@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/server/server.js

@@ -14,7 +14,9 @@ import {
   isSecureMode,
   readEnvironmentVariable,
 } from "../core/activity.js";
+import { PROJECT_TYPE_ALIASES } from "../core/env.js";
 import { isWin } from "../core/paths.js";
+import { isSecureModeActive } from "../core/projectTooling.js";
 import { resetRunState } from "../core/runState.js";
 import { CDXGEN_VERSION } from "../core/state.js";
 import { installConsoleShim, ui } from "../core/ui.js";
@@ -27,6 +29,7 @@ import {
   getGitAllowProtocol,
   gitClone,
   isAllowedPath,
+  isAllowedRealPath,
   isAllowedWinPath,
   maybePurlSource,
   maybeRemotePath,
@@ -82,6 +85,11 @@ const ALLOWED_PARAMS = [
   "tlpClassification",
 ];
 
+// Options that install packages or run the scanned project's own build tools
+// (for example `cargo check`, which runs build.rs), and so execute code from
+// the scanned repository.
+const CODE_EXECUTION_PARAMS = ["installDeps", "deep"];
+
 const app = connect();
 
 export { isAllowedHttpHost };
@@ -156,6 +164,7 @@ export function parseValue(raw) {
  * @returns {Object} Populated options object
  */
 export function parseQueryString(q, body = {}, options = {}) {
+  const operatorOptions = { ...options };
   // Priority is query params followed by body
   for (const param of ALLOWED_PARAMS) {
     const raw = q[param] ?? body[param];
@@ -163,7 +172,7 @@ export function parseQueryString(q, body = {}, options = {}) {
       options[param] = parseValue(raw);
     }
   }
-  options.projectType = options.type?.split(",");
+  options.projectType = toProjectTypeList(options.type);
   delete options.type;
   if (options.lifecycle === "pre-build") {
     options.installDeps = false;
@@ -171,9 +180,170 @@ export function parseQueryString(q, body = {}, options = {}) {
   if (options.profile) {
     applyProfileOptions(options);
   }
+  // failOnError ends the process, so one failing request would stop the server
+  // for every client.
+  options.failOnError = false;
+  restrictRequestOptions(options, operatorOptions);
   return options;
 }
 
+/**
+ * Normalise a `type` value from the request or the start-up options, which may
+ * be a comma separated string or an array, into a list of project types.
+ *
+ * @param {string|string[]|undefined} type Project type value
+ * @returns {string[]|undefined} Project types, or undefined when none are given
+ */
+function toProjectTypeList(type) {
+  if (type === undefined || type === null || type === "") {
+    return undefined;
+  }
+  const types = (Array.isArray(type) ? type : [type])
+    .flatMap((t) => String(t).split(","))
+    .map((t) => t.trim())
+    .filter(Boolean);
+  return types.length ? types : undefined;
+}
+
+/**
+ * Stop a request from turning on options that execute code from the scanned
+ * repository when the operator has not. In secure mode, or when the server was
+ * started with --no-install-deps, a request may turn these options off but
+ * never on.
+ *
+ * @param {Object} options Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {void}
+ */
+function restrictRequestOptions(options, operatorOptions) {
+  if (!isSecureModeActive() && operatorOptions.installDeps !== false) {
+    return;
+  }
+  for (const param of CODE_EXECUTION_PARAMS) {
+    // Only an explicit false from the request changes the operator's choice.
+    // Values such as "" or 0 would otherwise pass gates that test `!== false`.
+    options[param] =
+      operatorOptions[param] === true && options[param] !== false;
+  }
+}
+
+// Project types that inventory the host the server runs on, such as installed
+// packages, users, shell history, IDE and browser extensions, or the Maven,
+// Gradle, sbt, Cargo and Helm caches in the server user's home directory.
+// They ignore the scan path, so the path allowlist does not limit them.
+const HOST_SCOPE_PROJECT_TYPES = new Set(
+  [
+    "os",
+    "hbom",
+    "cargo-cache",
+    "helm-index",
+    "gradle-index",
+    "sbt-index",
+    "maven-index",
+    "vscode-extension",
+    "chrome-extension",
+    "agentic",
+  ]
+    .flatMap((key) => PROJECT_TYPE_ALIASES[key] || [key])
+    .concat(["maven-repo"]),
+);
+
+/**
+ * Check request options that the server must refuse outright.
+ *
+ * @param {Object} reqOptions Options parsed from the request
+ * @param {Object} operatorOptions Options the server was started with
+ * @returns {Object|null} Error object with status, error and details, or null
+ */
+export function validateRequestOptions(reqOptions, operatorOptions = {}) {
+  const operatorTypes = new Set(
+    toProjectTypeList(operatorOptions.type ?? operatorOptions.projectType) ||
+      [],
+  );
+  const hostScopeType = (reqOptions.projectType || []).find(
+    (t) => HOST_SCOPE_PROJECT_TYPES.has(t) && !operatorTypes.has(t),
+  );
+  if (hostScopeType) {
+    return {
+      status: 403,
+      error: "Project Type Not Allowed",
+      details: `The '${hostScopeType}' project type scans the server host. Start the server with this type to allow it.`,
+    };
+  }
+  const excludes = Array.isArray(reqOptions.exclude)
+    ? reqOptions.exclude
+    : [reqOptions.exclude];
+  // Brace patterns expand before matching, so one short pattern such as
+  // {1..100000} can keep the server busy for minutes.
+  if (
+    reqOptions.exclude !== operatorOptions.exclude &&
+    excludes.some(
+      (e) => typeof e === "string" && (e.includes("{") || e.length > 512),
+    )
+  ) {
+    return {
+      status: 400,
+      error: "Invalid Exclude Pattern",
+      details:
+        "Exclude patterns sent to the server cannot use braces or exceed 512 characters.",
+    };
+  }
+  if (
+    reqOptions.serverUrl &&
+    reqOptions.serverUrl !== operatorOptions.serverUrl
+  ) {
+    const requestedOrigin = urlOrigin(reqOptions.serverUrl);
+    if (!requestedOrigin) {
+      return {
+        status: 400,
+        error: "Invalid Server URL",
+        details: "The Dependency-Track server URL is invalid.",
+      };
+    }
+    if (requestedOrigin !== urlOrigin(operatorOptions.serverUrl)) {
+      // The operator's API key only ever goes to the operator's server.
+      if (
+        operatorOptions.apiKey &&
+        reqOptions.apiKey === operatorOptions.apiKey
+      ) {
+        return {
+          status: 400,
+          error: "API Key Required",
+          details:
+            "A request that names its own Dependency-Track server must send its own API key.",
+        };
+      }
+      // CDXGEN_SERVER_ALLOWED_HOSTS only covers git hosts, so in secure mode a
+      // server the operator did not configure must be on CDXGEN_ALLOWED_HOSTS.
+      if (isSecureMode && !readEnvironmentVariable("CDXGEN_ALLOWED_HOSTS")) {
+        return {
+          status: 403,
+          error: "Host Not Allowed",
+          details:
+            "Set CDXGEN_ALLOWED_HOSTS to let requests choose a Dependency-Track server.",
+        };
+      }
+    }
+  }
+  if (isSecureMode && reqOptions.includeFormulation && reqOptions.serverUrl) {
+    return {
+      status: 400,
+      error: "Formulation Not Allowed",
+      details:
+        "Formulation data may contain secrets and is not submitted to Dependency-Track in secure mode.",
+    };
+  }
+  return null;
+}
+
+function urlOrigin(value) {
+  try {
+    return new URL(value).origin;
+  } catch (_err) {
+    return undefined;
+  }
+}
+
 /**
  * Extracts query parameters from an incoming HTTP request object.
  * Handles repeated keys by collecting their values into an array.
@@ -391,6 +561,18 @@ const start = (options) => {
         }),
       );
     }
+    const optionsError = validateRequestOptions(reqOptions, options);
+    if (optionsError) {
+      res.writeHead(optionsError.status, {
+        "Content-Type": "application/json",
+      });
+      return res.end(
+        JSON.stringify({
+          error: optionsError.error,
+          details: optionsError.details,
+        }),
+      );
+    }
     // Enforce the v13 CycloneDX spec floor on the HTTP entry point too, so the
     // server cannot be used to request a generation target the CLI rejects.
     if (reqOptions.specVersion !== undefined) {
@@ -502,8 +684,11 @@ const start = (options) => {
         cleanup = true;
       } else {
         srcDir = sourcePath;
+        // Check where a symlinked path really points as well, so a link inside
+        // an allowed directory cannot open a scan of a directory outside it.
         if (
           !isAllowedPath(path.resolve(srcDir)) ||
+          !isAllowedRealPath(srcDir) ||
           (isWin && !isAllowedWinPath(srcDir))
         ) {
           res.writeHead(403, { "Content-Type": "application/json" });

package/lib/stages/postgen/annotator.js

@@ -463,6 +463,15 @@ export function textualMetadata(bomJson) {
   const swidCount = bomJson?.components?.filter((c) =>
     c?.purl?.startsWith("pkg:swid"),
   ).length;
+  // Homebrew packages are pkg:brew, not pkg:swid, so they are not counted as
+  // applications; formulae and casks are told apart by a property.
+  const brewComponents =
+    bomJson?.components?.filter((c) => c?.purl?.startsWith("pkg:brew/")) || [];
+  const brewCaskCount = brewComponents.filter((c) =>
+    c.properties?.some(
+      (p) => p.name === "cdx:homebrew:type" && p.value === "cask",
+    ),
+  ).length;
   const { unpackagedExecutableCount, unpackagedSharedLibraryCount } =
     getContainerFileInventoryStats(bomJson?.components);
   const githubStats = getGitHubWorkflowStats(bomJson?.components);
@@ -711,7 +720,14 @@ export function textualMetadata(bomJson) {
       text = `${text} The system appears to be set up for remote development, with ${vsixCount} Visual Studio Code extensions installed.`;
     }
     if (swidCount > 0) {
-      text = `${text} In addition, there are ${swidCount} applications installed on the system.`;
+      text = `${text} In addition, there ${swidCount === 1 ? "is 1 application" : `are ${swidCount} applications`} installed on the system.`;
+    }
+    if (brewComponents.length > 0) {
+      const brewCount = brewComponents.length;
+      const casks = brewCaskCount
+        ? `, of which ${brewCaskCount} ${brewCaskCount === 1 ? "is a cask" : "are casks"}`
+        : "";
+      text = `${text} The system also has ${brewCount} Homebrew package${brewCount === 1 ? "" : "s"} installed${casks}.`;
     }
   }
   if (bomType === "HBOM" && hbomSummary) {

package/lib/stages/postgen/introspection/reflect.js

@@ -36,6 +36,7 @@ import {
   isVersionedJvmToolProjectType,
   PROJECT_TYPE_ALIASES,
 } from "../../../core/env.js";
+import { safeExistsSync } from "../../../core/fs.js";
 import { dirNameStr } from "../../../core/paths.js";
 import { CDXGEN_VERSION } from "../../../core/state.js";
 import { evaluateRules, loadRules } from "../ruleEngine.js";
@@ -389,7 +390,9 @@ function resolveLedgerEvents(context) {
     };
   }
   const sidecarPath = readEnvironmentVariable("CDXGEN_INTROSPECT_LEDGER");
-  if (sidecarPath) {
+  // A sidecar the run could not create (the permission model denies writes
+  // outside the granted paths) holds nothing; the buffer still has the events.
+  if (sidecarPath && safeExistsSync(sidecarPath)) {
     return { events: loadLedgerFile(sidecarPath), source: "sidecar" };
   }
   const events = getLedgerEvents();

package/lib/stages/postgen/postgen.js

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { basename, join, relative, sep } from "node:path";
+import { join, relative } from "node:path";
 import process from "node:process";
 
 import { Purl } from "@cdxgen/cdx-purl";
@@ -943,10 +943,10 @@ function applyCustomMetadataProperties(bomJson, options) {
 export function applyStandards(bomJson, options) {
   if (options.standard && Array.isArray(options.standard)) {
     for (let astandard of options.standard) {
-      // See issue: #1953
-      if (astandard.includes(sep)) {
-        astandard = basename(astandard);
-      }
+      // See issue: #1953. Server requests can send either separator, and on
+      // Windows both "/" and "\" separate path segments, so keep only the
+      // last segment of either kind.
+      astandard = String(astandard).split(/[\\/]/).pop();
       const templateFile = join(
         dirNameStr,
         "data",

package/lib/stages/postgen/ruleEngine.js

@@ -165,7 +165,18 @@ function hasProperty(obj, propName, expectedValue) {
   if (expectedValue === undefined) {
     return value !== null;
   }
-  return value === String(expectedValue);
+  // A repeatable property (cdx:crypto:sourceType on a certificate found by
+  // several producers) matches when any of its values does.
+  return extractPropertyValues(obj, propName).includes(String(expectedValue));
+}
+
+function extractPropertyValues(obj, propName) {
+  if (!Array.isArray(obj?.properties)) {
+    return [];
+  }
+  return obj.properties
+    .filter((p) => p?.name === propName && p.value !== undefined)
+    .map((p) => String(p.value));
 }
 
 /**
@@ -315,6 +326,9 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("prop", (obj, propName) =>
     extractProperty(obj, propName),
   );
+  expression.registerFunction("propValues", (obj, propName) =>
+    extractPropertyValues(obj, propName),
+  );
   expression.registerFunction("nullSafeProp", (obj, propName) => {
     const value = extractProperty(obj, propName);
     return value === null ? "" : value;
@@ -385,6 +399,13 @@ function registerCdxHelpers(expression, helpers = {}) {
   expression.registerFunction("safeStr", (val) => {
     return val === null || val === undefined ? "" : String(val).trim();
   });
+  // End of validity in epoch milliseconds. A date-only value (2026-01-31)
+  // is valid through the end of that day in UTC; a full RFC 3339 timestamp
+  // is taken as is; anything else, or an impossible date, gives no value so
+  // the rule skips the component.
+  expression.registerFunction("certEndMillis", (val) =>
+    parseCertificateEndMillis(val),
+  );
   expression.registerFunction("parseSizeBytes", (val) => {
     if (val === null || val === undefined || val === "") {
       return null;
@@ -519,6 +540,42 @@ function registerCdxHelpers(expression, helpers = {}) {
  * @param {string} rulesDir - Path to directory containing .yaml rule files
  * @returns {Promise<Array>} Array of parsed rule objects
  */
+const FULL_TIMESTAMP_RE =
+  /^\d{4}-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])T([01]\d|2[0-3]):[0-5]\d:[0-5]\d(\.\d+)?(Z|[+-]([01]\d|2[0-3]):[0-5]\d)$/;
+const DATE_ONLY_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/**
+ * Parse a certificate notValidAfter value.
+ *
+ * @param {*} value timestamp or date-only string
+ * @returns {number|undefined} epoch milliseconds, or undefined when the value
+ *   does not parse
+ */
+export function parseCertificateEndMillis(value) {
+  if (typeof value !== "string") {
+    return undefined;
+  }
+  const text = value.trim();
+  const dateOnly = DATE_ONLY_RE.exec(text);
+  if (dateOnly) {
+    const [year, month, day] = dateOnly.slice(1).map(Number);
+    const start = new Date(Date.UTC(year, month - 1, day));
+    if (
+      start.getUTCFullYear() !== year ||
+      start.getUTCMonth() !== month - 1 ||
+      start.getUTCDate() !== day
+    ) {
+      return undefined;
+    }
+    return start.getTime() + 24 * 60 * 60 * 1000 - 1;
+  }
+  if (!FULL_TIMESTAMP_RE.test(text)) {
+    return undefined;
+  }
+  const millis = Date.parse(text);
+  return Number.isNaN(millis) ? undefined : millis;
+}
+
 export async function loadRules(rulesDir) {
   const rules = [];
   if (!safeExistsSync(rulesDir)) {

package/lib/stages/postgen/specVersionCompat.js

@@ -604,9 +604,39 @@ function downgradeSubjectForSpecVersion(subject, specVersion, parentKey) {
       certificateProperties.certificateExtension =
         certificateProperties.certificateFileExtension;
     }
+    // `relatedCryptographicAssets` and `certificateExtensions` are 1.7-only;
+    // the deprecated `subjectPublicKeyRef`/`signatureAlgorithmRef` (valid in
+    // 1.6, see data/bom-1.6.schema.json) carry the same links, and the
+    // extension facts survive as `cdx:crypto:` properties.
+    const relatedAssets = certificateProperties.relatedCryptographicAssets;
+    if (Array.isArray(relatedAssets)) {
+      for (const asset of relatedAssets) {
+        if (
+          asset?.type === "publicKey" &&
+          !certificateProperties.subjectPublicKeyRef
+        ) {
+          certificateProperties.subjectPublicKeyRef = asset.ref;
+        } else if (
+          asset?.type === "algorithm" &&
+          !certificateProperties.signatureAlgorithmRef
+        ) {
+          certificateProperties.signatureAlgorithmRef = asset.ref;
+        }
+      }
+      delete certificateProperties.relatedCryptographicAssets;
+    }
+    delete certificateProperties.certificateExtensions;
     delete certificateProperties.serialNumber;
     delete certificateProperties.certificateFileExtension;
     delete certificateProperties.fingerprint;
+  } else if (
+    specVersion < 1.7 &&
+    subject.cryptoProperties?.assetType === "related-crypto-material" &&
+    subject.cryptoProperties.relatedCryptoMaterialProperties
+  ) {
+    // The public-key `fingerprint` object is 1.7-only; the SPKI digest stays
+    // available as the `cdx:crypto:spkiSha256` property.
+    delete subject.cryptoProperties.relatedCryptoMaterialProperties.fingerprint;
   }
   if (specVersion < 1.7 && subject.cryptoProperties?.algorithmProperties) {
     // `algorithmFamily` and `ellipticCurve` are CycloneDX 1.7 additions to

package/lib/stages/pregen/pregen.js

@@ -28,6 +28,13 @@ import {
   TIMEOUT_MS,
 } from "../../core/fs.js";
 import { isMac, isWin } from "../../core/paths.js";
+import { isProjectToolingAllowed } from "../../core/projectTooling.js";
+import {
+  dosaiDotnetRequirement,
+  dosaiDotnetRequirementAdvice,
+  dosaiDotnetRequirementDetail,
+  markDosaiLaunchFailureReported,
+} from "../../inventory/dosai.js";
 import {
   bundleInstallWithDocker,
   collectJavaInfo,
@@ -60,6 +67,7 @@ import {
   readToolVersionOverride,
   resolvePartialVersion,
 } from "../../inventory/jvmToolEnv.js";
+import { resolvePluginBinary } from "../../inventory/plugins.js";
 import {
   classifyProbeResult,
   describeSpawnRestriction,
@@ -74,12 +82,20 @@ import {
  * @param {Object} options CLI options
  */
 export function prepareEnv(filePath, options) {
-  if (!options.projectType || isSecureMode) {
+  if (isSecureMode) {
     return;
   }
   if (filePath) {
     filePath = resolve(filePath);
   }
+  // Runs before the project type check: a .NET tree is also found when cdxgen
+  // detects the project types itself.
+  if (!isDryRun) {
+    prepareDotnetEnv(filePath, options);
+  }
+  if (!options.projectType) {
+    return;
+  }
   // The JVM preparation provisions the JDK ahead of the build tools, so an
   // alias it already installed must not be installed a second time here.
   // It runs under dry-run too, where it reports the toolchain it would set up
@@ -104,6 +120,91 @@ export function prepareEnv(filePath, options) {
   prepareRubyEnv(filePath, options);
 }
 
+/**
+ * Check that dosai, which deep runs use for .NET evidence, can start. The
+ * dosai bundled with cdxgen-plugins-bin is framework-dependent, so it needs a
+ * .NET runtime at least as new as the one it targets (.NET 11 from dosai
+ * 5.0.0). Running it lets the .NET host apply its own version rules. Skipped
+ * in the container images, which ship a dosai that works with their SDK, and
+ * when DOSAI_CMD names another build, such as the self-contained -full one.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ */
+export function prepareDotnetEnv(filePath, options) {
+  if (
+    !options.deep ||
+    !filePath ||
+    readEnvironmentVariable("CDXGEN_IN_CONTAINER") === "true" ||
+    readEnvironmentVariable("DOSAI_CMD") ||
+    !isDotnetInScope(filePath, options)
+  ) {
+    return;
+  }
+  const dosaiBin = resolvePluginBinary("dosai");
+  if (!dosaiBin) {
+    // A missing plugin is reported where dosai runs
+    return;
+  }
+  const result = safeSpawnSync(dosaiBin, ["--version"], {
+    encoding: "utf-8",
+    timeout: TIMEOUT_MS,
+  });
+  if (result?.status === 0 && !result.error) {
+    return;
+  }
+  const output = commandOutputText(result) || "";
+  const requirement = dosaiDotnetRequirement(output);
+  const detail = requirement
+    ? dosaiDotnetRequirementDetail(requirement)
+    : "dosai could not start";
+  console.log(
+    `WARNING: ${detail}, so this deep run has no dosai evidence for .NET (call graph, reachability, crypto). ${dosaiDotnetRequirementAdvice(requirement)}`,
+  );
+  if (requirement) {
+    markDosaiLaunchFailureReported(dosaiBin);
+  }
+  recordLedgerEvent(LEDGER_EVENT_KINDS.EVIDENCE_DEGRADED, {
+    ecosystem: "csharp",
+    tool: "dosai",
+    detail: `${detail}; .NET evidence from dosai is unavailable.`,
+    impact: LEDGER_EVENT_IMPACTS.COMPONENTS,
+  });
+  deferFailOnError(options, {
+    ecosystem: "csharp",
+    tool: "dosai",
+    detail,
+    exitCode: typeof result?.status === "number" ? result.status : undefined,
+    command: `${dosaiBin} --version`,
+    outputExcerpt: output.trim() || undefined,
+  });
+}
+
+/**
+ * Whether the run covers .NET: a .NET project type, or, when cdxgen detects
+ * the types itself, a .NET project or solution file in the tree.
+ *
+ * @param {String} filePath Project path
+ * @param {Object} options CLI options
+ *
+ * @returns {Boolean}
+ */
+function isDotnetInScope(filePath, options) {
+  if (options.projectType?.length) {
+    return hasAnyProjectType(["csharp"], options, false);
+  }
+  if (!hasAnyProjectType(["csharp"], options, true)) {
+    return false;
+  }
+  return (
+    getAllFiles(
+      filePath,
+      `${options.multiProject ? "**/" : ""}*.{csproj,vbproj,fsproj,sln,slnx}`,
+      options,
+    ).length > 0
+  );
+}
+
 /**
  * Record the tool requirements the project declares through its well-known
  * tool pin files (`.tool-versions`, `.nvmrc`, `package.json`, `go.mod`, …),
@@ -1205,7 +1306,7 @@ export function prepareNodeEnv(filePath, options) {
             }
           }
           if (nvmNodePath) {
-            doNpmInstall(filePath, nvmNodePath);
+            doNpmInstall(filePath, nvmNodePath, options);
             npmInstallAttempted = true;
           } else {
             console.log(
@@ -1228,7 +1329,7 @@ export function prepareNodeEnv(filePath, options) {
         );
         continue;
       }
-      doNpmInstall(filePath, nvmNodePath);
+      doNpmInstall(filePath, nvmNodePath, options);
       npmInstallAttempted = true;
     }
   }
@@ -1302,12 +1403,18 @@ export function tryLoadNvmAndInstallTool(nodeVersion) {
  *
  * @param {String} filePath Path
  * @param {String} nvmNodePath Path to node version in nvm
+ * @param {Object} [options] CLI options
  */
-export function doNpmInstall(filePath, nvmNodePath) {
+export function doNpmInstall(filePath, nvmNodePath, options = {}) {
   // we do not install if INSTALL_ARGS set false
   if (["0", "false"].includes(readEnvironmentVariable("NODE_INSTALL_ARGS"))) {
     return;
   }
+  // npm install runs the project's own lifecycle scripts, such as preinstall,
+  // even with --package-lock-only.
+  if (options.installDeps === false) {
+    return;
+  }
   const newPath = `${nvmNodePath}${delimiter}${readEnvironmentVariable("PATH")}`;
   let installArgs =
     readEnvironmentVariable("NPM_INSTALL_ARGS") || "--package-lock-only";
@@ -1386,7 +1493,12 @@ export function prepareSwiftEnv(filePath, options) {
       "INFO: Swift for Linux has known issues on non x64 machines. Run the cdxgen container image with --platform=linux/amd64 for best experience.",
     );
   }
-  if (options.deep || options?.lifecycle?.includes("post-build")) {
+  // `swift package resolve` runs the project's Package.swift, so it waits for
+  // the same permission as the scan's other project tooling.
+  if (
+    (options.deep || options?.lifecycle?.includes("post-build")) &&
+    isProjectToolingAllowed(options)
+  ) {
     const swiftFiles = getAllFiles(
       filePath,
       `${options.multiProject ? "**/" : ""}Package*.swift`,