@cdxgen/cdxgen 13.4.0 → 13.5.0

package/README.md

@@ -16,7 +16,7 @@ cdxgen is a CLI tool, library, [REPL](./ADVANCED.md), and server to create, vali
 
 Supported BOM formats:
 
-- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS and Linux amd64/arm64 systems.
+- Hardware (HBOM) - For supported live hosts such as Apple Silicon macOS, Linux amd64/arm64, and Windows amd64/arm64 systems.
 - Software (SBOM) - For many languages and container images.
 - Cryptography (CBOM) - For Java keystores and certificates, plus JavaScript and TypeScript source-level algorithm inventory.
 - Operations (OBOM) - For Linux container images and VMs running Linux or Windows operating systems.
@@ -175,7 +175,7 @@ Regardless of how you install, the following commands are available:
 | `obom`          | Alias for `cdxgen -t os`                                                                                             | yes                              |
 | `saasbom`       | Alias for SaaSBOM-oriented `cdxgen` defaults                                                                         | yes                              |
 | `spdxgen`       | Alias for `cdxgen --format spdx`                                                                                     | use `cdxgen`                     |
-| `cdxgen-secure` | Alias for hardened `cdxgen` defaults                                                                                 | use `cdxgen`                     |
+| `cdxgen-secure` | `cdxgen` in secure mode, with dependency installation always off                                                     | use `cdxgen`                     |
 
 Standalone GitHub release binaries are published for `cdxgen`, `cdxgen-slim`, `aibom`, `cbom`, `obom`, `saasbom`, `hbom`, `hbom-slim`, `cdx-audit`, `cdx-convert`, `cdx-sign`, `cdx-validate`, `cdx-verify`, and `tracebom`.
 
@@ -187,7 +187,7 @@ The `cbom` and `saasbom` release binaries bundle the Atom analysis stack (`@appt
 
 For AI-heavy repositories, cdxgen also supports an AI-BOM workflow via the `aibom` command or the `-t ai` project type aliases (`ai`, `aibom`, `ai-bom`). This emits AI service/model evidence and pairs naturally with the `ai-bom` BOM-audit category alias for governance, security, performance, AI-agent, and MCP findings.
 
-For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime, and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified.
+For host inventories, `hbom --include-runtime` produces a merged HBOM + OBOM view with strict topology links such as interface-name, driver-module, storage/runtime (including Windows drive letters), and explicit secure-boot trust matches, plus a `host-topology` BOM audit pack for higher-confidence host findings. When the live hardware collector reports missing utilities or permission-sensitive enrichments, use `hbom diagnostics` (or inspect the derived `cdx:hbom:analysis:*` summary properties) before deciding whether a rerun with `--privileged` is justified. On Windows, `--privileged` only helps from an already-elevated session, and a non-administrator over SSH or WinRM is denied every WMI query; see [HBOM permissions](docs/PERMISSIONS.md#hbom-permissions).
 
 ### Standalone executables (recommended)
 
@@ -216,7 +216,7 @@ Common asset names:
 #### Linux
 
 ```bash
-VERSION="v13.4.0"
+VERSION="v13.5.0"
 ASSET="cdx-audit-linux-amd64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -230,7 +230,7 @@ chmod +x "${ASSET}"
 #### macOS
 
 ```bash
-VERSION="v13.4.0"
+VERSION="v13.5.0"
 ASSET="cdx-audit-darwin-arm64"
 BASE_URL="https://github.com/cdxgen/cdxgen/releases/download/${VERSION}"
 
@@ -244,7 +244,7 @@ chmod +x "${ASSET}"
 #### Windows (PowerShell)
 
 ```powershell
-$Version = "v13.4.0"
+$Version = "v13.5.0"
 $Asset = "cdx-audit-windows-amd64.exe"
 $BaseUrl = "https://github.com/cdxgen/cdxgen/releases/download/$Version"
 
@@ -269,7 +269,7 @@ steps:
     env:
       GH_TOKEN: ${{ github.token }}
     run: |
-      gh release download v13.4.0 \
+      gh release download v13.5.0 \
         --repo cdxgen/cdxgen \
         --pattern 'cdx-audit-linux-amd64' \
         --pattern 'cdx-audit-linux-amd64.sha256'

package/bin/cdxgen-secure.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+// cdxgen-secure: cdxgen in secure mode.
+//
+// This is an entry point of its own rather than a second name for
+// bin/cdxgen.js. cdxgen recognised the command from the script path in
+// process.argv[1], but bun reports the real file behind a symlink there and
+// the npm shims on Windows always name bin/cdxgen.js, so in both cases a
+// `cdxgen-secure` that pointed at bin/cdxgen.js ran as plain cdxgen. Turning
+// secure mode on here, before any cdxgen module loads, also means the modules
+// that read CDXGEN_SECURE_MODE once at import see it.
+import process from "node:process";
+
+process.env.CDXGEN_SECURE_MODE = "true";
+
+await import("./cdxgen.js");

package/bin/cdxgen.js

@@ -4,7 +4,6 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import http from "node:http";
 import https from "node:https";
-import { tmpdir } from "node:os";
 import {
   basename,
   dirname,
@@ -22,6 +21,7 @@ import { hideBin } from "yargs/helpers";
 import { getExactAiInventoryType } from "../lib/cli/bomAssembly.js";
 import {
   applyAdvancedOptions as applyAdvancedOptionsImpl,
+  applyOperatorToolingChoice,
   buildOptionsFromArgs,
   isUserProvided,
   validateSpecVersion,
@@ -39,6 +39,7 @@ import {
   PROJECT_CONFIG_FILENAMES,
   sanitizeProjectConfig,
 } from "../lib/core/projectConfig.js";
+import { isSecureModeActive } from "../lib/core/projectTooling.js";
 import {
   ui as defaultUi,
   installConsoleShim,
@@ -103,6 +104,7 @@ import {
   printSummary,
   printTable,
 } from "../lib/inventory/display.js";
+import { runsEvidenceAnalysis } from "../lib/inventory/dosai.js";
 import {
   ensureNoMixedHbomProjectTypes,
   ensureSupportedHbomSpecVersion,
@@ -138,6 +140,11 @@ import { prepareEnv } from "../lib/stages/pregen/pregen.js";
 import { validateSpdx } from "../lib/validator/bomValidator.js";
 import { validateGeneratedBom } from "../lib/validator/index.js";
 
+// The environment as the operator launched cdxgen. The CLI later copies some
+// parsed options into the environment (--introspect becomes
+// CDXGEN_INTROSPECT), so the operator's own choices are read from this copy.
+const launchEnv = { ...process.env };
+
 // Support for config files. The config file lives in the directory under
 // analysis, so it carries that directory's trust level; see
 // sanitizeProjectConfig for the boundary this applies.
@@ -1127,8 +1134,10 @@ let autoLedgerSidecar;
 if (options.introspect) {
   process.env.CDXGEN_INTROSPECT = "true";
   if (!isDryRun && !readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER")) {
+    // The temp directory, not the OS one: under the permission model it is
+    // the directory cdxgen is granted writes to.
     autoLedgerSidecar = join(
-      tmpdir(),
+      getTmpDir(),
       `cdxgen-introspect-ledger-${process.pid}.jsonl`,
     );
     process.env.CDXGEN_INTROSPECT_LEDGER = autoLedgerSidecar;
@@ -1266,7 +1275,15 @@ if (options.lifecycle) {
 }
 const isHbomOnlyInvocation = isHbomOnlyProjectTypes(options.projectType);
 const advancedWarnings = applyAdvancedOptionsImpl(options, {
-  isSecureMode,
+  isSecureMode: isSecureModeActive(),
+});
+// The config file comes from the working directory, usually the scanned
+// project, so whether the project's own code may run stays the operator's
+// choice from the command line and environment.
+applyOperatorToolingChoice(options, {
+  env: launchEnv,
+  isSecureMode: isSecureModeActive(),
+  projectConfig: config,
 });
 if (options?.technique && Array.isArray(options.technique)) {
   if (options.technique.length === 1) {
@@ -2128,7 +2145,7 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   let internalCycloneDxInputPath = outputPlan.outputs.cyclonedx;
-  if ((options.evidence || options.includeCrypto) && bomNSData?.bomJson) {
+  if (runsEvidenceAnalysis(options) && bomNSData?.bomJson) {
     if (!internalCycloneDxInputPath) {
       internalCycloneDxInputPath = join(
         getTmpDir(),
@@ -2151,7 +2168,10 @@ const writeCycloneDxOutput = (jsonFile, bomJson, options) => {
     }
   }
   // Evidence generation
-  if (options.evidence || options.includeCrypto) {
+  // The same helper decides in createCsharpBom whether the dosai methods
+  // report may be trimmed: --include-crypto alone runs evinse too, so testing
+  // options.evidence alone here would trim a report this scan needs full.
+  if (runsEvidenceAnalysis(options)) {
     if (isDryRun) {
       recordActivity({
         kind: "write",

package/bin/evinse.js

@@ -226,6 +226,11 @@ const args = yargs(hideBin(process.argv))
     default: false,
     type: "boolean",
   })
+  .option("install-deps", {
+    description:
+      "Let evinse run the project's own build tools, such as Maven and SwiftPM, to collect evidence. On by default, and off in secure mode. Pass --no-install-deps for projects you do not trust.",
+    type: "boolean",
+  })
   .option("with-deep-jar-collector", {
     description:
       "Enable collection of all jars from maven cache directory. Useful to improve the recall for callstack evidence.",

package/bin/hbom.js

@@ -26,7 +26,10 @@ import {
   ensureSupportedHbomSpecVersion,
   hasHbomProjectType,
 } from "../lib/inventory/hbom.js";
-import { getHbomSummary } from "../lib/inventory/hbomAnalysis.js";
+import {
+  getHbomPrivilegeGuidance,
+  getHbomSummary,
+} from "../lib/inventory/hbomAnalysis.js";
 import {
   importProtobomModule,
   isProtoBomPath,
@@ -130,12 +133,13 @@ const args = _yargs
   })
   .option("privileged", {
     description:
-      "Enable privileged Linux enrichment and non-interactive sudo retries for documented permission-sensitive commands.",
+      "Enable privileged enrichment for documented permission-sensitive sources. Linux: privileged enrichment and non-interactive sudo retries. Windows: the TPM, BitLocker, storage-reliability and Secure Boot batch, which only an already-elevated (Run as administrator) session can read; HBOM never prompts for UAC and records permission-denied diagnostics otherwise. No effect on macOS.",
     type: "boolean",
     default: false,
   })
   .option("plist-enrichment", {
-    description: "Enable additional Darwin plist-based enrichment.",
+    description:
+      "Enable additional plist-based enrichment. Darwin only; ignored on Linux and Windows.",
     type: "boolean",
     default: false,
   })
@@ -172,7 +176,10 @@ const args = _yargs
     ["$0", "Generate an HBOM file for the current host"],
     ["$0 -p", "Print the generated HBOM to stdout"],
     ["$0 --platform linux --arch amd64", "Override target selection"],
-    ["$0 --privileged --pretty", "Enable privileged Linux enrichment"],
+    [
+      "$0 --privileged --pretty",
+      "Enable privileged enrichment: sudo retries on Linux, the elevated-only batch on Windows (run from an administrator prompt)",
+    ],
     [
       "$0 diagnostics",
       "Run a live HBOM diagnostic pass and summarize missing commands or permission-sensitive enrichments",
@@ -226,6 +233,9 @@ const options = {
   arch: args.arch,
   command: selectedCommand,
   commandName: hbomCommandName,
+  // yargs turns `--no-command-enrichment` into `commandEnrichment: false` and
+  // leaves `noCommandEnrichment` at its default, so forward both spellings.
+  commandEnrichment: args.commandEnrichment,
   dryRun: args.dryRun,
   input: args.input ? resolve(args.input) : undefined,
   noCommandEnrichment: args.noCommandEnrichment,
@@ -420,9 +430,7 @@ function printHbomDiagnosticsReport(bomJson) {
   }
 
   if (hbomSummary.requiresPrivilegedEnrichment) {
-    console.log(
-      "\nSome Linux enrichments can likely succeed only with --privileged and a target environment that allows non-interactive sudo.",
-    );
+    console.log(`\n${getHbomPrivilegeGuidance(hbomSummary.platform)}`);
   }
 }
 

package/bin/repl.js

@@ -25,6 +25,8 @@ import {
   printAiBomPedigree,
   printAiBomVariants,
   printCallStack,
+  printCertificateChain,
+  printCertificatesTable,
   printDependencyTree,
   printFormulation,
   printOccurrences,
@@ -1224,6 +1226,32 @@ cdxgenRepl.defineCommand("cryptos", {
     this.displayPrompt();
   },
 });
+cdxgenRepl.defineCommand("certs", {
+  help: "print the certificate components with role, issuer, expiry and SPKI prefix",
+  action() {
+    if (sbom) {
+      printCertificatesTable(sbom);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
+cdxgenRepl.defineCommand("certchain", {
+  help: "show the issuer chain above a certificate and the certificates issued under it (.certchain <bom-ref|spki-prefix|cert-prefix>)",
+  action(selector) {
+    if (sbom) {
+      printCertificateChain(sbom, selector);
+    } else {
+      console.log(
+        "⚠ No BOM is loaded. Use .import command to import an existing BOM",
+      );
+    }
+    this.displayPrompt();
+  },
+});
 cdxgenRepl.defineCommand("sourcecryptos", {
   help: "show source-derived cryptographic assets detected from JS AST analysis",
   action() {
@@ -2203,6 +2231,7 @@ cdxgenRepl.defineCommand("tagcloud", {
 });
 // Let's dynamically define more commands from the queries
 [
+  "apk_packages",
   "apt_sources",
   "behavioral_reverse_shell",
   "certificates",

package/data/cbomosdb-queries.json

@@ -17,6 +17,12 @@
     "purlType": "rpm",
     "componentType": "library"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm",
+    "componentType": "library"
+  },
   "python_packages": {
     "query": "select * from python_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "Python packages installed on system.",
@@ -32,7 +38,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages where name like '%ssl%' OR name like '%crypto%';",
     "description": "List all homebrew_packages.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "library"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages where name like '%ssl%' OR name like '%crypto%';",
+    "description": "Retrieves the crypto and TLS libraries among the active MacPorts ports.",
+    "purlType": "macports",
     "componentType": "library"
   },
   "authorized_keys": {

package/data/component-tags.json

@@ -164,6 +164,7 @@
       "windows_programs",
       "processor",
       "services_snapshot",
+      "apk_packages",
       "apt_sources",
       "apt_ppa_sources",
       "behavioral_reverse_shell",
@@ -180,6 +181,13 @@
       "gatekeeper",
       "vscode_extensions",
       "homebrew_packages",
+      "macports_packages",
+      "pacman_packages",
+      "snap_packages",
+      "flatpak_packages",
+      "ai_agent_skills",
+      "gpu_info",
+      "chrome_search_engines",
       "installed_applications",
       "interface_addresses",
       "kernel_info",

package/data/queries-darwin.json

@@ -29,6 +29,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "apps": {
     "query": "select * from apps;",
     "description": "macOS applications installed in known search paths (e.g., /Applications).",
@@ -47,6 +59,12 @@
     "purlType": "swid",
     "componentType": "application"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "certificates": {
     "query": "SELECT * FROM certificates WHERE path != 'Other People';",
     "description": "List all certificates in the trust store.",
@@ -74,7 +92,13 @@
   "homebrew_packages": {
     "query": "SELECT * FROM homebrew_packages;",
     "description": "Homebrew formula and cask inventory including auto-update behavior.",
-    "purlType": "swid",
+    "purlType": "brew",
+    "componentType": "application"
+  },
+  "macports_packages": {
+    "query": "select * from macports_packages;",
+    "description": "Retrieves the active ports of the MacPorts registry.",
+    "purlType": "macports",
     "componentType": "application"
   },
   "npm_packages": {

package/data/queries-win.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "browser_plugins": {
     "query": "select browser_plugins.* from users join browser_plugins using (uid);",
     "description": "Retrieves the list of C/NPAPI browser plugin in the target system.",
@@ -88,6 +100,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, uid, type, gid FROM users;",
     "description": "Local and domain-backed user account inventory on Windows endpoints.",
@@ -167,7 +185,7 @@
     "componentType": "data"
   },
   "windows_bitlocker_info": {
-    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status FROM bitlocker_info;",
+    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status, protector_types FROM bitlocker_info;",
     "description": "BitLocker protection and encryption state for local drives.",
     "purlType": "swid",
     "componentType": "data"

package/data/queries.json

@@ -30,6 +30,18 @@
     "purlType": "vscode-extension",
     "componentType": "application"
   },
+  "chrome_search_engines": {
+    "query": "SELECT chrome_search_engines.*, chrome_search_engines.browser_type || '/' || chrome_search_engines.uid || '/' || chrome_search_engines.profile AS label FROM users JOIN chrome_search_engines USING (uid);",
+    "description": "The default search engine of every Chromium-based browser profile, for each user.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "ai_agent_skills": {
+    "query": "SELECT ai_agent_skills.*, hash.sha256 FROM users JOIN ai_agent_skills USING (uid) LEFT JOIN hash ON hash.path = ai_agent_skills.path UNION ALL SELECT ai_agent_skills.*, hash.sha256 FROM ai_agent_skills LEFT JOIN hash ON hash.path = ai_agent_skills.path WHERE ai_agent_skills.scope = 'system';",
+    "description": "AI agent skills (SKILL.md packages) installed for each user, through Claude Code plugins and system-wide, with the SHA-256 of each SKILL.md. Skills have no package identity, so they get no purl.",
+    "purlType": "generic",
+    "componentType": "file"
+  },
   "deb_packages": {
     "query": "select * from deb_packages;",
     "description": "Retrieves all the installed DEB packages in the target Linux system.",
@@ -69,6 +81,29 @@
     "description": "Retrieves all the installed RPM packages in the target Linux system.",
     "purlType": "rpm"
   },
+  "pacman_packages": {
+    "query": "select * from pacman_packages;",
+    "description": "Retrieves all the packages pacman installed on Arch Linux and the distros built on it.",
+    "purlType": "alpm"
+  },
+  "snap_packages": {
+    "query": "select * from snap_packages;",
+    "description": "Retrieves the installed snap packages at their current revision.",
+    "purlType": "snap",
+    "componentType": "application"
+  },
+  "flatpak_packages": {
+    "query": "select app_id as name, name as display_name, version, arch, branch, commit_hash, origin, runtime, type, installation, summary, description, license, homepage, developer_name from flatpak_packages;",
+    "description": "Retrieves the Flatpak applications and runtimes installed system-wide and for each user.",
+    "purlType": "flatpak",
+    "componentType": "application"
+  },
+  "homebrew_packages": {
+    "query": "SELECT * FROM homebrew_packages;",
+    "description": "Homebrew formula and cask inventory including auto-update behavior.",
+    "purlType": "brew",
+    "componentType": "application"
+  },
   "python_packages": {
     "query": "select * from python_packages;",
     "description": "Python packages installed on system.",
@@ -85,6 +120,12 @@
     "purlType": "swid",
     "componentType": "data"
   },
+  "gpu_info": {
+    "query": "SELECT *, driver_version AS version, vendor AS publisher FROM gpu_info;",
+    "description": "GPU inventory with the vendor, model and installed driver version.",
+    "purlType": "swid",
+    "componentType": "device"
+  },
   "users_snapshot": {
     "query": "SELECT username as name, uuid as version, description, directory, shell, uid, gid FROM users;",
     "description": "Local user inventory for account and shell posture analysis.",