonPretty ? 2 : null),
-    );
-    if (publicKeyFile) {
-      const publicKeyStr = fs.readFileSync(publicKeyFile, "utf8");
-      const signatureVerification = verifyBom(signedBom, publicKeyStr);
-      if (signatureVerification) {
-        console.log(
-          "SBOM signature is verifiable natively with the public key and the algorithm",
-          publicKeyFile,
-          alg,
-        );
-      } else {
-        console.log("SBOM signature verification was unsuccessful");
-        console.log("Check if the public key was exported in PEM format");
-      }
-    }
-  } catch (ex) {
-    console.log("SBOM signing was unsuccessful:", ex.message);
-    console.log(
-      "Check if the private key was exported in PEM format and the algorithm is JSF-compliant.",
+    return { bomJson, jsonPayload, signingError: err };
+  }
+};
+
+const reportSigningFailure = (signingError, target) => {
+  console.error(`SBOM signing was unsuccessful: ${signingError.message}`);
+  console.error(SIGNING_HINT);
+  if (target !== "stdout") {
+    console.error(`The BOM at '${target}' was written without a signature.`);
+  }
+};
+
+const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
+  const result = signForOutput(
+    bomJson,
+    stringifyJson(bomJson, options.jsonPretty),
+    dirname(jsonFile),
+    jsonFile,
+    options,
+  );
+  safeWriteSync(jsonFile, result.jsonPayload);
+  if (jsonFile.endsWith("bom.json")) {
+    thoughtLog(
+      `Let's save the file to "${jsonFile}". Should I suggest the '.cdx.json' file extension for better semantics?`,
     );
+  } else {
+    thoughtLog(`Let's save the file to "${jsonFile}".`);
   }
-  return jsonPayload;
+  return result;
 };
 
 /**
@@ -2055,27 +2138,11 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
       });
       const evinserModule = await import("../lib/evinser/evinser.js");
       options.projectType = options.projectType || ["java"];
-      const evinseOptions = {
-        _: args._,
-        input: internalCycloneDxInputPath || options.output,
-        output: options.evinseOutput,
-        language: options.projectType,
-        skipMavenCollector: false,
-        force: false,
-        withReachables: options.deep,
-        usagesSlicesFile: options.usagesSlicesFile,
-        dataFlowSlicesFile: options.dataFlowSlicesFile,
-        reachablesSlicesFile: options.reachablesSlicesFile,
-        semanticsSlicesFile: options.semanticsSlicesFile,
-        openapiSpecFile: options.openapiSpecFile,
-        componentType: options.componentType,
-        includeCrypto:
-          options.includeCrypto &&
-          isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
-        specVersion: options.specVersion,
-        profile: options.profile,
-        jsonPretty: options.jsonPretty,
-      };
+      const evinseOptions = evinserModule.buildEvinseOptions(
+        options,
+        args,
+        internalCycloneDxInputPath || options.output,
+      );
       const dbObjMap = await evinserModule.prepareDB(evinseOptions);
       if (dbObjMap) {
         const sliceArtefacts = await evinserModule.analyzeProject(
@@ -2164,10 +2231,27 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   }
   if (outputIsStdout) {
     if (!isDryRun && bomNSData.bomJson) {
-      const payload =
-        outputPlan.formats.has("spdx") && bomNSData.spdxJson
-          ? stringifyJson(bomNSData.spdxJson, options.jsonPretty)
-          : stringifyJson(bomNSData.bomJson, options.jsonPretty);
+      let payload;
+      if (outputPlan.formats.has("spdx") && bomNSData.spdxJson) {
+        payload = stringifyJson(bomNSData.spdxJson, options.jsonPretty);
+      } else {
+        const result = signForOutput(
+          bomNSData.bomJson,
+          stringifyJson(bomNSData.bomJson, options.jsonPretty),
+          undefined,
+          "stdout",
+          options,
+        );
+        if (result.signingError) {
+          reportSigningFailure(result.signingError, "stdout");
+          if (cleanup) {
+            cleanupSourceDir(srcDir);
+          }
+          process.exit(1);
+        }
+        bomNSData.bomJson = result.bomJson;
+        payload = result.jsonPayload;
+      }
       process.stdout.write(payload);
     } else if (isDryRun) {
       recordActivity({
@@ -2182,11 +2266,20 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     (typeof options.output === "string" || options.output instanceof String)
   ) {
     if (!isDryRun && outputPlan.outputs.cyclonedx && bomNSData.bomJson) {
-      writeCycloneDxOutput(
+      const result = writeCycloneDxOutput(
         outputPlan.outputs.cyclonedx,
         bomNSData.bomJson,
         options,
       );
+      if (result.signingError) {
+        reportSigningFailure(result.signingError, outputPlan.outputs.cyclonedx);
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+      // Later consumers, such as the Dependency-Track upload, get the signed BOM.
+      bomNSData.bomJson = result.bomJson;
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
         const nsFile = `${outputPlan.outputs.cyclonedx}.map`;
         safeWriteSync(nsFile, JSON.stringify(bomNSData.nsMapping));
@@ -2217,7 +2310,22 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     if (outputPlan.formats.has("spdx") && bomNSData?.spdxJson) {
       console.log(stringifyJson(bomNSData.spdxJson, options.jsonPretty));
     } else if (bomNSData.bomJson) {
-      console.log(stringifyJson(bomNSData.bomJson, options.jsonPretty));
+      const result = signForOutput(
+        bomNSData.bomJson,
+        stringifyJson(bomNSData.bomJson, options.jsonPretty),
+        undefined,
+        "stdout",
+        options,
+      );
+      if (result.signingError) {
+        reportSigningFailure(result.signingError, "stdout");
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+      bomNSData.bomJson = result.bomJson;
+      console.log(result.jsonPayload);
     } else {
       console.log("Unable to produce BOM for", filePath);
       console.log("Try running the command with -t <type> or -r argument");

package/bin/evinse.js

@@ -89,6 +89,11 @@ const args = yargs(hideBin(process.argv))
     default: false,
     type: "boolean",
   })
+  .option("compile-commands", {
+    description:
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+    type: "string",
+  })
   .option("golem-command", {
     description: "Use a specific golem binary for Go Evinse analysis.",
     default: readEnvironmentVariable("GOLEM_CMD"),