@cdxgen/cdxgen 13.4.0 → 13.5.0

package/data/remediations.json

@@ -111,6 +111,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
   },
+  "jvm.maven.tooling-disabled": {
+    "ecosystem": "java",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Maven was skipped because dependency installation is disabled; only the direct dependencies declared in pom.xml files were captured",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Maven. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Maven without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "jvm.maven.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=java"
+  },
   "jvm.gradle.unresolved-config": {
     "ecosystem": "java",
     "kind": "fallback.engaged",
@@ -615,6 +639,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "python.poetry-export.tooling-disabled": {
+    "ecosystem": "python",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "poetry export and pdm export were skipped because dependency installation is disabled; only the packages in the lock file were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Poetry or PDM. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Poetry or PDM without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "python.poetry-export.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "clojure.lein.missing": {
     "ecosystem": "clojure",
     "kind": "fallback.engaged",
@@ -672,6 +720,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "clojure.lein.tooling-disabled": {
+    "ecosystem": "clojure",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "Leiningen was skipped because dependency installation is disabled; only the dependencies declared in project.clj were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run Leiningen. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs Leiningen without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "clojure.lein.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "swift.toolchain.missing": {
     "ecosystem": "swift",
     "kind": "fallback.engaged",
@@ -718,11 +790,35 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "swift.tooling-disabled": {
+    "ecosystem": "swift",
+    "kind": "fallback.engaged",
+    "impact": "transitive-deps",
+    "title": "SwiftPM was skipped because dependency installation is disabled; only the packages in Package.resolved were captured",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run SwiftPM. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs SwiftPM without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "swift.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "dotnet.sdk.missing": {
     "ecosystem": "csharp",
     "kind": "evidence.degraded",
     "impact": "components",
-    "title": ".NET SDK is not installed, so dotnet slices are degraded",
+    "title": "The .NET runtime dosai needs is not installed, so dotnet slices are degraded",
     "targetTier": "resolved",
     "actions": [
       {
@@ -749,6 +845,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "dotnet.msbuild.tooling-disabled": {
+    "ecosystem": "csharp",
+    "kind": "fallback.engaged",
+    "impact": "versions",
+    "title": "dotnet msbuild was skipped because dependency installation is disabled; package versions set by MSBuild properties that no project or props file defines are empty",
+    "targetTier": "manifest",
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run MSBuild. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs MSBuild without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "manifest",
+      "eventsCleared": [
+        "dotnet.msbuild.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "dosai.semantics.persist-failed": {
     "ecosystem": "csharp",
     "kind": "evidence.degraded",
@@ -773,6 +893,48 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
   },
+  "dosai.semantics.trimmed-report": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "none",
+    "title": "The persisted dosai report is partial: its methods half was written with --sections",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Run dosai methods without --sections, or run cdxgen with --evidence, so the persisted report holds every section."
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.semantics.trimmed-report"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
+  "dosai.usages.trimmed-report": {
+    "ecosystem": "csharp",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The supplied dosai usages slice was written without sections cdxgen reads",
+    "targetTier": "resolved",
+    "actions": [
+      {
+        "kind": "config",
+        "detail": "Run dosai methods without --sections, or with every section cdxgen reads, for the report passed with --usages-slices-file."
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": "resolved",
+      "eventsCleared": [
+        "dosai.usages.trimmed-report"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/EVINSE"
+  },
   "cocoa.pods.missing": {
     "ecosystem": "cocoa",
     "kind": "fallback.engaged",
@@ -796,6 +958,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "cocoa.podfile-json.tooling-disabled": {
+    "ecosystem": "cocoa",
+    "kind": "fallback.engaged",
+    "impact": "components",
+    "title": "pod ipc podfile-json was skipped because dependency installation is disabled; every pod from Podfile.lock is included without per-target filtering",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run CocoaPods. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs CocoaPods without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "cocoa.podfile-json.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
+  "cocoa.podspec.tooling-disabled": {
+    "ecosystem": "cocoa",
+    "kind": "fallback.engaged",
+    "impact": "licenses",
+    "title": "Ruby podspecs were not evaluated because dependency installation is disabled; their pods lack license and author details",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Only for a project you trust: pass --install-deps so cdxgen can run CocoaPods. Secure mode keeps installs off unless this flag is given. Outside secure mode, --introspect also runs CocoaPods without installing packages."
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "cocoa.podspec.tooling-disabled"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "ruby.build-deps.missing": {
     "ecosystem": "ruby",
     "kind": "evidence.degraded",
@@ -1048,6 +1258,54 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
   },
+  "php.host-probe.package-db-unreadable": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "A package database could not be read in full, so the PHP no package owns on this host was not identified",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the package databases (for example with sudo), so PHP files can be matched to the packages that own them"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "php.host-probe.package-db-unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
+  "php.composer.platform-unattributed": {
+    "ecosystem": "php",
+    "kind": "evidence.degraded",
+    "impact": "versions",
+    "title": "A composer.lock below the scanned directory sits beside a composer.json without a name, so its PHP and extension requirements were not recorded",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Give the project a \"name\" in its composer.json, or scan the project directory itself"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "php.composer.platform-unattributed"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES?id=php"
+  },
   "dart.pub-get-needed": {
     "ecosystem": "dart",
     "kind": "evidence.degraded",
@@ -1143,6 +1401,30 @@
     },
     "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
   },
+  "os.apk-installed-db.unreadable": {
+    "ecosystem": "generic",
+    "kind": "evidence.degraded",
+    "impact": "components",
+    "title": "The apk installed database could not be read in full, so the packages of this host are missing from the OBOM",
+    "targetTier": null,
+    "actions": [
+      {
+        "kind": "config",
+        "command": "Run cdxgen as a user that can read the apk installed database (for example as root), so the packages it lists are inventoried"
+      },
+      {
+        "kind": "rerun"
+      }
+    ],
+    "verify": {
+      "rules": [],
+      "expectTier": null,
+      "eventsCleared": [
+        "os.apk-installed-db.unreadable"
+      ]
+    },
+    "docs": "https://cyclonedx.github.io/cdxgen/#/PROJECT_TYPES"
+  },
   "policy.secure-mode": {
     "ecosystem": "generic",
     "kind": "evidence.degraded",

package/data/rules/cbom-security.yaml

@@ -141,21 +141,22 @@
     }
 
 - id: CBC-001
-  name: "Expired or Expiring Certificate"
-  description: "Certificates that have expired or are close to their expiration date will cause service disruptions or trust validation failures."
+  name: "Expired Certificate"
+  description: "A certificate whose validity ended before the audit ran will fail trust validation and cause service disruptions."
   severity: high
   category: cbom-compliance
   dry-run-support: full
   condition: |
     components[
       cryptoProperties.assetType = 'certificate'
-      and $hasProp($, 'cdx:cert:isExpired', 'true')
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) < $toMillis($now())
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' has expired or is invalid"
+  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' expired on {{ cryptoProperties.certificateProperties.notValidAfter }}"
   mitigation: "Renew the certificate and update the deployment trust stores."
   evidence: |
     {
@@ -163,3 +164,233 @@
       "issuer": cryptoProperties.certificateProperties.issuerName,
       "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
     }
+
+- id: CBC-002
+  name: "Certificate expiring within 30 days"
+  description: "A certificate that is still valid but expires within 30 days will soon cause trust validation failures."
+  severity: medium
+  category: cbom-compliance
+  dry-run-support: full
+  condition: |
+    components[
+      cryptoProperties.assetType = 'certificate'
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) >= $toMillis($now())
+      and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) < ($toMillis($now()) + 2592000000)
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate for Subject '{{ cryptoProperties.certificateProperties.subjectName }}' expires on {{ cryptoProperties.certificateProperties.notValidAfter }}"
+  mitigation: "Plan the certificate renewal and update the deployment trust stores before it expires."
+  evidence: |
+    {
+      "subject": cryptoProperties.certificateProperties.subjectName,
+      "issuer": cryptoProperties.certificateProperties.issuerName,
+      "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
+    }
+
+# The eight SPKI SHA-256 hashes Go 1.27.3 and 1.26.10 hard-code into
+# crypto/x509 (CVE-2026-111943).
+# https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de
+- id: CBC-003
+  name: "Certificate or key distrusted by Go (CVE-2026-111943)"
+  description: "Go 1.27.3 and 1.26.10 reject every chain containing one of eight intermediate CA keys, matched by the SHA-256 of the certificate's SubjectPublicKeyInfo. The hash matches re-issued and cross-signed copies of the same key as well."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    (
+      $deny := [
+        "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+        "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+        "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+        "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+        "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+        "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+        "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+        "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30"
+      ];
+      components[
+        (
+          cryptoProperties.assetType = 'certificate'
+          or cryptoProperties.assetType = 'related-crypto-material'
+        )
+        and $exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny])
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate or key '{{ name }}' carries a public key Go 1.27.3/1.26.10 distrust (CVE-2026-111943)"
+  mitigation: "Replace the certificate chain and remove the key from every trust store, bundle and pin. https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de"
+  evidence: |
+    {
+      "spkiSha256": $prop($, 'cdx:crypto:spkiSha256'),
+      "subject": cryptoProperties.certificateProperties.subjectName,
+      "locations": $count(evidence.occurrences)
+    }
+
+- id: CBC-004
+  name: "Certificate issued under a Go-distrusted key (CVE-2026-111943)"
+  description: "The certificate was issued by one of the eight intermediate CA keys Go 1.27.3 and 1.26.10 distrust, so Go clients rebuilt with those releases will refuse the chain even while the operating system still accepts it."
+  severity: high
+  category: cbom-security
+  dry-run-support: full
+  standards:
+    nist-800-53:
+      - "SC-13 Cryptographic Protection"
+  condition: |
+    (
+      $deny := [
+        "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105",
+        "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f",
+        "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41",
+        "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0",
+        "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b",
+        "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8",
+        "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6",
+        "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30"
+      ];
+      $badSkis := components[
+        cryptoProperties.assetType = 'certificate'
+        and $exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny])
+      ].properties[name = 'cdx:crypto:subjectKeyId'].value[$ != null].$lowercase($);
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $not($exists(properties[name = 'cdx:crypto:spkiSha256'].value[$lowercase($) in $deny]))
+        and (
+          $count(properties[name = 'cdx:crypto:issuerSpkiSha256' or name = 'cdx:crypto:unverifiedIssuerSpkiSha256'].value[$lowercase($) in $deny]) > 0
+          or (
+            $prop($, 'cdx:crypto:authorityKeyId') != null
+            and $lowercase($nullSafeProp($, 'cdx:crypto:authorityKeyId')) in $badSkis
+          )
+        )
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' was issued under a public key Go 1.27.3/1.26.10 distrust (CVE-2026-111943)"
+  mitigation: "Re-issue the certificate under a trusted CA and update the server chain. https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de"
+  evidence: |
+    {
+      "authorityKeyId": $prop($, 'cdx:crypto:authorityKeyId'),
+      "issuerSpkiSha256": properties[name = 'cdx:crypto:issuerSpkiSha256'].value,
+      "subject": cryptoProperties.certificateProperties.subjectName
+    }
+
+# Post-quantum OIDs (ML-DSA RFC 9881, SLH-DSA RFC 9909, ML-KEM RFC 9935) and
+# the classical-only cutoff. NIST IR 8547 (initial public draft) proposes
+# classical algorithms be disallowed after 2035.
+- id: CBC-005
+  name: "Classical-only CA certificate valid past the post-quantum transition"
+  description: "A CA certificate whose key and signature algorithms are both classical stays valid beyond 2035-01-01, past the date NIST IR 8547 (initial public draft) proposes to disallow classical algorithms."
+  severity: low
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    (
+      $pq := [
+        "2.16.840.1.101.3.4.3.17", "2.16.840.1.101.3.4.3.18", "2.16.840.1.101.3.4.3.19",
+        "2.16.840.1.101.3.4.3.20", "2.16.840.1.101.3.4.3.21", "2.16.840.1.101.3.4.3.22",
+        "2.16.840.1.101.3.4.3.23", "2.16.840.1.101.3.4.3.24", "2.16.840.1.101.3.4.3.25",
+        "2.16.840.1.101.3.4.3.26", "2.16.840.1.101.3.4.3.27", "2.16.840.1.101.3.4.3.28",
+        "2.16.840.1.101.3.4.3.29", "2.16.840.1.101.3.4.3.30", "2.16.840.1.101.3.4.3.31",
+        "2.16.840.1.101.3.4.4.1", "2.16.840.1.101.3.4.4.2", "2.16.840.1.101.3.4.4.3"
+      ];
+      $cutoff := '2035-01-01T00:00:00Z';
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $prop($, 'cdx:crypto:certRole') in ['root', 'intermediate']
+        and $prop($, 'cdx:crypto:publicKeyAlgorithmOid') != null
+        and $prop($, 'cdx:crypto:signatureAlgorithmOid') != null
+        and $not($prop($, 'cdx:crypto:publicKeyAlgorithmOid') in $pq)
+        and $not($prop($, 'cdx:crypto:signatureAlgorithmOid') in $pq)
+        and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) != null
+        and $certEndMillis(cryptoProperties.certificateProperties.notValidAfter) > $toMillis($cutoff)
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "CA certificate '{{ name }}' uses only classical algorithms but is valid past the 2035-01-01 cutoff"
+  mitigation: "Plan a migration to post-quantum algorithms before the classical-only validity window ends."
+  evidence: |
+    {
+      "keyAlgorithmOid": $prop($, 'cdx:crypto:publicKeyAlgorithmOid'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid'),
+      "notValidAfter": cryptoProperties.certificateProperties.notValidAfter
+    }
+
+- id: CBC-006
+  name: "Post-quantum key certified with a classical signature"
+  description: "The certificate's public key is post-quantum but its signature algorithm is classical, so the authentication of that key is only as strong as the classical signature."
+  severity: medium
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    (
+      $pq := [
+        "2.16.840.1.101.3.4.3.17", "2.16.840.1.101.3.4.3.18", "2.16.840.1.101.3.4.3.19",
+        "2.16.840.1.101.3.4.3.20", "2.16.840.1.101.3.4.3.21", "2.16.840.1.101.3.4.3.22",
+        "2.16.840.1.101.3.4.3.23", "2.16.840.1.101.3.4.3.24", "2.16.840.1.101.3.4.3.25",
+        "2.16.840.1.101.3.4.3.26", "2.16.840.1.101.3.4.3.27", "2.16.840.1.101.3.4.3.28",
+        "2.16.840.1.101.3.4.3.29", "2.16.840.1.101.3.4.3.30", "2.16.840.1.101.3.4.3.31",
+        "2.16.840.1.101.3.4.4.1", "2.16.840.1.101.3.4.4.2", "2.16.840.1.101.3.4.4.3"
+      ];
+      components[
+        cryptoProperties.assetType = 'certificate'
+        and $prop($, 'cdx:crypto:publicKeyAlgorithmOid') in $pq
+        and $prop($, 'cdx:crypto:signatureAlgorithmOid') != null
+        and $not($prop($, 'cdx:crypto:signatureAlgorithmOid') in $pq)
+      ]
+    )
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' binds a post-quantum key with the classical signature '{{ $prop($, 'cdx:crypto:signatureAlgorithm') }}'"
+  mitigation: "Re-issue the certificate under a post-quantum or composite signature scheme once one is standardised for your chain."
+  evidence: |
+    {
+      "keyAlgorithmOid": $prop($, 'cdx:crypto:publicKeyAlgorithmOid'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid')
+    }
+
+- id: CBC-007
+  name: "Unrecognised certificate algorithm"
+  description: "The key or signature algorithm is named only by its dotted OID, which means a composite, pre-standard or otherwise unregistered algorithm the inventory cannot classify. PLAN assigns this rule info severity; the rule engine's lowest level is low."
+  severity: low
+  category: cbom-security
+  dry-run-support: full
+  condition: |
+    components[
+      (
+        cryptoProperties.assetType = 'certificate'
+        and $match($safeStr($prop($, 'cdx:crypto:signatureAlgorithm')), /^[0-9]+(\.[0-9]+)+$/)
+      )
+      or (
+        cryptoProperties.assetType = 'related-crypto-material'
+        and $match(name, /^[0-9]+(\.[0-9]+)+$/)
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Certificate '{{ name }}' uses an algorithm named only by its OID '{{ $firstNonEmpty($prop($, 'cdx:crypto:signatureAlgorithm'), name) }}'"
+  mitigation: "Identify the algorithm behind the OID and confirm it is an approved one for this use."
+  evidence: |
+    {
+      "signatureAlgorithm": $prop($, 'cdx:crypto:signatureAlgorithm'),
+      "signatureAlgorithmOid": $prop($, 'cdx:crypto:signatureAlgorithmOid'),
+      "name": name
+    }

package/data/rules/go-binaries.yaml

@@ -0,0 +1,46 @@
+# Go binary toolchain rules
+# Category: go-security
+# Evaluates the cdx:go:buildVersion property recorded for executable file
+# components during container/rootfs scans.
+
+- id: GO-TLS-001
+  name: "Go binary built with a toolchain that lacks the CVE-2026-111943 distrust list"
+  description: "Go links its standard library statically, so a binary keeps the trust behaviour of the toolchain it was built with. Releases before go1.26.10, and go1.27.0 through go1.27.2, lack the eight SPKI hashes Go uses to distrust the CVE-2026-111943 intermediate CA keys, and older release lines (1.25 and earlier) will never receive them. Release candidates of newer lines (go1.28rc1) already carry the fix."
+  severity: high
+  category: go-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:go:buildVersion')
+      and (
+        $prop($, 'cdx:go:buildVersion') = 'unknown-pre-1.18'
+        or (
+          $m := $match($prop($, 'cdx:go:buildVersion'), /^go(\d+)\.(\d+)(?:\.(\d+))?/);
+          $m != null
+          and $number($m.groups[0]) = 1
+          and (
+            $number($m.groups[1]) < 26
+            or (
+              $number($m.groups[1]) = 26
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 10
+            )
+            or (
+              $number($m.groups[1]) = 27
+              and ($m.groups[2] != null ? $number($m.groups[2]) : 0) < 3
+            )
+          )
+        )
+      )
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "Go binary '{{ name }}' was built with {{ $prop($, 'cdx:go:buildVersion') }}, which lacks the CVE-2026-111943 distrust list"
+  mitigation: "Rebuild the binary with go1.26.10, go1.27.3 or newer so its crypto/x509 rejects the distrusted intermediate CA keys."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:go:buildVersion'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }