@cdxgen/cdxgen 13.3.0 → 13.4.0

package/data/rules/dependency-sources.yaml

@@ -234,3 +234,70 @@
       "registry": $prop($, 'cdx:pypi:registry'),
       "resolvedFrom": $prop($, 'cdx:pypi:resolved_from')
     }
+- id: PKG-012
+  name: "Terraform module from mutable VCS reference"
+  description: "Terraform modules sourced from git or mercurial without a commit or tag pin are not locked, so the next init can fetch different code"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType')
+      and ($prop($, 'cdx:tf:module:sourceType') = 'git' or $prop($, 'cdx:tf:module:sourceType') = 'hg')
+      and ($prop($, 'cdx:tf:module:pinning') = 'branch' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' tracks VCS source '{{ $prop($, 'cdx:tf:module:source') }}' at a mutable reference"
+  mitigation: "Pin the module source with `?ref=<commit sha>` or a reviewed, signed tag; the dependency lock file does not cover modules"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "ref": $prop($, 'cdx:tf:module:ref'),
+      "pinning": $prop($, 'cdx:tf:module:pinning')
+    }
+- id: PKG-013
+  name: "Terraform registry module not pinned to an exact version"
+  description: "Registry modules whose version argument is a range or absent resolve to whatever the registry serves at the next init"
+  severity: low
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:kind') and $prop($, 'cdx:tf:kind') = 'module'
+      and $hasProp($, 'cdx:tf:module:sourceType') and $prop($, 'cdx:tf:module:sourceType') = 'registry'
+      and ($prop($, 'cdx:tf:module:pinning') = 'range' or $prop($, 'cdx:tf:module:pinning') = 'none')
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform registry module '{{ $prop($, 'cdx:tf:address') }}' is not pinned to an exact version (pinning: {{ $prop($, 'cdx:tf:module:pinning') }})"
+  mitigation: "Set the module's `version` argument to a single exact version and review upgrades deliberately"
+  evidence: |
+    {
+      "constraints": $prop($, 'cdx:tf:constraints'),
+      "pinning": $prop($, 'cdx:tf:module:pinning'),
+      "address": $prop($, 'cdx:tf:address')
+    }
+- id: PKG-014
+  name: "Terraform module source embeds credentials"
+  description: "A module source string carries a credential such as URL userinfo, a git sshkey parameter or S3 keys, exposing the secret to every reader of the configuration"
+  severity: high
+  category: dependency-source
+  dry-run-support: full
+  condition: |
+    components[
+      $hasProp($, 'cdx:tf:module:credentialInSource')
+      and $prop($, 'cdx:tf:module:credentialInSource') = 'true'
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Terraform module '{{ name }}@{{ version }}' resolves from a source that embeds credentials"
+  mitigation: "Rotate the exposed credential, move authentication to git credential helpers or an SSH agent, and keep the source URL credential-free"
+  evidence: |
+    {
+      "source": $prop($, 'cdx:tf:module:source'),
+      "sourceType": $prop($, 'cdx:tf:module:sourceType'),
+      "credentialInSource": $prop($, 'cdx:tf:module:credentialInSource')
+    }

package/data/rules/scala-evidence.yaml

@@ -0,0 +1,115 @@
+# Scala Evinse and scalasem Rules
+# Categories: scala-security, scala-compliance
+# Evaluates cdx:scalasem:* properties and the crypto assets emitted by
+# evinse -l scala and cdxgen --evidence for Scala projects.
+
+- id: SCALA-SEC-001
+  name: "Scala source uses a weak cryptographic algorithm in runtime code"
+  description: "scalasem flagged a weak algorithm, mode or key size at a call site in main or generated sources (MD5, SHA-1, DES, ECB, or a key below the modern floor)"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'cryptographic-asset'
+      and $prop($, 'cdx:scalasem:crypto:weak') = 'true'
+      and (
+        'main' in properties[name = 'cdx:scalasem:usageScopes'].value
+        or 'generated' in properties[name = 'cdx:scalasem:usageScopes'].value
+      )
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm '{{ name }}' used in Scala source"
+  mitigation: "Move to the modern equivalent of this algorithm, mode and key size, and confirm no compatibility constraint forces the weak one. The locations name the exact call sites"
+  evidence: |
+    {
+      "algorithm": name,
+      "oid": cryptoProperties.oid,
+      "api": $prop($, 'cdx:scalasem:crypto:api'),
+      "locations": evidence.occurrences.(location & '#' & line)
+    }
+
+- id: SCALA-SEC-002
+  name: "Scala source calls an outbound service over plaintext transport"
+  description: "scalasem found an outbound HTTP or websocket client whose target URL starts with http:// or ws:// and is not a loopback address, so traffic and credentials cross the network unencrypted"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) {
+        ($contains($e, 'http://') or $contains($e, 'ws://'))
+        and $not($contains($e, /:\/\/(localhost|127\.[0-9.]+|\[::1\])(:|\/|$)/))
+      }))
+      and $prop($, 'cdx:scalasem:service:kind') != null
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Outbound service '{{ name }}' is called over plaintext"
+  mitigation: "Switch the target to https:// or wss://, or a local socket if the peer is on the same host. The call sites are named by the service's cdx:scalasem:service:location properties"
+  evidence: |
+    {
+      "kind": $prop($, 'cdx:scalasem:service:kind'),
+      "client": $prop($, 'cdx:scalasem:service:client'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-003
+  name: "Admin-like Scala endpoint is not marked as authenticated"
+  description: "scalasem found an inbound route with an admin, internal, manage or debug path segment that the report does not mark as authenticated. The source analysis does not see middleware or gateways, so this is a path-based prompt for review"
+  severity: low
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    services[
+      $exists($filter(endpoints, function($e) { $contains($e, /(^|\/)(admin|internal|manage|debug)(\/|$)/) }))
+      and $prop($, 'cdx:scalasem:endpoint:framework') != null
+      and $not(authenticated = true)
+    ]
+  location: |
+    { "name": name, "endpoints": endpoints }
+  message: "Endpoint '{{ name }}' looks administrative and is not marked as authenticated"
+  mitigation: "Confirm the route is protected by middleware or a gateway the source does not show, and otherwise require authentication on it. The declaration site is named by the service's cdx:scalasem:service:location property"
+  evidence: |
+    {
+      "framework": $prop($, 'cdx:scalasem:endpoint:framework'),
+      "handler": $prop($, 'cdx:scalasem:endpoint:handler'),
+      "locations": $filter(properties, function($p) { $p.name = 'cdx:scalasem:service:location' }).value
+    }
+
+- id: SCALA-SEC-004
+  name: "Scala source uses a weak algorithm that has no registry OID"
+  description: "scalasem flagged a weak algorithm that the OID registry cannot name, such as an MD5 or SHA-1 based signature or an RC4 password scheme, so it is recorded as a property instead of a crypto asset"
+  severity: medium
+  category: scala-security
+  dry-run-support: full
+  condition: |
+    $append(components, metadata.component)[
+      $exists(properties[name = 'cdx:scalasem:crypto:weakFinding'])
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "Weak cryptographic algorithm used in Scala source, recorded on '{{ name }}'"
+  mitigation: "Move to a modern algorithm. Each finding names the algorithm and its call site as name@file#line"
+  evidence: |
+    {
+      "findings": properties[name = 'cdx:scalasem:crypto:weakFinding'].value
+    }
+
+- id: SCALA-COMP-001
+  name: "Scala semantic evidence is incomplete"
+  description: "The scalasem run behind this BOM was degraded, for example by class files no compiler could read, a missing classpath, a timeout or a failed analyzer, so the BOM's Scala evidence may be missing usages, crypto findings or services"
+  severity: low
+  category: scala-compliance
+  dry-run-support: full
+  condition: |
+    metadata.component[$prop($, 'cdx:scalasem:degraded') = 'true']
+  location: |
+    { "bomRef": $."bom-ref", "name": name }
+  message: "The Scala semantic evidence for '{{ name }}' is incomplete"
+  mitigation: "Read the cdx:scalasem:diagnostic:* metadata properties for the cause, and build the project before scanning when the diagnostics name missing class files or a missing classpath"
+  evidence: |
+    {
+      "diagnostics": $filter(properties, function($p) { $contains($p.name, 'cdx:scalasem:diagnostic:') }).(name & '=' & value)
+    }

package/lib/audit/index.js

@@ -390,6 +390,27 @@ function targetSlug(target) {
   return `${target.type}-${normalized || "package"}-${version}-${digest}`;
 }
 
+/**
+ * Build a deterministic directory name for a repository checkout, keyed by
+ * the repository URL and the ref it is cloned at.
+ *
+ * Keying by the coordinates rather than the package means the packages of
+ * one monorepo share a single checkout instead of each cloning the whole
+ * repository, while a different ref, which is a different snapshot of the
+ * tree, never shares one.
+ *
+ * @param {string} repoUrl Repository URL
+ * @param {string | undefined} gitRef Ref the checkout is cloned at
+ * @returns {string} slug string
+ */
+function repositoryCheckoutSlug(repoUrl, gitRef) {
+  const digest = createHash("sha256")
+    .update(`${repoUrl}\n${gitRef || ""}`)
+    .digest("hex")
+    .slice(0, 16);
+  return `repo-${digest}`;
+}
+
 /**
  * Ensure a parent directory exists before writing a file.
  *
@@ -1378,7 +1399,12 @@ async function ensureCheckout(target, resolution, workspaceDir, gitRef) {
   if (!safeExistsSync(resolvedWorkspaceDir)) {
     safeMkdirSync(resolvedWorkspaceDir, { recursive: true });
   }
-  const cloneDir = join(resolvedWorkspaceDir, targetSlug(target));
+  // One checkout per repository and ref, so packages of the same monorepo
+  // share it; each package still keeps its own cache and report directory.
+  const cloneDir = join(
+    resolvedWorkspaceDir,
+    repositoryCheckoutSlug(resolution.repoUrl, gitRef),
+  );
   if (safeExistsSync(join(cloneDir, ".git"))) {
     return {
       cleanup: false,
@@ -2635,11 +2661,17 @@ export async function runAuditFromBoms(inputBoms, options) {
       total: extractedTargets.targets.length,
       type: "run:start",
     });
-    // Every target's repository lookup is known here, before the first clone,
-    // so they are resolved in one round rather than one per iteration below.
-    await prefetchGitUrlSources(
-      extractedTargets.targets.map((target) => target.purl),
-    );
+    // Every target's repository lookup is known here, before the first
+    // clone, so they are resolved in one round rather than one per iteration
+    // below. A target whose cached child BOM already answers it is resolved
+    // from the workspace alone, so only the targets that will be cloned take
+    // part in the round.
+    const purlsToResolve = extractedTargets.targets
+      .filter((target) => !loadCachedChildBom(options.workspaceDir, target))
+      .map((target) => target.purl);
+    if (purlsToResolve.length) {
+      await prefetchGitUrlSources(purlsToResolve);
+    }
   }
   for (const [index, target] of extractedTargets.targets.entries()) {
     const targetIndex = index + 1;

package/lib/cli/index.js

@@ -44,6 +44,7 @@ import {
   parseOpenapiSpecData,
   parsePrivadoFile,
 } from "../ecosystems/parsers-misc.js";
+import { hasTerraformConfiguration } from "../ecosystems/parsers-terraform.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
   buildDependencyTrackBomRequest,
@@ -65,6 +66,7 @@ import {
   hasHbomProjectType,
 } from "../inventory/hbom.js";
 import { mergeHostInventoryBoms } from "../inventory/hostTopology.js";
+import { orderParentCandidates } from "../inventory/parentSelection.js";
 // Imported directly rather than through the utils.js barrel: purl validity is
 // checked in a hot path and the barrel is already the root of several import
 // cycles.
@@ -877,6 +879,19 @@ export async function createMultiXBom(pathList, options) {
     let components = [];
     let dependencies = [];
     let parentSubComponents = [];
+    // Each builder detects the project of its own ecosystem. A builder that sets
+    // options.parentComponent to force its project into its own BOM must not
+    // make that project the next builder's too, or the next ecosystem's project
+    // is lost: every builder starts from the parent the caller gave.
+    const callerParent = options.parentComponent;
+    const withOwnParent = async (build) => {
+      options.parentComponent = callerParent;
+      try {
+        return await build();
+      } finally {
+        options.parentComponent = callerParent;
+      }
+    };
     setActivityContext({
       projectType: Array.isArray(options.projectType)
         ? options.projectType.join(",")
@@ -923,7 +938,7 @@ export async function createMultiXBom(pathList, options) {
         }
       }
       setProjectTypeActivityContext(exactAiInventoryType || "js", path);
-      bomData = await createNodejsBom(path, options);
+      bomData = await withOwnParent(() => createNodejsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (exactAiInventoryType) {
           thoughtLog(
@@ -973,7 +988,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("java", path);
-      bomData = await createJavaBom(path, options);
+      bomData = await withOwnParent(() => createJavaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} java packages.`,
@@ -1038,7 +1053,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("py", path);
-      bomData = await createPythonBom(path, options);
+      bomData = await withOwnParent(() => createPythonBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} python packages.`,
@@ -1059,6 +1074,17 @@ export async function createMultiXBom(pathList, options) {
         ) {
           parentSubComponents.push(bomData.parentComponent);
         }
+        // Retain metadata.component.components. uv workspace members are
+        // nested under the python project, so hoisting them keeps them
+        // siblings of the other sub-components instead of riding one level
+        // deeper (or being dropped by the same-name collapse) when another
+        // ecosystem's project becomes the parent.
+        if (bomData.parentComponent?.components?.length) {
+          parentSubComponents = parentSubComponents.concat(
+            bomData.parentComponent.components,
+          );
+          delete bomData.parentComponent.components;
+        }
       }
       if (bomData?.formulationList?.length) {
         formulationList = formulationList.concat(bomData.formulationList);
@@ -1071,7 +1097,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("go", path);
-      bomData = await createGoBom(path, options);
+      bomData = await withOwnParent(() => createGoBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(`I found ${bomData.bomJson.components.length} go packages.`);
         if (DEBUG_MODE) {
@@ -1099,7 +1125,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("rust", path);
-      bomData = await createRustBom(path, options);
+      bomData = await withOwnParent(() => createRustBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} rust packages.`,
@@ -1136,7 +1162,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("php", path);
-      bomData = createPHPBom(path, options);
+      bomData = await withOwnParent(() => createPHPBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} php packages.`,
@@ -1173,7 +1199,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("ruby", path);
-      bomData = await createRubyBom(path, options);
+      bomData = await withOwnParent(() => createRubyBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `We got ${bomData.bomJson.components.length} ruby packages.`,
@@ -1209,7 +1235,7 @@ export async function createMultiXBom(pathList, options) {
         thoughtLog("**CSHARP**: What about csharp and fsharp projects?");
       }
       setProjectTypeActivityContext("csharp", path);
-      bomData = await createCsharpBom(path, options);
+      bomData = await withOwnParent(() => createCsharpBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `There are ${bomData.bomJson.components.length} csharp packages.`,
@@ -1246,7 +1272,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("dart", path);
-      bomData = await createDartBom(path, options);
+      bomData = await withOwnParent(() => createDartBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} pub packages.`,
@@ -1276,7 +1302,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("haskell", path);
-      bomData = createHaskellBom(path, options);
+      bomData = await withOwnParent(() => createHaskellBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} hackage packages.`,
@@ -1306,7 +1332,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("elixir", path);
-      bomData = createElixirBom(path, options);
+      bomData = await withOwnParent(() => createElixirBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} mix packages.`,
@@ -1336,7 +1362,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("c", path);
-      bomData = createCppBom(path, options);
+      bomData = await withOwnParent(() => createCppBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cpp packages.`,
@@ -1358,6 +1384,10 @@ export async function createMultiXBom(pathList, options) {
           parentSubComponents.push(bomData.parentComponent);
         }
       }
+      // presets and compilers describe the build, whatever it depends on
+      if (bomData?.formulationList?.length) {
+        formulationList = formulationList.concat(bomData.formulationList);
+      }
     }
     if (hasAnyProjectType(["oci", "clojure"], options)) {
       if (!hasAnyProjectType(["oci"], options, false)) {
@@ -1366,7 +1396,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("clojure", path);
-      bomData = createClojureBom(path, options);
+      bomData = await withOwnParent(() => createClojureBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} clojure packages.`,
@@ -1396,7 +1426,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("github", path);
-      bomData = createGitHubBom(path, options);
+      bomData = await withOwnParent(() => createGitHubBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} github action packages as well. Should I convert these to formulation instead 🤔`,
@@ -1426,7 +1456,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cloudbuild", path);
-      bomData = createCloudBuildBom(path, options);
+      bomData = await withOwnParent(() => createCloudBuildBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} cloudbuild packages.`,
@@ -1456,7 +1486,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("swift", path);
-      bomData = await createSwiftBom(path, options);
+      bomData = await withOwnParent(() => createSwiftBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} swift packages here.`,
@@ -1494,7 +1524,7 @@ export async function createMultiXBom(pathList, options) {
         detail:
           "Components are being inferred by scanning jar/war/ear files from disk.",
       });
-      bomData = await createJarBom(path, options);
+      bomData = await withOwnParent(() => createJarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} jar packages as well.`,
@@ -1519,7 +1549,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "cocoa"], options)) {
       setProjectTypeActivityContext("cocoa", path);
-      bomData = await createCocoaBom(path, options);
+      bomData = await withOwnParent(() => createCocoaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1538,7 +1568,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["oci", "nix"], options)) {
       setProjectTypeActivityContext("nix", path);
-      bomData = await createNixBom(path, options);
+      bomData = await withOwnParent(() => createNixBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1560,7 +1590,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["caxa"], options, false)) {
       setProjectTypeActivityContext("caxa", path);
-      bomData = await createCaxaBom(path, options);
+      bomData = await withOwnParent(() => createCaxaBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1582,7 +1612,7 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["asar"], options, false)) {
       setProjectTypeActivityContext("asar", path);
-      bomData = await createAsarBom(path, options);
+      bomData = await withOwnParent(() => createAsarBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1604,7 +1634,9 @@ export async function createMultiXBom(pathList, options) {
     }
     if (hasAnyProjectType(["vscode-extension"], options, false)) {
       setProjectTypeActivityContext("vscode-extension", path);
-      bomData = await createVscodeExtensionBom(path, options);
+      bomData = await withOwnParent(() =>
+        createVscodeExtensionBom(path, options),
+      );
       if (bomData?.bomJson?.components?.length) {
         if (DEBUG_MODE) {
           console.log(
@@ -1647,7 +1679,9 @@ export async function createMultiXBom(pathList, options) {
           sharedOptions.__didScanChromeExtensions = true;
         }
         setProjectTypeActivityContext("chrome-extension", path);
-        bomData = await createChromeExtensionBom(path, options);
+        bomData = await withOwnParent(() =>
+          createChromeExtensionBom(path, options),
+        );
         if (bomData?.bomJson?.components?.length) {
           if (DEBUG_MODE) {
             console.log(
@@ -1668,6 +1702,34 @@ export async function createMultiXBom(pathList, options) {
         }
       }
     }
+    if (hasAnyProjectType(["terraform"], options)) {
+      thoughtLog(
+        "**TERRAFORM**: Looking for Terraform and OpenTofu modules and providers. The registry metadata fetch is opt-in, so I will rely on the lock file, the module manifest and the configuration files.",
+      );
+      setProjectTypeActivityContext("terraform", path);
+      bomData = await withOwnParent(() => createTerraformBom(path, options));
+      if (bomData?.bomJson?.components?.length) {
+        thoughtLog(
+          `I found ${bomData.bomJson.components.length} terraform components. Should I also resolve their licenses from the registry when FETCH_LICENSE is enabled?`,
+        );
+        if (DEBUG_MODE) {
+          console.log(
+            `Found ${bomData.bomJson.components.length} terraform components at ${path}`,
+          );
+        }
+        components = components.concat(bomData.bomJson.components);
+        dependencies = mergeDependencies(
+          dependencies,
+          bomData.bomJson.dependencies,
+        );
+        if (
+          bomData.parentComponent &&
+          Object.keys(bomData.parentComponent).length
+        ) {
+          parentSubComponents.push(bomData.parentComponent);
+        }
+      }
+    }
     // Collect any crypto keys
     if (
       options.specVersion >= 1.6 &&
@@ -1680,7 +1742,7 @@ export async function createMultiXBom(pathList, options) {
         );
       }
       setProjectTypeActivityContext("cbom", path);
-      bomData = await createCryptoCertsBom(path, options);
+      bomData = await withOwnParent(() => createCryptoCertsBom(path, options));
       if (bomData?.bomJson?.components?.length) {
         thoughtLog(
           `I found ${bomData.bomJson.components.length} crypto assets.`,
@@ -1771,7 +1833,7 @@ export async function createMultiXBom(pathList, options) {
     !options.lastWorkingDir.includes("/home/")
   ) {
     setProjectTypeActivityContext("jar", options.lastWorkingDir);
-    bomData = createJarBom(options.lastWorkingDir, options);
+    bomData = await createJarBom(options.lastWorkingDir, options);
     if (bomData?.bomJson?.components?.length) {
       if (DEBUG_MODE) {
         console.log(
@@ -1797,14 +1859,24 @@ export async function createMultiXBom(pathList, options) {
       thoughtLog("**METADATA**: Tweaking the parent component hierarchy.");
     }
     if (!parentComponent || !Object.keys(parentComponent).length) {
-      parentComponent = parentSubComponents[0];
+      // the project whose manifest sits at the scan root describes the
+      // repository; ties keep the order the ecosystems were scanned in
+      parentComponent = orderParentCandidates(
+        parentSubComponents,
+        pathList,
+        options,
+      )[0];
     }
     // Our naive approach to appending to sub-components could result in same parent being included as a child
     // This is filtered out here
     parentSubComponents = parentSubComponents.filter(
       (c) => c["bom-ref"] !== parentComponent["bom-ref"],
     );
-    parentComponent.components = trimComponents(parentSubComponents);
+    // keep the parent's own sub-components (a CMake project's sub-projects)
+    parentComponent.components = trimComponents([
+      ...(parentComponent.components || []),
+      ...parentSubComponents,
+    ]);
     if (
       parentComponent.components.length === 1 &&
       parentComponent.components[0].name === parentComponent.name &&
@@ -1814,24 +1886,15 @@ export async function createMultiXBom(pathList, options) {
       delete parentComponent.components;
     }
     // Add references between the multiple sub-boms
-    let parentDependencies = dependencies.find(
-      (d) => d["ref"] === parentComponent["bom-ref"],
-    );
-    if (!parentDependencies) {
-      parentDependencies = {
-        ref: parentComponent["bom-ref"],
-      };
-      dependencies = mergeDependencies(dependencies, parentDependencies);
-    }
-    if (!parentDependencies["dependsOn"]) {
-      parentDependencies["dependsOn"] = [];
-    }
-    for (const parentSub of parentSubComponents) {
-      // Issue: 1622. We might have already captured this parent component dependency
-      if (!parentDependencies["dependsOn"].includes(parentSub["bom-ref"])) {
-        parentDependencies["dependsOn"].push(parentSub["bom-ref"]);
-      }
-    }
+    // mergeDependencies returns fresh objects and unions dependsOn per ref,
+    // so the parent edges are folded in through a single merge
+    const parentRef = parentComponent["bom-ref"];
+    const parentSubRefs = parentSubComponents
+      .map((c) => c["bom-ref"])
+      .filter((ref) => ref && ref !== parentRef);
+    dependencies = mergeDependencies(dependencies, [
+      { ref: parentRef, dependsOn: parentSubRefs },
+    ]);
   }
   // some cleanup, but not complete
   for (const path of pathList) {
@@ -2464,14 +2527,10 @@ export async function createXBom(path, options) {
     return createPerlBom(path, options);
   }
 
-  // Terraform and OpenTofu providers
-  const tfLockFiles = getAllFiles(
-    path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
-    options,
-  );
-  if (tfLockFiles.length) {
-    return createTerraformBom(path, options);
+  // Terraform and OpenTofu providers and modules, discovered with the same
+  // patterns and exclusions the workspace assembly uses.
+  if (hasTerraformConfiguration(path, options)) {
+    return await createTerraformBom(path, options);
   }
 }
 
@@ -2861,7 +2920,7 @@ async function createBomForPath(path, options) {
     return createPerlBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["terraform"].includes(projectType[0])) {
-    return createTerraformBom(path, options);
+    return await createTerraformBom(path, options);
   }
   if (PROJECT_TYPE_ALIASES["caxa"].includes(projectType[0])) {
     return await createCaxaBom(path, options);