@cdxgen/cdxgen 13.3.0 → 13.4.0

package/bin/validate.js

@@ -26,6 +26,7 @@ import {
   safeMkdirSync,
   safeWriteSync,
 } from "../lib/ecosystems/utils.js";
+import { displayValue } from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
   isCycloneDxBom,
@@ -35,6 +36,7 @@ import {
   isProtoBomPath,
 } from "../lib/inventory/protobomLoader.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 import { shouldFail, validateBomAdvanced } from "../lib/validator/index.js";
 import { render as renderReport } from "../lib/validator/reporters/index.js";
 
@@ -126,9 +128,8 @@ const args = _yargs
   })
   .option("require-signature", {
     type: "boolean",
-    default: false,
     description:
-      "Exit non-zero (4) when --public-key or --secret-key is provided but signature verification fails.",
+      "Exit non-zero (4) when signature verification fails. On by default when --public-key or --secret-key is given; pass --no-require-signature to only report the result.",
   })
   .option("strict", {
     type: "boolean",
@@ -143,7 +144,11 @@ const args = _yargs
   .help()
   .wrap(Math.min(120, yargs().terminalWidth())).argv;
 
-async function loadBom(input, platform) {
+/**
+ * Loads the BOM. When signatures are verified, the text must also pass
+ * parseStrictJson(), and `strictError` explains why it did not.
+ */
+async function loadBom(input, platform, strict, requireSignature) {
   if (safeExistsSync(input)) {
     try {
       if (isProtoBomPath(input)) {
@@ -151,9 +156,18 @@ async function loadBom(input, platform) {
           "cdx-validate",
           "protobuf BOM input",
         );
-        return readBinary(input, true);
+        return { bomJson: readBinary(input, true) };
       }
-      return JSON.parse(fs.readFileSync(input, "utf8"));
+      const bytes = fs.readFileSync(input);
+      const bomJson = JSON.parse(bytes.toString("utf8"));
+      if (strict) {
+        try {
+          parseStrictJson(bytes);
+        } catch (err) {
+          return { bomJson, strictError: err.message };
+        }
+      }
+      return { bomJson };
     } catch (err) {
       console.error(`Failed to parse ${input}: ${err.message}`);
       process.exit(1);
@@ -164,8 +178,27 @@ async function loadBom(input, platform) {
     input.includes("docker") ||
     input.includes("ghcr")
   ) {
-    const bom = await getBomWithOras(input, platform);
-    if (bom) return bom;
+    let strictError;
+    try {
+      const bom = await getBomWithOras(
+        input,
+        platform,
+        strict ? { checkBytes: parseStrictJson } : {},
+      );
+      if (bom) return { bomJson: bom };
+    } catch (err) {
+      if (requireSignature) {
+        console.error(
+          `cdx-validate: signature verification failed — the attached BOM cannot be verified: ${err.message}`,
+        );
+        process.exit(4);
+      }
+      strictError = err.message;
+    }
+    if (strictError) {
+      const bom = await getBomWithOras(input, platform);
+      if (bom) return { bomJson: bom, strictError };
+    }
   }
   console.error(`Input '${input}' is not a readable SBOM.`);
   process.exit(1);
@@ -173,12 +206,21 @@ async function loadBom(input, platform) {
 }
 
 function loadKeyFile(path, label, encoding) {
-  if (!path) return null;
+  if (path === undefined) return null;
+  if (typeof path !== "string" || !path.trim()) {
+    console.error(`cdx-validate: ${label} needs exactly one file path.`);
+    process.exit(1);
+  }
   if (!safeExistsSync(path)) {
     console.error(`${label} '${path}' not found.`);
     process.exit(1);
   }
-  return fs.readFileSync(path, encoding);
+  const content = fs.readFileSync(path, encoding);
+  if (!content.toString().trim()) {
+    console.error(`${label} '${path}' is empty.`);
+    process.exit(1);
+  }
+  return content;
 }
 
 function splitCsv(value) {
@@ -208,14 +250,21 @@ function isLocalProtoBomInput(input) {
   return isProtoBomPath(input);
 }
 
-const bomJson = await loadBom(args.input, args.platform);
-if (args.publicKey && args.secretKey) {
+const keyGiven = args.publicKey !== undefined || args.secretKey !== undefined;
+const requireSignature = args.requireSignature ?? keyGiven;
+const { bomJson, strictError } = await loadBom(
+  args.input,
+  args.platform,
+  keyGiven,
+  requireSignature,
+);
+if (args.publicKey !== undefined && args.secretKey !== undefined) {
   console.error("cdx-validate: use either --public-key or --secret-key.");
   process.exit(1);
 }
 const publicKeyStr = loadKeyFile(args.publicKey, "Public key", "utf8");
 const secretKey = loadKeyFile(args.secretKey, "Shared secret");
-const verificationRequested = Boolean(publicKeyStr || secretKey);
+const verificationRequested = keyGiven;
 const inputIsLocalProtoBom = isLocalProtoBomInput(args.input);
 if (!isCycloneDxBom(bomJson)) {
   console.error(getNonCycloneDxErrorMessage(bomJson, "cdx-validate"));
@@ -226,7 +275,7 @@ if (inputIsLocalProtoBom && verificationRequested) {
   console.error(
     "cdx-validate: protobuf BOM input does not currently preserve JSF signature blocks. Verify signatures against the source JSON BOM instead.",
   );
-  process.exit(args.requireSignature ? 4 : 1);
+  process.exit(requireSignature ? 4 : 1);
 }
 
 const report = await validateBomAdvanced(bomJson, {
@@ -237,10 +286,17 @@ const report = await validateBomAdvanced(bomJson, {
   minSeverity: args.minSeverity,
   includeManual: args.includeManual,
   includePass: args.includePass,
-  publicKey: publicKeyStr || undefined,
-  secretKey: secretKey || undefined,
+  publicKey: publicKeyStr ?? undefined,
+  secretKey: secretKey ?? undefined,
   nestedSignatures: args.nestedSignatures,
 });
+if (strictError && verificationRequested) {
+  report.signatureVerified = false;
+  report.signatureEntries = null;
+  report.signatureDetails = {
+    error: `the BOM cannot be verified: ${strictError}`,
+  };
+}
 
 let output;
 try {
@@ -267,14 +323,24 @@ for (const e of report.validationErrors || []) {
 const { shouldFail: fail, reason } = shouldFail(report, {
   failSeverity: args.failSeverity,
   strict: args.strict,
-  requireSignature: Boolean(args.requireSignature && verificationRequested),
+  requireSignature: Boolean(requireSignature && verificationRequested),
 });
 
-if (report.signatureVerified === false && args.requireSignature) {
+if (report.signatureVerified === false && verificationRequested) {
   console.error(
     `cdx-validate: signature verification failed — ${report.signatureDetails?.error || "no matching key"}.`,
   );
-  process.exit(4);
+  if (requireSignature) {
+    process.exit(4);
+  }
+}
+const unverifiedEntries = (report.signatureEntries || []).filter(
+  (entry) => !entry.verified,
+);
+if (report.signatureVerified && unverifiedEntries.length) {
+  console.error(
+    `cdx-validate: warning — ${unverifiedEntries.length} of ${report.signatureEntries.length} signature entries did not verify with the given key: ${unverifiedEntries.map((entry) => `entry ${entry.index}${entry.keyId === undefined ? "" : ` (keyId '${displayValue(entry.keyId)}')`}`).join(", ")}.`,
+  );
 }
 
 if (args.strict && report.schemaValid === false) {

package/bin/verify.js

@@ -17,7 +17,7 @@ import {
   displayValue,
   loadSharedSecret,
   loadVerificationKey,
-  verifyNode,
+  verifyBomSignatures,
 } from "../lib/helpers/bomSigner.js";
 import {
   getNonCycloneDxErrorMessage,
@@ -25,6 +25,7 @@ import {
 } from "../lib/inventory/bomUtils.js";
 import { isProtoBomPath } from "../lib/inventory/protobomLoader.js";
 import { getBomWithOras } from "../lib/managers/oci.js";
+import { parseStrictJson } from "../lib/parsers/strictJson.js";
 
 const dirName = dirNameStr;
 
@@ -41,10 +42,13 @@ const args = _yargs
     description: "The platform to validate. No default",
   })
   .option("public-key", {
+    type: "array",
+    string: true,
     description:
-      "Public key in PEM format. Default public.key unless --secret-key is used",
+      "Trusted public key in PEM format. Repeat to trust several keys; a signature entry verifies when one of them verifies it.",
   })
   .option("secret-key", {
+    type: "string",
     description:
       "File holding the shared secret for HMAC (HS256, HS384, HS512) signatures. HMAC signatures are only accepted with this option.",
   })
@@ -52,7 +56,19 @@ const args = _yargs
     type: "boolean",
     default: true,
     description:
-      "Strictly verify all nested component, service, and annotation signatures against the provided public key. Pass --no-deep to verify only the root signature.",
+      "Strictly verify all nested component, service, and annotation signatures against the provided keys. Pass --no-deep to verify only the root signature.",
+  })
+  .option("require-all", {
+    type: "boolean",
+    default: false,
+    description:
+      "Require every entry of a signers or chain signature to verify with one of the keys, instead of at least one.",
+  })
+  .option("allow-nested-only", {
+    type: "boolean",
+    default: false,
+    description:
+      "Accept a BOM without a root signature when every component, service, and annotation carries a signature that verifies. No signature then covers the other members of the BOM.",
   })
   .completion("completion", "Generate bash/zsh completion")
   .epilogue("for documentation, visit https://cdxgen.github.io/cdxgen")
@@ -96,7 +112,7 @@ async function getBom(args) {
       process.exit(1);
     }
     try {
-      return JSON.parse(fs.readFileSync(args.input, "utf8"));
+      return parseStrictJson(fs.readFileSync(args.input));
     } catch (error) {
       console.log(`Failed to parse '${args.input}': ${error.message}`);
       process.exit(1);
@@ -107,11 +123,32 @@ async function getBom(args) {
     args.input.includes("docker") ||
     args.input.includes("ghcr")
   ) {
-    return await getBomWithOras(args.input, args.platform);
+    try {
+      return await getBomWithOras(args.input, args.platform, {
+        checkBytes: parseStrictJson,
+      });
+    } catch (error) {
+      console.log(
+        `Failed to parse the BOM attached to '${args.input}': ${error.message}`,
+      );
+      process.exit(1);
+    }
   }
   return undefined;
 }
 
+const publicKeyFiles = args.publicKey || [];
+if (publicKeyFiles.length && args.secretKey) {
+  console.log("Use either --public-key or --secret-key, not both.");
+  process.exit(1);
+}
+if (!publicKeyFiles.length && !args.secretKey) {
+  console.log(
+    "Name the trusted key with --public-key <file>, or --secret-key <file> for HMAC signatures.",
+  );
+  process.exit(1);
+}
+
 const bomJson = await getBom(args);
 
 if (!bomJson) {
@@ -123,107 +160,139 @@ if (!isCycloneDxBom(bomJson)) {
   process.exit(1);
 }
 
-if (args.publicKey && args.secretKey) {
-  console.log("Use either --public-key or --secret-key, not both.");
-  process.exit(1);
-}
-const keyFile = args.secretKey || args.publicKey || "public.key";
-if (!args.secretKey && !args.publicKey) {
-  console.log(
-    `No --public-key given; using '${keyFile}' from the current directory. Pass --public-key to name the trusted key explicitly.`,
-  );
-}
-if (!safeExistsSync(keyFile)) {
-  console.log(
-    args.secretKey
-      ? "Shared secret for signature verification is missing!"
-      : "Public key for signature verification is missing!",
-  );
-  process.exit(1);
-}
-
-let verificationKey;
-try {
-  verificationKey = args.secretKey
-    ? loadSharedSecret(fs.readFileSync(keyFile))
-    : loadVerificationKey(fs.readFileSync(keyFile, "utf8"));
-} catch (error) {
-  console.log(`Unable to use '${keyFile}': ${error.message}`);
-  process.exit(1);
+const verificationKeys = [];
+for (const keyFile of args.secretKey ? [args.secretKey] : publicKeyFiles) {
+  if (!safeExistsSync(keyFile)) {
+    console.log(
+      args.secretKey
+        ? `Shared secret '${keyFile}' for signature verification is missing!`
+        : `Public key '${keyFile}' for signature verification is missing!`,
+    );
+    process.exit(1);
+  }
+  try {
+    verificationKeys.push(
+      args.secretKey
+        ? loadSharedSecret(fs.readFileSync(keyFile))
+        : loadVerificationKey(fs.readFileSync(keyFile, "utf8")),
+    );
+  } catch (error) {
+    console.log(`Unable to use '${keyFile}': ${error.message}`);
+    process.exit(1);
+  }
 }
 
-function verify(node) {
-  const reasons = [];
-  const match = verifyNode(node, verificationKey, { reasons });
-  return { match, reasons };
+function describeEntry(node, entry) {
+  const parts = [displayValue(entry.algorithm)];
+  if (entry.keyId !== undefined) {
+    parts.push(`keyId '${displayValue(entry.keyId)}'`);
+  }
+  const position =
+    node.form === "single" ? "" : `${node.form}[${entry.index}] `;
+  return `${position}(${parts.join(", ")})`;
 }
 
-function printReasons(reasons) {
-  for (const reason of new Set(reasons)) {
+function printRejections(node) {
+  for (const reason of node.reasons) {
     console.log(`  - ${reason}`);
   }
-}
-
-let rootResult = null;
-if (bomJson.signature) {
-  rootResult = verify(bomJson);
-}
-
-const verifyNested = args.deep || !bomJson.signature;
-let hasInvalidNested = false;
-let checkedNested = 0;
-
-if (verifyNested) {
-  const nestedTargets = [
-    ["components", "Component", (c) => c["bom-ref"] || c.name],
-    ["services", "Service", (s) => s["bom-ref"] || s.name],
-    ["annotations", "Annotation", (a) => a["bom-ref"] || a.subject],
-  ];
-  for (const [field, label, nameOf] of nestedTargets) {
-    for (const node of bomJson[field] || []) {
-      if (node?.signature) {
-        checkedNested++;
-        const result = verify(node);
-        if (!result.match) {
-          console.log(
-            `${label} '${displayValue(nameOf(node))}' signature is invalid!`,
-          );
-          printReasons(result.reasons);
-          hasInvalidNested = true;
-        }
-      }
+  for (const entry of node.entries) {
+    for (const reason of entry.reasons) {
+      console.log(
+        `  - ${node.form === "single" ? "" : `${node.form}[${entry.index}]: `}${reason}`,
+      );
     }
   }
 }
 
-if (hasInvalidNested) {
+const report = verifyBomSignatures(bomJson, verificationKeys, {
+  deep: args.deep,
+  allowNestedOnly: args.allowNestedOnly,
+  requireAll: args.requireAll,
+});
+
+for (const error of report.errors) {
+  console.log(error);
+}
+const keyFiles = args.secretKey ? [args.secretKey] : publicKeyFiles;
+if (args.requireAll && report.root?.form) {
+  report.root.keysMatched.forEach((matched, index) => {
+    if (!matched) {
+      console.log(`  - key #${index + 1}: ${keyFiles[index]}`);
+    }
+  });
+}
+const invalidNested = report.nested.filter((item) => !item.verified);
+for (const item of invalidNested) {
+  console.log(`${item.label} signature is invalid!`);
+  printRejections(item);
+}
+if (invalidNested.length) {
   console.log("One or more nested signatures are invalid!");
-  if (rootResult?.match) {
+  if (report.root?.verified) {
     console.log(
       "The root signature verifies with this key. Nested signatures belong to the party that created them, so pass --no-deep to verify only the root signature with this key.",
     );
   }
+}
+if (report.root && !report.root.verified) {
+  console.log("BOM signature is invalid!");
+  printRejections(report.root);
+  if (!report.root.reasons.length && !report.root.match) {
+    console.log(
+      "If this BOM was signed with cdxgen 13.2.0 or earlier, re-sign it with this version of cdx-sign.",
+    );
+  }
+}
+if (!report.root && !bomJson.signature && !args.allowNestedOnly) {
+  console.log(
+    "Pass --allow-nested-only to accept a BOM whose components, services, and annotations are all signed.",
+  );
+}
+for (const notice of report.notices) {
+  console.log(`Note: ${notice}`);
+}
+if (!report.verified) {
   process.exit(1);
 }
 
-if (bomJson.signature) {
-  const rootMatch = rootResult?.match;
-  if (rootMatch) {
-    const identifier = rootMatch.keyId
-      ? `KeyId: '${displayValue(rootMatch.keyId)}'`
-      : `Algorithm: '${rootMatch.algorithm}'`;
-    console.log(`✓ Signature is valid! (Matched ${identifier})`);
-  } else {
-    console.log("BOM signature is invalid!");
-    printReasons(rootResult?.reasons || []);
+if (report.root) {
+  const rootMatch = report.root.match;
+  const identifier = rootMatch.keyId
+    ? `KeyId: '${displayValue(rootMatch.keyId)}'`
+    : `Algorithm: '${rootMatch.algorithm}'`;
+  console.log(`✓ Signature is valid! (Matched ${identifier})`);
+  const unverified = report.root.entries.filter((entry) => !entry.verified);
+  if (unverified.length) {
     console.log(
-      "If this BOM was signed with cdxgen 13.2.0 or earlier, re-sign it with this version of cdx-sign.",
+      `Warning: ${unverified.length} of ${report.root.entries.length} ${report.root.form} entries did not verify with the given key(s). Pass --require-all to fail in that case.`,
     );
-    process.exit(1);
+    for (const entry of unverified) {
+      console.log(
+        `  - ${describeEntry(report.root, entry)}: ${entry.reasons[0] || "not verified"}`,
+      );
+    }
   }
-} else if (checkedNested > 0 && !hasInvalidNested) {
-  console.log(`✓ ${checkedNested} nested signature(s) are valid!`);
 } else {
-  console.log("No valid signatures found to verify!");
-  process.exit(1);
+  console.log(`✓ ${report.nested.length} nested signature(s) are valid!`);
+}
+const MAX_LISTED_ENTRIES = 10;
+const unverifiedNested = report.nested.flatMap((item) =>
+  item.entries
+    .filter((entry) => !entry.verified)
+    .map(
+      (entry) =>
+        `${item.label} ${describeEntry(item, entry)}: ${entry.reasons[0] || "not verified"}`,
+    ),
+);
+if (unverifiedNested.length) {
+  console.log(
+    `Warning: ${unverifiedNested.length} nested signature entries did not verify with the given key(s). Pass --require-all to fail in that case.`,
+  );
+  for (const line of unverifiedNested.slice(0, MAX_LISTED_ENTRIES)) {
+    console.log(`  - ${line}`);
+  }
+  if (unverifiedNested.length > MAX_LISTED_ENTRIES) {
+    console.log(`  - and ${unverifiedNested.length - MAX_LISTED_ENTRIES} more`);
+  }
 }

package/data/helpers/init.gradle

@@ -17,14 +17,51 @@ allprojects {
         // attached to the matching component instead of guessing the first repository.
         if (project.hasProperty('cdxgenResolveDistribution') &&
                 project.property('cdxgenResolveDistribution').toString() == 'true') {
-            def resolvedKeys = [] as Set
+            // Shared by every project in the build, so a dependency declared in
+            // many subprojects is probed once, and a repository host that
+            // answers 429 is left alone for the rest of the build.
+            if (!gradle.ext.has('cdxgenResolvedKeys')) {
+                gradle.ext.cdxgenResolvedKeys = java.util.concurrent.ConcurrentHashMap.newKeySet()
+                gradle.ext.cdxgenPausedHosts = java.util.concurrent.ConcurrentHashMap.newKeySet()
+            }
+            def resolvedKeys = gradle.ext.cdxgenResolvedKeys
+            def pausedHosts = gradle.ext.cdxgenPausedHosts
+            // A HEAD request answers whether the repository serves the file
+            // without downloading it. Other URL schemes, such as file:, are
+            // opened and closed.
+            def artifactExists = { String artifactUrl ->
+                try {
+                    def url = new URL(artifactUrl)
+                    if (url.protocol == 'http' || url.protocol == 'https') {
+                        if (pausedHosts.contains(url.host)) {
+                            return false
+                        }
+                        def connection = (HttpURLConnection) url.openConnection()
+                        connection.requestMethod = 'HEAD'
+                        connection.instanceFollowRedirects = true
+                        connection.connectTimeout = 10000
+                        connection.readTimeout = 10000
+                        def code = connection.responseCode
+                        connection.disconnect()
+                        if (code == 429) {
+                            pausedHosts.add(url.host)
+                        }
+                        return code >= 200 && code < 300
+                    }
+                    def stream = url.openStream()
+                    stream.close()
+                    return true
+                } catch (Exception ignored) {
+                    return false
+                }
+            }
             project.configurations.each { configuration ->
                 configuration.dependencies.each { dependency ->
                     if (dependency.group == null || dependency.version == null) {
                         return
                     }
                     def depKey = String.format("%s:%s:%s", dependency.group, dependency.name, dependency.version)
-                    if (resolvedKeys.contains(depKey)) {
+                    if (!resolvedKeys.add(depKey)) {
                         return
                     }
                     def groupPath = dependency.group.replace('.', '/')
@@ -40,28 +77,16 @@ allprojects {
                         def jarUrl = String.format("%s%s/%s/%s/%s-%s.jar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
+                        if (artifactExists(jarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
+                            break
+                        }
                         def aarUrl = String.format("%s%s/%s/%s/%s-%s.aar", urlString,
                                 groupPath, dependency.name, dependency.version,
                                 dependency.name, dependency.version)
-                        try {
-                            def inStreamJar = new URL(jarUrl).openStream()
-                            if (inStreamJar != null) {
-                                inStreamJar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + jarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
-                        }
-                        try {
-                            def inStreamAar = new URL(aarUrl).openStream()
-                            if (inStreamAar != null) {
-                                inStreamAar.close()
-                                println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
-                                resolvedKeys.add(depKey)
-                                break
-                            }
-                        } catch (Exception ignored) {
+                        if (artifactExists(aarUrl)) {
+                            println "<CDXGEN:distribution>:" + depKey + " -> " + aarUrl
+                            break
                         }
                     }
                 }

package/data/remediations.json

@@ -263,6 +263,46 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "build.rate-limited": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "transitive-deps",
+    "title": "A build tool's repository rate limited the machine, so its dependency tree did not resolve",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Maven: declare a <mirror> in the Maven settings.xml, or set MVNW_REPOURL for the Maven wrapper"
+      },
+      {
+        "kind": "config",
+        "command": "Gradle: declare the mirror repository in a Gradle init script"
+      },
+      {
+        "kind": "config",
+        "command": "sbt: list the mirror in ~/.sbt/repositories and pass -Dsbt.override.build.repos=true in SBT_OPTS or .sbtopts"
+      },
+      {
+        "kind": "config",
+        "command": "Mill and scala-cli: set central.from and central.to in Coursier's mirror.properties, separating several central.from URLs with semicolons"
+      },
+      {
+        "kind": "env",
+        "command": "Point MAVEN_CENTRAL_URL at a mirror for cdxgen's own lookups"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "build.rate-limited"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ADVANCED"
+  },
   "js.no-lockfile": {
     "ecosystem": "npm",
     "kind": "evidence.degraded",
@@ -1187,5 +1227,26 @@
       ]
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
+  },
+  "policy.rate-limited": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "licenses",
+    "title": "A registry rate limited this run, so its metadata came from local caches only",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "env",
+        "command": "Point MAVEN_CENTRAL_URL at a mirror or repository manager, or wait for the block to expire, then re-run"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "policy.rate-limited"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/ENV"
   }
 }