@cdxgen/cdxgen 13.2.0 → 13.4.0

package/bin/verify.js

@@ -13,13 +13,19 @@ import {
   retrieveCdxgenVersion,
   safeExistsSync,
 } from "../lib/ecosystems/utils.js";
-import { verifyNode } from "../lib/helpers/bomSigner.js";
+import {
+  displayValue,
+  loadSharedSecret,
+  loadVerificationKey,
+  verifyBomSignatures,
+} from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
 } from "../lib/inventory/bomUtils.js";
 import { isProtoBomPath } from "../lib/inventory/protobomLoader.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 
 const dirName = dirNameStr;
 
@@ -36,14 +42,33 @@ const args = _yargs
     description: "The platform to validate. No default",
   })
   .option("public-key", {
-    default: "public.key",
-    description: "Public key in PEM format. Default public.key",
+    type: "array",
+    string: true,
+    description:
+      "Trusted public key in PEM format. Repeat to trust several keys; a signature entry verifies when one of them verifies it.",
+  })
+  .option("secret-key", {
+    type: "string",
+    description:
+      "File holding the shared secret for HMAC (HS256, HS384, HS512) signatures. HMAC signatures are only accepted with this option.",
   })
   .option("deep", {
     type: "boolean",
     default: true,
     description:
-      "Strictly verify all nested component, service, and annotation signatures against the provided public key. Pass --no-deep to verify only the root signature.",
+      "Strictly verify all nested component, service, and annotation signatures against the provided keys. Pass --no-deep to verify only the root signature.",
+  })
+  .option("require-all", {
+    type: "boolean",
+    default: false,
+    description:
+      "Require every entry of a signers or chain signature to verify with one of the keys, instead of at least one.",
+  })
+  .option("allow-nested-only", {
+    type: "boolean",
+    default: false,
+    description:
+      "Accept a BOM without a root signature when every component, service, and annotation carries a signature that verifies. No signature then covers the other members of the BOM.",
   })
   .completion("completion", "Generate bash/zsh completion")
   .epilogue("for documentation, visit https://cdxgen.github.io/cdxgen")
@@ -87,7 +112,7 @@ async function getBom(args) {
       process.exit(1);
     }
     try {
-      return JSON.parse(fs.readFileSync(args.input, "utf8"));
+      return parseStrictJson(fs.readFileSync(args.input));
     } catch (error) {
       console.log(`Failed to parse '${args.input}': ${error.message}`);
       process.exit(1);
@@ -98,11 +123,32 @@ async function getBom(args) {
     args.input.includes("docker") ||
     args.input.includes("ghcr")
   ) {
-    return await getBomWithOras(args.input, args.platform);
+    try {
+      return await getBomWithOras(args.input, args.platform, {
+        checkBytes: parseStrictJson,
+      });
+    } catch (error) {
+      console.log(
+        `Failed to parse the BOM attached to '${args.input}': ${error.message}`,
+      );
+      process.exit(1);
+    }
   }
   return undefined;
 }
 
+const publicKeyFiles = args.publicKey || [];
+if (publicKeyFiles.length && args.secretKey) {
+  console.log("Use either --public-key or --secret-key, not both.");
+  process.exit(1);
+}
+if (!publicKeyFiles.length && !args.secretKey) {
+  console.log(
+    "Name the trusted key with --public-key <file>, or --secret-key <file> for HMAC signatures.",
+  );
+  process.exit(1);
+}
+
 const bomJson = await getBom(args);
 
 if (!bomJson) {
@@ -114,76 +160,139 @@ if (!isCycloneDxBom(bomJson)) {
   process.exit(1);
 }
 
-if (bomJson && !safeExistsSync(args.publicKey)) {
-  console.log("Public key for signature verification is missing!");
-  process.exit(1);
+const verificationKeys = [];
+for (const keyFile of args.secretKey ? [args.secretKey] : publicKeyFiles) {
+  if (!safeExistsSync(keyFile)) {
+    console.log(
+      args.secretKey
+        ? `Shared secret '${keyFile}' for signature verification is missing!`
+        : `Public key '${keyFile}' for signature verification is missing!`,
+    );
+    process.exit(1);
+  }
+  try {
+    verificationKeys.push(
+      args.secretKey
+        ? loadSharedSecret(fs.readFileSync(keyFile))
+        : loadVerificationKey(fs.readFileSync(keyFile, "utf8")),
+    );
+  } catch (error) {
+    console.log(`Unable to use '${keyFile}': ${error.message}`);
+    process.exit(1);
+  }
 }
 
-const publicKeyStr = fs.readFileSync(args.publicKey, "utf8");
-
-let rootMatch = null;
-if (bomJson.signature) {
-  rootMatch = verifyNode(bomJson, publicKeyStr);
+function describeEntry(node, entry) {
+  const parts = [displayValue(entry.algorithm)];
+  if (entry.keyId !== undefined) {
+    parts.push(`keyId '${displayValue(entry.keyId)}'`);
+  }
+  const position =
+    node.form === "single" ? "" : `${node.form}[${entry.index}] `;
+  return `${position}(${parts.join(", ")})`;
 }
 
-const verifyNested = args.deep || !bomJson.signature;
-let hasInvalidNested = false;
-let checkedNested = 0;
-
-if (verifyNested) {
-  for (const comp of bomJson.components || []) {
-    if (comp.signature) {
-      checkedNested++;
-      if (!verifyNode(comp, publicKeyStr)) {
-        console.log(
-          `Component '${comp["bom-ref"] || comp.name}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
-      }
-    }
+function printRejections(node) {
+  for (const reason of node.reasons) {
+    console.log(`  - ${reason}`);
   }
-  for (const svc of bomJson.services || []) {
-    if (svc.signature) {
-      checkedNested++;
-      if (!verifyNode(svc, publicKeyStr)) {
-        console.log(
-          `Service '${svc["bom-ref"] || svc.name}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
-      }
-    }
-  }
-  for (const ann of bomJson.annotations || []) {
-    if (ann.signature) {
-      checkedNested++;
-      if (!verifyNode(ann, publicKeyStr)) {
-        console.log(
-          `Annotation '${ann["bom-ref"] || ann.subject}' signature is invalid!`,
-        );
-        hasInvalidNested = true;
-      }
+  for (const entry of node.entries) {
+    for (const reason of entry.reasons) {
+      console.log(
+        `  - ${node.form === "single" ? "" : `${node.form}[${entry.index}]: `}${reason}`,
+      );
     }
   }
 }
 
-if (hasInvalidNested) {
+const report = verifyBomSignatures(bomJson, verificationKeys, {
+  deep: args.deep,
+  allowNestedOnly: args.allowNestedOnly,
+  requireAll: args.requireAll,
+});
+
+for (const error of report.errors) {
+  console.log(error);
+}
+const keyFiles = args.secretKey ? [args.secretKey] : publicKeyFiles;
+if (args.requireAll && report.root?.form) {
+  report.root.keysMatched.forEach((matched, index) => {
+    if (!matched) {
+      console.log(`  - key #${index + 1}: ${keyFiles[index]}`);
+    }
+  });
+}
+const invalidNested = report.nested.filter((item) => !item.verified);
+for (const item of invalidNested) {
+  console.log(`${item.label} signature is invalid!`);
+  printRejections(item);
+}
+if (invalidNested.length) {
   console.log("One or more nested signatures are invalid!");
+  if (report.root?.verified) {
+    console.log(
+      "The root signature verifies with this key. Nested signatures belong to the party that created them, so pass --no-deep to verify only the root signature with this key.",
+    );
+  }
+}
+if (report.root && !report.root.verified) {
+  console.log("BOM signature is invalid!");
+  printRejections(report.root);
+  if (!report.root.reasons.length && !report.root.match) {
+    console.log(
+      "If this BOM was signed with cdxgen 13.2.0 or earlier, re-sign it with this version of cdx-sign.",
+    );
+  }
+}
+if (!report.root && !bomJson.signature && !args.allowNestedOnly) {
+  console.log(
+    "Pass --allow-nested-only to accept a BOM whose components, services, and annotations are all signed.",
+  );
+}
+for (const notice of report.notices) {
+  console.log(`Note: ${notice}`);
+}
+if (!report.verified) {
   process.exit(1);
 }
 
-if (bomJson.signature) {
-  if (rootMatch) {
-    const identifier = rootMatch.keyId
-      ? `KeyId: '${rootMatch.keyId}'`
-      : `Algorithm: '${rootMatch.algorithm}'`;
-    console.log(`✓ Signature is valid! (Matched ${identifier})`);
-  } else {
-    console.log("BOM signature is invalid!");
-    process.exit(1);
+if (report.root) {
+  const rootMatch = report.root.match;
+  const identifier = rootMatch.keyId
+    ? `KeyId: '${displayValue(rootMatch.keyId)}'`
+    : `Algorithm: '${rootMatch.algorithm}'`;
+  console.log(`✓ Signature is valid! (Matched ${identifier})`);
+  const unverified = report.root.entries.filter((entry) => !entry.verified);
+  if (unverified.length) {
+    console.log(
+      `Warning: ${unverified.length} of ${report.root.entries.length} ${report.root.form} entries did not verify with the given key(s). Pass --require-all to fail in that case.`,
+    );
+    for (const entry of unverified) {
+      console.log(
+        `  - ${describeEntry(report.root, entry)}: ${entry.reasons[0] || "not verified"}`,
+      );
+    }
   }
-} else if (checkedNested > 0 && !hasInvalidNested) {
-  console.log(`✓ ${checkedNested} nested signature(s) are valid!`);
 } else {
-  console.log("No valid signatures found to verify!");
-  process.exit(1);
+  console.log(`✓ ${report.nested.length} nested signature(s) are valid!`);
+}
+const MAX_LISTED_ENTRIES = 10;
+const unverifiedNested = report.nested.flatMap((item) =>
+  item.entries
+    .filter((entry) => !entry.verified)
+    .map(
+      (entry) =>
+        `${item.label} ${describeEntry(item, entry)}: ${entry.reasons[0] || "not verified"}`,
+    ),
+);
+if (unverifiedNested.length) {
+  console.log(
+    `Warning: ${unverifiedNested.length} nested signature entries did not verify with the given key(s). Pass --require-all to fail in that case.`,
+  );
+  for (const line of unverifiedNested.slice(0, MAX_LISTED_ENTRIES)) {
+    console.log(`  - ${line}`);
+  }
+  if (unverifiedNested.length > MAX_LISTED_ENTRIES) {
+    console.log(`  - and ${unverifiedNested.length - MAX_LISTED_ENTRIES} more`);
+  }
 }

package/data/helpers/init.gradle

@@ -17,14 +17,51 @@ allprojects {
         // attached to the matching component instead of guessing the first repository.
         if (project.hasProperty('cdxgenResolveDistribution') &&
                 project.property('cdxgenResolveDistribution').toString() == 'true') {
-            def resolvedKeys = [] as Set
+            // Shared by every project in the build, so a dependency declared in
+            // many subprojects is probed once, and a repository host that
+            // answers 429 is left alone for the rest of the build.
+            if (!gradle.ext.has('cdxgenResolvedKeys')) {
+                gradle.ext.cdxgenResolvedKeys = java.util.concurrent.ConcurrentHashMap.newKeySet()
+                gradle.ext.cdxgenPausedHosts = java.util.concurrent.ConcurrentHashMap.newKeySet()
+            }
+            def resolvedKeys = gradle.ext.cdxgenResolvedKeys
+            def pausedHosts = gradle.ext.cdxgenPausedHosts
+            // A HEAD request answers whether the repository serves the file
+            // without downloading it. Other URL schemes, such as file:, are
+            // opened and closed.
+            def artifactExists = { String artifactUrl ->
+                try {
+                    def url = new URL(artifactUrl)
+                    if (url.protocol == 'http' || url.protocol == 'https') {
+                        if (pausedHosts.contains(url.host)) {
+                            return false
+                        }
+                        def connection = (HttpURLConnection) url.openConnection()
+                        connection.requestMethod = 'HEAD'
+                        connection.instanceFollowRedirects = true
+                        connection.connectTimeout = 10000
+                        connection.readTimeout = 10000
+                        def code = connection.responseCode
+                        connection.disconnect()
+                        if (code == 429) {
+                            pausedHosts.add(url.host)
+                        }
+                        return code >= 200 && code < 300
+                    }
+                    def stream = url.openStream()
+                    stream.close()
+                    return true
+                } catch (Exception ignored) {
+                    return false
+                }
+            }
             project.configurations.each { configuration ->
                 configuration.dependencies.each { dependency ->
                     if (dependency.group == null || dependency.version == null) {
                         return
                     }
                     def depKey = String.format("%s:%s:%s", dependency.group, dependency.name, dependency.version)
-                    if (resolvedKeys.contains(depKey)) {
+                    if (!resolvedKeys.add(depKey)) {
                         return
                     }
                     def groupPath = dependency.group.replace('.', '/')
@@ -40,28 +77,16 @@ allprojects {
                         def jarUrl = String.format("%s%s/%s/%s/%s-%s.jar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
+                        if (artifactExists(jarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
+                            break
+                        }
                         def aarUrl = String.format("%s%s/%s/%s/%s-%s.aar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
-                        try {
-                            def inStreamJar = new URL(jarUrl).openStream()
-                            if (inStreamJar != null) {
-                                inStreamJar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
-                        }
-                        try {
-                            def inStreamAar = new URL(aarUrl).openStream()
-                            if (inStreamAar != null) {
-                                inStreamAar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
+                        if (artifactExists(aarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
+                            break
                         }
                     }
                 }

package/data/remediations.json

@@ -263,6 +263,46 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "build.rate-limited": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "A build tool's repository rate limited the machine, so its dependency tree did not resolve",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Maven: declare a <mirror> in the Maven settings.xml, or set MVNW_REPOURL for the Maven wrapper"
+      },
+      {
+        "kind": "config",
+        "command": "Gradle: declare the mirror repository in a Gradle init script"
+      },
+      {
+        "kind": "config",
+        "command": "sbt: list the mirror in ~/.sbt/repositories and pass -Dsbt.override.build.repos=true in SBT_OPTS or .sbtopts"
+      },
+      {
+        "kind": "config",
+        "command": "Mill and scala-cli: set central.from and central.to in Coursier's mirror.properties, separating several central.from URLs with semicolons"
+      },
+      {
+        "kind": "env",
+        "command": "Point MAVEN_CENTRAL_URL at a mirror for cdxgen's own lookups"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "build.rate-limited"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ADVANCED"
+  },
   "js.no-lockfile": {
     "ecosystem": "npm",
     "kind": "evidence.degraded",
@@ -709,6 +749,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "dosai.semantics.persist-failed": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "none",
+    "title": "The combined dosai report could not be written to the semantics slices file; the SBOM evidence is unaffected",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Check that the --semantics-slices-file path is writable and has room for a report the size of the dosai slices."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.semantics.persist-failed"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -1163,5 +1227,26 @@
       ]
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "policy.rate-limited": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "licenses",
+    "title": "A registry rate limited this run, so its metadata came from local caches only",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Point MAVEN_CENTRAL_URL at a mirror or repository manager, or wait for the block to expire, then re-run"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.rate-limited"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
   }
 }

package/data/rules/dependency-sources.yaml

@@ -234,3 +234,70 @@
       "registry": $prop($, 'cdx:pypi:registry'),
       "resolvedFrom": $prop($, 'cdx:pypi:resolved_from')
     }
+- id: PKG-012
+  name: "Terraform module from mutable VCS reference"
+  description: "Terraform modules sourced from git or mercurial without a commit or tag pin are not locked, so the next init can fetch different code"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType')
+      and ($prop($, 'cdx:tf:module:sourceType') = 'git' or $prop($, 'cdx:tf:module:sourceType') = 'hg')
+      and ($prop($, 'cdx:tf:module:pinning') = 'branch' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' tracks VCS source '{{ $prop($, 'cdx:tf:module:source') }}' at a mutable reference"
+  mitigation: "Pin the module source with `?ref=<commit sha>` or a reviewed, signed tag; the dependency lock file does not cover modules"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "ref": $prop($, 'cdx:tf:module:ref'),
+      "pinning": $prop($, 'cdx:tf:module:pinning')
+    }
+- id: PKG-013
+  name: "Terraform registry module not pinned to an exact version"
+  description: "Registry modules whose version argument is a range or absent resolve to whatever the registry serves at the next init"
+  severity: low
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType') and $prop($, 'cdx:tf:module:sourceType') = 'registry'
+      and ($prop($, 'cdx:tf:module:pinning') = 'range' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform registry module '{{ $prop($, 'cdx:tf:address') }}' is not pinned to an exact version (pinning: {{ $prop($, 'cdx:tf:module:pinning') }})"
+  mitigation: "Set the module's `version` argument to a single exact version and review upgrades deliberately"
+  evidence: |
+    {
+      "constraints": $prop($, 'cdx:tf:constraints'),
+      "pinning": $prop($, 'cdx:tf:module:pinning'),
+      "address": $prop($, 'cdx:tf:address')
+    }
+- id: PKG-014
+  name: "Terraform module source embeds credentials"
+  description: "A module source string carries a credential such as URL userinfo, a git sshkey parameter or S3 keys, exposing the secret to every reader of the configuration"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:module:credentialInSource')
+      and $prop($, 'cdx:tf:module:credentialInSource') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' resolves from a source that embeds credentials"
+  mitigation: "Rotate the exposed credential, move authentication to git credential helpers or an SSH agent, and keep the source URL credential-free"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "credentialInSource": $prop($, 'cdx:tf:module:credentialInSource')
+    }

package/data/rules/scala-evidence.yaml

@@ -0,0 +1,115 @@
+# Scala Evinse and scalasem Rules
+# Categories: scala-security, scala-compliance
+# Evaluates cdx:scalasem:* properties and the crypto assets emitted by
+# evinse -l scala and cdxgen --evidence for Scala projects.
+
+- id: SCALA-SEC-001
+  name: "Scala source uses a weak cryptographic algorithm in runtime code"
+  description: "scalasem flagged a weak algorithm, mode or key size at a call site in main or generated sources (MD5, SHA-1, DES, ECB, or a key below the modern floor)"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'cryptographic-asset'
+      and $prop($, 'cdx:scalasem:crypto:weak') = 'true'
+      and (
+        'main' in properties[name = 'cdx:scalasem:usageScopes'].value
+        or 'generated' in properties[name = 'cdx:scalasem:usageScopes'].value
+      )
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm '{{ name }}' used in Scala source"
+  mitigation: "Move to the modern equivalent of this algorithm, mode and key size, and confirm no compatibility constraint forces the weak one. The locations name the exact call sites"
+  evidence: |
+    {
+      "algorithm": name,
+      "oid": cryptoProperties.oid,
+      "api": $prop($, 'cdx:scalasem:crypto:api'),
+      "locations": evidence.occurrences.(location & '#' & line)
+    }
+
+- id: SCALA-SEC-002
+  name: "Scala source calls an outbound service over plaintext transport"
+  description: "scalasem found an outbound HTTP or websocket client whose target URL starts with http:// or ws:// and is not a loopback address, so traffic and credentials cross the network unencrypted"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) {
+        ($contains($e, 'http://') or $contains($e, 'ws://'))
+        and $not($contains($e, /:\/\/(localhost|127\.[0-9.]+|\[::1\])(:|\/|$)/))
+      }))
+      and $prop($, 'cdx:scalasem:service:kind') != null
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Outbound service '{{ name }}' is called over plaintext"
+  mitigation: "Switch the target to https:// or wss://, or a local socket if the peer is on the same host. The call sites are named by the service's cdx:scalasem:service:location properties"
+  evidence: |
+    {
+      "kind": $prop($, 'cdx:scalasem:service:kind'),
+      "client": $prop($, 'cdx:scalasem:service:client'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-003
+  name: "Admin-like Scala endpoint is not marked as authenticated"
+  description: "scalasem found an inbound route with an admin, internal, manage or debug path segment that the report does not mark as authenticated. The source analysis does not see middleware or gateways, so this is a path-based prompt for review"
+  severity: low
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) { $contains($e, /(^|\/)(admin|internal|manage|debug)(\/|$)/) }))
+      and $prop($, 'cdx:scalasem:endpoint:framework') != null
+      and $not(authenticated = true)
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Endpoint '{{ name }}' looks administrative and is not marked as authenticated"
+  mitigation: "Confirm the route is protected by middleware or a gateway the source does not show, and otherwise require authentication on it. The declaration site is named by the service's cdx:scalasem:service:location property"
+  evidence: |
+    {
+      "framework": $prop($, 'cdx:scalasem:endpoint:framework'),
+      "handler": $prop($, 'cdx:scalasem:endpoint:handler'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-004
+  name: "Scala source uses a weak algorithm that has no registry OID"
+  description: "scalasem flagged a weak algorithm that the OID registry cannot name, such as an MD5 or SHA-1 based signature or an RC4 password scheme, so it is recorded as a property instead of a crypto asset"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    $append(components, metadata.component)[
+      $exists(properties[name = 'cdx:scalasem:crypto:weakFinding'])
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm used in Scala source, recorded on '{{ name }}'"
+  mitigation: "Move to a modern algorithm. Each finding names the algorithm and its call site as name@file#line"
+  evidence: |
+    {
+      "findings": properties[name = 'cdx:scalasem:crypto:weakFinding'].value
+    }
+
+- id: SCALA-COMP-001
+  name: "Scala semantic evidence is incomplete"
+  description: "The scalasem run behind this BOM was degraded, for example by class files no compiler could read, a missing classpath, a timeout or a failed analyzer, so the BOM's Scala evidence may be missing usages, crypto findings or services"
+  severity: low
+  category: scala-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[$prop($, 'cdx:scalasem:degraded') = 'true']
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "The Scala semantic evidence for '{{ name }}' is incomplete"
+  mitigation: "Read the cdx:scalasem:diagnostic:* metadata properties for the cause, and build the project before scanning when the diagnostics name missing class files or a missing classpath"
+  evidence: |
+    {
+      "diagnostics": $filter(properties, function($p) { $contains($p.name, 'cdx:scalasem:diagnostic:') }).(name & '=' & value)
+    }