@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/cli/managedBom.js

@@ -1,11 +1,24 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { platform as _platform } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  hasDangerousUnicode,
+  isDryRun,
+  readEnvironmentVariable,
+  recordActivity,
+} from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import {
@@ -13,6 +26,7 @@ import {
   hasAnyProjectType,
   isFeatureEnabled,
   shouldFetchLicense,
+  shouldFetchPackageMetadata,
 } from "../core/env.js";
 import {
   checksumFile,
@@ -25,7 +39,10 @@ import {
   safeWriteSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
-import { mapWithConcurrency } from "../core/parallel.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import {
   extractJarArchive,
   getNugetMetadata,
@@ -33,14 +50,20 @@ import {
   parseBdistMetadata,
 } from "../ecosystems/ecosystems.js";
 import {
+  agreedNugetVersions,
+  applyNugetVersion,
+  dotnetManifestProjectDir,
+  dotnetRestoredProjectFile,
   getCentralPackageVersions,
-  getPropertyGroupTextNodes,
+  indexPropsProperties,
   parseCsPkgData,
   parseCsPkgLockData,
   parseCsProjAssetsData,
   parseCsProjData,
   parseNupkg,
   parsePaketLockData,
+  projectPropertyCandidates,
+  resolveInstalledNugetVersion,
 } from "../ecosystems/parsers-dotnet.js";
 import { parseMinJs } from "../ecosystems/parsers-js.js";
 import {
@@ -52,7 +75,9 @@ import {
 } from "../ecosystems/parsers-misc.js";
 import { parseCpanSnapshot } from "../ecosystems/parsers-perl.js";
 import {
+  enrichFromInstalledMetadata,
   generatePixiLockFile,
+  installedMetadataKey,
   parseMojoProject,
   parsePiplockData,
   parsePixiLockFile,
@@ -63,7 +88,7 @@ import {
   parseSetupPyFile,
 } from "../ecosystems/parsers-python.js";
 import { parseRenvLock } from "../ecosystems/parsers-r.js";
-import { parseTerraformLockFile } from "../ecosystems/parsers-terraform.js";
+import { parseTerraformWorkspace } from "../ecosystems/parsers-terraform.js";
 import { collectEmbeddedSboms } from "../ecosystems/pep770.js";
 import { isPyLockFile } from "../ecosystems/pylockutils.js";
 import {
@@ -82,6 +107,7 @@ import {
   parseGemfileLockData,
   parseGemspecData,
 } from "../ecosystems/rubyutils.js";
+import { getTerraformRegistryMetadata } from "../ecosystems/terraformRegistry.js";
 import {
   collectAiInventory,
   summarizeAiInventory,
@@ -92,6 +118,15 @@ import {
   collectDosaiCryptoComponents,
   collectSourceCryptoComponents,
 } from "../inventory/cbomutils.js";
+import {
+  androidNetworkSecurityConfigPins,
+  CertificateCollector,
+  certRecordFromDer,
+  classifyCryptoFile,
+  containerRelativePath,
+  kubernetesTlsSecretRecords,
+  linkFallbackIssuers,
+} from "../inventory/certificates.js";
 import { readZipEntry } from "../inventory/deps.js";
 import {
   filterInvalidCryptoComponents,
@@ -105,11 +140,17 @@ import {
   collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
+  dosaiFailureReported,
+  dosaiMethodsSectionsArgument,
+  dosaiReportFileOmittedSections,
+  dosaiToolComponents,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   readDosaiMethodsReport,
+  runsEvidenceAnalysis,
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
+import { resolvePluginBinary } from "../inventory/plugins.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
 import { classifyProbeResult } from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
@@ -216,11 +257,14 @@ export function createPixiBom(path, options) {
       generatePixiLockFile(path);
 
       const pixiLockFile = join(path, "pixi.lock");
-      if (!safeExistsSync(pixiLockFile) && DEBUG_MODE) {
-        console.log(
-          "Unexpected Error tried to generate pixi.lock file but failed.",
-        );
-        console.log("This will result in creations of empty BOM.");
+      if (!safeExistsSync(pixiLockFile)) {
+        if (DEBUG_MODE) {
+          console.log(
+            "Unexpected Error tried to generate pixi.lock file but failed.",
+          );
+        }
+        // Let createPythonBOM() generate the BOM from the other manifests.
+        return null;
       }
       PixiLockData = parsePixiLockFile(pixiLockFile);
       metadataFilename = "pixi.lock";
@@ -404,6 +448,17 @@ export async function createPythonBom(path, options) {
     !pyLockFiles?.length;
   const poetryMode = poetryFiles?.length;
 
+  // The installed dist-info METADATA files describe the distributions this
+  // machine holds. They are read once, before any lockfile is parsed, so the
+  // lockfile entries they match are enriched before PyPI is asked and the
+  // registry is left only what the installations do not answer.
+  const installedLists = (metadataFiles || []).map((mf) =>
+    parseBdistMetadata(mf),
+  );
+  const installedMetadata = installedLists
+    .map((dlist) => dlist?.[0])
+    .filter((md) => md?.name);
+
   // TODO: Support for nested directories
   const setupPy = join(path, "setup.py");
   const setupPyMode = safeExistsSync(setupPy);
@@ -416,7 +471,9 @@ export async function createPythonBom(path, options) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${f}`);
       }
-      let retMap = await parsePyLockData(lockData, f);
+      let retMap = await parsePyLockData(lockData, f, undefined, {
+        installedMetadata,
+      });
       if (retMap?.workspaceWarningShown) {
         deferFailOnError(options, {
           ecosystem: "python",
@@ -472,11 +529,14 @@ export async function createPythonBom(path, options) {
               retMap.dependenciesList,
               parentComponent,
             );
-        } else {
+        } else if (isProjectToolingAllowed(options)) {
+          // poetry export and pdm export load plugins from the project tree
+          // (.poetry/plugins, .pdm-plugins), so they run only when the
+          // project's own tooling may.
           let exportedReqs = "";
           if (f.endsWith("poetry.lock")) {
             thoughtLog(
-              "Using poetry export as a safe, static alternative to pip install.",
+              "Using poetry export to collect the resolved closure without installing anything.",
             );
             const expCmd = safeSpawnSync(
               "poetry",
@@ -487,7 +547,7 @@ export async function createPythonBom(path, options) {
               exportedReqs = expCmd.stdout.toString();
           } else if (f.endsWith("pdm.lock")) {
             thoughtLog(
-              "Using pdm export as a safe, static alternative to pip install.",
+              "Using pdm export to collect the resolved closure without installing anything.",
             );
             const expCmd = safeSpawnSync(
               "pdm",
@@ -508,25 +568,33 @@ export async function createPythonBom(path, options) {
               `exported-${basename(basePath)}-reqs.txt`,
             );
             safeWriteSync(tmpReqFile, exportedReqs);
-            const dlist = await parseReqFile(tmpReqFile, false);
+            const dlist = await parseReqFile(
+              tmpReqFile,
+              false,
+              installedMetadata,
+            );
             if (dlist?.length) {
               pkgList = pkgList.concat(dlist);
             }
           }
+        } else {
+          reportProjectToolingSkipped(
+            options,
+            "python.poetry-export.tooling-disabled",
+            "Skipping 'poetry export' and 'pdm export' since dependency installation is disabled. Only the packages parsed from the lock file will be used.",
+            {
+              ecosystem: "python",
+              tool: f.endsWith("pdm.lock") ? "pdm" : "poetry",
+              impact: "transitive-deps",
+              detail:
+                "Dependency installation is disabled, so poetry or pdm export was not run and only the packages parsed from the lock file are available.",
+            },
+          );
         }
       }
     }
     options.parentComponent = parentComponent;
   } // poetryMode
-  if (metadataFiles?.length) {
-    // dist-info directories
-    for (const mf of metadataFiles) {
-      const dlist = parseBdistMetadata(mf);
-      if (dlist?.length) {
-        pkgList = pkgList.concat(dlist);
-      }
-    }
-  }
   // .whl files. Zip file containing dist-info directory
   if (whlFiles?.length) {
     for (const wf of whlFiles) {
@@ -592,7 +660,7 @@ export async function createPythonBom(path, options) {
         let dlist;
         try {
           const lockData = JSON.parse(readFileSync(piplockFile));
-          dlist = await parsePiplockData(lockData);
+          dlist = await parsePiplockData(lockData, installedMetadata);
         } catch (err) {
           recordDegradation("python.lockfile-unparseable.pipenv", {
             ecosystem: "python",
@@ -617,7 +685,7 @@ export async function createPythonBom(path, options) {
     } else if (reqDirFiles?.length) {
       for (const j in reqDirFiles) {
         const f = reqDirFiles[j];
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
@@ -625,13 +693,30 @@ export async function createPythonBom(path, options) {
       metadataFilename = reqDirFiles.join(", ");
     } else if (reqFiles?.length) {
       for (const f of reqFiles) {
-        const dlist = await parseReqFile(f, false);
+        const dlist = await parseReqFile(f, false, installedMetadata);
         if (dlist?.length) {
           pkgList = pkgList.concat(dlist);
         }
       }
     }
   }
+  if (metadataFiles?.length) {
+    // dist-info directories, after every manifest block has added its
+    // entries. An installation whose package a lockfile, Pipfile.lock or
+    // requirements entry already lists enriched that entry, so it is not
+    // also emitted as a component of its own; an installation nothing else
+    // covers still is one. This pass is the emission decision only: each
+    // parser enriched its own entries before it asked PyPI.
+    const enriched = enrichFromInstalledMetadata(pkgList, installedMetadata);
+    for (const dlist of installedLists) {
+      if (dlist?.length) {
+        if (enriched.has(installedMetadataKey(dlist[0]))) {
+          continue;
+        }
+        pkgList = pkgList.concat(dlist);
+      }
+    }
+  }
 
   const parentDependsOn = new Set();
 
@@ -742,79 +827,81 @@ export async function createPythonBom(path, options) {
           );
         }
       }
-      // ATOM parsedeps block
-      // Atom parsedeps slices can be used to identify packages that are not declared in manifests
-      // Since it is a slow operation, we only use it as a fallback or in deep mode
-      // This change was made in 10.9.2 release onwards
-      if (options.deep || !pkgList.length) {
-        if (!pkgList.length) {
-          thoughtLog(
-            "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
-          );
-        }
-        const retMap = await getPyModules(path, pkgList, options);
-        // We need to patch the existing package list to add ImportedModules for evinse to work
-        if (retMap.modList?.length) {
-          const iSymbolsMap = {};
-          retMap.modList.forEach((v) => {
-            iSymbolsMap[v.name] = v.importedSymbols;
-            iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
-          });
-          for (const apkg of pkgList) {
-            if (iSymbolsMap[apkg.name]) {
-              apkg.scope = "required";
-              apkg.properties = apkg.properties || [];
-              apkg.properties.push({
-                name: "internal:ImportedModules",
-                value: iSymbolsMap[apkg.name],
-              });
-            }
+    }
+    // ATOM parsedeps block
+    // Atom parsedeps slices can be used to identify packages that are not declared in manifests
+    // Since it is a slow operation, we only use it as a fallback or in deep mode
+    // This change was made in 10.9.2 release onwards. It reads the sources and
+    // installs nothing, so it runs whether or not dependencies are installed.
+    if (options.deep || !pkgList.length) {
+      if (!pkgList.length) {
+        thoughtLog(
+          "I couldn't find any components yet. Let's try static analysis with atom parsedeps command.",
+        );
+      }
+      const retMap = await getPyModules(path, pkgList, options);
+      // We need to patch the existing package list to add ImportedModules for evinse to work
+      if (retMap.modList?.length) {
+        const iSymbolsMap = {};
+        retMap.modList.forEach((v) => {
+          iSymbolsMap[v.name] = v.importedSymbols;
+          iSymbolsMap[v.name.replace(/_/g, "-")] = v.importedSymbols;
+        });
+        for (const apkg of pkgList) {
+          if (iSymbolsMap[apkg.name]) {
+            apkg.scope = "required";
+            apkg.properties = apkg.properties || [];
+            apkg.properties.push({
+              name: "internal:ImportedModules",
+              value: iSymbolsMap[apkg.name],
+            });
           }
         }
-        if (retMap.pkgList?.length) {
-          pkgList = pkgList.concat(retMap.pkgList);
-          for (const p of retMap.pkgList) {
-            if (
-              !p.version ||
-              (parentComponent &&
-                p.name === parentComponent.name &&
-                (p.version === parentComponent.version ||
-                  p.version === "latest"))
-            ) {
-              continue;
-            }
-            parentDependsOn.add(pypiBomRef(p.name, p.version));
+      }
+      if (retMap.pkgList?.length) {
+        pkgList = pkgList.concat(retMap.pkgList);
+        for (const p of retMap.pkgList) {
+          if (
+            !p.version ||
+            (parentComponent &&
+              p.name === parentComponent.name &&
+              (p.version === parentComponent.version || p.version === "latest"))
+          ) {
+            continue;
           }
-        }
-        if (retMap.dependenciesList) {
-          dependencies = mergeDependencies(
-            dependencies,
-            retMap.dependenciesList,
-            parentComponent,
-          );
-        }
-        if (retMap.allImports) {
-          allImports = { ...allImports, ...retMap.allImports };
+          parentDependsOn.add(pypiBomRef(p.name, p.version));
         }
       }
-      // ATOM parsedeps block
-      let parentPresent = false;
-      for (const d of dependencies) {
-        if (d.ref === parentComponent["bom-ref"]) {
-          parentPresent = true;
-          break;
-        }
+      if (retMap.dependenciesList) {
+        dependencies = mergeDependencies(
+          dependencies,
+          retMap.dependenciesList,
+          parentComponent,
+        );
       }
-      if (!parentPresent) {
-        const pdependencies = {
-          ref: parentComponent["bom-ref"],
-          dependsOn: Array.from(parentDependsOn).filter(
-            (r) => parentComponent && r !== parentComponent["bom-ref"],
-          ),
-        };
-        dependencies.splice(0, 0, pdependencies);
+      if (retMap.allImports) {
+        allImports = { ...allImports, ...retMap.allImports };
       }
     }
+    // ATOM parsedeps block
+    let parentPresent = false;
+    for (const d of dependencies) {
+      if (d.ref === parentComponent["bom-ref"]) {
+        parentPresent = true;
+        break;
+      }
+    }
+    // Without an install, the parent's dependencies are known only when the
+    // import scan found some: an empty list would claim it has none.
+    if (!parentPresent && (options.installDeps || parentDependsOn.size)) {
+      const pdependencies = {
+        ref: parentComponent["bom-ref"],
+        dependsOn: Array.from(parentDependsOn).filter(
+          (r) => parentComponent && r !== parentComponent["bom-ref"],
+        ),
+      };
+      dependencies.splice(0, 0, pdependencies);
+    }
   }
   // Final fallback is to manually parse setup.py if we still
   // have an empty list
@@ -843,9 +930,11 @@ export async function createPythonBom(path, options) {
     );
   }
   emitAiInventorySummary(aiInventory, path);
-  // Check and complete the dependency tree
+  // Check and complete the dependency tree. This installs every package into a
+  // virtual environment, so --no-install-deps turns it off too.
   if (
     isFeatureEnabled(options, "safe-pip-install") &&
+    options.installDeps !== false &&
     pkgList.length &&
     isPartialTree(dependencies, pkgList.length)
   ) {
@@ -1072,6 +1161,28 @@ export function createHelmBom(path, options) {
   return {};
 }
 
+/**
+ * The properties of a list followed by those of another it does not hold yet.
+ * It returns a new array, so a shallow copy of a component keeps its own
+ * properties.
+ *
+ * @param {{name: string, value: string}[]|undefined} existing Properties held so far
+ * @param {{name: string, value: string}[]} additions Properties to add
+ * @returns {{name: string, value: string}[]} The merged properties
+ */
+function withMissingProperties(existing, additions) {
+  const held = existing || [];
+  return [
+    ...held,
+    ...additions.filter(
+      (added) =>
+        !held.some(
+          (known) => known.name === added.name && known.value === added.value,
+        ),
+    ),
+  ];
+}
+
 /**
  * Function to create bom string for php projects
  *
@@ -1104,6 +1215,10 @@ export function createPHPBom(path, options) {
     composerLockSearchOptions,
   );
   let pkgList = [];
+  // Platform facts of the scanned directory's lock when its composer.json names
+  // no project: there is no module component to carry them, so they go on the
+  // document. A nested lock like that has nowhere to put them.
+  let metadataProperties = [];
   const composerJsonMode = composerJsonFiles.length;
   const composerLockMode = composerLockFiles.length;
   // Create a composer.lock file for each composer.json file if needed.
@@ -1217,6 +1332,37 @@ export function createPHPBom(path, options) {
         }
       }
       const retMap = parseComposerLock(f, rootRequires);
+      if (retMap.platformProperties?.length) {
+        if (moduleParent?.["bom-ref"]) {
+          // The root composer.json is parsed twice, once for the parent
+          // component and once per lock, so the object that ends up as
+          // metadata.component is not always the module parsed here.
+          for (const module of [moduleParent, parentComponent]) {
+            if (module?.["bom-ref"] === moduleParent["bom-ref"]) {
+              module.properties = withMissingProperties(
+                module.properties,
+                retMap.platformProperties,
+              );
+            }
+          }
+        } else if (resolve(basePath) === resolve(path)) {
+          // The document describes the scanned directory, so only the lock
+          // in it may put its facts on the document.
+          metadataProperties = withMissingProperties(
+            metadataProperties,
+            retMap.platformProperties,
+          );
+        } else {
+          recordDegradation("php.composer.platform-unattributed", {
+            ecosystem: "php",
+            tool: "composer",
+            impact: "versions",
+            path: f,
+            detail:
+              "The composer.json beside this lock names no project, so no component can carry the PHP and extension requirements of the lock.",
+          });
+        }
+      }
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1256,6 +1402,7 @@ export function createPHPBom(path, options) {
       filename: composerLockFiles.join(", "),
       dependencies,
       parentComponent,
+      metadataProperties,
     });
   }
   if (composerJsonMode && !composerLockMode) {
@@ -1403,7 +1550,7 @@ export async function createRubyBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const gemLockData = readFileSync(f, { encoding: "utf-8" });
-      const retMap = await parseGemfileLockData(gemLockData, f);
+      const retMap = await parseGemfileLockData(gemLockData, f, { gemHome });
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1457,7 +1604,7 @@ export async function createRubyBom(path, options) {
       const gpkgList = await parseGemspecData(
         gemspecData,
         f,
-        isRootGemspec ? { lockedVersions } : {},
+        isRootGemspec ? { lockedVersions, projectGemspec: true } : {},
       );
       if (!gpkgList.length) {
         continue;
@@ -1503,7 +1650,14 @@ export async function createRubyBom(path, options) {
     options.resolveClass ||
     (options.deep && !hasAnyProjectType(["oci"], options, false))
   ) {
-    if (gemHome && !isGemHomeEmpty) {
+    // `bundle exec` evaluates the project's Gemfile, a Ruby program
+    if (gemHome && !isGemHomeEmpty && !isProjectToolingAllowed(options)) {
+      reportProjectToolingSkipped(
+        options,
+        null,
+        "Skipping the module names of gems since dependency installation is disabled. Collecting them runs 'bundle exec', which evaluates the Gemfile.",
+      );
+    } else if (gemHome && !isGemHomeEmpty) {
       const rubyCommand =
         readEnvironmentVariable("CDXGEN_RUBY_CMD") ||
         readEnvironmentVariable("RUBY_CMD") ||
@@ -1619,6 +1773,12 @@ export async function createCsharpBom(path, options) {
     return createBinaryBom(path, options);
   }
   let parentComponent = createDefaultParentComponent(path, "nuget", options);
+  // The directory a scan starts from is not a package, so it has a version
+  // only when --project-version gives it one; "latest" is not a version.
+  applyNugetVersion(
+    parentComponent,
+    options.projectVersion ? `${options.projectVersion}` : undefined,
+  );
   const slnFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}*.sln*`,
@@ -1821,49 +1981,129 @@ export async function createCsharpBom(path, options) {
   const parentDependsOn = new Set();
   if (nupkgFiles.length && projAssetsFiles.length === 0) {
     manifestFiles = manifestFiles.concat(nupkgFiles);
-    // When parsing nupkg files, only version ranges will be specified under dependencies
-    // To resolve the version, we need to track the mapping between name and resolved versions here
-    let dependenciesMap = {};
-    const pkgNameVersions = {};
+    // A nuspec states the range each dependency accepts, not the version
+    // installed. The installed packages are the components, and a dependency
+    // edge points at the installed version its range resolves to; a minimum
+    // version nobody installed is not a component.
+    const installedVersions = {};
+    const installedNames = {};
+    let dependencyRanges = {};
     for (const nf of nupkgFiles) {
       if (DEBUG_MODE) {
         console.log(`Parsing ${nf}`);
       }
       const retMap = await parseNupkg(nf);
-      if (retMap?.pkgList?.length) {
-        pkgList = pkgList.concat(retMap.pkgList);
-        for (const d of retMap.pkgList) {
-          parentDependsOn.add(d["bom-ref"]);
-          pkgNameVersions[d.name] = d.version;
+      const installed = retMap?.pkgList?.[0];
+      if (installed) {
+        pkgList.push(installed);
+        parentDependsOn.add(installed["bom-ref"]);
+        const key = installed.name.toLowerCase();
+        installedNames[key] ??= installed.name;
+        installedVersions[key] ??= [];
+        if (installed.version) {
+          installedVersions[key].push(installed.version);
         }
       }
-      if (retMap?.dependenciesMap) {
-        dependenciesMap = { ...dependenciesMap, ...retMap.dependenciesMap };
+      if (retMap?.dependencyRanges) {
+        dependencyRanges = { ...dependencyRanges, ...retMap.dependencyRanges };
       }
     } // end for
-    for (const k of Object.keys(dependenciesMap)) {
-      const dependsOn = dependenciesMap[k].map((p) => {
-        const ver = pkgNameVersions[p] || "latest";
-        const purl = nugetPurl(p, ver);
-        return purl ? decodeURIComponent(purl) : `library:${p}:${ver}`;
-      });
-      dependencies.push({ ref: k, dependsOn: [...new Set(dependsOn)].sort() });
+    for (const [ref, ranges] of Object.entries(dependencyRanges)) {
+      const dependsOn = new Set();
+      for (const [name, range] of Object.entries(ranges)) {
+        const key = name.toLowerCase();
+        const version = resolveInstalledNugetVersion(
+          range,
+          installedVersions[key],
+        );
+        const purl = version ? nugetPurl(installedNames[key], version) : null;
+        if (purl) {
+          dependsOn.add(decodeURIComponent(purl));
+        }
+      }
+      dependencies.push({ ref, dependsOn: [...dependsOn].sort() });
     }
   }
+  // Versions each project restored, by project directory and lowercased
+  // package id. Two projects of one tree routinely restore different versions
+  // of a package, so a version missing from one project's manifest is taken
+  // from that project's restore output, never from another project's.
+  // The restore output also spells each package id the way its nuspec does.
+  const projectVersions = {};
+  const projectNames = {};
+  const recordProjectVersions = (projectDir, pkgs) => {
+    projectVersions[projectDir] ??= {};
+    projectNames[projectDir] ??= {};
+    for (const p of pkgs || []) {
+      if (
+        p?.name &&
+        p.version &&
+        !["application", "project"].includes(p.type)
+      ) {
+        projectVersions[projectDir][p.name.toLowerCase()] ??= p.version;
+        projectNames[projectDir][p.name.toLowerCase()] ??= p.name;
+      }
+    }
+  };
+  // Direct dependencies of each project directory from its lock file or
+  // packages.config, attached to that project once the project files are read.
+  const rootsByProjectDir = {};
+  const recordRoots = (projectDir, pkgs) => {
+    rootsByProjectDir[projectDir] ??= new Set();
+    for (const p of pkgs || []) {
+      if (p?.["bom-ref"]) {
+        rootsByProjectDir[projectDir].add(p["bom-ref"]);
+      }
+    }
+  };
   // In a multi-project scan, different projects may use different manifest
   // formats: modern SDK-style (project.assets.json / packages.lock.json) or
   // legacy (packages.config). Apply the assets > lock > config precedence per
   // project directory instead of across the whole scan, so dependencies from
   // one project's manifest are not dropped just because another format exists
   // elsewhere in the scan.
-  const assetsProjectDirs = new Set(
-    projAssetsFiles.map((af) => {
-      // project.assets.json is generated under <project>/obj/
-      const d = dirname(af);
-      return basename(d) === "obj" ? dirname(d) : d;
-    }),
-  );
-  const lockProjectDirs = new Set(pkgLockFiles.map((af) => dirname(af)));
+  const assetsProjectDirs = new Set();
+  // Restore records a project file the way the build was pointed at it, which
+  // on a case-insensitive file system can differ in case from the file found
+  // here. Such a path takes the found file's spelling, unless that is ambiguous.
+  const foundProjectFiles = new Set();
+  const foundProjectFilesByKey = new Map();
+  for (const f of csProjFiles) {
+    const file = resolve(f);
+    const key = file.toLowerCase();
+    foundProjectFiles.add(file);
+    foundProjectFilesByKey.set(
+      key,
+      foundProjectFilesByKey.has(key) ? null : file,
+    );
+  }
+  const foundProjectFile = (file) =>
+    !file || foundProjectFiles.has(file)
+      ? file
+      : foundProjectFilesByKey.get(file.toLowerCase()) || file;
+  // The package id and version each project's restore output records, by
+  // project file. A project whose restore outputs disagree, such as a stale
+  // obj/ beside an artifacts directory, takes neither.
+  const restoredIdentities = new Map();
+  const recordRestoredIdentity = (projectFile, identity) => {
+    if (!projectFile || !identity) {
+      return;
+    }
+    const known = restoredIdentities.get(projectFile);
+    if (known === undefined) {
+      restoredIdentities.set(projectFile, identity);
+    } else if (
+      known &&
+      (known.name !== identity.name || known.version !== identity.version)
+    ) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Restore outputs disagree on the package id or version of ${projectFile}, so the identity its project file states is used.`,
+        );
+      }
+      restoredIdentities.set(projectFile, null);
+    }
+  };
   // project.assets.json parsing
   if (projAssetsFiles.length) {
     manifestFiles = manifestFiles.concat(projAssetsFiles);
@@ -1875,6 +2115,15 @@ export async function createCsharpBom(path, options) {
       const results = parseCsProjAssetsData(pkgData, af);
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
+      // Restore output names its project; an artifacts layout keeps it outside
+      // the project directory.
+      const projectFile = foundProjectFile(
+        dotnetRestoredProjectFile(af, results.projectPath, results.outputPath),
+      );
+      const projectDir = dotnetManifestProjectDir(af, projectFile);
+      assetsProjectDirs.add(projectDir);
+      recordProjectVersions(projectDir, dlist);
+      recordRestoredIdentity(projectFile, results.projectIdentity);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -1907,9 +2156,12 @@ export async function createCsharpBom(path, options) {
       });
     }
   }
+  const lockProjectDirs = new Set(
+    pkgLockFiles.map((af) => dotnetManifestProjectDir(af)),
+  );
   // packages.lock.json parsing for any project without a project.assets.json
   const pkgLockToParse = pkgLockFiles.filter(
-    (af) => !assetsProjectDirs.has(dirname(af)),
+    (af) => !assetsProjectDirs.has(dotnetManifestProjectDir(af)),
   );
   if (pkgLockToParse.length) {
     manifestFiles = manifestFiles.concat(pkgLockToParse);
@@ -1923,37 +2175,29 @@ export async function createCsharpBom(path, options) {
       const deps = results["dependenciesList"];
       const dlist = results["pkgList"];
       const rootList = results["rootList"];
+      const projectDir = dotnetManifestProjectDir(af);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
       if (deps?.length) {
         dependencies = mergeDependencies(dependencies, deps, parentComponent);
       }
-      // Keep track of the direct dependencies so that we can construct one complete
-      // list after processing all lock files
-      if (rootList?.length) {
-        for (const p of rootList) {
-          parentDependsOn.add(p["bom-ref"]);
-        }
-      }
+      recordRoots(projectDir, rootList);
     }
   }
   // packages.config parsing for any project without a modern manifest
   // (project.assets.json / packages.lock.json) covering the same directory
   const pkgConfigToParse = pkgConfigFiles.filter((f) => {
-    const projDir = dirname(f);
+    const projDir = dotnetManifestProjectDir(f);
     return !assetsProjectDirs.has(projDir) && !lockProjectDirs.has(projDir);
   });
   if (pkgConfigToParse.length) {
     manifestFiles = manifestFiles.concat(pkgConfigToParse);
-    // Versions already resolved from project.assets.json / packages.lock.json
-    // can backfill templated or missing versions in packages.config
-    const resolvedVersions = {};
-    for (const p of pkgList) {
-      if (p.name && p.version) {
-        resolvedVersions[p.name] = p.version;
-      }
-    }
+    // A templated or missing version is backfilled only from a version every
+    // other manifest of the scan agrees on: these projects restored nothing of
+    // their own, and another project's version may not be theirs.
+    const resolvedVersions = agreedNugetVersions(pkgList);
     // packages.config parsing
     for (const f of pkgConfigToParse) {
       if (DEBUG_MODE) {
@@ -1961,11 +2205,11 @@ export async function createCsharpBom(path, options) {
       }
       pkgData = readFileSync(f, { encoding: "utf-8" });
       const dlist = parseCsPkgData(pkgData, f, resolvedVersions);
+      const projectDir = dotnetManifestProjectDir(f);
+      recordProjectVersions(projectDir, dlist);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
-        for (const d of dlist) {
-          parentDependsOn.add(d["bom-ref"]);
-        }
+        recordRoots(projectDir, dlist);
       }
     }
   }
@@ -1988,27 +2232,34 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
-  const pkgNameVersions = {};
+  const projectRefByDir = {};
   let services = [];
+  let dosaiTools = [];
   if (csProjFiles.length) {
     manifestFiles = manifestFiles.concat(csProjFiles);
-    // Parsing csproj is quite error-prone. Some project files may not have versions specified
-    // To work around this, we make use of the version from the existing list
-    for (const p of pkgList) {
-      if (p.version) {
-        pkgNameVersions[p.name] = p.version;
-      }
-    }
+    // Parsing csproj is quite error-prone. Some project files may not have
+    // versions specified. Such a version comes from what this project restored,
+    // then from central package management, and only then from a version the
+    // whole scan agrees on.
+    const agreedVersions = agreedNugetVersions(pkgList);
     let msbuildInstalled = false;
-    let pkgVersionLabelCandidates = {};
-    const result = safeSpawnSync(DOTNET_CMD, ["msbuild --version"], {
-      shell: isWin,
-    });
-    if (result.status === 0 && !result.error && result.stdout.trim()) {
-      msbuildInstalled = true;
-    } else {
-      pkgVersionLabelCandidates = getPropertyGroupTextNodes(propsFiles);
+    // `dotnet msbuild` evaluates the project (loading Directory.Build.rsp,
+    // Directory.Build.props/targets and build extensions), so it belongs to
+    // the dependency-tooling surface disabled by --no-install-deps and the
+    // pre-build lifecycle. Version labels it would resolve then fall back to
+    // the static props/central-version resolution.
+    if (isProjectToolingAllowed(options)) {
+      const result = safeSpawnSync(DOTNET_CMD, ["msbuild", "--version"], {
+        shell: isWin,
+      });
+      if (result.status === 0 && !result.error && result.stdout?.trim()) {
+        msbuildInstalled = true;
+      }
     }
+    // `$(Name)` version labels resolve from the props files that can apply to
+    // each project (beside and above it), read once for the whole scan.
+    // msbuild evaluates only what they leave unresolved.
+    const propsIndex = indexPropsProperties(propsFiles);
     // Directory.Packages.props can sit above the directory being scanned, so it is
     // resolved per project file by walking up rather than from the props glob below.
     // The cache keeps a repository with many projects from re-parsing the same file.
@@ -2019,15 +2270,20 @@ export async function createCsharpBom(path, options) {
         console.log(`Parsing ${f}`);
       }
       const csProjData = readFileSync(f, { encoding: "utf-8" });
+      const projectDir = dotnetManifestProjectDir(f);
       const retMap = parseCsProjData(
         csProjData,
         f,
-        pkgNameVersions,
+        projectVersions[projectDir] || {},
         msbuildInstalled,
-        pkgVersionLabelCandidates,
+        projectPropertyCandidates(f, propsIndex),
         getCentralPackageVersions(f, centralVersionsCache),
+        agreedVersions,
+        projectNames[projectDir] || {},
+        restoredIdentities.get(resolve(f)) || undefined,
       );
       if (retMap?.parentComponent?.purl) {
+        projectRefByDir[projectDir] ??= retMap.parentComponent["bom-ref"];
         // If there are multiple project files, track the parent components using nested components
         if (csProjFiles.length > 1) {
           if (!parentComponent.components) {
@@ -2049,8 +2305,56 @@ export async function createCsharpBom(path, options) {
           parentComponent,
         );
       }
+      // Only a version that needed msbuild makes its skip a loss
+      if (
+        retMap?.unresolvedVersionLabels?.length &&
+        !isProjectToolingAllowed(options)
+      ) {
+        reportProjectToolingSkipped(
+          options,
+          "dotnet.msbuild.tooling-disabled",
+          "Skipping 'dotnet msbuild' property evaluation since dependency installation is disabled. Package versions that come from MSBuild properties no project or props file sets stay empty.",
+          {
+            ecosystem: "csharp",
+            tool: "msbuild",
+            impact: "versions",
+            detail:
+              "Dependency installation is disabled, so $(Property) version references that the project and props files do not set were not evaluated with msbuild.",
+          },
+        );
+      }
+    }
+  }
+  // A lock file's or packages.config's direct dependencies belong to the
+  // project in that directory; without a project file there, to the parent.
+  for (const [projectDir, roots] of Object.entries(rootsByProjectDir)) {
+    if (!roots.size) {
+      continue;
+    }
+    const projectRef = projectRefByDir[projectDir];
+    if (projectRef && projectRef !== parentComponent?.["bom-ref"]) {
+      dependencies = mergeDependencies(
+        dependencies,
+        [{ ref: projectRef, dependsOn: [...roots].sort() }],
+        parentComponent,
+      );
+    } else {
+      for (const ref of roots) {
+        parentDependsOn.add(ref);
+      }
     }
   }
+  // A scan of several projects is made of them, so the directory depends on
+  // each, as a Gradle build does on its subprojects. Restore output also lists
+  // every project it restored as a package; the parent and its projects are
+  // already in the BOM, and a second component with the same bom-ref would
+  // merge the two in every consumer.
+  const projectRefs = new Set([parentComponent?.["bom-ref"]]);
+  for (const project of parentComponent?.components || []) {
+    parentDependsOn.add(project["bom-ref"]);
+    projectRefs.add(project["bom-ref"]);
+  }
+  pkgList = pkgList.filter((p) => !projectRefs.has(p["bom-ref"]));
   if (pkgList.length) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
@@ -2059,44 +2363,92 @@ export async function createCsharpBom(path, options) {
       // as-is: join would append it to the scan path, which is never a valid
       // path on Windows and silently loses the .NET evidence elsewhere
       // (issue 4394). A relative value still resolves against the scan path.
-      const slicesFile = resolve(
-        options.depsSlicesFile
-          ? resolve(path, options.depsSlicesFile)
-          : join(getTmpDir(), "dosai.json"),
-      );
-      // Create the slices file if it doesn't exist
-      if (!safeExistsSync(slicesFile)) {
-        thoughtLog(
-          "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
-        );
-        const sliceResult = createDosaiMethodsSlice(
-          resolve(path),
-          resolve(slicesFile),
-          options,
-        );
-        if (!sliceResult) {
-          // Visible without --debug: otherwise the components silently lose
-          // the dependency-slice evidence while the scan still exits 0.
-          // --evidence (which implies --deep) runs dosai again during evinse
-          // and can still add occurrences, so this names only what is lost.
-          console.warn(
-            "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with --debug for the dosai errors.",
+      // Without --deps-slices-file the slice goes to a directory of this run:
+      // a fixed name in the shared temp directory was reused by every later
+      // scan, of any project, as if it were that project's evidence.
+      const slicesDir = options.depsSlicesFile
+        ? undefined
+        : safeMkdtempSync(join(getTmpDir(), "cdxgen-dosai-"));
+      const slicesFile = options.depsSlicesFile
+        ? resolve(path, options.depsSlicesFile)
+        : join(slicesDir, "dosai.json");
+      try {
+        // A run that will run evinse (--evidence or --include-crypto, after
+        // profiles are applied) keeps the report full: evinse reuses this
+        // file as its usages slice and persists it as the native report.
+        // Anything else needs only the sections cdxgen reads, so dosai
+        // leaves the rest out (Metadata.OmittedSections names it).
+        const willRunEvinse = runsEvidenceAnalysis(options);
+        // Reuse an existing slice as-is, with one exception: a trimmed file
+        // (an earlier --deep run left it behind) is regenerated full before
+        // an evidence run uses it, so dosai still runs once per scan.
+        let reuseExisting = safeExistsSync(slicesFile);
+        if (reuseExisting && willRunEvinse) {
+          const omitted = dosaiReportFileOmittedSections(slicesFile);
+          if (omitted.length) {
+            if (DEBUG_MODE) {
+              console.log(
+                `The existing dosai methods slice "${slicesFile}" omits sections (${omitted.join(", ")}); regenerating the full report because this run performs evidence analysis.`,
+              );
+            }
+            reuseExisting = false;
+          }
+        }
+        // Create the slices file if it doesn't exist
+        if (!reuseExisting) {
+          thoughtLog(
+            "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
+          );
+          const sliceResult = createDosaiMethodsSlice(
+            resolve(path),
+            resolve(slicesFile),
+            {
+              ...options,
+              dosaiMethodsSections: willRunEvinse
+                ? undefined
+                : dosaiMethodsSectionsArgument(),
+            },
+          );
+          // A stopped run, or one the .NET host refused to start, has
+          // already said why and what to change; the debug output would show
+          // no other dosai error for it (issue 4438).
+          if (!sliceResult && !dosaiFailureReported(resolve(slicesFile))) {
+            // Visible without debug output: otherwise the components silently
+            // lose the dependency-slice evidence while the scan still exits 0.
+            // --evidence (which implies --deep) runs dosai again during evinse
+            // and can still add occurrences, so this names only what is lost.
+            // Debug output comes from the environment, not a CLI flag (issue
+            // 4438).
+            console.warn(
+              "Slicing with dosai was unsuccessful, so the .NET components get no occurrence, reachability, or services evidence from the dependency slice. Re-run with CDXGEN_DEBUG_MODE=debug for the dosai errors.",
+            );
+          }
+        } else if (DEBUG_MODE) {
+          console.log(
+            `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
           );
         }
-      } else if (DEBUG_MODE) {
-        console.log(
-          `Reusing the existing dosai methods slice "${slicesFile}" without checking whether it honours the current --exclude patterns. Delete the file to force a fresh run.`,
+        pkgList = addEvidenceForDotnet(pkgList, slicesFile, {
+          srcPath: resolve(path),
+        });
+        const methodsSlice = readDosaiMethodsReport(slicesFile, {
+          sections: ["Metadata", "Services", "ApiEndpoints"],
+        });
+        // Provider-backed Services[] first so bom-refs, trust zones, and data
+        // classifications survive; ApiEndpoints derivation fills in the rest.
+        const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
+        collectDosaiServicesFromMethods(methodsSlice, servicesMap);
+        services = normalizeDosaiServiceMap(servicesMap);
+        dosaiTools = dosaiToolComponents(
+          slicesFile,
+          methodsSlice,
+          getPluginToolComponents(["dosai"])[0],
         );
+      } finally {
+        if (slicesDir) {
+          safeRmSync(slicesDir, { recursive: true, force: true });
+        }
       }
-      pkgList = addEvidenceForDotnet(pkgList, slicesFile);
-      const methodsSlice = readDosaiMethodsReport(slicesFile, {
-        sections: ["Metadata", "Services", "ApiEndpoints"],
-      });
-      // Provider-backed Services[] first so bom-refs, trust zones, and data
-      // classifications survive; ApiEndpoints derivation fills in the rest.
-      const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
-      collectDosaiServicesFromMethods(methodsSlice, servicesMap);
-      services = normalizeDosaiServiceMap(servicesMap);
     }
   }
   // Parent dependency tree. A single project file already contributed an
@@ -2131,7 +2483,7 @@ export async function createCsharpBom(path, options) {
     dependencies,
     parentComponent,
     services,
-    tools: options.deep ? getPluginToolComponents(["dosai"]) : [],
+    tools: dosaiTools,
   });
 }
 
@@ -2150,58 +2502,239 @@ export async function createCryptoCertsBom(path, options) {
       },
     };
   }
+  const collector = new CertificateCollector();
   const pkgList = [];
-  const certFiles = getAllFiles(
-    path,
-    `${
-      options.multiProject ? "**/" : ""
-    }*.{p12,jks,jceks,bks,keystore,key,pem,cer,gpg,pub}`,
-    options,
+  // In rootfs/container mode the scan path sits inside the extracted tree;
+  // locations are recorded relative to that tree so they merge with the
+  // trustinspector rootfs producer (G18).
+  const locationRoot = options.allLayersExplodedDir;
+  const relativeLocation = (file) =>
+    containerRelativePath(file, locationRoot) || file;
+  // Bom-refs never carry host paths: outside rootfs mode, key and keystore
+  // refs are relative to the scanned path.
+  const refLocation = (file) =>
+    containerRelativePath(file, locationRoot || path) || file;
+  const certFiles = [
+    ...new Set([
+      ...getAllFiles(
+        path,
+        `${
+          options.multiProject ? "**/" : ""
+        }*.{p12,jks,jceks,bks,keystore,key,pem,cer,crt,der,p7b,p7c,pfx,truststore,gpg,pub}`,
+        options,
+      ),
+      // Java truststores carry no extension; match them by exact name.
+      ...getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}{cacerts,jssecacerts}`,
+        options,
+      ),
+    ]),
+  ];
+  // Newlines would corrupt the plugin's stdin file list, and oversized
+  // files are capped in the fallback; the plugin list gets the same caps.
+  const pluginCandidateFiles = certFiles.filter(
+    (file) =>
+      !/[\r\n]/.test(file) &&
+      statSync(file, { throwIfNoEntry: false })?.size <= MAX_CRYPTO_FILE_BYTES,
   );
-  const certHashes = await mapWithConcurrency(certFiles, (f) =>
-    checksumFile("sha256", f),
+  const pluginMaterials = runTrustInspectorCertsMode(
+    pluginCandidateFiles,
+    locationRoot,
   );
-  for (let ci = 0; ci < certFiles.length; ci++) {
-    const f = certFiles[ci];
-    const fileHash = certHashes[ci];
-    const name = basename(f);
-    let evidence;
-    if (options.evidence) {
-      const identityEvidence = {
-        field: "name",
-        confidence: 1,
-        concludedValue: name,
-        methods: [
+  const fallbackRecords = [];
+  if (pluginMaterials) {
+    collector.addTrustInspectorMaterials(pluginMaterials);
+    for (const material of pluginMaterials) {
+      if (typeof material?.path !== "string" || !material.path) {
+        continue;
+      }
+      if (material.kind === "keystore") {
+        pkgList.push(
+          sourceKeystoreComponent(material, refLocation(material.path)),
+        );
+      } else if (material.kind === "private-key") {
+        pkgList.push(
+          sourcePrivateKeyComponent(material, refLocation(material.path)),
+        );
+      }
+    }
+  }
+  // Files the plugin was not given (names with line breaks, oversized
+  // files) are still read here, so no name can hide a file from the
+  // inventory; without a plugin every file is. The files it was given are
+  // its own, except for the keys it builds nothing from: it reports nothing
+  // for a bare PEM public key, and an OpenPGP key only as public-key
+  // material, so both are built here whether it saw them or not.
+  const pluginFiles = new Set(pluginMaterials ? pluginCandidateFiles : []);
+  for (const f of certFiles) {
+    let bytes;
+    try {
+      const stats = statSync(f);
+      if (stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      bytes = readFileSync(f);
+    } catch {
+      continue;
+    }
+    const location = relativeLocation(f);
+    const classification = classifyCryptoFile(bytes);
+    if (
+      pluginFiles.has(f) &&
+      classification.kind !== "gpg" &&
+      classification.kind !== "public-key"
+    ) {
+      continue;
+    }
+    if (classification.kind === "certificates") {
+      for (const der of classification.ders) {
+        const record = certRecordFromDer(der, {
+          location,
+          sourceType: deriveCryptoSourceType(f),
+        });
+        if (record) {
+          record.fileExtension = extname(f).replace(/^\./, "") || undefined;
+          fallbackRecords.push(record);
+        }
+      }
+    } else if (classification.kind === "private-key") {
+      pkgList.push(
+        sourcePrivateKeyComponent(
           {
-            technique: "filename",
-            confidence: 1,
-            value: f,
+            format: classification.format,
+            sourceType: deriveCryptoSourceType(f),
           },
-        ],
-      };
-      evidence = {
-        identity:
-          options.specVersion >= 1.6 ? [identityEvidence] : identityEvidence,
-        occurrences: [{ location: f }],
-      };
+          refLocation(f),
+        ),
+      );
+    } else if (classification.kind === "gpg") {
+      pkgList.push(await sourceGpgComponent(f, location, options));
+    } else if (classification.kind === "public-key") {
+      pkgList.push(await sourcePemPublicKeyComponent(f, location, options));
+    } else if (classification.kind === "keystore") {
+      pkgList.push(
+        sourceKeystoreComponent(
+          {
+            format: classification.format,
+            sourceType: deriveCryptoSourceType(f),
+          },
+          refLocation(f),
+        ),
+      );
     }
-    const apkg = {
-      name,
-      type: "cryptographic-asset",
-      version: fileHash,
-      "bom-ref": `crypto/certificate/${name}@sha256:${fileHash}`,
-      cryptoProperties: {
-        assetType: "certificate",
-        algorithmProperties: {
-          executionEnvironment: "unknown",
-          implementationPlatform: "unknown",
+  }
+  // Kubernetes TLS secrets and Android SPKI pins are cdxgen-side producers:
+  // the plugin has no YAML or Android-config parser.
+  const yamlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.{yaml,yml}`,
+    options,
+  );
+  for (const yamlFile of yamlFiles) {
+    let yamlText;
+    try {
+      const stats = statSync(yamlFile);
+      if (stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      yamlText = readFileSync(yamlFile, "utf-8");
+    } catch {
+      continue;
+    }
+    // Cheap pre-filter: the Secret type string must be present before the
+    // YAML parser runs.
+    if (!yamlText.includes("kubernetes.io/tls")) {
+      continue;
+    }
+    for (const record of kubernetesTlsSecretRecords(yamlText, {
+      file: relativeLocation(yamlFile),
+    })) {
+      fallbackRecords.push(record);
+    }
+  }
+  const androidXmlFiles = getAllFiles(path, "**/res/xml/*.xml", options);
+  for (const xmlFile of androidXmlFiles) {
+    let xmlText;
+    try {
+      const stats = statSync(xmlFile, { throwIfNoEntry: false });
+      if (!stats || stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      xmlText = readFileSync(xmlFile, "utf-8");
+    } catch {
+      continue;
+    }
+    if (!xmlText.includes("<network-security-config")) {
+      continue;
+    }
+    for (const pin of androidNetworkSecurityConfigPins(xmlText, {
+      file: relativeLocation(xmlFile),
+    })) {
+      collector.addPin(pin);
+    }
+  }
+  if (fallbackRecords.length) {
+    linkFallbackIssuers(fallbackRecords);
+    collector.addRecords(fallbackRecords);
+  }
+  const {
+    components: certificateComponents,
+    dependencies: certificateDependencies,
+  } = collector.build();
+  if (pluginMaterials) {
+    // The plugin reports the certificates a readable keystore holds, not the
+    // keystore itself; give it the same component the fallback emits and
+    // link it to what it holds.
+    const keystoreMaterials = new Map();
+    for (const material of pluginMaterials) {
+      if (material?.kind === "certificate" && material.path) {
+        keystoreMaterials.set(material.path, material);
+      }
+    }
+    for (const file of pluginCandidateFiles) {
+      const location = relativeLocation(file);
+      const material = keystoreMaterials.get(location);
+      if (!material) {
+        continue;
+      }
+      let classification;
+      try {
+        classification = classifyCryptoFile(readFileSync(file));
+      } catch {
+        continue;
+      }
+      if (classification.kind !== "keystore") {
+        continue;
+      }
+      const keystore = sourceKeystoreComponent(
+        {
+          format: classification.format,
+          sourceType: material.sourceType || deriveCryptoSourceType(file),
+          readable: true,
         },
-      },
-      ...(evidence ? { evidence } : {}),
-      properties: [{ name: "internal:SrcFile", value: f }],
-    };
-    pkgList.push(apkg);
+        refLocation(file),
+      );
+      pkgList.push(keystore);
+      const held = certificateComponents
+        .filter(
+          (component) =>
+            component.cryptoProperties?.assetType === "certificate" &&
+            component.evidence?.occurrences?.some(
+              (occurrence) => occurrence.location === location,
+            ),
+        )
+        .map((component) => component["bom-ref"])
+        .sort();
+      if (held.length) {
+        certificateDependencies.push({
+          ref: keystore["bom-ref"],
+          dependsOn: held,
+        });
+      }
+    }
   }
+  pkgList.push(...certificateComponents);
   const sourceCryptoComponents = await collectSourceCryptoComponents(
     path,
     options,
@@ -2222,9 +2755,229 @@ export async function createCryptoCertsBom(path, options) {
     bomJson: {
       components: filterInvalidCryptoComponents(pkgList),
     },
+    dependencies: certificateDependencies,
+  };
+}
+
+// Files larger than this are not classified: no real certificate bundle or
+// keystore comes close, and the cap bounds hostile inputs.
+const MAX_CRYPTO_FILE_BYTES = 16 * 1024 * 1024;
+
+function deriveCryptoSourceType(filePath) {
+  const normalized = String(filePath).replace(/\\/g, "/");
+  if (
+    normalized.includes("/etc/ssl/certs") ||
+    normalized.includes("ca-certificates")
+  ) {
+    return "ca-store";
+  }
+  if (normalized.includes("certifi") || normalized.includes("botocore")) {
+    return "language-bundle";
+  }
+  if (
+    /\/etc\/(nginx|apache2|httpd|haproxy|letsencrypt|kubernetes|docker|containerd)\//.test(
+      normalized,
+    )
+  ) {
+    return "server-config";
+  }
+  if (
+    normalized.includes("cacerts") ||
+    /\.(jks|jceks|p12|pfx|truststore)$/i.test(normalized)
+  ) {
+    return "java-truststore";
+  }
+  return "generic";
+}
+
+function sourceCryptoFileEvidence(location, options) {
+  if (!options.evidence) {
+    return undefined;
+  }
+  const identityEvidence = {
+    field: "name",
+    confidence: 1,
+    concludedValue: basename(location),
+    methods: [
+      {
+        technique: "filename",
+        confidence: 1,
+        value: location,
+      },
+    ],
+  };
+  return {
+    identity:
+      options.specVersion >= 1.6 ? [identityEvidence] : identityEvidence,
+    occurrences: [{ location }],
+  };
+}
+
+async function sourceGpgComponent(srcFile, location, options) {
+  const fileHash = await checksumFile("sha256", srcFile);
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    version: fileHash,
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(basename(location))}@sha256:${fileHash}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        format: "OpenPGP",
+      },
+    },
+    ...(sourceCryptoFileEvidence(location, options)
+      ? { evidence: sourceCryptoFileEvidence(location, options) }
+      : {}),
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      { name: "cdx:crypto:sourceType", value: "generic" },
+    ],
+  };
+}
+
+async function sourcePemPublicKeyComponent(srcFile, location, options) {
+  const fileHash = await checksumFile("sha256", srcFile);
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    version: fileHash,
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(basename(location))}@sha256:${fileHash}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        format: "SPKI",
+      },
+    },
+    ...(sourceCryptoFileEvidence(location, options)
+      ? { evidence: sourceCryptoFileEvidence(location, options) }
+      : {}),
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      { name: "cdx:crypto:sourceType", value: "generic" },
+    ],
+  };
+}
+
+function sourcePrivateKeyComponent(material, location) {
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/private-key/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "private-key",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+    ],
+  };
+}
+
+function sourceKeystoreComponent(material, location) {
+  const readable = (material?.properties || []).find(
+    (property) => property.name === "cdx:crypto:keystoreReadable",
+  )?.value;
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/keystore/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "other",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+      // A keystore the plugin read has no keystoreReadable property.
+      ...(material?.readable
+        ? []
+        : [
+            { name: "cdx:crypto:keystoreReadable", value: readable || "false" },
+          ]),
+    ],
   };
 }
 
+/**
+ * Parse the candidate certificate files with the trustinspector `certs`
+ * mode. Only a report-2 envelope is accepted: report-1 output has no
+ * certificate identity to build the shared model from, and the Node
+ * fallback covers that case.
+ *
+ * @param {string[]} files candidate files
+ * @param {string} root paths are reported relative to this directory
+ * @returns {object[]|undefined} materials, or undefined when the plugin is
+ *   absent, blocked or not report-2
+ */
+function runTrustInspectorCertsMode(files, root) {
+  if (!files?.length) {
+    return undefined;
+  }
+  if (isDryRun) {
+    recordActivity({
+      kind: "trustinspector",
+      reason:
+        "Dry run mode blocks trustinspector execution and reports the requested inspection instead.",
+      status: "blocked",
+      target: `certs --stdin (${files.length} files)`,
+    });
+    return undefined;
+  }
+  const trustInspectorBin = resolvePluginBinary("trustinspector");
+  if (!trustInspectorBin) {
+    return undefined;
+  }
+  // `--root` is passed only in rootfs/container mode, where locations must
+  // come out relative to the extracted tree; a plain source scan keeps the
+  // host paths every other producer records. The value reaches a spawned
+  // command, so it gets the same rejection the rootfs path applies:
+  // dangerous unicode or line breaks disable the plugin call.
+  const args = ["certs", "--stdin"];
+  const safeRoot =
+    typeof root === "string" &&
+    !hasDangerousUnicode(root) &&
+    !/[\r\n]/.test(root)
+      ? root
+      : undefined;
+  if (safeRoot) {
+    args.push("--root", safeRoot);
+  }
+  const result = safeSpawnSync(trustInspectorBin, args, {
+    input: `${files.join("\n")}\n`,
+    maxBuffer: 256 * 1024 * 1024,
+    // A hung plugin must not hang cdxgen; the Node fallback takes over.
+    timeout: 10 * 60 * 1000,
+  });
+  if (result?.status !== 0 || result?.error || !result?.stdout) {
+    return undefined;
+  }
+  try {
+    const report = JSON.parse(result.stdout);
+    if (report?.schema !== "trustinspector/report-2") {
+      return undefined;
+    }
+    return report.materials || [];
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Function to create bom string for R projects using renv.
  *
@@ -2342,34 +3095,41 @@ export function createPerlBom(path, options) {
 /**
  * Function to create bom string for Terraform and OpenTofu projects.
  *
- * The `.terraform.lock.hcl` file pins the providers the configuration
- * resolves to, with content hashes suitable for the CycloneDX hashes array.
+ * The workspace assembly turns the provider lock file, the module manifest
+ * `init` writes and the configuration files into module and provider
+ * components with a dependency graph and offline licenses. When metadata
+ * fetching is enabled, the public registries add licenses, repository URLs
+ * and registry flags to components the offline pass could not resolve.
  *
  * @param {string} path to the project
  * @param {Object} options Parse options from the cli
- * @returns {Object} BOM object
+ * @returns {Promise<Object>} BOM object
  */
-export function createTerraformBom(path, options) {
-  let pkgList = [];
-  const lockFiles = getAllFiles(
+export async function createTerraformBom(path, options) {
+  const parentComponent = createDefaultParentComponent(
     path,
-    `${options.multiProject ? "**/" : ""}.terraform.lock.hcl`,
+    "generic",
     options,
   );
-  for (const lockFile of lockFiles) {
-    if (DEBUG_MODE) {
-      console.log(`Parsing ${lockFile}`);
-    }
-    const result = parseTerraformLockFile(lockFile);
-    if (result.pkgList?.length) {
-      pkgList = pkgList.concat(result.pkgList);
-    }
+  const { pkgList, dependencies, parentProperties, srcFiles } =
+    parseTerraformWorkspace(path, options, parentComponent["bom-ref"]);
+  // No module or provider found (for example, resources only, or a stray
+  // .tf in a JS repo): emit nothing, including no root applications, so
+  // multi-type scans do not gain an empty Terraform parent.
+  if (!pkgList.some((p) => p.type === "library")) {
+    return {};
   }
-  if (pkgList.length) {
-    return buildBomNSData(options, pkgList, "terraform", {
-      src: path,
-      filename: lockFiles.join(", "),
-    });
+  parentComponent.properties = [
+    ...(parentComponent.properties || []),
+    ...parentProperties,
+  ];
+  if (pkgList.length && shouldFetchPackageMetadata()) {
+    await getTerraformRegistryMetadata(pkgList);
   }
-  return {};
+  return buildBomNSData(options, pkgList, "terraform", {
+    src: path,
+    filename: srcFiles.join(", "),
+    dependencies,
+    parentComponent,
+  });
 }