@cdxgen/cdxgen 13.2.0 → 13.4.0

package/bin/cdxgen.js

@@ -34,6 +34,7 @@ import {
   isDeferredFailOnError,
 } from "../lib/core/deferredExit.js";
 import { TRACE_MODE, thoughtEnd, thoughtLog } from "../lib/core/logger.js";
+import { resolveSourcePathArgument } from "../lib/core/pluginRun.js";
 import {
   PROJECT_CONFIG_FILENAMES,
   sanitizeProjectConfig,
@@ -72,7 +73,11 @@ import {
   setDryRunMode,
   shouldRunPredictiveBomAudit,
 } from "../lib/ecosystems/utils.js";
-import { signBom, verifyBom } from "../lib/helpers/bomSigner.js";
+import {
+  generateSigningKeyPair,
+  signBom,
+  verifyBom,
+} from "../lib/helpers/bomSigner.js";
 import {
   createOutputPlan,
   getOutputDirectory,
@@ -81,7 +86,6 @@ import {
   DEFAULT_CDX_SPEC_VERSION,
   getSupportedCycloneDxComponentTypes,
   isCycloneDxBom,
-  isCycloneDxComponentTypeEnabled,
   normalizeCycloneDxComponentTypeFilter,
   toCycloneDxSpecVersionString,
 } from "../lib/inventory/bomUtils.js";
@@ -164,6 +168,11 @@ for (const configPattern of PROJECT_CONFIG_FILENAMES) {
         `Config file '${configPath}' sets '${foundKey}'. Verify this is intentional.`,
       );
     }
+    for (const propertyName of sanitized.reservedProperties) {
+      console.warn(
+        `\x1b[1;35mConfig file '${configPath}' sets the metadata property '${propertyName}', whose namespace cdxgen reserves for its own findings. Ignoring it. Pass the property with --metadata-property if this is intentional.\x1b[0m`,
+      );
+    }
   } catch (_e) {
     console.log("Invalid config file", configPath);
   }
@@ -252,6 +261,16 @@ const args = _yargs
     description:
       "Perform deep searches for components. Useful while scanning C/C++ apps, live OS and oci images.",
   })
+  .option("cmake-cache", {
+    type: "string",
+    description:
+      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup in the build directories of the CMake presets, build*/, out/, builddir/ and cmake-build-*/.",
+  })
+  .option("compile-commands", {
+    type: "string",
+    description:
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
+  })
   .option("git-branch", {
     description: "Git branch to clone when the source is a git URL or purl",
     type: "string",
@@ -399,7 +418,7 @@ const args = _yargs
   .option("generate-key-and-sign", {
     type: "boolean",
     description:
-      "Generate an RSA public/private key pair and then sign the generated SBOM using JSON Web Signatures.",
+      "Generate a public/private key pair for SBOM_SIGN_ALGORITHM (RS512 by default) and then sign the generated SBOM using the JSON Signature Format (JSF).",
   })
   .option("server", {
     type: "boolean",
@@ -438,6 +457,23 @@ const args = _yargs
     default: false,
     description: "Generate SBOM with evidence for supported languages.",
   })
+  .option("scalasem", {
+    type: "boolean",
+    default: true,
+    description:
+      "Run the Scala semantic analyzer for the evidence of Scala projects. Use --no-scalasem to skip it.",
+  })
+  .option("scalasem-command", {
+    type: "string",
+    description:
+      "Use a specific scalasem script for the Scala evidence. Defaults to SCALASEM_CMD.",
+  })
+  .option("scalasem-include-tests", {
+    type: "boolean",
+    default: false,
+    description:
+      "Include test sources in the Scala evidence, tagged with their usage scope.",
+  })
   .option("deps-slices-file", {
     description: "Path for the parsedeps slice file created by atom.",
     default: "deps.slices.json",
@@ -565,6 +601,11 @@ const args = _yargs
     default: false,
     description: "Disable default ignore lists during scanning.",
   })
+  .option("caxa-app-dir", {
+    type: "string",
+    description:
+      "Directory of the app a caxa binary extracts. With -t caxa, also records the native tools, the vendored PHP, Ruby and Java packages, and the npm integrity hashes found there.",
+  })
   .option("export-proto", {
     type: "boolean",
     default: false,
@@ -605,6 +646,12 @@ const args = _yargs
     default: false,
     description: "Synthesize custom LicenseRef IDs for unresolved licenses.",
   })
+  .option("metadata-property", {
+    description:
+      "Custom property to add to the BOM metadata, as name=value. Repeat the flag for several properties. Combined with the properties of the CDXGEN_METADATA_PROPERTIES environment variable and of a config file.",
+    nargs: 1,
+    type: "array",
+  })
   .option("standard", {
     description:
       "The list of standards which may consist of regulations, industry or organizational-specific standards, maturity models, best practices, or any other requirements which can be evaluated against or attested to.",
@@ -864,7 +911,7 @@ const args = _yargs
     type: "boolean",
     default: true,
     description:
-      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run.",
+      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run; answers are still remembered within the run.",
   })
   .option("cache-ttl", {
     type: "number",
@@ -984,9 +1031,24 @@ if (!readEnvironmentVariable("NODE_USE_SYSTEM_CA")) {
   process.env.NODE_USE_SYSTEM_CA = "1";
 }
 
-const filePath = args._[0] || process.cwd();
+let filePath = args._[0] || process.cwd();
 const sourceInputIsRemoteOrPurl =
   maybeRemotePath(filePath) || maybePurlSource(filePath);
+// Resolve the source argument once, before anything uses it. With the working
+// directory already set to the project and the argument relative to a
+// repository root (depscan's launch shape), every later resolve would produce
+// <project>/<argument>, a directory that does not exist: the BOM came out
+// empty and the plugins analyzed nothing, while the run still exited 0.
+if (!sourceInputIsRemoteOrPurl && args._?.[0]) {
+  const sourceResolution = resolveSourcePathArgument(filePath);
+  if (sourceResolution.rewritten) {
+    console.warn(
+      `Source path '${filePath}' does not exist relative to the working directory, which is itself the directory it names; using '${sourceResolution.path}'.`,
+    );
+    filePath = sourceResolution.path;
+    args._[0] = filePath;
+  }
+}
 if (!args.projectName) {
   if (filePath !== ".") {
     args.projectName = basename(filePath);
@@ -1047,6 +1109,7 @@ const { options, warnings: phase3Warnings } = buildOptionsFromArgs(args, {
   userSetSpecVersion,
   isDryRun,
   isSecureMode,
+  projectConfig: config,
 });
 // Exit status reserved for the introspection CI gate: the BOM was generated
 // and written, but its introspection score missed the configured threshold.
@@ -1410,6 +1473,8 @@ const checkPermissions = (filePath, options) => {
   return true;
 };
 
+let warnedAboutSigningAlgorithm = false;
+
 const needsBomSigning = ({ generateKeyAndSign }) =>
   generateKeyAndSign ||
   (() => {
@@ -1427,11 +1492,19 @@ const needsBomSigning = ({ generateKeyAndSign }) =>
         sensitive: true,
       },
     );
-    return (
-      sbomSignAlgorithm &&
-      sbomSignAlgorithm !== "none" &&
-      ((sbomSignPrivateKey && safeExistsSync(sbomSignPrivateKey)) ||
-        sbomSignPrivateKeyBase64)
+    const keyConfigured = Boolean(
+      sbomSignPrivateKey || sbomSignPrivateKeyBase64,
+    );
+    if (keyConfigured && !sbomSignAlgorithm && !warnedAboutSigningAlgorithm) {
+      warnedAboutSigningAlgorithm = true;
+      console.warn(
+        "SBOM_SIGN_PRIVATE_KEY is set without SBOM_SIGN_ALGORITHM, so the BOM is not signed. Set SBOM_SIGN_ALGORITHM (for example RS512) to sign it, or SBOM_SIGN_ALGORITHM=none to silence this warning.",
+      );
+    }
+    // A configured key file that is missing counts as a signing request, so
+    // that signing fails loudly instead of being skipped.
+    return Boolean(
+      sbomSignAlgorithm && sbomSignAlgorithm !== "none" && keyConfigured,
     );
   })();
 
@@ -1440,28 +1513,20 @@ const stringifyJson = (jsonPayload, jsonPretty) =>
     ? jsonPayload
     : JSON.stringify(jsonPayload, null, jsonPretty ? 2 : null);
 
-const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
-  const jsonPayload = stringifyJson(bomJson, options.jsonPretty);
-  safeWriteSync(jsonFile, jsonPayload);
-  if (jsonFile.endsWith("bom.json")) {
-    thoughtLog(
-      `Let's save the file to "${jsonFile}". Should I suggest the '.cdx.json' file extension for better semantics?`,
-    );
-  } else {
-    thoughtLog(`Let's save the file to "${jsonFile}".`);
-  }
-  if (!jsonPayload || !needsBomSigning(options)) {
-    return jsonPayload;
-  }
-  if (isDryRun) {
-    recordActivity({
-      kind: "sign",
-      reason: "Dry run mode skips BOM signing and key generation.",
-      status: "blocked",
-      target: jsonFile,
-    });
-    return jsonPayload;
-  }
+const SIGNING_HINT =
+  "Check that the private key is in PEM format and that SBOM_SIGN_ALGORITHM matches its key type.";
+
+/**
+ * Signs a CycloneDX payload with the configured or generated key.
+ *
+ * @param {string} jsonPayload Serialized CycloneDX BOM
+ * @param {string|undefined} keyDir Directory for --generate-key-and-sign keys
+ * @param {string} target Output the signed BOM is written to (for the activity log)
+ * @param {Object} options CLI options
+ * @returns {Object} Signed BOM
+ * @throws {Error} When signing was requested but cannot be completed
+ */
+const signCycloneDxPayload = (jsonPayload, keyDir, target, options) => {
   const sbomSignAlgorithm = readEnvironmentVariable("SBOM_SIGN_ALGORITHM");
   const sbomSignPrivateKey = readEnvironmentVariable("SBOM_SIGN_PRIVATE_KEY", {
     sensitive: true,
@@ -1476,29 +1541,20 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   const sbomSignPublicKeyBase64 = readEnvironmentVariable(
     "SBOM_SIGN_PUBLIC_KEY_BASE64",
   );
-  let alg = sbomSignAlgorithm || "RS512";
-  if (alg.includes("none")) {
-    alg = "RS512";
-  }
+  const alg = sbomSignAlgorithm || "RS512";
   let privateKeyToUse;
   let jwkPublicKey;
   let publicKeyFile;
   if (options.generateKeyAndSign) {
-    const jdirName = dirname(jsonFile);
-    publicKeyFile = join(jdirName, "public.key");
-    const privateKeyFile = join(jdirName, "private.key");
-    const privateKeyB64File = join(jdirName, "private.key.base64");
-    const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
-      modulusLength: 4096,
-      publicKeyEncoding: {
-        type: "spki",
-        format: "pem",
-      },
-      privateKeyEncoding: {
-        type: "pkcs8",
-        format: "pem",
-      },
-    });
+    if (!keyDir) {
+      throw new Error(
+        "--generate-key-and-sign needs a file output (-o) to write the generated keys next to.",
+      );
+    }
+    publicKeyFile = join(keyDir, "public.key");
+    const privateKeyFile = join(keyDir, "private.key");
+    const privateKeyB64File = join(keyDir, "private.key.base64");
+    const { privateKey, publicKey } = generateSigningKeyPair(alg);
     safeWriteSync(publicKeyFile, publicKey);
     safeWriteSync(privateKeyFile, privateKey);
     safeWriteSync(
@@ -1515,69 +1571,129 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     jwkPublicKey = crypto.createPublicKey(publicKey).export({ format: "jwk" });
   } else {
     if (sbomSignPrivateKey) {
+      if (!safeExistsSync(sbomSignPrivateKey)) {
+        throw new Error(
+          `The SBOM_SIGN_PRIVATE_KEY file '${sbomSignPrivateKey}' was not found.`,
+        );
+      }
       recordSensitiveFileRead(sbomSignPrivateKey, {
         label: "SBOM signing private key",
       });
-      privateKeyToUse = fs.readFileSync(sbomSignPrivateKey, "utf8");
+      privateKeyToUse = fs.readFileSync(sbomSignPrivateKey);
     } else if (sbomSignPrivateKeyBase64) {
-      privateKeyToUse = Buffer.from(
-        sbomSignPrivateKeyBase64,
-        "base64",
-      ).toString("utf8");
+      privateKeyToUse = Buffer.from(sbomSignPrivateKeyBase64, "base64");
     }
     if (sbomSignPublicKey && safeExistsSync(sbomSignPublicKey)) {
       jwkPublicKey = crypto
         .createPublicKey(fs.readFileSync(sbomSignPublicKey, "utf8"))
         .export({ format: "jwk" });
     } else if (sbomSignPublicKeyBase64) {
-      jwkPublicKey = Buffer.from(sbomSignPublicKeyBase64, "base64").toString(
-        "utf8",
+      jwkPublicKey = crypto
+        .createPublicKey(Buffer.from(sbomSignPublicKeyBase64, "base64"))
+        .export({ format: "jwk" });
+    }
+  }
+  thoughtLog(`Signing the BOM for "${target}".`);
+  const signedBom = signBom(JSON.parse(jsonPayload), {
+    privateKey: privateKeyToUse,
+    algorithm: alg,
+    publicKeyJwk: jwkPublicKey,
+    mode: readEnvironmentVariable("SBOM_SIGN_MODE") || "replace",
+    signComponents: true,
+    signServices: true,
+    signAnnotations: true,
+  });
+  if (publicKeyFile) {
+    if (!verifyBom(signedBom, fs.readFileSync(publicKeyFile, "utf8"))) {
+      throw new Error(
+        `The new signature does not verify with ${publicKeyFile}.`,
       );
     }
+    console.log(
+      "SBOM signature is verifiable natively with the public key and the algorithm",
+      publicKeyFile,
+      alg,
+    );
+  }
+  recordActivity({
+    kind: "sign",
+    status: "completed",
+    target,
+  });
+  return signedBom;
+};
+
+/**
+ * Signs the BOM for an output when signing is configured. A failure is
+ * recorded and returned so that the caller can stop with a non-zero exit
+ * instead of publishing an unsigned BOM.
+ *
+ * @returns {{ bomJson: Object, jsonPayload: string, signingError?: Error }}
+ */
+const signForOutput = (bomJson, jsonPayload, keyDir, target, options) => {
+  if (!jsonPayload || !needsBomSigning(options)) {
+    return { bomJson, jsonPayload };
+  }
+  if (isDryRun) {
+    recordActivity({
+      kind: "sign",
+      reason: "Dry run mode skips BOM signing and key generation.",
+      status: "blocked",
+      target,
+    });
+    return { bomJson, jsonPayload };
   }
   try {
-    const bomJsonUnsignedObj = JSON.parse(jsonPayload);
-    const signOptions = {
-      privateKey: privateKeyToUse,
-      algorithm: alg,
-      publicKeyJwk: jwkPublicKey,
-      mode: readEnvironmentVariable("SBOM_SIGN_MODE") || "replace",
-      signComponents: true,
-      signServices: true,
-      signAnnotations: true,
+    const signedBom = signCycloneDxPayload(
+      jsonPayload,
+      keyDir,
+      target,
+      options,
+    );
+    return {
+      bomJson: signedBom,
+      jsonPayload: JSON.stringify(
+        signedBom,
+        null,
+        options.jsonPretty ? 2 : null,
+      ),
     };
-    thoughtLog(`Signing the BOM file "${jsonFile}".`);
+  } catch (err) {
     recordActivity({
       kind: "sign",
-      status: "completed",
-      target: jsonFile,
+      reason: err.message,
+      status: "failed",
+      target,
     });
-    const signedBom = signBom(bomJsonUnsignedObj, signOptions);
-    safeWriteSync(
-      jsonFile,
-      JSON.stringify(signedBom, null, options.jsonPretty ? 2 : null),
-    );
-    if (publicKeyFile) {
-      const publicKeyStr = fs.readFileSync(publicKeyFile, "utf8");
-      const signatureVerification = verifyBom(signedBom, publicKeyStr);
-      if (signatureVerification) {
-        console.log(
-          "SBOM signature is verifiable natively with the public key and the algorithm",
-          publicKeyFile,
-          alg,
-        );
-      } else {
-        console.log("SBOM signature verification was unsuccessful");
-        console.log("Check if the public key was exported in PEM format");
-      }
-    }
-  } catch (ex) {
-    console.log("SBOM signing was unsuccessful:", ex.message);
-    console.log(
-      "Check if the private key was exported in PEM format and the algorithm is JSF-compliant.",
+    return { bomJson, jsonPayload, signingError: err };
+  }
+};
+
+const reportSigningFailure = (signingError, target) => {
+  console.error(`SBOM signing was unsuccessful: ${signingError.message}`);
+  console.error(SIGNING_HINT);
+  if (target !== "stdout") {
+    console.error(`The BOM at '${target}' was written without a signature.`);
+  }
+};
+
+const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
+  const result = signForOutput(
+    bomJson,
+    stringifyJson(bomJson, options.jsonPretty),
+    dirname(jsonFile),
+    jsonFile,
+    options,
+  );
+  safeWriteSync(jsonFile, result.jsonPayload);
+  if (jsonFile.endsWith("bom.json")) {
+    thoughtLog(
+      `Let's save the file to "${jsonFile}". Should I suggest the '.cdx.json' file extension for better semantics?`,
     );
+  } else {
+    thoughtLog(`Let's save the file to "${jsonFile}".`);
   }
-  return jsonPayload;
+  return result;
 };
 
 /**
@@ -2054,46 +2170,61 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         sourcePath: filePath,
       });
       const evinserModule = await import("../lib/evinser/evinser.js");
-      options.projectType = options.projectType || ["java"];
-      const evinseOptions = {
-        _: args._,
-        input: internalCycloneDxInputPath || options.output,
-        output: options.evinseOutput,
-        language: options.projectType,
-        skipMavenCollector: false,
-        force: false,
-        withReachables: options.deep,
-        usagesSlicesFile: options.usagesSlicesFile,
-        dataFlowSlicesFile: options.dataFlowSlicesFile,
-        reachablesSlicesFile: options.reachablesSlicesFile,
-        semanticsSlicesFile: options.semanticsSlicesFile,
-        openapiSpecFile: options.openapiSpecFile,
-        componentType: options.componentType,
-        includeCrypto:
-          options.includeCrypto &&
-          isCycloneDxComponentTypeEnabled("cryptographic-asset", options),
-        specVersion: options.specVersion,
-        profile: options.profile,
-        jsonPretty: options.jsonPretty,
-      };
-      const dbObjMap = await evinserModule.prepareDB(evinseOptions);
-      if (dbObjMap) {
-        const sliceArtefacts = await evinserModule.analyzeProject(
-          dbObjMap,
-          evinseOptions,
+      if (!options.projectType) {
+        const evidenceLanguage = evinserModule.defaultEvidenceLanguage(
+          filePath,
+          bomNSData?.bomJson,
+          options,
         );
-        const evinseJson = await evinserModule.createEvinseFile(
-          sliceArtefacts,
-          evinseOptions,
+        if (evidenceLanguage) {
+          options.projectType = [evidenceLanguage];
+        }
+      }
+      if (!options.projectType) {
+        console.log(
+          "Skipping the evidence analysis since the BOM lists no package in a language it supports. Pass -t to choose the language.",
         );
-        // The scope filter is deferred until here so the analyzers get to
-        // prove that an optional dependency is actually used.
-        bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
-        if (options.print && evinseJson) {
-          printOccurrences(evinseJson);
-          printCallStack(evinseJson);
-          printReachables(sliceArtefacts);
-          printServices(evinseJson);
+        if (bomNSData) {
+          bomNSData.bomJson = applyEvidenceBasedFilter(
+            bomNSData.bomJson,
+            options,
+          );
+        }
+      } else {
+        const evinseOptions = evinserModule.buildEvinseOptions(
+          options,
+          args,
+          internalCycloneDxInputPath || options.output,
+        );
+        try {
+          const dbObjMap = await evinserModule.prepareDB(evinseOptions);
+          if (dbObjMap) {
+            const sliceArtefacts = await evinserModule.analyzeProject(
+              dbObjMap,
+              evinseOptions,
+            );
+            const evinseJson = await evinserModule.createEvinseFile(
+              sliceArtefacts,
+              evinseOptions,
+            );
+            // The scope filter is deferred until here so the analyzers get to
+            // prove that an optional dependency is actually used.
+            bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
+            if (options.print && evinseJson) {
+              printOccurrences(evinseJson);
+              printCallStack(evinseJson);
+              printReachables(sliceArtefacts);
+              printServices(evinseJson);
+            }
+          }
+        } catch (err) {
+          // A rusi/golem analysis failure under --fail-on-error on an
+          // introspected run defers its exit so the BOM and the reports are
+          // still written; the run continues here without the reachability
+          // evidence, exactly as the deferral contract describes.
+          if (!isDeferredFailOnError(err)) {
+            throw err;
+          }
         }
       }
     }
@@ -2164,10 +2295,27 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
   }
   if (outputIsStdout) {
     if (!isDryRun && bomNSData.bomJson) {
-      const payload =
-        outputPlan.formats.has("spdx") && bomNSData.spdxJson
-          ? stringifyJson(bomNSData.spdxJson, options.jsonPretty)
-          : stringifyJson(bomNSData.bomJson, options.jsonPretty);
+      let payload;
+      if (outputPlan.formats.has("spdx") && bomNSData.spdxJson) {
+        payload = stringifyJson(bomNSData.spdxJson, options.jsonPretty);
+      } else {
+        const result = signForOutput(
+          bomNSData.bomJson,
+          stringifyJson(bomNSData.bomJson, options.jsonPretty),
+          undefined,
+          "stdout",
+          options,
+        );
+        if (result.signingError) {
+          reportSigningFailure(result.signingError, "stdout");
+          if (cleanup) {
+            cleanupSourceDir(srcDir);
+          }
+          process.exit(1);
+        }
+        bomNSData.bomJson = result.bomJson;
+        payload = result.jsonPayload;
+      }
       process.stdout.write(payload);
     } else if (isDryRun) {
       recordActivity({
@@ -2182,11 +2330,20 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     (typeof options.output === "string" || options.output instanceof String)
   ) {
     if (!isDryRun && outputPlan.outputs.cyclonedx && bomNSData.bomJson) {
-      writeCycloneDxOutput(
+      const result = writeCycloneDxOutput(
         outputPlan.outputs.cyclonedx,
         bomNSData.bomJson,
         options,
       );
+      if (result.signingError) {
+        reportSigningFailure(result.signingError, outputPlan.outputs.cyclonedx);
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+      // Later consumers, such as the Dependency-Track upload, get the signed BOM.
+      bomNSData.bomJson = result.bomJson;
       if (bomNSData.nsMapping && Object.keys(bomNSData.nsMapping).length) {
         const nsFile = `${outputPlan.outputs.cyclonedx}.map`;
         safeWriteSync(nsFile, JSON.stringify(bomNSData.nsMapping));
@@ -2217,7 +2374,22 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     if (outputPlan.formats.has("spdx") && bomNSData?.spdxJson) {
       console.log(stringifyJson(bomNSData.spdxJson, options.jsonPretty));
     } else if (bomNSData.bomJson) {
-      console.log(stringifyJson(bomNSData.bomJson, options.jsonPretty));
+      const result = signForOutput(
+        bomNSData.bomJson,
+        stringifyJson(bomNSData.bomJson, options.jsonPretty),
+        undefined,
+        "stdout",
+        options,
+      );
+      if (result.signingError) {
+        reportSigningFailure(result.signingError, "stdout");
+        if (cleanup) {
+          cleanupSourceDir(srcDir);
+        }
+        process.exit(1);
+      }
+      bomNSData.bomJson = result.bomJson;
+      console.log(result.jsonPayload);
     } else {
       console.log("Unable to produce BOM for", filePath);
       console.log("Try running the command with -t <type> or -r argument");

package/bin/evinse.js

@@ -89,6 +89,11 @@ const args = yargs(hideBin(process.argv))
     default: false,
     type: "boolean",
   })
+  .option("compile-commands", {
+    description:
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
+    type: "string",
+  })
   .option("golem-command", {
     description: "Use a specific golem binary for Go Evinse analysis.",
     default: readEnvironmentVariable("GOLEM_CMD"),
@@ -259,6 +264,23 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("scalasem-command", {
+    description:
+      "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",
+    default: readEnvironmentVariable("SCALASEM_CMD"),
+  })
+  .option("scalasem-include-tests", {
+    description:
+      "Include test sources in the Scala semantic evidence, tagged with their usage scope.",
+    default: false,
+    type: "boolean",
+  })
+  .option("scalasem", {
+    description:
+      "Run the Scala semantic analyzer for Scala projects. Use --no-scalasem to skip it and keep the plain BOM.",
+    default: true,
+    type: "boolean",
+  })
   .option("data-flow-slices-file", {
     description: "Use an existing data-flow slices file.",
     default: "data-flow.slices.json",