@cdxgen/cdxgen 13.3.0 → 13.4.0

package/README.md

@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.3.0"
+VERSION="v13.4.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.3.0"
+VERSION="v13.4.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.3.0"
+$Version = "v13.4.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.3.0 \
+      gh release download v13.4.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'
@@ -759,9 +759,9 @@ BOMs signed with cdxgen 13.2.0 or earlier must be re-signed with the current `cd
 For complex supply chain orchestration, use the bundled `cdx-sign` CLI. This tool allows multiple entities (e.g., a Builder and an Auditor) to co-sign an existing BOM without modifying its original data.
 
 ```shell
-# Append a parallel multi-signature (Auditor co-signing)
+# Append a parallel multi-signature (Auditor co-signing) after checking the Builder's signature
 # Note: Granular component signing is disabled to preserve the Builder's original signature payload.
-cdx-sign -i bom.json -k auditor_private.pem -a ES256 --key-id "auditor-qa" --mode signers --no-sign-components
+cdx-sign -i bom.json -k auditor_private.pem -a ES256 --key-id "auditor-qa" --mode signers --no-sign-components --verify-existing-with builder_public.pem
 ```
 
 ### Validating CycloneDX BOMs
@@ -780,6 +780,9 @@ cdx-verify -i bom.json --public-key public.key
 
 # Verify ONLY the top-level root signature (useful for verifying a multi-signer who didn't sign nested components)
 cdx-verify -i bom.json --public-key auditor_public.key --no-deep
+
+# Require every co-signer
+cdx-verify -i bom.json --public-key builder_public.key --public-key auditor_public.key --require-all
 ```
 
 ### Verifying the signature (pnpm)

package/bin/cdxgen.js

@@ -34,6 +34,7 @@ import {
   isDeferredFailOnError,
 } from "../lib/core/deferredExit.js";
 import { TRACE_MODE, thoughtEnd, thoughtLog } from "../lib/core/logger.js";
+import { resolveSourcePathArgument } from "../lib/core/pluginRun.js";
 import {
   PROJECT_CONFIG_FILENAMES,
   sanitizeProjectConfig,
@@ -263,12 +264,12 @@ const args = _yargs
   .option("cmake-cache", {
     type: "string",
     description:
-      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup under build/, out/ and cmake-build-*/.",
+      "Path to the CMakeCache.txt of a configured C/C++ build. Overrides the lookup in the build directories of the CMake presets, build*/, out/, builddir/ and cmake-build-*/.",
   })
   .option("compile-commands", {
     type: "string",
     description:
-      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one. atom then parses each file with its build's include paths, macros and language. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
   })
   .option("git-branch", {
     description: "Git branch to clone when the source is a git URL or purl",
@@ -456,6 +457,23 @@ const args = _yargs
     default: false,
     description: "Generate SBOM with evidence for supported languages.",
   })
+  .option("scalasem", {
+    type: "boolean",
+    default: true,
+    description:
+      "Run the Scala semantic analyzer for the evidence of Scala projects. Use --no-scalasem to skip it.",
+  })
+  .option("scalasem-command", {
+    type: "string",
+    description:
+      "Use a specific scalasem script for the Scala evidence. Defaults to SCALASEM_CMD.",
+  })
+  .option("scalasem-include-tests", {
+    type: "boolean",
+    default: false,
+    description:
+      "Include test sources in the Scala evidence, tagged with their usage scope.",
+  })
   .option("deps-slices-file", {
     description: "Path for the parsedeps slice file created by atom.",
     default: "deps.slices.json",
@@ -893,7 +911,7 @@ const args = _yargs
     type: "boolean",
     default: true,
     description:
-      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run.",
+      "Use the on-disk metadata cache for registry lookups. Pass --no-cache to bypass it for this run; answers are still remembered within the run.",
   })
   .option("cache-ttl", {
     type: "number",
@@ -1013,9 +1031,24 @@ if (!readEnvironmentVariable("NODE_USE_SYSTEM_CA")) {
   process.env.NODE_USE_SYSTEM_CA = "1";
 }
 
-const filePath = args._[0] || process.cwd();
+let filePath = args._[0] || process.cwd();
 const sourceInputIsRemoteOrPurl =
   maybeRemotePath(filePath) || maybePurlSource(filePath);
+// Resolve the source argument once, before anything uses it. With the working
+// directory already set to the project and the argument relative to a
+// repository root (depscan's launch shape), every later resolve would produce
+// <project>/<argument>, a directory that does not exist: the BOM came out
+// empty and the plugins analyzed nothing, while the run still exited 0.
+if (!sourceInputIsRemoteOrPurl && args._?.[0]) {
+  const sourceResolution = resolveSourcePathArgument(filePath);
+  if (sourceResolution.rewritten) {
+    console.warn(
+      `Source path '${filePath}' does not exist relative to the working directory, which is itself the directory it names; using '${sourceResolution.path}'.`,
+    );
+    filePath = sourceResolution.path;
+    args._[0] = filePath;
+  }
+}
 if (!args.projectName) {
   if (filePath !== ".") {
     args.projectName = basename(filePath);
@@ -2137,30 +2170,61 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
         sourcePath: filePath,
       });
       const evinserModule = await import("../lib/evinser/evinser.js");
-      options.projectType = options.projectType || ["java"];
-      const evinseOptions = evinserModule.buildEvinseOptions(
-        options,
-        args,
-        internalCycloneDxInputPath || options.output,
-      );
-      const dbObjMap = await evinserModule.prepareDB(evinseOptions);
-      if (dbObjMap) {
-        const sliceArtefacts = await evinserModule.analyzeProject(
-          dbObjMap,
-          evinseOptions,
+      if (!options.projectType) {
+        const evidenceLanguage = evinserModule.defaultEvidenceLanguage(
+          filePath,
+          bomNSData?.bomJson,
+          options,
+        );
+        if (evidenceLanguage) {
+          options.projectType = [evidenceLanguage];
+        }
+      }
+      if (!options.projectType) {
+        console.log(
+          "Skipping the evidence analysis since the BOM lists no package in a language it supports. Pass -t to choose the language.",
         );
-        const evinseJson = await evinserModule.createEvinseFile(
-          sliceArtefacts,
-          evinseOptions,
+        if (bomNSData) {
+          bomNSData.bomJson = applyEvidenceBasedFilter(
+            bomNSData.bomJson,
+            options,
+          );
+        }
+      } else {
+        const evinseOptions = evinserModule.buildEvinseOptions(
+          options,
+          args,
+          internalCycloneDxInputPath || options.output,
         );
-        // The scope filter is deferred until here so the analyzers get to
-        // prove that an optional dependency is actually used.
-        bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
-        if (options.print && evinseJson) {
-          printOccurrences(evinseJson);
-          printCallStack(evinseJson);
-          printReachables(sliceArtefacts);
-          printServices(evinseJson);
+        try {
+          const dbObjMap = await evinserModule.prepareDB(evinseOptions);
+          if (dbObjMap) {
+            const sliceArtefacts = await evinserModule.analyzeProject(
+              dbObjMap,
+              evinseOptions,
+            );
+            const evinseJson = await evinserModule.createEvinseFile(
+              sliceArtefacts,
+              evinseOptions,
+            );
+            // The scope filter is deferred until here so the analyzers get to
+            // prove that an optional dependency is actually used.
+            bomNSData.bomJson = applyEvidenceBasedFilter(evinseJson, options);
+            if (options.print && evinseJson) {
+              printOccurrences(evinseJson);
+              printCallStack(evinseJson);
+              printReachables(sliceArtefacts);
+              printServices(evinseJson);
+            }
+          }
+        } catch (err) {
+          // A rusi/golem analysis failure under --fail-on-error on an
+          // introspected run defers its exit so the BOM and the reports are
+          // still written; the run continues here without the reachability
+          // evidence, exactly as the deferral contract describes.
+          if (!isDeferredFailOnError(err)) {
+            throw err;
+          }
         }
       }
     }

package/bin/evinse.js

@@ -91,7 +91,7 @@ const args = yargs(hideBin(process.argv))
   })
   .option("compile-commands", {
     description:
-      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root, build/, out/, builddir/ and cmake-build-*/, which is skipped in secure mode.",
+      "Path to the compile_commands.json of a C/C++ build, or a directory holding one, for atom to parse each file as its build does. Overrides the lookup in the project root and its build directories (those of the CMake presets, build*/, out/, builddir/, cmake-build-*/), which is skipped in secure mode.",
     type: "string",
   })
   .option("golem-command", {
@@ -264,6 +264,23 @@ const args = yargs(hideBin(process.argv))
     description: "Use an existing usages slices file.",
     default: "usages.slices.json",
   })
+  .option("scalasem-command", {
+    description:
+      "Use a specific scalasem script for Scala evidence analysis. Defaults to SCALASEM_CMD.",
+    default: readEnvironmentVariable("SCALASEM_CMD"),
+  })
+  .option("scalasem-include-tests", {
+    description:
+      "Include test sources in the Scala semantic evidence, tagged with their usage scope.",
+    default: false,
+    type: "boolean",
+  })
+  .option("scalasem", {
+    description:
+      "Run the Scala semantic analyzer for Scala projects. Use --no-scalasem to skip it and keep the plain BOM.",
+    default: true,
+    type: "boolean",
+  })
   .option("data-flow-slices-file", {
     description: "Use an existing data-flow slices file.",
     default: "data-flow.slices.json",

package/bin/repl.js

@@ -1741,6 +1741,92 @@ cdxgenRepl.defineCommand("golemcoverage", {
     this.displayPrompt();
   },
 });
+function hasScalasemProperties(component) {
+  return Boolean(
+    component?.properties?.some((property) =>
+      property?.name?.startsWith("cdx:scalasem:"),
+    ),
+  );
+}
+
+cdxgenRepl.defineCommand("scalasemsummary", {
+  help: "summarize Scala Evinse/scalasem metadata and evidence coverage",
+  action() {
+    const interactiveBom = getInteractiveBom();
+    if (!interactiveBom) {
+      console.log("⚠ No BOM is loaded. Use .import command to import an SBOM");
+      this.displayPrompt();
+      return;
+    }
+    if (!hasScalasemProperties(interactiveBom.metadata?.component)) {
+      console.log(
+        "No scalasem properties found. Generate an evidence BOM with evinse -l scala or cdxgen --evidence to use this view.",
+      );
+      this.displayPrompt();
+      return;
+    }
+    const rootComponent = interactiveBom.metadata?.component || {};
+    const components = interactiveBom.components || [];
+    const occurrences = components.reduce(
+      (total, component) =>
+        total + (component?.evidence?.occurrences?.length || 0),
+      0,
+    );
+    const occurrencesWithLine = components.reduce(
+      (total, component) =>
+        total +
+        (component?.evidence?.occurrences || []).filter(
+          (occurrence) => occurrence?.line,
+        ).length,
+      0,
+    );
+    const callstacks = components.filter(
+      (component) => component?.evidence?.callstack?.frames?.length,
+    ).length;
+    const cryptoAssets = components.filter(
+      (component) => component?.type === "cryptographic-asset",
+    ).length;
+    printKeyValueTable("Scala Evinse / scalasem summary", [
+      [
+        "Schema version",
+        getPropertyValue(rootComponent, "cdx:scalasem:schemaVersion"),
+      ],
+      [
+        "Facts source",
+        getPropertyValue(rootComponent, "cdx:scalasem:factsSource"),
+      ],
+      [
+        "Scala versions",
+        getPropertyValue(rootComponent, "cdx:scalasem:scalaVersions"),
+      ],
+      ["Platforms", getPropertyValue(rootComponent, "cdx:scalasem:platforms")],
+      [
+        "Files analyzed",
+        getPropertyValue(rootComponent, "cdx:scalasem:filesAnalyzed"),
+      ],
+      ["Degraded", getPropertyValue(rootComponent, "cdx:scalasem:degraded")],
+      ...(rootComponent.properties || [])
+        .filter((property) =>
+          property?.name?.startsWith("cdx:scalasem:diagnostic:"),
+        )
+        .map((property) => [
+          `Diagnostic ${property.name.slice("cdx:scalasem:diagnostic:".length)}`,
+          property.value,
+        ]),
+      [
+        "Components with occurrences",
+        components.filter((c) => c?.evidence?.occurrences?.length).length,
+      ],
+      ["Occurrences", occurrences],
+      ["Occurrences with line", occurrencesWithLine],
+      ["Components with call stacks", callstacks],
+      ["Crypto assets", cryptoAssets],
+      ["Services", (interactiveBom.services || []).length],
+    ]);
+    this.displayPrompt();
+  },
+});
+
 cdxgenRepl.defineCommand("auditfindings", {
   help: "summarize cdx-audit and bom-audit annotations from the loaded BOM",
   action() {

package/bin/sign.js

@@ -20,6 +20,7 @@ import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
 } from "../lib/inventory/bomUtils.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 
 const _yargs = yargs(hideBin(process.argv));
 
@@ -55,13 +56,19 @@ const args = _yargs
     type: "array",
     string: true,
     description:
-      "Public key (PEM) of an earlier signer. With --mode chain, every existing chain entry must verify with one of these keys before a new entry is appended.",
+      "Public key (PEM) of an earlier signer. Before a new entry is appended, every existing chain entry (--mode chain), or at least one existing entry (--mode signers), must verify with one of these keys.",
   })
   .option("allow-unverified-history", {
     type: "boolean",
     default: false,
     description:
-      "With --mode chain, append even when existing chain entries cannot be verified with --verify-existing-with.",
+      "With --mode chain or signers, append even when the existing signature entries cannot be verified with --verify-existing-with.",
+  })
+  .option("embed-public-key", {
+    type: "boolean",
+    default: true,
+    description:
+      "Embed the signer's public key in the root signature, which binds the signature to that key. Not used for HMAC (HS*) algorithms. Pass --no-embed-public-key to leave it out.",
   })
   .option("key-id", {
     description:
@@ -173,16 +180,19 @@ function describeEntry(result) {
     : `entry ${result.index}`;
 }
 
-// A new chain entry covers every earlier entry, so the signer vouches for
-// that history. Check it with the earlier signers' keys before appending.
-function checkChainHistory(bomJson) {
+// A new chain entry covers every earlier entry, so the signer vouches for that
+// history, and every entry must verify. A new signers entry covers the same
+// content as the existing entries, so at least one must verify to show the
+// content is still what an earlier signer signed.
+function checkExistingSignatures(bomJson) {
   const existing = bomJson.signature;
+  const otherForm = args.mode === "chain" ? "signers" : "chain";
   if (
-    args.mode !== "chain" ||
+    args.mode === "replace" ||
     existing === undefined ||
     (existing !== null &&
       typeof existing === "object" &&
-      Object.hasOwn(existing, "signers"))
+      Object.hasOwn(existing, otherForm))
   ) {
     return;
   }
@@ -192,10 +202,10 @@ function checkChainHistory(bomJson) {
     }
     return fs.readFileSync(keyFile, "utf8");
   });
-  const unverified = checkSignatureEntries(bomJson, keys).filter(
-    (result) => !result.verified,
-  );
-  if (!unverified.length) {
+  const results = checkSignatureEntries(bomJson, keys);
+  const unverified = results.filter((result) => !result.verified);
+  const chain = args.mode === "chain";
+  if (chain ? !unverified.length : unverified.length < results.length) {
     return;
   }
   const details = unverified.map(
@@ -205,7 +215,9 @@ function checkChainHistory(bomJson) {
   if (args.allowUnverifiedHistory) {
     console.warn(
       [
-        `Warning: appending to a chain with ${unverified.length} unverified entry(s):`,
+        chain
+          ? `Warning: appending to a chain with ${unverified.length} unverified entry(s):`
+          : `Warning: appending a signers entry although none of the ${unverified.length} existing entry(s) verified:`,
         ...details,
       ].join("\n"),
     );
@@ -213,7 +225,9 @@ function checkChainHistory(bomJson) {
   }
   throw new Error(
     [
-      `the new chain entry would vouch for ${unverified.length} existing entry(s) that could not be verified:`,
+      chain
+        ? `the new chain entry would vouch for ${unverified.length} existing entry(s) that could not be verified:`
+        : `none of the ${unverified.length} existing signature entry(s) could be verified, so the content may have changed since it was signed:`,
       ...details,
       "Pass --verify-existing-with <public key> for each earlier signer, or --allow-unverified-history to sign anyway.",
     ].join("\n"),
@@ -221,7 +235,7 @@ function checkChainHistory(bomJson) {
 }
 
 try {
-  const bomJson = JSON.parse(fs.readFileSync(args.input, "utf8"));
+  const bomJson = parseStrictJson(fs.readFileSync(args.input));
   if (!isCycloneDxBom(bomJson)) {
     console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-sign"));
     process.exit(1);
@@ -229,10 +243,12 @@ try {
 
   let signedBom = bomJson;
   if (hasPrivateKey && privateKeyContent) {
-    checkChainHistory(bomJson);
+    checkExistingSignatures(bomJson);
     signedBom = signBom(bomJson, {
       privateKey: privateKeyContent,
       algorithm: args.algorithm,
+      embedPublicKey: args.embedPublicKey,
+      embedPublicKeyNested: false,
       keyId: args.keyId,
       mode: args.mode,
       signComponents: args.signComponents,
@@ -247,6 +263,20 @@ try {
     console.log(
       `Mode: ${args.mode} | Algorithm: ${args.algorithm}${args.keyId ? ` | KeyId: ${args.keyId}` : ""}`,
     );
+    const rootSignature = signedBom.signature;
+    const newEntry =
+      rootSignature?.signers?.at(-1) ??
+      rootSignature?.chain?.at(-1) ??
+      rootSignature;
+    if (
+      args.embedPublicKey &&
+      !String(args.algorithm).startsWith("HS") &&
+      newEntry?.publicKey === undefined
+    ) {
+      console.warn(
+        "Warning: this key type has no JWK form, so the public key was not embedded in the signature.",
+      );
+    }
   } else {
     if (!hasAnySignature(bomJson)) {
       console.error(

package/bin/tracebom.js

@@ -14,6 +14,7 @@ import {
   safeWriteSync,
 } from "../lib/ecosystems/utils.js";
 import { DEFAULT_CDX_SPEC_VERSION } from "../lib/inventory/bomUtils.js";
+import { applySpecVersionCompatibility } from "../lib/stages/postgen/specVersionCompat.js";
 
 const _yargs = yargs(hideBin(process.argv));
 
@@ -166,7 +167,7 @@ const args = _yargs
   })
   .option("trace-crypto", {
     description:
-      "Enable eBPF-based cryptographic library and cipher suite tracing (Linux only).",
+      "Trace cryptographic libraries and TLS parameters: eBPF on Linux, crypto DLLs on Windows (elevated prompt), and TLS handshakes through --proxy-egress on every platform.",
     default: true,
     type: "boolean",
   })
@@ -337,6 +338,9 @@ const options = {
     console.error("Dynamic SBOM generation failed: no output was produced.");
     process.exit(1);
   }
+  // tracebom skips postProcess, so the downgrade to an older --spec-version
+  // (for example dropping the 1.7 algorithmFamily of traced crypto) runs here.
+  applySpecVersionCompatibility(bomJson, options);
 
   const jsonPayload = JSON.stringify(bomJson, null, DEBUG_MODE ? 2 : null);