@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/managers/binary.js

@@ -6,7 +6,15 @@ import {
   statSync,
 } from "node:fs";
 import { platform as _platform, homedir } from "node:os";
-import { basename, dirname, extname, join, relative, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  relative,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
@@ -33,23 +41,41 @@ import {
 import { mapWithConcurrency } from "../core/parallel.js";
 import { isValidDriveRoot } from "../core/paths.js";
 import { isCycloneDxComponentTypeEnabled } from "../inventory/bomUtils.js";
+import {
+  CertificateCollector,
+  classifyCryptoFile,
+} from "../inventory/certificates.js";
 import { createContainerRiskProperties } from "../inventory/containerRisk.js";
 import {
   attachIdentityTools,
   extractToolRefs,
 } from "../inventory/evidenceUtils.js";
+import {
+  PRE_1_18_VERSION,
+  readGoBuildVersion,
+} from "../inventory/goBuildInfo.js";
 import { createGtfoBinsProperties } from "../inventory/gtfobins.js";
 import {
   canonicalDistroQualifier,
+  getDistroInfo,
   isCleanDistroQualifier,
   OS_DISTRO_ALIAS,
   OS_NAMESPACE_ALIAS,
   readOsRelease,
 } from "../inventory/osinfo.js";
+import { isRealArchitecture } from "../inventory/osPackagePurl.js";
 import {
   collectExecutables,
   collectSharedLibs,
 } from "../inventory/osPackageResolver.js";
+import {
+  attachPhpBuild,
+  classifyPhpSapi,
+  createPhpRuntimeInventory,
+  MAX_PHP_PROBES,
+  packageStoreOf,
+  readPhpBuildVersion,
+} from "../inventory/phpBuildInfo.js";
 import {
   resolveCdxgenPlugins,
   resolvePluginBinary,
@@ -60,11 +86,13 @@ import {
   parsePurlLoose,
   tryBuildPurl,
 } from "../inventory/purl.js";
+import { collectRootfsCertificates } from "../inventory/rootfsCerts.js";
 import {
   adjustLicenseInformation,
   findLicenseId,
   isSpdxLicenseExpression,
 } from "../inventory/spdx.js";
+import { isValidIdnEmail } from "../parsers/email.js";
 import { getDirs } from "./containerutils.js";
 
 const isWin = _platform() === "win32";
@@ -654,7 +682,35 @@ export function canonicaliseOsPackageNamespace(
   group,
   distroId,
 ) {
-  if (!purlObj || !OS_PURL_TYPES.includes(purlObj.type)) {
+  if (!purlObj) {
+    return group;
+  }
+  // trivy invents a `bottlerocket` purl type for Bottlerocket host packages
+  // (trivy pkg/purl/purl.go, packageurlTypeBottlerocket); the purl spec has
+  // no such type — @cdxgen/cdx-purl has no generated type class for it, and
+  // no vulnerability feed stores under it. Rewrite to the form cdxgen's own
+  // os-release path produces for a Bottlerocket host: type rpm, namespace
+  // bottlerocket (the os-release ID; OS_NAMESPACE_ALIAS needs no entry).
+  // The distro qualifier trivy stamps (bottlerocket-<os version>) survives
+  // unchanged. The caller's group is returned as for any other rpm distro
+  // without an alias, so getOSPackages still records the rpm type and the
+  // distro in allTypes (oci:image:componentTypes).
+  if (purlObj.type === "bottlerocket") {
+    purlObj.type = "rpm";
+    purlObj.namespace = "bottlerocket";
+    comp.group = "bottlerocket";
+    comp.purl = build({
+      type: purlObj.type,
+      namespace: purlObj.namespace,
+      name: name,
+      version: purlObj.version || null,
+      qualifiers: purlObj.qualifiers || null,
+      subpath: purlObj.subpath || null,
+    });
+    comp["bom-ref"] = decodeURIComponent(comp.purl);
+    return group;
+  }
+  if (!OS_PURL_TYPES.includes(purlObj.type)) {
     return group;
   }
   const os_ns = purlObj.namespace || group || "";
@@ -923,80 +979,20 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       if (DEBUG_MODE) {
         console.log(osReleaseData);
       }
-      // distro_name must be a real release codename/token (bookworm, jammy,
-      // rhel-9, alpine-3.19), never a distro *display name*. VERSION_CODENAME is
-      // authoritative when present; otherwise the RHEL/CentOS product-name
-      // fallbacks are only accepted when they resolve through OS_DISTRO_ALIAS
-      // (e.g. "red hat enterprise linux 9" -> "rhel-9"). Display names such as
-      // "Rocky Linux" or "AlmaLinux" have no alias entry and are dropped so we
-      // never emit a bogus distro_name qualifier (RPM distros track packages
-      // flat, without a release segment, so folding a display name breaks
-      // downstream vuln-db matching).
-      let distro_codename = (
-        osReleaseData["VERSION_CODENAME"] || ""
-      ).toLowerCase();
-      if (!distro_codename) {
-        const distro_display_name = (
-          osReleaseData["CENTOS_MANTISBT_PROJECT"] ||
-          osReleaseData["REDHAT_BUGZILLA_PRODUCT"] ||
-          osReleaseData["REDHAT_SUPPORT_PRODUCT"] ||
-          ""
-        ).toLowerCase();
-        if (distro_display_name && OS_DISTRO_ALIAS[distro_display_name]) {
-          distro_codename = OS_DISTRO_ALIAS[distro_display_name];
-        }
-      }
-      let distro_id = osReleaseData["ID"] || "";
-      const distro_id_like = osReleaseData["ID_LIKE"] || "";
-      let purl_type = "rpm";
-      switch (distro_id) {
-        case "debian":
-        case "ubuntu":
-        case "pop":
-          purl_type = "deb";
-          break;
-        case "sles":
-        case "suse":
-        case "opensuse":
-          purl_type = "rpm";
-          break;
-        case "alpine":
-          purl_type = "apk";
-          if (osReleaseData.VERSION_ID) {
-            const versionParts = osReleaseData["VERSION_ID"].split(".");
-            if (versionParts.length >= 2) {
-              distro_codename = `alpine-${versionParts[0]}.${versionParts[1]}`;
-            }
-          }
-          break;
-        case "alpaquita":
-          purl_type = "apk";
-          break;
-        default:
-          if (distro_id_like.includes("debian")) {
-            purl_type = "deb";
-          } else if (distro_id_like.includes("alpine")) {
-            purl_type = "apk";
-          } else if (
-            distro_id_like.includes("rhel") ||
-            distro_id_like.includes("centos") ||
-            distro_id_like.includes("fedora")
-          ) {
-            purl_type = "rpm";
-          }
-          break;
-      }
-      if (osReleaseData["VERSION_ID"]) {
-        distro_id = `${distro_id}-${osReleaseData["VERSION_ID"]}`;
-        if (OS_DISTRO_ALIAS[distro_id]) {
-          distro_codename = OS_DISTRO_ALIAS[distro_id];
-        }
-      }
-      // Canonicalise the distro qualifier vendor (e.g. "mariner-2.0" ->
-      // "azure-linux-2.0") so every spelling of one release yields a single
-      // qualifier value. This runs before distro_id is used to overwrite
-      // trivy's own qualifier below.
-      distro_id = canonicalDistroQualifier(distro_id);
+      // The distro of the rootfs is decided in getDistroInfo, which an OBOM run
+      // on the same system reads too, so a package gets the same qualifiers
+      // from either scan. distro_name is a real release codename/token
+      // (bookworm, jammy, rhel, alpine-3.24), never a distro *display name*:
+      // "Rocky Linux" or "AlmaLinux" is dropped, since RPM distros track
+      // packages flat and a display name there breaks downstream vuln-db
+      // matching. distro is ID-VERSION_ID with the vendor canonicalised (e.g.
+      // "mariner-2.0" -> "azure-linux-2.0"), so every spelling of one release
+      // yields a single qualifier value; it overwrites trivy's own qualifier
+      // below.
+      const distroInfo = getDistroInfo(src);
+      let distro_codename = distroInfo.distroName;
+      const distro_id = distroInfo.distroId;
+      const purl_type = distroInfo.purlType;
       const tmpDependencies = {};
       tools = enrichToolComponents(
         (Array.isArray(tmpBom?.metadata?.tools)
@@ -1030,6 +1026,27 @@ export async function getOSPackages(src, imageConfig, options = {}) {
             try {
               purlObj = Purl.parse(comp.purl);
               purlObj.qualifiers = purlObj.qualifiers || {};
+              if (
+                OS_PURL_TYPES.includes(purlObj.type) &&
+                "arch" in purlObj.qualifiers &&
+                !isRealArchitecture(purlObj.qualifiers.arch)
+              ) {
+                // trivy writes arch=None for a package with no architecture,
+                // such as an rpm's gpg-pubkey; a package has the architecture
+                // it has, or none, as in an OBOM.
+                delete purlObj.qualifiers.arch;
+                comp.purl = build({
+                  type: purlObj.type,
+                  namespace: purlObj.namespace || null,
+                  name: name,
+                  version: purlObj.version || null,
+                  qualifiers: Object.keys(purlObj.qualifiers).length
+                    ? purlObj.qualifiers
+                    : null,
+                  subpath: purlObj.subpath || null,
+                });
+                comp["bom-ref"] = decodeURIComponent(comp.purl);
+              }
             } catch (_err) {
               // continue regardless of error
             }
@@ -1115,16 +1132,20 @@ export async function getOSPackages(src, imageConfig, options = {}) {
                 if (distro_codename !== "") {
                   allTypes.add(distro_codename);
                   allTypes.add(purlObj.namespace);
-                  comp.purl = build({
-                    type: purlObj.type,
-                    namespace: purlObj.namespace || null,
-                    name: name,
-                    version: purlObj.version || null,
-                    qualifiers: purlObj.qualifiers || null,
-                    subpath: purlObj.subpath || null,
-                  });
-                  comp["bom-ref"] = decodeURIComponent(comp.purl);
                 }
+                // Rebuilt whether or not the distro has a codename: the distro
+                // stamped above is ID-VERSION_ID for every distro, and a purl
+                // left as trivy wrote it keeps trivy's own spelling (a bare
+                // 20230201 for a Wolfi image).
+                comp.purl = build({
+                  type: purlObj.type,
+                  namespace: purlObj.namespace || null,
+                  name: name,
+                  version: purlObj.version || null,
+                  qualifiers: purlObj.qualifiers || null,
+                  subpath: purlObj.subpath || null,
+                });
+                comp["bom-ref"] = decodeURIComponent(comp.purl);
               } catch (_err) {
                 // continue regardless of error
               }
@@ -1404,9 +1425,36 @@ export async function getOSPackages(src, imageConfig, options = {}) {
       "/etc/ld.so.conf",
       "/etc/ld.so.conf.d/*.conf",
       ownedFilePaths,
+      // Apache loads libphp*.so from a modules directory that is two levels
+      // below /usr, which the default one-level globs miss.
+      [
+        "**/usr/lib/apache2/modules/libphp*.so",
+        "**/usr/lib/httpd/modules/libphp*.so",
+        "**/usr/lib64/httpd/modules/libphp*.so",
+      ],
     ),
     "shared_library",
   );
+  // Go executables carry the toolchain they were built with in their
+  // buildinfo header. The stdlib is statically linked, so that version
+  // decides whether the binary applies Go's CVE-2026-111943 distrust list.
+  const goBuildInventory = collectGoBuildInfo(executables, src);
+  if (goBuildInventory.stdlibComponents.length) {
+    pkgList.push(...goBuildInventory.stdlibComponents);
+  }
+  if (goBuildInventory.dependencies.length) {
+    dependenciesList.push(...goBuildInventory.dependencies);
+  }
+  // Source-built PHP (the Docker Official image, FrankenPHP and custom
+  // /usr/local builds) is unpackaged, so its version is only visible in the
+  // binaries and the installed php_version.h.
+  const phpBuildInventory = collectPhpBuildInfo(executables, sharedLibs, src);
+  if (phpBuildInventory.runtimeComponents.length) {
+    pkgList.push(...phpBuildInventory.runtimeComponents);
+  }
+  if (phpBuildInventory.dependencies.length) {
+    dependenciesList.push(...phpBuildInventory.dependencies);
+  }
   return {
     osPackages: pkgList,
     osPackageFiles,
@@ -1545,17 +1593,24 @@ function mergeOrganizationalEntityField(component, fieldName, entityName) {
   return { applied: false, represented: false };
 }
 
-function parseOrganizationalContact(value) {
+/**
+ * Split a `Name <address>` maintainer string into an `organizationalContact`.
+ *
+ * @param {string} value Maintainer or supplier string
+ * @returns {{name: string, email?: string}|undefined} The contact, if any
+ */
+export function parseOrganizationalContact(value) {
   const normalizedValue = `${value || ""}`.trim();
   if (!normalizedValue) {
     return undefined;
   }
   const match = normalizedValue.match(/^([^<>]+?)\s*<([^<>\s]+@[^<>\s]+)>$/);
   if (match) {
-    return {
-      name: match[1].trim(),
-      email: match[2].trim(),
-    };
+    const name = match[1].trim();
+    const email = match[2].trim();
+    // `organizationalContact.email` is an `idn-email`; an address that is not
+    // one (say `a@b@c`) would fail schema validation, so keep only the name.
+    return isValidIdnEmail(email) ? { name, email } : { name };
   }
   return { name: normalizedValue };
 }
@@ -1644,13 +1699,34 @@ function promoteTrivyOsPackageIdentity(component, trivyMetadata) {
 async function collectRootfsRepositoryInventory(basePath, options = {}) {
   let trustedKeyComponents = [];
   let refsByPath = new Map();
+  let trustMaterialDependencies = [];
   if (isCycloneDxComponentTypeEnabled("cryptographic-asset", options)) {
     ({ components: trustedKeyComponents, refsByPath } =
       await collectTrustedKeyComponents(basePath));
-    trustedKeyComponents = applyTrustMaterialEnhancements(
+    ({
+      components: trustedKeyComponents,
+      dependencies: trustMaterialDependencies,
+    } = applyTrustMaterialEnhancements(
       trustedKeyComponents,
       collectTrustInspectorRootfsInventory(basePath),
-    );
+      basePath,
+    ));
+    if (!TRUSTINSPECTOR_BIN) {
+      // No plugin: walk the same locations in JavaScript. With the plugin
+      // present its rootfs report is the only producer, so nothing is
+      // counted twice.
+      const fallback = collectRootfsCertificates(basePath);
+      const knownRefs = new Set(trustedKeyComponents.map((c) => c["bom-ref"]));
+      for (const component of fallback.components) {
+        if (!knownRefs.has(component["bom-ref"])) {
+          knownRefs.add(component["bom-ref"]);
+          trustedKeyComponents.push(component);
+        }
+      }
+      trustMaterialDependencies = trustMaterialDependencies.concat(
+        fallback.dependencies,
+      );
+    }
   }
   refsByPath = new Map(
     trustedKeyComponents
@@ -1692,6 +1768,7 @@ async function collectRootfsRepositoryInventory(basePath, options = {}) {
       });
     }
   }
+  dependenciesList.push(...trustMaterialDependencies);
   return { components, dependenciesList };
 }
 
@@ -1877,7 +1954,9 @@ function executeTrustInspector(args, activity) {
   if (DEBUG_MODE) {
     console.log("Executing", TRUSTINSPECTOR_BIN, args.join(" "));
   }
-  const result = safeSpawnSync(TRUSTINSPECTOR_BIN, args);
+  const result = safeSpawnSync(TRUSTINSPECTOR_BIN, args, {
+    timeout: 10 * 60 * 1000,
+  });
   if (result?.status !== 0 || result?.error) {
     if (DEBUG_MODE && (result?.stdout || result?.stderr)) {
       console.error(result.stdout, result.stderr);
@@ -1991,91 +2070,54 @@ function createTrustMaterialComponent(material) {
       ? [{ name: "cdx:crypto:expiresAt", value: material.expiresAt }]
       : []),
   ]);
-  let component;
   if (material.kind === "certificate") {
-    component = {
-      "bom-ref": `crypto/certificate/${encodeURIComponent(material.name || normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.serial || material.expiresAt || "unknown"}`,
-      name: material.name || basename(normalizedPath),
-      type: "cryptographic-asset",
-      version:
-        material.sha256 ||
-        material.serial ||
-        material.expiresAt ||
-        "configured",
-      hashes,
-      description: material.subject || normalizedPath,
-      cryptoProperties: {
-        assetType: "certificate",
-        algorithmProperties: {
-          executionEnvironment: "unknown",
-          implementationPlatform: "unknown",
-        },
-        certificateProperties: {
-          serialNumber: material.serial || undefined,
-          subjectName: material.subject || undefined,
-          issuerName: material.issuer || undefined,
-          notValidBefore: material.createdAt || undefined,
-          notValidAfter: material.expiresAt || undefined,
-          certificateFormat: material.format || "X.509",
-          certificateFileExtension: material.fileExtension || undefined,
-          fingerprint: material.fingerprint
-            ? { alg: "SHA-256", content: material.fingerprint }
-            : undefined,
-        },
+    // Certificates are built by the shared collector in
+    // applyTrustMaterialEnhancements; this legacy builder no longer produces
+    // them, so a certificate material reaching here is skipped.
+    return undefined;
+  }
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.keyId || "unknown"}`,
+    name: material.name || basename(normalizedPath),
+    type: "cryptographic-asset",
+    version: material.sha256 || material.keyId || normalizedPath,
+    hashes,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        id:
+          material.keyId ||
+          material.fingerprint ||
+          material.sha256 ||
+          normalizedPath,
+        state: trustMaterialState(material),
       },
-      properties: uniqueProperties(
-        sharedProperties.concat(
-          material.trustDomain
-            ? [{ name: "cdx:crypto:trustDomain", value: material.trustDomain }]
-            : [],
-        ),
-      ),
-    };
-  } else {
-    component = {
-      "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(normalizedPath)}@${material.sha256 ? `sha256:${material.sha256}` : material.keyId || "unknown"}`,
-      name: material.name || basename(normalizedPath),
-      type: "cryptographic-asset",
-      version: material.sha256 || material.keyId || normalizedPath,
-      hashes,
-      cryptoProperties: {
-        assetType: "related-crypto-material",
-        relatedCryptoMaterialProperties: {
-          type: "public-key",
-          id:
-            material.keyId ||
-            material.fingerprint ||
-            material.sha256 ||
-            normalizedPath,
-          state: trustMaterialState(material),
+    },
+    properties: uniqueProperties(
+      sharedProperties.concat([
+        {
+          name: "cdx:crypto:trustDomain",
+          value: material.trustDomain || deriveTrustedKeyDomain(normalizedPath),
         },
-      },
-      properties: uniqueProperties(
-        sharedProperties.concat([
-          {
-            name: "cdx:crypto:trustDomain",
-            value:
-              material.trustDomain || deriveTrustedKeyDomain(normalizedPath),
-          },
-          { name: "cdx:crypto:keyPath", value: normalizedPath },
-          {
-            name: "cdx:crypto:fileExtension",
-            value:
-              material.fileExtension ||
-              extname(normalizedPath).replace(/^\./, "") ||
-              "gpg",
-          },
-          ...(material?.keyId
-            ? [{ name: "cdx:crypto:keyId", value: material.keyId }]
-            : []),
-          ...(material?.userIds || []).map((value) => ({
-            name: "cdx:crypto:userId",
-            value,
-          })),
-        ]),
-      ),
-    };
-  }
+        { name: "cdx:crypto:keyPath", value: normalizedPath },
+        {
+          name: "cdx:crypto:fileExtension",
+          value:
+            material.fileExtension ||
+            extname(normalizedPath).replace(/^\./, "") ||
+            "gpg",
+        },
+        ...(material?.keyId
+          ? [{ name: "cdx:crypto:keyId", value: material.keyId }]
+          : []),
+        ...(material?.userIds || []).map((value) => ({
+          name: "cdx:crypto:userId",
+          value,
+        })),
+      ]),
+    ),
+  };
   attachIdentityTools(component, trustInspectorToolRefs());
   return component;
 }
@@ -2100,9 +2142,73 @@ function enhanceComponentFromTrustMaterial(component, material) {
   return component;
 }
 
-function applyTrustMaterialEnhancements(components, materials) {
+function createKeystoreComponent(material) {
+  const normalizedPath = normalizeContainerPath(material?.path);
+  if (!normalizedPath) {
+    return undefined;
+  }
+  const readable = (material?.properties || []).find(
+    (property) => property.name === "cdx:crypto:keystoreReadable",
+  )?.value;
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/keystore/${encodeURIComponent(normalizedPath)}`,
+    name: basename(normalizedPath),
+    type: "cryptographic-asset",
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "other",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location: normalizedPath }] },
+    properties: [
+      { name: "internal:SrcFile", value: normalizedPath },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+      ...(readable
+        ? [{ name: "cdx:crypto:keystoreReadable", value: readable }]
+        : []),
+    ],
+  };
+  attachIdentityTools(component, trustInspectorToolRefs());
+  return component;
+}
+
+// Private keys are classified from the PEM header line only and never
+// decoded (PLAN section 1.7): the format travels, no key material does.
+function createPrivateKeyComponent(material) {
+  const normalizedPath = normalizeContainerPath(material?.path);
+  if (!normalizedPath) {
+    return undefined;
+  }
+  const component = {
+    "bom-ref": `crypto/related-crypto-material/private-key/${encodeURIComponent(normalizedPath)}`,
+    name: basename(normalizedPath),
+    type: "cryptographic-asset",
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "private-key",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location: normalizedPath }] },
+    properties: [
+      { name: "internal:SrcFile", value: normalizedPath },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+    ],
+  };
+  attachIdentityTools(component, trustInspectorToolRefs());
+  return component;
+}
+
+function applyTrustMaterialEnhancements(components, materials, basePath) {
   if (!materials?.length) {
-    return components || [];
+    return { components: components || [], dependencies: [] };
   }
   const componentList = [...(components || [])];
   const bySrcFile = new Map();
@@ -2119,6 +2225,8 @@ function applyTrustMaterialEnhancements(components, materials) {
     }
   }
   for (const material of materials) {
+    // GPG-style keyring materials (report-1 `kind: public-key`) enhance the
+    // components the native readers already produced.
     const srcFile = normalizeContainerPath(material?.path);
     const existing = bySrcFile.get(srcFile);
     if (
@@ -2129,17 +2237,95 @@ function applyTrustMaterialEnhancements(components, materials) {
       enhanceComponentFromTrustMaterial(existing, material);
       continue;
     }
-    const component = createTrustMaterialComponent(material);
+    if (material?.kind === "public-key") {
+      const component = createTrustMaterialComponent(material);
+      if (!component?.["bom-ref"] || seenRefs.has(component["bom-ref"])) {
+        continue;
+      }
+      seenRefs.add(component["bom-ref"]);
+      componentList.push(component);
+      if (srcFile) {
+        bySrcFile.set(srcFile, component);
+      }
+    }
+  }
+  // Certificates, their SPKI public keys, algorithm components and verified
+  // issuer edges come from the shared collector; keystores and private keys
+  // are their own components.
+  const collector = new CertificateCollector();
+  collector.addTrustInspectorMaterials(materials);
+  const { components: cryptoComponents, dependencies } = collector.build();
+  for (const material of materials) {
+    if (material?.kind === "keystore") {
+      cryptoComponents.push(createKeystoreComponent(material));
+    } else if (material?.kind === "private-key") {
+      cryptoComponents.push(createPrivateKeyComponent(material));
+    }
+  }
+  // A keystore the plugin could read is reported as the certificates it
+  // holds; give it the keystore component the unreadable ones get and link
+  // it to those certificates.
+  if (basePath) {
+    const certMaterialByPath = new Map();
+    for (const material of materials) {
+      if (material?.kind === "certificate" && material.path) {
+        certMaterialByPath.set(normalizeContainerPath(material.path), material);
+      }
+    }
+    for (const [path, material] of certMaterialByPath) {
+      let classification;
+      try {
+        const absolute = join(basePath, path.replace(/^\/+/, ""));
+        // The path comes from the plugin report: it must stay inside the
+        // scanned root, symlinks included.
+        const realRoot = realpathSync(basePath);
+        const realFile = realpathSync(absolute);
+        const inside = relative(realRoot, realFile);
+        if (inside.startsWith("..") || isAbsolute(inside)) {
+          continue;
+        }
+        const stats = lstatSync(absolute);
+        if (!stats.isFile() || stats.size > 16 * 1024 * 1024) {
+          continue;
+        }
+        classification = classifyCryptoFile(readFileSync(absolute));
+      } catch (_err) {
+        continue;
+      }
+      if (classification.kind !== "keystore") {
+        continue;
+      }
+      const keystore = createKeystoreComponent({
+        path,
+        format: classification.format,
+        sourceType: material.sourceType,
+      });
+      cryptoComponents.push(keystore);
+      const held = cryptoComponents
+        .filter(
+          (component) =>
+            component.cryptoProperties?.assetType === "certificate" &&
+            component.evidence?.occurrences?.some(
+              (occurrence) =>
+                normalizeContainerPath(occurrence.location) === path,
+            ),
+        )
+        .map((component) => component["bom-ref"])
+        .sort();
+      if (held.length) {
+        dependencies.push({ ref: keystore["bom-ref"], dependsOn: held });
+      }
+    }
+  }
+  for (const component of cryptoComponents) {
     if (!component?.["bom-ref"] || seenRefs.has(component["bom-ref"])) {
       continue;
     }
     seenRefs.add(component["bom-ref"]);
+    attachIdentityTools(component, trustInspectorToolRefs());
     componentList.push(component);
-    if (srcFile) {
-      bySrcFile.set(srcFile, component);
-    }
   }
-  return componentList;
+  return { components: componentList, dependencies };
 }
 
 function collectTrustInspectorRootfsInventory(basePath) {
@@ -3299,10 +3485,37 @@ export function enrichOSComponentsWithTrustData(components = []) {
   if (hostComponents.length) {
     mergedComponents.push(...hostComponents);
   }
+  // report-2 host mode enumerates the platform trust stores as materials;
+  // they flow through the shared certificate model like any other producer.
+  const hostCollector = new CertificateCollector();
+  hostCollector.addTrustInspectorMaterials(hostData?.materials);
+  const { components: hostMaterialComponents } = hostCollector.build();
+  for (const material of hostData?.materials || []) {
+    if (material?.kind === "keystore") {
+      const component = createKeystoreComponent(material);
+      if (component) {
+        hostMaterialComponents.push(component);
+      }
+    } else if (material?.kind === "private-key") {
+      const component = createPrivateKeyComponent(material);
+      if (component) {
+        hostMaterialComponents.push(component);
+      }
+    }
+  }
+  for (const component of hostMaterialComponents) {
+    if (!component?.["bom-ref"]) {
+      continue;
+    }
+    attachIdentityTools(component, trustInspectorToolRefs());
+    mergedComponents.push(component);
+  }
   return {
     components: mergedComponents,
     tools:
-      pathInspectionCandidates.length || hostComponents.length
+      pathInspectionCandidates.length ||
+      hostComponents.length ||
+      hostMaterialComponents.length
         ? getPluginToolComponents(["trustinspector"])
         : [],
   };
@@ -3473,6 +3686,139 @@ export function getBinaryBom(src, binaryBomFile, deepMode) {
   return true;
 }
 
+// The Go standard library has no module path, so `pkg:golang/stdlib@v<x>` is
+// not a purl cdx-purl will build (the same reason trivy's stdlib purl is
+// dropped further up). The bom-ref below is the decoded form of that string,
+// exactly the ref trivy-produced stdlib components already carry, so both
+// paths land on one component. Trivy reports the stdlib version without the
+// `go` prefix (`v1.27.2`) while buildinfo keeps it (`go1.27.2`).
+function goStdlibRef(goVersion) {
+  // "go1.26.10 X:boringcrypto" names the toolchain go1.26.10.
+  return `pkg:golang/stdlib@v${goVersion.split(/\s/)[0].replace(/^go/, "")}`;
+}
+
+/**
+ * Read the Go buildinfo version of each executable file component and link it
+ * to (or create) the matching `pkg:golang/stdlib` component. Mutates the
+ * components in place by adding `cdx:go:buildVersion`.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{stdlibComponents: Object[], dependencies: Object[]}}
+ */
+function collectGoBuildInfo(executables, basePath) {
+  const stdlibComponents = [];
+  const dependencies = [];
+  if (!executables?.length) {
+    return { stdlibComponents, dependencies };
+  }
+  const stdlibRefs = new Set();
+  for (const component of executables) {
+    if (!component?.properties) {
+      continue;
+    }
+    const srcFile = component.properties.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const goVersion = readGoBuildVersion(
+      join(basePath, srcFile.replace(/^\/+/, "")),
+    );
+    if (!goVersion) {
+      continue;
+    }
+    component.properties.push({
+      name: "cdx:go:buildVersion",
+      value: goVersion,
+    });
+    // A pre-1.18 toolchain has no version string to build a stdlib ref
+    // from; the buildVersion property alone records the fact.
+    if (goVersion === PRE_1_18_VERSION) {
+      continue;
+    }
+    const stdlibRef = goStdlibRef(goVersion);
+    if (!stdlibRefs.has(stdlibRef)) {
+      stdlibRefs.add(stdlibRef);
+      stdlibComponents.push({
+        "bom-ref": stdlibRef,
+        name: "stdlib",
+        type: "library",
+        version: stdlibRef.slice("pkg:golang/stdlib@".length),
+        group: "",
+      });
+      dependencies.push({ ref: stdlibRef, dependsOn: [] });
+    }
+    if (component["bom-ref"]) {
+      dependencies.push({
+        ref: component["bom-ref"],
+        dependsOn: [stdlibRef],
+      });
+    }
+  }
+  return { stdlibComponents, dependencies };
+}
+
+/**
+ * Read the PHP build version of each PHP-named executable and shared library,
+ * add the cdx:php:* properties, and link the components to one platform
+ * component per distinct version. Mutates the components in place, as the Go
+ * collector does.
+ *
+ * @param {Object[]} executables file components from `fileComponents(.., "executable")`
+ * @param {Object[]} sharedLibs file components from `fileComponents(.., "shared_library")`
+ * @param {string} basePath extracted rootfs the paths are relative to
+ * @returns {{runtimeComponents: Object[], dependencies: Object[]}}
+ */
+function collectPhpBuildInfo(executables, sharedLibs, basePath) {
+  const inventory = createPhpRuntimeInventory();
+  let probes = 0;
+  for (const component of [...(executables || []), ...(sharedLibs || [])]) {
+    if (probes >= MAX_PHP_PROBES) {
+      break;
+    }
+    if (!component?.properties) {
+      continue;
+    }
+    const srcFile = component.properties.find(
+      (property) => property.name === "internal:SrcFile",
+    )?.value;
+    if (!srcFile) {
+      continue;
+    }
+    const sapi = classifyPhpSapi(srcFile);
+    if (!sapi) {
+      continue;
+    }
+    const absolutePath = join(basePath, srcFile.replace(/^\/+/, ""));
+    let resolvedPath = srcFile;
+    try {
+      resolvedPath = relative(
+        realpathSync(basePath),
+        realpathSync(absolutePath),
+      );
+    } catch {
+      // readPhpBuildVersion decides what an unresolvable path yields.
+    }
+    // Trivy does not list Nix, Guix or Homebrew packages, so a PHP in their
+    // stores looks unpackaged here, but it is still theirs.
+    if (packageStoreOf(srcFile) || packageStoreOf(resolvedPath)) {
+      continue;
+    }
+    probes += 1;
+    const build = readPhpBuildVersion(absolutePath, basePath);
+    if (!build) {
+      continue;
+    }
+    attachPhpBuild(inventory, component, build, sapi);
+  }
+  return {
+    runtimeComponents: inventory.runtimeComponents,
+    dependencies: inventory.dependencies,
+  };
+}
+
 async function fileComponents(basePath, fileList, fileType) {
   const hashResults = await mapWithConcurrency(fileList, (f) =>
     multiChecksumFile(["md5", "sha1"], join(basePath, f))