@cdxgen/cdxgen 13.4.0 → 13.5.0

package/data/rules/golem-go.yaml

@@ -227,3 +227,83 @@
       "goModExcludeCount": $prop($, 'cdx:golem:goModExcludeCount'),
       "excludeModule": $prop($, 'cdx:golem:excludeModule')
     }
+
+- id: GOLEM-SEC-008
+  name: "Go component configures a custom TLS root pool"
+  description: "Golem reported a tls.Config RootCAs or x509.VerifyOptions Roots override, so the module validates certificates against a pool it supplies instead of the system roots"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-ROOTS' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets a custom TLS root CA pool"
+  mitigation: "Review where the custom pool comes from and refresh it from a trusted source; a stale pool keeps trusting revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-009
+  name: "Go component replaces certificate verification"
+  description: "Golem reported a VerifyPeerCertificate or VerifyConnection callback, so the module performs its own certificate validation instead of (part of) the standard chain verification"
+  severity: medium
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-CUSTOM-VERIFY' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' installs a custom certificate verification callback"
+  mitigation: "Check that the callback still calls Certificate.Verify, or that its custom checks are at least as strict; hand-rolled verification can miss revoked or distrusted intermediates"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-010
+  name: "Go component disables TLS verification while customising it"
+  description: "Golem reported an InsecureSkipVerify setting on a tls.Config that also customises verification, the pattern where Go's own distrust list no longer applies"
+  severity: high
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-TLS-VERIFY-REPLACED' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' sets InsecureSkipVerify together with custom verification"
+  mitigation: "Remove InsecureSkipVerify and implement the required checks inside VerifyPeerCertificate on top of the standard chain verification"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }
+
+- id: GOLEM-SEC-011
+  name: "Go component embeds a certificate pool"
+  description: "Golem reported a package-level //go:embed variable fed to x509.CertPool.AppendCertsFromPEM, so a private trust anchor travels inside the binary"
+  severity: low
+  category: golem-security
+  dry-run-support: full
+  condition: |
+    components[
+      'GOLEM-CRYPTO-X509-EMBEDDED-POOL' in properties[name = 'cdx:golem:cryptoFinding'].value
+    ]
+  location: |
+    { "bomRef": $."bom-ref", "purl": purl }
+  message: "Go component '{{ name }}' appends an embedded PEM bundle to an x509 pool"
+  mitigation: "Track the embedded bundle like any other trust store: refresh it when CAs change and confirm it contains none of the distrusted keys"
+  evidence: |
+    {
+      "finding": $prop($, 'cdx:golem:cryptoFinding'),
+      "severity": $prop($, 'cdx:golem:cryptoFindingSeverity')
+    }

package/data/rules/hbom-compliance.yaml

@@ -16,26 +16,38 @@
       - "1.1 Establish and Maintain Detailed Enterprise Asset Inventory"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $count(
-        $$.components[
-          $prop($, 'cdx:hbom:hardwareClass') = 'board'
-          and (
-            $hasProp($, 'cdx:hbom:boardVendor')
-            or $hasProp($, 'cdx:hbom:boardName')
-            or $hasProp($, 'cdx:hbom:biosVendor')
-            or $hasProp($, 'cdx:hbom:biosVersion')
-            or $hasProp($, 'cdx:hbom:firmwareDate')
-          )
-        ]
-      ) = 0
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $count(
+          $$.components[
+            $prop($, 'cdx:hbom:hardwareClass') = 'board'
+            and (
+              $hasProp($, 'cdx:hbom:boardVendor')
+              or $hasProp($, 'cdx:hbom:boardName')
+              or $hasProp($, 'cdx:hbom:biosVendor')
+              or $hasProp($, 'cdx:hbom:biosVersion')
+              or $hasProp($, 'cdx:hbom:firmwareDate')
+            )
+          ]
+        ) = 0
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $not(
+          $hasProp($, 'cdx:hbom:boardVendor')
+          or $hasProp($, 'cdx:hbom:boardName')
+          or $hasProp($, 'cdx:hbom:biosVendor')
+          or $hasProp($, 'cdx:hbom:biosVersion')
+          or $hasProp($, 'cdx:hbom:firmwareDate')
+        )
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' lacks board or firmware provenance fields needed for governance review"
-  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available."
+  mitigation: "Enable richer firmware/board collection on supported Linux hosts, validate SMBIOS access, and ensure the inventory captures board vendor, board name, BIOS vendor, BIOS version, and firmware date where available. On Windows these come from the windows-cim-platform batch, which a network logon (SSH, WinRM) as a non-administrator cannot run: collect from a local session or an elevated one."
   evidence: |
     {
       "platform": $prop($, 'cdx:hbom:platform'),
@@ -142,7 +154,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "HBOM for '{{ name }}' includes storage volumes but no explicit encryption posture evidence"
-  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified."
+  mitigation: "Enable volume-level enrichment on supported platforms or pair the HBOM with equivalent host controls evidence so encryption compliance can be verified. On Windows, BitLocker status comes from the --privileged batch, so rerun from an elevated (Run as administrator) prompt with --privileged."
   evidence: |
     {
       "storageVolumeCount": $count($$.components[$prop($, 'cdx:hbom:hardwareClass') = 'storage-volume']),
@@ -219,8 +231,8 @@
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require a rerun with --privileged"
-  mitigation: "Where policy allows, rerun HBOM collection with --privileged so cdx-hbom can use the documented non-interactive sudo path for permission-sensitive Linux enrichments."
+  message: "HBOM for '{{ name }}' hit permission-denied enrichments that likely require {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'a rerun from a local or elevated session' : 'a rerun with --privileged' }}"
+  mitigation: "Where policy allows, rerun HBOM collection with --privileged. On Linux, cdx-hbom then uses the documented non-interactive sudo path for permission-sensitive enrichments. On Windows it never elevates or prompts: run it from a local session (a non-administrator over SSH or WinRM is denied every WMI query) and, for the TPM, BitLocker and storage-reliability batch, from an elevated (Run as administrator) prompt."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),
@@ -260,7 +272,7 @@
 
 - id: HBC-009
   name: "HBOM board and BIOS provenance was blocked by permissions"
-  description: "When dmidecode-backed firmware and board enrichment is blocked, the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
+  description: "When dmidecode-backed firmware and board enrichment is blocked on Linux, or Windows denies WMI to the whole session (a network logon), the HBOM may miss board-vendor, board-name, BIOS-version, and related governance evidence."
   severity: medium
   category: hbom-compliance
   dry-run-support: full
@@ -270,15 +282,21 @@
       - "SI-7 Software, Firmware, and Information Integrity"
   condition: |
     metadata.component[
-      $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
-      and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'linux'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'dmidecode-firmware-board')
+      )
+      or (
+        $safeStr($prop($, 'cdx:hbom:platform')) = 'windows'
+        and $listContains($propList($$, 'cdx:hbom:analysis:permissionDeniedIds'), 'windows-cim-platform:network-logon')
+      )
     ]
   location: |
     {
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
-  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because dmidecode enrichment was blocked"
-  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data."
+  message: "HBOM for '{{ name }}' could not capture full board and BIOS provenance because {{ $safeStr($prop($, 'cdx:hbom:platform')) = 'windows' ? 'WMI was denied to this network logon' : 'dmidecode enrichment was blocked' }}"
+  mitigation: "Where policy allows, rerun with --privileged or equivalent access so the collector can gather firmware vendor, BIOS version, board vendor, and board name data. On Windows, run HBOM from a local session or an elevated one instead of over SSH or WinRM as a non-administrator."
   evidence: |
     {
       "collectorProfile": $prop(bom, 'cdx:hbom:collectorProfile'),

package/data/rules/hbom-performance.yaml

@@ -32,7 +32,7 @@
 
 - id: HBP-002
   name: "Storage health is degraded or wear is near exhaustion"
-  description: "Degraded SMART state or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
+  description: "Degraded SMART state, a Warning or Unhealthy Windows storage health status, or high wear percentage is a strong leading indicator of latency, failure, or replacement pressure."
   severity: high
   category: hbom-performance
   dry-run-support: full
@@ -50,6 +50,10 @@
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'ok'
           and $lowercase($safeStr($prop($, 'cdx:hbom:smartStatus'))) != 'passed'
         )
+        or (
+          $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'warning'
+          or $lowercase($safeStr($prop($, 'cdx:hbom:healthStatus'))) = 'unhealthy'
+        )
         or (
           $hasProp($, 'cdx:hbom:wearPercentageUsed')
           and $number($prop($, 'cdx:hbom:wearPercentageUsed')) >= 80
@@ -65,6 +69,8 @@
   evidence: |
     {
       "smartStatus": $prop($, 'cdx:hbom:smartStatus'),
+      "healthStatus": $prop($, 'cdx:hbom:healthStatus'),
+      "operationalStatus": $prop($, 'cdx:hbom:operationalStatus'),
       "wearPercentageUsed": $prop($, 'cdx:hbom:wearPercentageUsed'),
       "revision": $prop($, 'cdx:hbom:revision'),
       "deviceSerial": $prop($, 'cdx:hbom:deviceSerial')

package/data/rules/host-topology.yaml

@@ -90,7 +90,7 @@
       "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
     }
   message: "Merged host inventory for '{{ name }}' contains no strict HBOM-to-OBOM topology links"
-  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules are available, and prefer exact identifier-bearing probes over heuristic joins."
+  mitigation: "Review collector coverage, ensure runtime categories such as interface_addresses or kernel_modules (logical_drives on Windows) are available, and prefer exact identifier-bearing probes over heuristic joins."
   evidence: |
     {
       "hostViewMode": $prop($, 'cdx:hostview:mode'),

package/data/rules/obom-runtime.yaml

@@ -111,8 +111,9 @@
       "deviceId": name,
       "driveLetter": version,
       "protectionStatus": $prop($, 'protection_status'),
-      "encryptionMethod": $prop($, 'encryption_method'),
-      "percentageEncrypted": $prop($, 'percentage_encrypted')
+      "encryptionMethod": description,
+      "percentageEncrypted": $prop($, 'percentage_encrypted'),
+      "protectorTypes": $prop($, 'protector_types')
     }
 
 - id: OBOM-WIN-002
@@ -1774,3 +1775,31 @@
       "comment": description,
       "uid": $prop($, 'uid')
     }
+
+- id: OBOM-LNX-023
+  name: "Linux snap installed in devmode confinement"
+  description: "A snap installed with --devmode runs without its sandbox being enforced: policy violations are only logged. Devmode is meant for snap development, not for software a host relies on."
+  severity: medium
+  category: obom-runtime
+  dry-run-support: full
+  condition: |
+    components[
+      $prop($, 'cdx:osquery:category') = 'snap_packages'
+      and $lowercase($safeStr($prop($, 'cdx:snap:confinement'))) = 'devmode'
+    ]
+  location: |
+    {
+      "bomRef": $."bom-ref",
+      "purl": purl
+    }
+  message: "Snap '{{ name }}' {{ version }} (revision {{ $prop($, 'cdx:snap:revision') }}) is installed in devmode confinement, so its sandbox is not enforced"
+  mitigation: "Reinstall the snap from a stable channel with strict confinement, or remove it. If devmode is required for development, keep it off production and shared hosts."
+  evidence: |
+    {
+      "snap": name,
+      "version": version,
+      "revision": $prop($, 'cdx:snap:revision'),
+      "channel": $prop($, 'cdx:snap:channel'),
+      "confinement": $prop($, 'cdx:snap:confinement'),
+      "grade": $prop($, 'grade')
+    }

package/data/rules/php-runtime.yaml

@@ -0,0 +1,143 @@
+# PHP source-build runtime rules
+# Category: php-security
+# Evaluates the cdx:php:* properties recorded for unpackaged PHP binaries and
+# shared libraries during container, rootfs and OS (obom) scans. CVE-2026-109618 and
+# CVE-2026-109619 are unauthenticated remote code execution bugs in request
+# handling; fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
+# https://www.php.net/archive/2026.php#2026-10-21-5
+#
+# Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches
+# keep their old version number, so a version check cannot tell them from a
+# vulnerable build. That caveat is in the finding text.
+
+- id: PHP-RCE-001
+  name: "Network-reachable PHP build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP web SAPI older than its fixed release is vulnerable to two unauthenticated RCE bugs in request handling. PHP-FPM, php-cgi, libphp (Apache or embed) and FrankenPHP serve requests, so the worker is reachable from the network. The rule never reads PHP configuration: a mitigation never suppresses a finding."
+  severity: critical
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['fpm', 'cgi', 'libphp', 'frankenphp']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}"
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Interim measures named by the advisory (an admin-level memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0, and fatal_error_backtraces=0 on 8.5) reduce but do not remove the risk. Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }
+
+- id: PHP-RCE-002
+  name: "PHP CLI build affected by CVE-2026-109618 and CVE-2026-109619"
+  description: "A source-built PHP CLI or phpdbg older than its fixed release contains the same vulnerable request-handling code. The CLI is not network-reachable, but any web SAPI built from the same tree is, so the build should be upgraded."
+  severity: medium
+  category: php-security
+  dry-run-support: full
+  condition: |
+    components[
+      type = 'file'
+      and $hasProp($, 'cdx:php:buildVersion')
+      and $hasProp($, 'cdx:php:sapi')
+      and (
+        $m := $match($prop($, 'cdx:php:buildVersion'), /^(\d+)\.(\d+)\.(\d+)(?:-(dev)|(alpha|beta|RC)(\d+))?$/);
+        $m != null
+        and (
+          $number($m.groups[0]) < 8
+          or ($number($m.groups[0]) = 8 and $number($m.groups[1]) < 2)
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 2
+            and $number($m.groups[2]) < 35
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 3
+            and $number($m.groups[2]) < 36
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 4
+            and $number($m.groups[2]) < 27
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 5
+            and $number($m.groups[2]) < 12
+          )
+          or (
+            $number($m.groups[0]) = 8
+            and $number($m.groups[1]) = 6
+            and $number($m.groups[2]) = 0
+            and $m.groups[4] != null
+            and (
+              $m.groups[4] = 'alpha'
+              or $m.groups[4] = 'beta'
+              or ($m.groups[4] = 'RC' and $number($m.groups[5]) <= 3)
+            )
+          )
+        )
+      )
+      and $prop($, 'cdx:php:sapi') in ['cli', 'phpdbg']
+    ]
+  location: |
+    {
+      "bomRef": $firstNonEmpty($."bom-ref", bom.serialNumber)
+    }
+  message: "PHP {{ $prop($, 'cdx:php:sapi') }} '{{ name }}' is {{ $prop($, 'cdx:php:buildVersion') }}, which is affected by CVE-2026-109618 and CVE-2026-109619 (unauthenticated RCE); fixed in {{ $startsWith($prop($, 'cdx:php:buildVersion'), '8.2.') ? '8.2.35' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.3.') ? '8.3.36' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.4.') ? '8.4.27' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.5.') ? '8.5.12' : $startsWith($prop($, 'cdx:php:buildVersion'), '8.6.') ? '8.6.0RC4 or later' : 'a supported PHP branch or a vendor backport (builds from the php-src CVE backport branches keep their version number and are false positives)' }}. The CLI is not network-reachable, but the same build's web SAPIs are."
+  mitigation: "Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For 8.1 and older, move to a supported branch or a vendor backport. https://www.php.net/archive/2026.php#2026-10-21-5 Builds from the php-src PHP-<M.m>-CVE-2026-109618-109619 backport branches keep their old version number and are false positives."
+  evidence: |
+    {
+      "buildVersion": $prop($, 'cdx:php:buildVersion'),
+      "sapi": $prop($, 'cdx:php:sapi'),
+      "source": $prop($, 'cdx:php:buildVersionSource'),
+      "srcFile": $prop($, 'internal:SrcFile')
+    }

package/lib/audit/index.js

@@ -47,6 +47,7 @@ import {
   resolveGitUrlFromPurl,
   resolvePurlSourceDirectory,
   sanitizeRemoteUrlForLogs,
+  validateAndRejectGitSource,
 } from "../inventory/source.js";
 import { executeOsQuery } from "../managers/binary.js";
 import { getBomWithOras } from "../managers/oci.js";
@@ -1307,6 +1308,17 @@ export function buildTargetContextFindings(target) {
  * @returns {void}
  */
 function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
+  // The repository URL comes from registry metadata, so it gets the same
+  // protocol and host checks as a URL sent to the server.
+  const validationError = validateAndRejectGitSource(repoUrl);
+  if (validationError) {
+    const error = new Error(
+      `${validationError.error}: ${validationError.details}`,
+    );
+    error.errorType = "clone";
+    error.retryable = false;
+    throw error;
+  }
   const gitArgs = [
     "-c",
     "alias.clone=",
@@ -1316,6 +1328,8 @@ function cloneRepositoryToDir(repoUrl, cloneDir, gitRef) {
     "safe.bareRepository=explicit",
     "-c",
     "core.hooksPath=/dev/null",
+    "-c",
+    "core.symlinks=false",
     "clone",
     "--template=",
     "--depth",

package/lib/cli/bomAssembly.js

@@ -45,6 +45,7 @@ import {
   setCycloneDxFormat,
   toCycloneDxSpecVersionString,
 } from "../inventory/bomUtils.js";
+import { mergeDuplicateCryptoComponents } from "../inventory/certificates.js";
 import { mergeServices, trimComponents } from "../inventory/depsUtils.js";
 import {
   attachIdentityTools,
@@ -457,6 +458,11 @@ export const addLifecyclesSection = (options) => {
 /**
  * Function to create metadata block
  *
+ * @param {Object} [parentComponent] Component the BOM describes
+ * @param {Object} [options] CLI options
+ * @param {Object} [context] Generator context. `context.metadataProperties`
+ *   holds facts of a manifest that has no component to carry them, such as the
+ *   platform data of a composer.lock whose composer.json names no project.
  */
 export function addMetadata(parentComponent = {}, options = {}, context = {}) {
   // DO NOT fork this project to just change the vendor or author's name
@@ -752,7 +758,7 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
             });
             let appLanguage;
             // TODO: Move these lists to a config file.
-            for (const lang in [
+            for (const lang of [
               "java",
               "node",
               "dotnet",
@@ -828,6 +834,9 @@ export function addMetadata(parentComponent = {}, options = {}, context = {}) {
     // AI provenance/oversight detection (`-t ai-provenance`) is injected into the
     // BOM document root (bomJson.properties) after post-processing, not into
     // metadata.properties. See ensureAiProvenanceProperties/ensureAiOversightProperties.
+    if (context?.metadataProperties?.length) {
+      mproperties.push(...context.metadataProperties);
+    }
     if (mproperties.length) {
       metadata.properties = mproperties;
     }
@@ -1602,6 +1611,10 @@ export const buildBomNSData = (options, pkgInfo, ptype, context) => {
     if (context?.formulationList?.length) {
       bomNSData.formulationList = context.formulationList;
     }
+    // createMultiXBom rebuilds the metadata block, so these are handed on.
+    if (context?.metadataProperties?.length) {
+      bomNSData.metadataProperties = context.metadataProperties;
+    }
     // Carry language-specific provenance citations (e.g. PEP 770 embedded
     // SBOMs) so postProcess can attach them in the single root-level citations
     // section it builds.
@@ -1933,16 +1946,28 @@ export function emitAiInventorySummary(aiInventory, discoveryPath) {
  * @param {Array} components Components
  * @param {Object} parentComponent Parent component
  * @param {Array} dependencies Dependencies
+ * @param {Array} [metadataProperties] Properties for the metadata block, from
+ *   generators whose manifest has no component to carry them
  *
  * @returns {Object} Object including BOM Json
  */
-export function dedupeBom(options, components, parentComponent, dependencies) {
+export function dedupeBom(
+  options,
+  components,
+  parentComponent,
+  dependencies,
+  metadataProperties = [],
+) {
   if (!components) {
     return {};
   }
   if (!dependencies) {
     dependencies = [];
   }
+  // Certificate components from different producers (trustinspector rootfs,
+  // the source-directory scan, observed chains) share a bom-ref; merge their
+  // occurrences and properties before the generic trim.
+  components = mergeDuplicateCryptoComponents(components);
   components = trimComponents(components);
   // Let's apply some common tweaks
   // Convert evidence.identity section to an object for 1.5
@@ -1971,7 +1996,7 @@ export function dedupeBom(options, components, parentComponent, dependencies) {
         ),
         serialNumber: serialNum,
         version: 1,
-        metadata: addMetadata(parentComponent, options, {}),
+        metadata: addMetadata(parentComponent, options, { metadataProperties }),
         components,
         services: options.services || [],
         dependencies,