@cdxgen/cdxgen 13.4.0 → 13.5.0

package/lib/cli/managedBom.js

@@ -1,11 +1,24 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { platform as _platform } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  resolve,
+} from "node:path";
 import process from "node:process";
 
 import { build } from "@cdxgen/cdx-purl";
 
-import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import {
+  DEBUG_MODE,
+  hasDangerousUnicode,
+  isDryRun,
+  readEnvironmentVariable,
+  recordActivity,
+} from "../core/activity.js";
 import { recordDegradation } from "../core/buildLedger.js";
 import { deferFailOnError } from "../core/deferredExit.js";
 import {
@@ -26,7 +39,10 @@ import {
   safeWriteSync,
 } from "../core/fs.js";
 import { thoughtLog } from "../core/logger.js";
-import { mapWithConcurrency } from "../core/parallel.js";
+import {
+  isProjectToolingAllowed,
+  reportProjectToolingSkipped,
+} from "../core/projectTooling.js";
 import {
   extractJarArchive,
   getNugetMetadata,
@@ -35,7 +51,9 @@ import {
 } from "../ecosystems/ecosystems.js";
 import {
   agreedNugetVersions,
+  applyNugetVersion,
   dotnetManifestProjectDir,
+  dotnetRestoredProjectFile,
   getCentralPackageVersions,
   indexPropsProperties,
   parseCsPkgData,
@@ -100,6 +118,15 @@ import {
   collectDosaiCryptoComponents,
   collectSourceCryptoComponents,
 } from "../inventory/cbomutils.js";
+import {
+  androidNetworkSecurityConfigPins,
+  CertificateCollector,
+  certRecordFromDer,
+  classifyCryptoFile,
+  containerRelativePath,
+  kubernetesTlsSecretRecords,
+  linkFallbackIssuers,
+} from "../inventory/certificates.js";
 import { readZipEntry } from "../inventory/deps.js";
 import {
   filterInvalidCryptoComponents,
@@ -113,12 +140,17 @@ import {
   collectDosaiServiceComponents,
   collectDosaiServicesFromMethods,
   createDosaiMethodsSlice,
-  dosaiRunWasStopped,
+  dosaiFailureReported,
+  dosaiMethodsSectionsArgument,
+  dosaiReportFileOmittedSections,
+  dosaiToolComponents,
   isDosaiDotnetLanguage,
   normalizeDosaiServiceMap,
   readDosaiMethodsReport,
+  runsEvidenceAnalysis,
 } from "../inventory/dosai.js";
 import { addEvidenceForDotnet } from "../inventory/evidenceUtils.js";
+import { resolvePluginBinary } from "../inventory/plugins.js";
 import { nugetPurl, pypiBomRef } from "../inventory/purl.js";
 import { classifyProbeResult } from "../inventory/toolRequirements.js";
 import { getPluginToolComponents } from "../managers/binary.js";
@@ -225,11 +257,14 @@ export function createPixiBom(path, options) {
       generatePixiLockFile(path);
 
       const pixiLockFile = join(path, "pixi.lock");
-      if (!safeExistsSync(pixiLockFile) && DEBUG_MODE) {
-        console.log(
-          "Unexpected Error tried to generate pixi.lock file but failed.",
-        );
-        console.log("This will result in creations of empty BOM.");
+      if (!safeExistsSync(pixiLockFile)) {
+        if (DEBUG_MODE) {
+          console.log(
+            "Unexpected Error tried to generate pixi.lock file but failed.",
+          );
+        }
+        // Let createPythonBOM() generate the BOM from the other manifests.
+        return null;
       }
       PixiLockData = parsePixiLockFile(pixiLockFile);
       metadataFilename = "pixi.lock";
@@ -494,11 +529,14 @@ export async function createPythonBom(path, options) {
               retMap.dependenciesList,
               parentComponent,
             );
-        } else {
+        } else if (isProjectToolingAllowed(options)) {
+          // poetry export and pdm export load plugins from the project tree
+          // (.poetry/plugins, .pdm-plugins), so they run only when the
+          // project's own tooling may.
           let exportedReqs = "";
           if (f.endsWith("poetry.lock")) {
             thoughtLog(
-              "Using poetry export as a safe, static alternative to pip install.",
+              "Using poetry export to collect the resolved closure without installing anything.",
             );
             const expCmd = safeSpawnSync(
               "poetry",
@@ -509,7 +547,7 @@ export async function createPythonBom(path, options) {
               exportedReqs = expCmd.stdout.toString();
           } else if (f.endsWith("pdm.lock")) {
             thoughtLog(
-              "Using pdm export as a safe, static alternative to pip install.",
+              "Using pdm export to collect the resolved closure without installing anything.",
             );
             const expCmd = safeSpawnSync(
               "pdm",
@@ -539,6 +577,19 @@ export async function createPythonBom(path, options) {
               pkgList = pkgList.concat(dlist);
             }
           }
+        } else {
+          reportProjectToolingSkipped(
+            options,
+            "python.poetry-export.tooling-disabled",
+            "Skipping 'poetry export' and 'pdm export' since dependency installation is disabled. Only the packages parsed from the lock file will be used.",
+            {
+              ecosystem: "python",
+              tool: f.endsWith("pdm.lock") ? "pdm" : "poetry",
+              impact: "transitive-deps",
+              detail:
+                "Dependency installation is disabled, so poetry or pdm export was not run and only the packages parsed from the lock file are available.",
+            },
+          );
         }
       }
     }
@@ -879,9 +930,11 @@ export async function createPythonBom(path, options) {
     );
   }
   emitAiInventorySummary(aiInventory, path);
-  // Check and complete the dependency tree
+  // Check and complete the dependency tree. This installs every package into a
+  // virtual environment, so --no-install-deps turns it off too.
   if (
     isFeatureEnabled(options, "safe-pip-install") &&
+    options.installDeps !== false &&
     pkgList.length &&
     isPartialTree(dependencies, pkgList.length)
   ) {
@@ -1108,6 +1161,28 @@ export function createHelmBom(path, options) {
   return {};
 }
 
+/**
+ * The properties of a list followed by those of another it does not hold yet.
+ * It returns a new array, so a shallow copy of a component keeps its own
+ * properties.
+ *
+ * @param {{name: string, value: string}[]|undefined} existing Properties held so far
+ * @param {{name: string, value: string}[]} additions Properties to add
+ * @returns {{name: string, value: string}[]} The merged properties
+ */
+function withMissingProperties(existing, additions) {
+  const held = existing || [];
+  return [
+    ...held,
+    ...additions.filter(
+      (added) =>
+        !held.some(
+          (known) => known.name === added.name && known.value === added.value,
+        ),
+    ),
+  ];
+}
+
 /**
  * Function to create bom string for php projects
  *
@@ -1140,6 +1215,10 @@ export function createPHPBom(path, options) {
     composerLockSearchOptions,
   );
   let pkgList = [];
+  // Platform facts of the scanned directory's lock when its composer.json names
+  // no project: there is no module component to carry them, so they go on the
+  // document. A nested lock like that has nowhere to put them.
+  let metadataProperties = [];
   const composerJsonMode = composerJsonFiles.length;
   const composerLockMode = composerLockFiles.length;
   // Create a composer.lock file for each composer.json file if needed.
@@ -1253,6 +1332,37 @@ export function createPHPBom(path, options) {
         }
       }
       const retMap = parseComposerLock(f, rootRequires);
+      if (retMap.platformProperties?.length) {
+        if (moduleParent?.["bom-ref"]) {
+          // The root composer.json is parsed twice, once for the parent
+          // component and once per lock, so the object that ends up as
+          // metadata.component is not always the module parsed here.
+          for (const module of [moduleParent, parentComponent]) {
+            if (module?.["bom-ref"] === moduleParent["bom-ref"]) {
+              module.properties = withMissingProperties(
+                module.properties,
+                retMap.platformProperties,
+              );
+            }
+          }
+        } else if (resolve(basePath) === resolve(path)) {
+          // The document describes the scanned directory, so only the lock
+          // in it may put its facts on the document.
+          metadataProperties = withMissingProperties(
+            metadataProperties,
+            retMap.platformProperties,
+          );
+        } else {
+          recordDegradation("php.composer.platform-unattributed", {
+            ecosystem: "php",
+            tool: "composer",
+            impact: "versions",
+            path: f,
+            detail:
+              "The composer.json beside this lock names no project, so no component can carry the PHP and extension requirements of the lock.",
+          });
+        }
+      }
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
         pkgList = trimComponents(pkgList);
@@ -1292,6 +1402,7 @@ export function createPHPBom(path, options) {
       filename: composerLockFiles.join(", "),
       dependencies,
       parentComponent,
+      metadataProperties,
     });
   }
   if (composerJsonMode && !composerLockMode) {
@@ -1539,7 +1650,14 @@ export async function createRubyBom(path, options) {
     options.resolveClass ||
     (options.deep && !hasAnyProjectType(["oci"], options, false))
   ) {
-    if (gemHome && !isGemHomeEmpty) {
+    // `bundle exec` evaluates the project's Gemfile, a Ruby program
+    if (gemHome && !isGemHomeEmpty && !isProjectToolingAllowed(options)) {
+      reportProjectToolingSkipped(
+        options,
+        null,
+        "Skipping the module names of gems since dependency installation is disabled. Collecting them runs 'bundle exec', which evaluates the Gemfile.",
+      );
+    } else if (gemHome && !isGemHomeEmpty) {
       const rubyCommand =
         readEnvironmentVariable("CDXGEN_RUBY_CMD") ||
         readEnvironmentVariable("RUBY_CMD") ||
@@ -1655,6 +1773,12 @@ export async function createCsharpBom(path, options) {
     return createBinaryBom(path, options);
   }
   let parentComponent = createDefaultParentComponent(path, "nuget", options);
+  // The directory a scan starts from is not a package, so it has a version
+  // only when --project-version gives it one; "latest" is not a version.
+  applyNugetVersion(
+    parentComponent,
+    options.projectVersion ? `${options.projectVersion}` : undefined,
+  );
   const slnFiles = getAllFiles(
     path,
     `${options.multiProject ? "**/" : ""}*.sln*`,
@@ -1939,6 +2063,47 @@ export async function createCsharpBom(path, options) {
   // one project's manifest are not dropped just because another format exists
   // elsewhere in the scan.
   const assetsProjectDirs = new Set();
+  // Restore records a project file the way the build was pointed at it, which
+  // on a case-insensitive file system can differ in case from the file found
+  // here. Such a path takes the found file's spelling, unless that is ambiguous.
+  const foundProjectFiles = new Set();
+  const foundProjectFilesByKey = new Map();
+  for (const f of csProjFiles) {
+    const file = resolve(f);
+    const key = file.toLowerCase();
+    foundProjectFiles.add(file);
+    foundProjectFilesByKey.set(
+      key,
+      foundProjectFilesByKey.has(key) ? null : file,
+    );
+  }
+  const foundProjectFile = (file) =>
+    !file || foundProjectFiles.has(file)
+      ? file
+      : foundProjectFilesByKey.get(file.toLowerCase()) || file;
+  // The package id and version each project's restore output records, by
+  // project file. A project whose restore outputs disagree, such as a stale
+  // obj/ beside an artifacts directory, takes neither.
+  const restoredIdentities = new Map();
+  const recordRestoredIdentity = (projectFile, identity) => {
+    if (!projectFile || !identity) {
+      return;
+    }
+    const known = restoredIdentities.get(projectFile);
+    if (known === undefined) {
+      restoredIdentities.set(projectFile, identity);
+    } else if (
+      known &&
+      (known.name !== identity.name || known.version !== identity.version)
+    ) {
+      if (DEBUG_MODE) {
+        console.log(
+          `Restore outputs disagree on the package id or version of ${projectFile}, so the identity its project file states is used.`,
+        );
+      }
+      restoredIdentities.set(projectFile, null);
+    }
+  };
   // project.assets.json parsing
   if (projAssetsFiles.length) {
     manifestFiles = manifestFiles.concat(projAssetsFiles);
@@ -1952,9 +2117,13 @@ export async function createCsharpBom(path, options) {
       const dlist = results["pkgList"];
       // Restore output names its project; an artifacts layout keeps it outside
       // the project directory.
-      const projectDir = dotnetManifestProjectDir(af, results.projectPath);
+      const projectFile = foundProjectFile(
+        dotnetRestoredProjectFile(af, results.projectPath, results.outputPath),
+      );
+      const projectDir = dotnetManifestProjectDir(af, projectFile);
       assetsProjectDirs.add(projectDir);
       recordProjectVersions(projectDir, dlist);
+      recordRestoredIdentity(projectFile, results.projectIdentity);
       if (dlist?.length) {
         pkgList = pkgList.concat(dlist);
       }
@@ -2065,6 +2234,7 @@ export async function createCsharpBom(path, options) {
   }
   const projectRefByDir = {};
   let services = [];
+  let dosaiTools = [];
   if (csProjFiles.length) {
     manifestFiles = manifestFiles.concat(csProjFiles);
     // Parsing csproj is quite error-prone. Some project files may not have
@@ -2073,11 +2243,18 @@ export async function createCsharpBom(path, options) {
     // whole scan agrees on.
     const agreedVersions = agreedNugetVersions(pkgList);
     let msbuildInstalled = false;
-    const result = safeSpawnSync(DOTNET_CMD, ["msbuild", "--version"], {
-      shell: isWin,
-    });
-    if (result.status === 0 && !result.error && result.stdout?.trim()) {
-      msbuildInstalled = true;
+    // `dotnet msbuild` evaluates the project (loading Directory.Build.rsp,
+    // Directory.Build.props/targets and build extensions), so it belongs to
+    // the dependency-tooling surface disabled by --no-install-deps and the
+    // pre-build lifecycle. Version labels it would resolve then fall back to
+    // the static props/central-version resolution.
+    if (isProjectToolingAllowed(options)) {
+      const result = safeSpawnSync(DOTNET_CMD, ["msbuild", "--version"], {
+        shell: isWin,
+      });
+      if (result.status === 0 && !result.error && result.stdout?.trim()) {
+        msbuildInstalled = true;
+      }
     }
     // `$(Name)` version labels resolve from the props files that can apply to
     // each project (beside and above it), read once for the whole scan.
@@ -2103,6 +2280,7 @@ export async function createCsharpBom(path, options) {
         getCentralPackageVersions(f, centralVersionsCache),
         agreedVersions,
         projectNames[projectDir] || {},
+        restoredIdentities.get(resolve(f)) || undefined,
       );
       if (retMap?.parentComponent?.purl) {
         projectRefByDir[projectDir] ??= retMap.parentComponent["bom-ref"];
@@ -2127,6 +2305,24 @@ export async function createCsharpBom(path, options) {
           parentComponent,
         );
       }
+      // Only a version that needed msbuild makes its skip a loss
+      if (
+        retMap?.unresolvedVersionLabels?.length &&
+        !isProjectToolingAllowed(options)
+      ) {
+        reportProjectToolingSkipped(
+          options,
+          "dotnet.msbuild.tooling-disabled",
+          "Skipping 'dotnet msbuild' property evaluation since dependency installation is disabled. Package versions that come from MSBuild properties no project or props file sets stay empty.",
+          {
+            ecosystem: "csharp",
+            tool: "msbuild",
+            impact: "versions",
+            detail:
+              "Dependency installation is disabled, so $(Property) version references that the project and props files do not set were not evaluated with msbuild.",
+          },
+        );
+      }
     }
   }
   // A lock file's or packages.config's direct dependencies belong to the
@@ -2148,6 +2344,17 @@ export async function createCsharpBom(path, options) {
       }
     }
   }
+  // A scan of several projects is made of them, so the directory depends on
+  // each, as a Gradle build does on its subprojects. Restore output also lists
+  // every project it restored as a package; the parent and its projects are
+  // already in the BOM, and a second component with the same bom-ref would
+  // merge the two in every consumer.
+  const projectRefs = new Set([parentComponent?.["bom-ref"]]);
+  for (const project of parentComponent?.components || []) {
+    parentDependsOn.add(project["bom-ref"]);
+    projectRefs.add(project["bom-ref"]);
+  }
+  pkgList = pkgList.filter((p) => !projectRefs.has(p["bom-ref"]));
   if (pkgList.length) {
     pkgList = trimComponents(pkgList);
     // Perform deep analysis using dosai
@@ -2166,19 +2373,46 @@ export async function createCsharpBom(path, options) {
         ? resolve(path, options.depsSlicesFile)
         : join(slicesDir, "dosai.json");
       try {
+        // A run that will run evinse (--evidence or --include-crypto, after
+        // profiles are applied) keeps the report full: evinse reuses this
+        // file as its usages slice and persists it as the native report.
+        // Anything else needs only the sections cdxgen reads, so dosai
+        // leaves the rest out (Metadata.OmittedSections names it).
+        const willRunEvinse = runsEvidenceAnalysis(options);
+        // Reuse an existing slice as-is, with one exception: a trimmed file
+        // (an earlier --deep run left it behind) is regenerated full before
+        // an evidence run uses it, so dosai still runs once per scan.
+        let reuseExisting = safeExistsSync(slicesFile);
+        if (reuseExisting && willRunEvinse) {
+          const omitted = dosaiReportFileOmittedSections(slicesFile);
+          if (omitted.length) {
+            if (DEBUG_MODE) {
+              console.log(
+                `The existing dosai methods slice "${slicesFile}" omits sections (${omitted.join(", ")}); regenerating the full report because this run performs evidence analysis.`,
+              );
+            }
+            reuseExisting = false;
+          }
+        }
         // Create the slices file if it doesn't exist
-        if (!safeExistsSync(slicesFile)) {
+        if (!reuseExisting) {
           thoughtLog(
             "Alright, the next step is to invoke the dosai command to identify evidence of occurrences for various components.",
           );
           const sliceResult = createDosaiMethodsSlice(
             resolve(path),
             resolve(slicesFile),
-            options,
+            {
+              ...options,
+              dosaiMethodsSections: willRunEvinse
+                ? undefined
+                : dosaiMethodsSectionsArgument(),
+            },
           );
-          // A stopped run has already said so and what to change; the debug
-          // output would show no dosai error for it (issue 4438).
-          if (!sliceResult && !dosaiRunWasStopped(resolve(slicesFile))) {
+          // A stopped run, or one the .NET host refused to start, has
+          // already said why and what to change; the debug output would show
+          // no other dosai error for it (issue 4438).
+          if (!sliceResult && !dosaiFailureReported(resolve(slicesFile))) {
             // Visible without debug output: otherwise the components silently
             // lose the dependency-slice evidence while the scan still exits 0.
             // --evidence (which implies --deep) runs dosai again during evinse
@@ -2205,6 +2439,11 @@ export async function createCsharpBom(path, options) {
         const servicesMap = collectDosaiServiceComponents(methodsSlice, {});
         collectDosaiServicesFromMethods(methodsSlice, servicesMap);
         services = normalizeDosaiServiceMap(servicesMap);
+        dosaiTools = dosaiToolComponents(
+          slicesFile,
+          methodsSlice,
+          getPluginToolComponents(["dosai"])[0],
+        );
       } finally {
         if (slicesDir) {
           safeRmSync(slicesDir, { recursive: true, force: true });
@@ -2244,7 +2483,7 @@ export async function createCsharpBom(path, options) {
     dependencies,
     parentComponent,
     services,
-    tools: options.deep ? getPluginToolComponents(["dosai"]) : [],
+    tools: dosaiTools,
   });
 }
 
@@ -2263,58 +2502,239 @@ export async function createCryptoCertsBom(path, options) {
       },
     };
   }
+  const collector = new CertificateCollector();
   const pkgList = [];
-  const certFiles = getAllFiles(
-    path,
-    `${
-      options.multiProject ? "**/" : ""
-    }*.{p12,jks,jceks,bks,keystore,key,pem,cer,gpg,pub}`,
-    options,
+  // In rootfs/container mode the scan path sits inside the extracted tree;
+  // locations are recorded relative to that tree so they merge with the
+  // trustinspector rootfs producer (G18).
+  const locationRoot = options.allLayersExplodedDir;
+  const relativeLocation = (file) =>
+    containerRelativePath(file, locationRoot) || file;
+  // Bom-refs never carry host paths: outside rootfs mode, key and keystore
+  // refs are relative to the scanned path.
+  const refLocation = (file) =>
+    containerRelativePath(file, locationRoot || path) || file;
+  const certFiles = [
+    ...new Set([
+      ...getAllFiles(
+        path,
+        `${
+          options.multiProject ? "**/" : ""
+        }*.{p12,jks,jceks,bks,keystore,key,pem,cer,crt,der,p7b,p7c,pfx,truststore,gpg,pub}`,
+        options,
+      ),
+      // Java truststores carry no extension; match them by exact name.
+      ...getAllFiles(
+        path,
+        `${options.multiProject ? "**/" : ""}{cacerts,jssecacerts}`,
+        options,
+      ),
+    ]),
+  ];
+  // Newlines would corrupt the plugin's stdin file list, and oversized
+  // files are capped in the fallback; the plugin list gets the same caps.
+  const pluginCandidateFiles = certFiles.filter(
+    (file) =>
+      !/[\r\n]/.test(file) &&
+      statSync(file, { throwIfNoEntry: false })?.size <= MAX_CRYPTO_FILE_BYTES,
   );
-  const certHashes = await mapWithConcurrency(certFiles, (f) =>
-    checksumFile("sha256", f),
+  const pluginMaterials = runTrustInspectorCertsMode(
+    pluginCandidateFiles,
+    locationRoot,
   );
-  for (let ci = 0; ci < certFiles.length; ci++) {
-    const f = certFiles[ci];
-    const fileHash = certHashes[ci];
-    const name = basename(f);
-    let evidence;
-    if (options.evidence) {
-      const identityEvidence = {
-        field: "name",
-        confidence: 1,
-        concludedValue: name,
-        methods: [
+  const fallbackRecords = [];
+  if (pluginMaterials) {
+    collector.addTrustInspectorMaterials(pluginMaterials);
+    for (const material of pluginMaterials) {
+      if (typeof material?.path !== "string" || !material.path) {
+        continue;
+      }
+      if (material.kind === "keystore") {
+        pkgList.push(
+          sourceKeystoreComponent(material, refLocation(material.path)),
+        );
+      } else if (material.kind === "private-key") {
+        pkgList.push(
+          sourcePrivateKeyComponent(material, refLocation(material.path)),
+        );
+      }
+    }
+  }
+  // Files the plugin was not given (names with line breaks, oversized
+  // files) are still read here, so no name can hide a file from the
+  // inventory; without a plugin every file is. The files it was given are
+  // its own, except for the keys it builds nothing from: it reports nothing
+  // for a bare PEM public key, and an OpenPGP key only as public-key
+  // material, so both are built here whether it saw them or not.
+  const pluginFiles = new Set(pluginMaterials ? pluginCandidateFiles : []);
+  for (const f of certFiles) {
+    let bytes;
+    try {
+      const stats = statSync(f);
+      if (stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      bytes = readFileSync(f);
+    } catch {
+      continue;
+    }
+    const location = relativeLocation(f);
+    const classification = classifyCryptoFile(bytes);
+    if (
+      pluginFiles.has(f) &&
+      classification.kind !== "gpg" &&
+      classification.kind !== "public-key"
+    ) {
+      continue;
+    }
+    if (classification.kind === "certificates") {
+      for (const der of classification.ders) {
+        const record = certRecordFromDer(der, {
+          location,
+          sourceType: deriveCryptoSourceType(f),
+        });
+        if (record) {
+          record.fileExtension = extname(f).replace(/^\./, "") || undefined;
+          fallbackRecords.push(record);
+        }
+      }
+    } else if (classification.kind === "private-key") {
+      pkgList.push(
+        sourcePrivateKeyComponent(
           {
-            technique: "filename",
-            confidence: 1,
-            value: f,
+            format: classification.format,
+            sourceType: deriveCryptoSourceType(f),
           },
-        ],
-      };
-      evidence = {
-        identity:
-          options.specVersion >= 1.6 ? [identityEvidence] : identityEvidence,
-        occurrences: [{ location: f }],
-      };
+          refLocation(f),
+        ),
+      );
+    } else if (classification.kind === "gpg") {
+      pkgList.push(await sourceGpgComponent(f, location, options));
+    } else if (classification.kind === "public-key") {
+      pkgList.push(await sourcePemPublicKeyComponent(f, location, options));
+    } else if (classification.kind === "keystore") {
+      pkgList.push(
+        sourceKeystoreComponent(
+          {
+            format: classification.format,
+            sourceType: deriveCryptoSourceType(f),
+          },
+          refLocation(f),
+        ),
+      );
     }
-    const apkg = {
-      name,
-      type: "cryptographic-asset",
-      version: fileHash,
-      "bom-ref": `crypto/certificate/${name}@sha256:${fileHash}`,
-      cryptoProperties: {
-        assetType: "certificate",
-        algorithmProperties: {
-          executionEnvironment: "unknown",
-          implementationPlatform: "unknown",
+  }
+  // Kubernetes TLS secrets and Android SPKI pins are cdxgen-side producers:
+  // the plugin has no YAML or Android-config parser.
+  const yamlFiles = getAllFiles(
+    path,
+    `${options.multiProject ? "**/" : ""}*.{yaml,yml}`,
+    options,
+  );
+  for (const yamlFile of yamlFiles) {
+    let yamlText;
+    try {
+      const stats = statSync(yamlFile);
+      if (stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      yamlText = readFileSync(yamlFile, "utf-8");
+    } catch {
+      continue;
+    }
+    // Cheap pre-filter: the Secret type string must be present before the
+    // YAML parser runs.
+    if (!yamlText.includes("kubernetes.io/tls")) {
+      continue;
+    }
+    for (const record of kubernetesTlsSecretRecords(yamlText, {
+      file: relativeLocation(yamlFile),
+    })) {
+      fallbackRecords.push(record);
+    }
+  }
+  const androidXmlFiles = getAllFiles(path, "**/res/xml/*.xml", options);
+  for (const xmlFile of androidXmlFiles) {
+    let xmlText;
+    try {
+      const stats = statSync(xmlFile, { throwIfNoEntry: false });
+      if (!stats || stats.size > MAX_CRYPTO_FILE_BYTES) {
+        continue;
+      }
+      xmlText = readFileSync(xmlFile, "utf-8");
+    } catch {
+      continue;
+    }
+    if (!xmlText.includes("<network-security-config")) {
+      continue;
+    }
+    for (const pin of androidNetworkSecurityConfigPins(xmlText, {
+      file: relativeLocation(xmlFile),
+    })) {
+      collector.addPin(pin);
+    }
+  }
+  if (fallbackRecords.length) {
+    linkFallbackIssuers(fallbackRecords);
+    collector.addRecords(fallbackRecords);
+  }
+  const {
+    components: certificateComponents,
+    dependencies: certificateDependencies,
+  } = collector.build();
+  if (pluginMaterials) {
+    // The plugin reports the certificates a readable keystore holds, not the
+    // keystore itself; give it the same component the fallback emits and
+    // link it to what it holds.
+    const keystoreMaterials = new Map();
+    for (const material of pluginMaterials) {
+      if (material?.kind === "certificate" && material.path) {
+        keystoreMaterials.set(material.path, material);
+      }
+    }
+    for (const file of pluginCandidateFiles) {
+      const location = relativeLocation(file);
+      const material = keystoreMaterials.get(location);
+      if (!material) {
+        continue;
+      }
+      let classification;
+      try {
+        classification = classifyCryptoFile(readFileSync(file));
+      } catch {
+        continue;
+      }
+      if (classification.kind !== "keystore") {
+        continue;
+      }
+      const keystore = sourceKeystoreComponent(
+        {
+          format: classification.format,
+          sourceType: material.sourceType || deriveCryptoSourceType(file),
+          readable: true,
         },
-      },
-      ...(evidence ? { evidence } : {}),
-      properties: [{ name: "internal:SrcFile", value: f }],
-    };
-    pkgList.push(apkg);
+        refLocation(file),
+      );
+      pkgList.push(keystore);
+      const held = certificateComponents
+        .filter(
+          (component) =>
+            component.cryptoProperties?.assetType === "certificate" &&
+            component.evidence?.occurrences?.some(
+              (occurrence) => occurrence.location === location,
+            ),
+        )
+        .map((component) => component["bom-ref"])
+        .sort();
+      if (held.length) {
+        certificateDependencies.push({
+          ref: keystore["bom-ref"],
+          dependsOn: held,
+        });
+      }
+    }
   }
+  pkgList.push(...certificateComponents);
   const sourceCryptoComponents = await collectSourceCryptoComponents(
     path,
     options,
@@ -2335,9 +2755,229 @@ export async function createCryptoCertsBom(path, options) {
     bomJson: {
       components: filterInvalidCryptoComponents(pkgList),
     },
+    dependencies: certificateDependencies,
   };
 }
 
+// Files larger than this are not classified: no real certificate bundle or
+// keystore comes close, and the cap bounds hostile inputs.
+const MAX_CRYPTO_FILE_BYTES = 16 * 1024 * 1024;
+
+function deriveCryptoSourceType(filePath) {
+  const normalized = String(filePath).replace(/\\/g, "/");
+  if (
+    normalized.includes("/etc/ssl/certs") ||
+    normalized.includes("ca-certificates")
+  ) {
+    return "ca-store";
+  }
+  if (normalized.includes("certifi") || normalized.includes("botocore")) {
+    return "language-bundle";
+  }
+  if (
+    /\/etc\/(nginx|apache2|httpd|haproxy|letsencrypt|kubernetes|docker|containerd)\//.test(
+      normalized,
+    )
+  ) {
+    return "server-config";
+  }
+  if (
+    normalized.includes("cacerts") ||
+    /\.(jks|jceks|p12|pfx|truststore)$/i.test(normalized)
+  ) {
+    return "java-truststore";
+  }
+  return "generic";
+}
+
+function sourceCryptoFileEvidence(location, options) {
+  if (!options.evidence) {
+    return undefined;
+  }
+  const identityEvidence = {
+    field: "name",
+    confidence: 1,
+    concludedValue: basename(location),
+    methods: [
+      {
+        technique: "filename",
+        confidence: 1,
+        value: location,
+      },
+    ],
+  };
+  return {
+    identity:
+      options.specVersion >= 1.6 ? [identityEvidence] : identityEvidence,
+    occurrences: [{ location }],
+  };
+}
+
+async function sourceGpgComponent(srcFile, location, options) {
+  const fileHash = await checksumFile("sha256", srcFile);
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    version: fileHash,
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(basename(location))}@sha256:${fileHash}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        format: "OpenPGP",
+      },
+    },
+    ...(sourceCryptoFileEvidence(location, options)
+      ? { evidence: sourceCryptoFileEvidence(location, options) }
+      : {}),
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      { name: "cdx:crypto:sourceType", value: "generic" },
+    ],
+  };
+}
+
+async function sourcePemPublicKeyComponent(srcFile, location, options) {
+  const fileHash = await checksumFile("sha256", srcFile);
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    version: fileHash,
+    "bom-ref": `crypto/related-crypto-material/public-key/${encodeURIComponent(basename(location))}@sha256:${fileHash}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "public-key",
+        format: "SPKI",
+      },
+    },
+    ...(sourceCryptoFileEvidence(location, options)
+      ? { evidence: sourceCryptoFileEvidence(location, options) }
+      : {}),
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      { name: "cdx:crypto:sourceType", value: "generic" },
+    ],
+  };
+}
+
+function sourcePrivateKeyComponent(material, location) {
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/private-key/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "private-key",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+    ],
+  };
+}
+
+function sourceKeystoreComponent(material, location) {
+  const readable = (material?.properties || []).find(
+    (property) => property.name === "cdx:crypto:keystoreReadable",
+  )?.value;
+  return {
+    name: basename(location),
+    type: "cryptographic-asset",
+    "bom-ref": `crypto/related-crypto-material/keystore/${encodeURIComponent(location)}`,
+    cryptoProperties: {
+      assetType: "related-crypto-material",
+      relatedCryptoMaterialProperties: {
+        type: "other",
+        ...(material?.format ? { format: material.format } : {}),
+      },
+    },
+    evidence: { occurrences: [{ location }] },
+    properties: [
+      { name: "internal:SrcFile", value: location },
+      ...(material?.sourceType
+        ? [{ name: "cdx:crypto:sourceType", value: material.sourceType }]
+        : []),
+      // A keystore the plugin read has no keystoreReadable property.
+      ...(material?.readable
+        ? []
+        : [
+            { name: "cdx:crypto:keystoreReadable", value: readable || "false" },
+          ]),
+    ],
+  };
+}
+
+/**
+ * Parse the candidate certificate files with the trustinspector `certs`
+ * mode. Only a report-2 envelope is accepted: report-1 output has no
+ * certificate identity to build the shared model from, and the Node
+ * fallback covers that case.
+ *
+ * @param {string[]} files candidate files
+ * @param {string} root paths are reported relative to this directory
+ * @returns {object[]|undefined} materials, or undefined when the plugin is
+ *   absent, blocked or not report-2
+ */
+function runTrustInspectorCertsMode(files, root) {
+  if (!files?.length) {
+    return undefined;
+  }
+  if (isDryRun) {
+    recordActivity({
+      kind: "trustinspector",
+      reason:
+        "Dry run mode blocks trustinspector execution and reports the requested inspection instead.",
+      status: "blocked",
+      target: `certs --stdin (${files.length} files)`,
+    });
+    return undefined;
+  }
+  const trustInspectorBin = resolvePluginBinary("trustinspector");
+  if (!trustInspectorBin) {
+    return undefined;
+  }
+  // `--root` is passed only in rootfs/container mode, where locations must
+  // come out relative to the extracted tree; a plain source scan keeps the
+  // host paths every other producer records. The value reaches a spawned
+  // command, so it gets the same rejection the rootfs path applies:
+  // dangerous unicode or line breaks disable the plugin call.
+  const args = ["certs", "--stdin"];
+  const safeRoot =
+    typeof root === "string" &&
+    !hasDangerousUnicode(root) &&
+    !/[\r\n]/.test(root)
+      ? root
+      : undefined;
+  if (safeRoot) {
+    args.push("--root", safeRoot);
+  }
+  const result = safeSpawnSync(trustInspectorBin, args, {
+    input: `${files.join("\n")}\n`,
+    maxBuffer: 256 * 1024 * 1024,
+    // A hung plugin must not hang cdxgen; the Node fallback takes over.
+    timeout: 10 * 60 * 1000,
+  });
+  if (result?.status !== 0 || result?.error || !result?.stdout) {
+    return undefined;
+  }
+  try {
+    const report = JSON.parse(result.stdout);
+    if (report?.schema !== "trustinspector/report-2") {
+      return undefined;
+    }
+    return report.materials || [];
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Function to create bom string for R projects using renv.
  *