@cdxgen/cdxgen 13.2.0 → 13.4.0

package/bin/repl.js

@@ -1741,6 +1741,92 @@ cdxgenRepl.defineCommand("golemcoverage", {
     this.displayPrompt();
   },
 });
+function hasScalasemProperties(component) {
+  return Boolean(
+    component?.properties?.some((property) =>
+      property?.name?.startsWith("cdx:scalasem:"),
+    ),
+  );
+}
+
+cdxgenRepl.defineCommand("scalasemsummary", {
+  help: "summarize Scala Evinse/scalasem metadata and evidence coverage",
+  action() {
+    const interactiveBom = getInteractiveBom();
+    if (!interactiveBom) {
+      console.log("⚠ No BOM is loaded. Use .import command to import an SBOM");
+      this.displayPrompt();
+      return;
+    }
+    if (!hasScalasemProperties(interactiveBom.metadata?.component)) {
+      console.log(
+        "No scalasem properties found. Generate an evidence BOM with evinse -l scala or cdxgen --evidence to use this view.",
+      );
+      this.displayPrompt();
+      return;
+    }
+    const rootComponent = interactiveBom.metadata?.component || {};
+    const components = interactiveBom.components || [];
+    const occurrences = components.reduce(
+      (total, component) =>
+        total + (component?.evidence?.occurrences?.length || 0),
+      0,
+    );
+    const occurrencesWithLine = components.reduce(
+      (total, component) =>
+        total +
+        (component?.evidence?.occurrences || []).filter(
+          (occurrence) => occurrence?.line,
+        ).length,
+      0,
+    );
+    const callstacks = components.filter(
+      (component) => component?.evidence?.callstack?.frames?.length,
+    ).length;
+    const cryptoAssets = components.filter(
+      (component) => component?.type === "cryptographic-asset",
+    ).length;
+    printKeyValueTable("Scala Evinse / scalasem summary", [
+      [
+        "Schema version",
+        getPropertyValue(rootComponent, "cdx:scalasem:schemaVersion"),
+      ],
+      [
+        "Facts source",
+        getPropertyValue(rootComponent, "cdx:scalasem:factsSource"),
+      ],
+      [
+        "Scala versions",
+        getPropertyValue(rootComponent, "cdx:scalasem:scalaVersions"),
+      ],
+      ["Platforms", getPropertyValue(rootComponent, "cdx:scalasem:platforms")],
+      [
+        "Files analyzed",
+        getPropertyValue(rootComponent, "cdx:scalasem:filesAnalyzed"),
+      ],
+      ["Degraded", getPropertyValue(rootComponent, "cdx:scalasem:degraded")],
+      ...(rootComponent.properties || [])
+        .filter((property) =>
+          property?.name?.startsWith("cdx:scalasem:diagnostic:"),
+        )
+        .map((property) => [
+          `Diagnostic ${property.name.slice("cdx:scalasem:diagnostic:".length)}`,
+          property.value,
+        ]),
+      [
+        "Components with occurrences",
+        components.filter((c) => c?.evidence?.occurrences?.length).length,
+      ],
+      ["Occurrences", occurrences],
+      ["Occurrences with line", occurrencesWithLine],
+      ["Components with call stacks", callstacks],
+      ["Crypto assets", cryptoAssets],
+      ["Services", (interactiveBom.services || []).length],
+    ]);
+    this.displayPrompt();
+  },
+});
+
 cdxgenRepl.defineCommand("auditfindings", {
   help: "summarize cdx-audit and bom-audit annotations from the loaded BOM",
   action() {

package/bin/sign.js

@@ -11,11 +11,16 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
 } from "../lib/ecosystems/utils.js";
-import { signBom } from "../lib/helpers/bomSigner.js";
+import {
+  checkSignatureEntries,
+  displayValue,
+  signBom,
+} from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
 } from "../lib/inventory/bomUtils.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 
 const _yargs = yargs(hideBin(process.argv));
 
@@ -31,12 +36,14 @@ const args = _yargs
   })
   .option("private-key", {
     alias: "k",
-    description: "Private key in PEM format.",
+    description:
+      "Private key in PEM format, or the shared secret file for HS256, HS384, and HS512.",
   })
   .option("algorithm", {
     alias: "a",
     default: readEnvironmentVariable("SBOM_SIGN_ALGORITHM") || "RS512",
-    description: "JSF Signature Algorithm (e.g., RS512, ES256, Ed25519).",
+    description:
+      "JSF Signature Algorithm (e.g., RS512, ES256, Ed25519). It must match the key type.",
   })
   .option("mode", {
     alias: "m",
@@ -45,27 +52,42 @@ const args = _yargs
     description:
       "Signature mode. Use 'signers' for multi-signing, 'chain' for sequential chaining.",
   })
+  .option("verify-existing-with", {
+    type: "array",
+    string: true,
+    description:
+      "Public key (PEM) of an earlier signer. Before a new entry is appended, every existing chain entry (--mode chain), or at least one existing entry (--mode signers), must verify with one of these keys.",
+  })
+  .option("allow-unverified-history", {
+    type: "boolean",
+    default: false,
+    description:
+      "With --mode chain or signers, append even when the existing signature entries cannot be verified with --verify-existing-with.",
+  })
+  .option("embed-public-key", {
+    type: "boolean",
+    default: true,
+    description:
+      "Embed the signer's public key in the root signature, which binds the signature to that key. Not used for HMAC (HS*) algorithms. Pass --no-embed-public-key to leave it out.",
+  })
   .option("key-id", {
     description:
       "Optional identifier for the key (keyId) to embed in the signature block.",
   })
   .option("sign-components", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular components. Disable (--no-sign-components) when appending multi-signatures.",
+      "Sign granular components. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("sign-services", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular services. Disable (--no-sign-services) when appending multi-signatures.",
+      "Sign granular services. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("sign-annotations", {
     type: "boolean",
-    default: true,
     description:
-      "Sign granular annotations. Disable (--no-sign-annotations) when appending multi-signatures.",
+      "Sign granular annotations. Defaults to true, or false when appending a signers or chain signature to a signed BOM.",
   })
   .option("attach", {
     type: "string",
@@ -97,7 +119,7 @@ const envPrivateKeyBase64 = readEnvironmentVariable(
 
 if (args.privateKey) {
   if (safeExistsSync(args.privateKey)) {
-    privateKeyContent = fs.readFileSync(args.privateKey, "utf8");
+    privateKeyContent = fs.readFileSync(args.privateKey);
     hasPrivateKey = true;
   } else {
     console.error(`Private key file '${args.privateKey}' not found.`);
@@ -105,7 +127,7 @@ if (args.privateKey) {
   }
 } else if (envPrivateKeyFile) {
   if (safeExistsSync(envPrivateKeyFile)) {
-    privateKeyContent = fs.readFileSync(envPrivateKeyFile, "utf8");
+    privateKeyContent = fs.readFileSync(envPrivateKeyFile);
     hasPrivateKey = true;
   } else {
     console.error(
@@ -115,9 +137,7 @@ if (args.privateKey) {
   }
 } else if (envPrivateKeyBase64) {
   try {
-    privateKeyContent = Buffer.from(envPrivateKeyBase64, "base64").toString(
-      "utf8",
-    );
+    privateKeyContent = Buffer.from(envPrivateKeyBase64, "base64");
     hasPrivateKey = true;
   } catch {
     console.error(
@@ -147,8 +167,75 @@ function hasAnySignature(bomJson) {
   return false;
 }
 
+function describeEntry(result) {
+  const parts = [];
+  if (result.algorithm !== undefined) {
+    parts.push(displayValue(result.algorithm));
+  }
+  if (result.keyId !== undefined) {
+    parts.push(`keyId '${displayValue(result.keyId)}'`);
+  }
+  return parts.length
+    ? `entry ${result.index} (${parts.join(", ")})`
+    : `entry ${result.index}`;
+}
+
+// A new chain entry covers every earlier entry, so the signer vouches for that
+// history, and every entry must verify. A new signers entry covers the same
+// content as the existing entries, so at least one must verify to show the
+// content is still what an earlier signer signed.
+function checkExistingSignatures(bomJson) {
+  const existing = bomJson.signature;
+  const otherForm = args.mode === "chain" ? "signers" : "chain";
+  if (
+    args.mode === "replace" ||
+    existing === undefined ||
+    (existing !== null &&
+      typeof existing === "object" &&
+      Object.hasOwn(existing, otherForm))
+  ) {
+    return;
+  }
+  const keys = (args.verifyExistingWith || []).map((keyFile) => {
+    if (!safeExistsSync(keyFile)) {
+      throw new Error(`Public key file '${keyFile}' not found.`);
+    }
+    return fs.readFileSync(keyFile, "utf8");
+  });
+  const results = checkSignatureEntries(bomJson, keys);
+  const unverified = results.filter((result) => !result.verified);
+  const chain = args.mode === "chain";
+  if (chain ? !unverified.length : unverified.length < results.length) {
+    return;
+  }
+  const details = unverified.map(
+    (result) =>
+      `  - ${describeEntry(result)}: ${result.reasons[0] || "no --verify-existing-with key was given"}`,
+  );
+  if (args.allowUnverifiedHistory) {
+    console.warn(
+      [
+        chain
+          ? `Warning: appending to a chain with ${unverified.length} unverified entry(s):`
+          : `Warning: appending a signers entry although none of the ${unverified.length} existing entry(s) verified:`,
+        ...details,
+      ].join("\n"),
+    );
+    return;
+  }
+  throw new Error(
+    [
+      chain
+        ? `the new chain entry would vouch for ${unverified.length} existing entry(s) that could not be verified:`
+        : `none of the ${unverified.length} existing signature entry(s) could be verified, so the content may have changed since it was signed:`,
+      ...details,
+      "Pass --verify-existing-with <public key> for each earlier signer, or --allow-unverified-history to sign anyway.",
+    ].join("\n"),
+  );
+}
+
 try {
-  const bomJson = JSON.parse(fs.readFileSync(args.input, "utf8"));
+  const bomJson = parseStrictJson(fs.readFileSync(args.input));
   if (!isCycloneDxBom(bomJson)) {
     console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-sign"));
     process.exit(1);
@@ -156,9 +243,12 @@ try {
 
   let signedBom = bomJson;
   if (hasPrivateKey && privateKeyContent) {
+    checkExistingSignatures(bomJson);
     signedBom = signBom(bomJson, {
       privateKey: privateKeyContent,
       algorithm: args.algorithm,
+      embedPublicKey: args.embedPublicKey,
+      embedPublicKeyNested: false,
       keyId: args.keyId,
       mode: args.mode,
       signComponents: args.signComponents,
@@ -173,6 +263,20 @@ try {
     console.log(
       `Mode: ${args.mode} | Algorithm: ${args.algorithm}${args.keyId ? ` | KeyId: ${args.keyId}` : ""}`,
     );
+    const rootSignature = signedBom.signature;
+    const newEntry =
+      rootSignature?.signers?.at(-1) ??
+      rootSignature?.chain?.at(-1) ??
+      rootSignature;
+    if (
+      args.embedPublicKey &&
+      !String(args.algorithm).startsWith("HS") &&
+      newEntry?.publicKey === undefined
+    ) {
+      console.warn(
+        "Warning: this key type has no JWK form, so the public key was not embedded in the signature.",
+      );
+    }
   } else {
     if (!hasAnySignature(bomJson)) {
       console.error(

package/bin/tracebom.js

@@ -14,6 +14,7 @@ import {
   safeWriteSync,
 } from "../lib/ecosystems/utils.js";
 import { DEFAULT_CDX_SPEC_VERSION } from "../lib/inventory/bomUtils.js";
+import { applySpecVersionCompatibility } from "../lib/stages/postgen/specVersionCompat.js";
 
 const _yargs = yargs(hideBin(process.argv));
 
@@ -79,7 +80,7 @@ const args = _yargs
   })
   .option("disable-network", {
     description:
-      "Disable network inside sandbox. Automatically disabled when --trace-http-urls is set.",
+      "Disable network inside sandbox. Automatically disabled when --trace-http-urls or --proxy-egress is set.",
     default: true,
     type: "boolean",
   })
@@ -166,10 +167,60 @@ const args = _yargs
   })
   .option("trace-crypto", {
     description:
-      "Enable eBPF-based cryptographic library and cipher suite tracing (Linux only).",
+      "Trace cryptographic libraries and TLS parameters: eBPF on Linux, crypto DLLs on Windows (elevated prompt), and TLS handshakes through --proxy-egress on every platform.",
     default: true,
     type: "boolean",
   })
+  .option("proxy-egress", {
+    description:
+      "Route all outbound traffic through safer-exec's hostname-pinning egress proxy. Only --allow-host (and --allow-url) hosts are reachable; allowed and denied targets are recorded as services. Enables the network.",
+    default: false,
+    type: "boolean",
+  })
+  .option("allow-loopback", {
+    description: "Allow the traced process to connect to loopback addresses.",
+    default: false,
+    type: "boolean",
+  })
+  .option("sandbox-dry-run", {
+    description:
+      "Deny every filesystem write and network connection and record the attempted operations as counts in the BOM metadata.",
+    default: false,
+    type: "boolean",
+  })
+  .option("policy", {
+    description:
+      "Apply a named safer-exec ecosystem policy (for example npm, pnpm, pypi, uv, maven, cargo, gomod, nuget) before the other sandbox options.",
+    type: "string",
+  })
+  .option("policy-file", {
+    description: "Apply a safer-exec JSON policy file.",
+    type: "string",
+  })
+  .option("block-interpreters", {
+    description:
+      "Block interpreters that carry sandbox or task-port exemptions (macOS only).",
+    default: false,
+    type: "boolean",
+  })
+  .option("deny-persistence-writes", {
+    description:
+      "Deny writes to auto-execution and persistence locations such as LaunchAgents, shell rc files and cron directories. Paths in --write-paths stay writable.",
+    default: false,
+    type: "boolean",
+  })
+  .option("private-tmp", {
+    description:
+      "Give the traced process private /tmp and /var/tmp mounts (Linux only).",
+    default: false,
+    type: "boolean",
+  })
+  .option("protect-home", {
+    description: "Isolate $HOME inside the sandbox (Linux only).",
+    choices: ["off", "read-only", "tmpfs"],
+    default: "off",
+    type: "string",
+  })
   .option("print", {
     description: "Print BOM to stdout.",
     default: false,
@@ -230,9 +281,10 @@ const options = {
   traceMaxMemoryMB: args.maxMemory,
   traceMaxProcesses: args.maxProcesses,
   traceTimeoutMs: args.timeout,
-  traceDisableNetwork: args.traceHttpUrls
-    ? false
-    : (args.disableNetwork ?? true),
+  traceDisableNetwork:
+    args.traceHttpUrls || args.proxyEgress
+      ? false
+      : (args.disableNetwork ?? true),
   traceHTTPURLs: args.traceHttpUrls ?? false,
   tracePeriod: args.tracePeriod,
   traceMaxCPUCores: args.maxCpu,
@@ -265,6 +317,15 @@ const options = {
     ? args.blockExec.split(",").filter(Boolean)
     : [],
   traceCrypto: args.traceCrypto ?? true,
+  traceProxyEgress: args.proxyEgress ?? false,
+  traceAllowLoopback: args.allowLoopback ?? false,
+  traceDryRun: args.sandboxDryRun ?? false,
+  tracePolicy: args.policy,
+  tracePolicyFile: args.policyFile ? resolve(args.policyFile) : undefined,
+  traceBlockInterpreters: args.blockInterpreters ?? false,
+  traceDenyPersistenceWrites: args.denyPersistenceWrites ?? false,
+  tracePrivateTmp: args.privateTmp ?? false,
+  traceProtectHome: args.protectHome,
   cbom: undefined,
   projectType: ["dynamic"],
   output: resolve(args.output),
@@ -277,6 +338,9 @@ const options = {
     console.error("Dynamic SBOM generation failed: no output was produced.");
     process.exit(1);
   }
+  // tracebom skips postProcess, so the downgrade to an older --spec-version
+  // (for example dropping the 1.7 algorithmFamily of traced crypto) runs here.
+  applySpecVersionCompatibility(bomJson, options);
 
   const jsonPayload = JSON.stringify(bomJson, null, DEBUG_MODE ? 2 : null);
 

package/bin/validate.js

@@ -26,6 +26,7 @@ import {
   safeMkdirSync,
   safeWriteSync,
 } from "../lib/ecosystems/utils.js";
+import { displayValue } from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
@@ -35,6 +36,7 @@ import {
   isProtoBomPath,
 } from "../lib/inventory/protobomLoader.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 import { shouldFail, validateBomAdvanced } from "../lib/validator/index.js";
 import { render as renderReport } from "../lib/validator/reporters/index.js";
 
@@ -114,11 +116,20 @@ const args = _yargs
     description:
       "Path to a PEM public key. When set, cdx-validate also verifies the BOM signature.",
   })
+  .option("secret-key", {
+    description:
+      "Path to the shared secret for HMAC (HS256, HS384, HS512) signatures. HMAC signatures are only accepted with this option.",
+  })
+  .option("nested-signatures", {
+    type: "boolean",
+    default: true,
+    description:
+      "Also verify component, service, and annotation signatures, as cdx-verify does. Pass --no-nested-signatures to verify only the root signature.",
+  })
   .option("require-signature", {
     type: "boolean",
-    default: false,
     description:
-      "Exit non-zero (4) when --public-key is provided but signature verification fails.",
+      "Exit non-zero (4) when signature verification fails. On by default when --public-key or --secret-key is given; pass --no-require-signature to only report the result.",
   })
   .option("strict", {
     type: "boolean",
@@ -133,7 +144,11 @@ const args = _yargs
   .help()
   .wrap(Math.min(120, yargs().terminalWidth())).argv;
 
-async function loadBom(input, platform) {
+/**
+ * Loads the BOM. When signatures are verified, the text must also pass
+ * parseStrictJson(), and `strictError` explains why it did not.
+ */
+async function loadBom(input, platform, strict, requireSignature) {
   if (safeExistsSync(input)) {
     try {
       if (isProtoBomPath(input)) {
@@ -141,9 +156,18 @@ async function loadBom(input, platform) {
           "cdx-validate",
           "protobuf BOM input",
         );
-        return readBinary(input, true);
+        return { bomJson: readBinary(input, true) };
+      }
+      const bytes = fs.readFileSync(input);
+      const bomJson = JSON.parse(bytes.toString("utf8"));
+      if (strict) {
+        try {
+          parseStrictJson(bytes);
+        } catch (err) {
+          return { bomJson, strictError: err.message };
+        }
       }
-      return JSON.parse(fs.readFileSync(input, "utf8"));
+      return { bomJson };
     } catch (err) {
       console.error(`Failed to parse ${input}: ${err.message}`);
       process.exit(1);
@@ -154,21 +178,49 @@ async function loadBom(input, platform) {
     input.includes("docker") ||
     input.includes("ghcr")
   ) {
-    const bom = await getBomWithOras(input, platform);
-    if (bom) return bom;
+    let strictError;
+    try {
+      const bom = await getBomWithOras(
+        input,
+        platform,
+        strict ? { checkBytes: parseStrictJson } : {},
+      );
+      if (bom) return { bomJson: bom };
+    } catch (err) {
+      if (requireSignature) {
+        console.error(
+          `cdx-validate: signature verification failed — the attached BOM cannot be verified: ${err.message}`,
+        );
+        process.exit(4);
+      }
+      strictError = err.message;
+    }
+    if (strictError) {
+      const bom = await getBomWithOras(input, platform);
+      if (bom) return { bomJson: bom, strictError };
+    }
   }
   console.error(`Input '${input}' is not a readable SBOM.`);
   process.exit(1);
   return undefined;
 }
 
-function loadPublicKey(path) {
-  if (!path) return null;
+function loadKeyFile(path, label, encoding) {
+  if (path === undefined) return null;
+  if (typeof path !== "string" || !path.trim()) {
+    console.error(`cdx-validate: ${label} needs exactly one file path.`);
+    process.exit(1);
+  }
   if (!safeExistsSync(path)) {
-    console.error(`Public key '${path}' not found.`);
+    console.error(`${label} '${path}' not found.`);
     process.exit(1);
   }
-  return fs.readFileSync(path, "utf8");
+  const content = fs.readFileSync(path, encoding);
+  if (!content.toString().trim()) {
+    console.error(`${label} '${path}' is empty.`);
+    process.exit(1);
+  }
+  return content;
 }
 
 function splitCsv(value) {
@@ -198,19 +250,32 @@ function isLocalProtoBomInput(input) {
   return isProtoBomPath(input);
 }
 
-const bomJson = await loadBom(args.input, args.platform);
-const publicKeyStr = loadPublicKey(args.publicKey);
+const keyGiven = args.publicKey !== undefined || args.secretKey !== undefined;
+const requireSignature = args.requireSignature ?? keyGiven;
+const { bomJson, strictError } = await loadBom(
+  args.input,
+  args.platform,
+  keyGiven,
+  requireSignature,
+);
+if (args.publicKey !== undefined && args.secretKey !== undefined) {
+  console.error("cdx-validate: use either --public-key or --secret-key.");
+  process.exit(1);
+}
+const publicKeyStr = loadKeyFile(args.publicKey, "Public key", "utf8");
+const secretKey = loadKeyFile(args.secretKey, "Shared secret");
+const verificationRequested = keyGiven;
 const inputIsLocalProtoBom = isLocalProtoBomInput(args.input);
 if (!isCycloneDxBom(bomJson)) {
   console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-validate"));
   process.exit(1);
 }
 
-if (inputIsLocalProtoBom && publicKeyStr) {
+if (inputIsLocalProtoBom && verificationRequested) {
   console.error(
     "cdx-validate: protobuf BOM input does not currently preserve JSF signature blocks. Verify signatures against the source JSON BOM instead.",
   );
-  process.exit(args.requireSignature ? 4 : 1);
+  process.exit(requireSignature ? 4 : 1);
 }
 
 const report = await validateBomAdvanced(bomJson, {
@@ -221,8 +286,17 @@ const report = await validateBomAdvanced(bomJson, {
   minSeverity: args.minSeverity,
   includeManual: args.includeManual,
   includePass: args.includePass,
-  publicKey: publicKeyStr || undefined,
+  publicKey: publicKeyStr ?? undefined,
+  secretKey: secretKey ?? undefined,
+  nestedSignatures: args.nestedSignatures,
 });
+if (strictError && verificationRequested) {
+  report.signatureVerified = false;
+  report.signatureEntries = null;
+  report.signatureDetails = {
+    error: `the BOM cannot be verified: ${strictError}`,
+  };
+}
 
 let output;
 try {
@@ -242,17 +316,31 @@ try {
 
 writeOrPrint(output, args.reportFile);
 
+for (const e of report.validationErrors || []) {
+  console.error(`cdx-validate: ${e.stage} validation threw: ${e.message}`);
+}
+
 const { shouldFail: fail, reason } = shouldFail(report, {
   failSeverity: args.failSeverity,
   strict: args.strict,
-  requireSignature: Boolean(args.requireSignature && publicKeyStr),
+  requireSignature: Boolean(requireSignature && verificationRequested),
 });
 
-if (report.signatureVerified === false && args.requireSignature) {
+if (report.signatureVerified === false && verificationRequested) {
   console.error(
     `cdx-validate: signature verification failed — ${report.signatureDetails?.error || "no matching key"}.`,
   );
-  process.exit(4);
+  if (requireSignature) {
+    process.exit(4);
+  }
+}
+const unverifiedEntries = (report.signatureEntries || []).filter(
+  (entry) => !entry.verified,
+);
+if (report.signatureVerified && unverifiedEntries.length) {
+  console.error(
+    `cdx-validate: warning — ${unverifiedEntries.length} of ${report.signatureEntries.length} signature entries did not verify with the given key: ${unverifiedEntries.map((entry) => `entry ${entry.index}${entry.keyId === undefined ? "" : ` (keyId '${displayValue(entry.keyId)}')`}`).join(", ")}.`,
+  );
 }
 
 if (args.strict && report.schemaValid === false) {